@seekrit/cli 0.43.0 → 0.45.0

package/dist/index.js

@@ -8,6 +8,11 @@ import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+/** Default lifetime of a published bundle (7 days), in seconds. */
+const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
+/** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
+const POLICY_MIN_TTL_SECONDS = 3600;
+const POLICY_MAX_TTL_SECONDS = 2160 * 60 * 60;
 /** A bare hostname: no scheme, no port, no path, no wildcard. */
 const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
 const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
@@ -17,7 +22,7 @@ const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/
 */
 const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
 const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
-z.object({
+const agentPolicyRuleSchema = z.object({
 	host: policyHostSchema,
 	methods: z.array(policyMethodSchema).max(16).default([]),
 	paths: z.array(policyPathSchema).max(64).default([]),
@@ -44,6 +49,88 @@ z.object({
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
+/**
+* Serialize a bundle to the exact bytes that get signed and transported.
+*
+* Explicit field order rather than a generic sorted-key walk: the field list is
+* the format, and a reviewer should be able to read it here. Optional fields are
+* omitted rather than emitted as `null`, and empty `methods`/`paths`/`allow`
+* arrays are kept, since their emptiness is meaningful (any/any/none).
+*/
+function canonicalizeAgentPolicy(bundle) {
+	const rules = bundle.rules.map((rule) => {
+		const out = {
+			host: rule.host.trim().toLowerCase(),
+			methods: rule.methods.map((m) => m.trim().toUpperCase()).sort(),
+			paths: rule.paths.map((p) => p.trim()),
+			allow: [...rule.allow].sort()
+		};
+		if (rule.label?.trim()) out.label = rule.label.trim();
+		return out;
+	});
+	return JSON.stringify({
+		v: bundle.v,
+		org: bundle.org,
+		agent: bundle.agent,
+		agent_slug: bundle.agent_slug,
+		policy_version: bundle.policy_version,
+		issued_at: bundle.issued_at,
+		expires_at: bundle.expires_at,
+		rules,
+		signer: {
+			kid: bundle.signer.kid,
+			jwk: {
+				crv: bundle.signer.jwk.crv,
+				kty: bundle.signer.jwk.kty,
+				x: bundle.signer.jwk.x,
+				y: bundle.signer.jwk.y
+			}
+		}
+	});
+}
+/**
+* RFC 7638 JWK thumbprint (SHA-256, base64url, no padding) — the identifier an
+* operator pins in the proxy's TOML.
+*/
+async function policySignerThumbprint(jwk) {
+	const canonical = JSON.stringify({
+		crv: jwk.crv,
+		kty: jwk.kty,
+		x: jwk.x,
+		y: jwk.y
+	});
+	const digest = await crypto.subtle.digest("SHA-256", utf8(canonical));
+	return base64url(new Uint8Array(digest));
+}
+/**
+* Sign a draft bundle with the publishing admin's key, returning the `ap1.`
+* envelope to hand to the API.
+*
+* `privateKey` must be an ECDSA P-256 key with the `sign` usage — in the
+* dashboard that is the signed-in admin's existing principal key, re-imported
+* for signing (`importPolicySigningKey` in `@seekrit/crypto`). No new key
+* material is involved, which is what makes this shippable without a second
+* passphrase-protected keypair to manage.
+*/
+async function signAgentPolicy(privateKey, signerJwk, draft) {
+	const kid = await policySignerThumbprint(signerJwk);
+	const bytes = utf8(canonicalizeAgentPolicy({
+		...draft,
+		signer: {
+			kid,
+			jwk: signerJwk
+		}
+	}));
+	const sig = new Uint8Array(await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, privateKey, bytes));
+	return [
+		"ap1",
+		base64url(bytes),
+		base64url(sig)
+	].join(".");
+}
 /** A structurally invalid, unverifiable, or expired bundle. */
 var AgentPolicyError = class extends Error {
 	constructor(message) {
@@ -72,9 +159,149 @@ function parseAgentPolicyUnverified(envelope) {
 	if (!Array.isArray(body.rules) || !body.signer?.jwk) throw new AgentPolicyError("policy bundle is missing rules or signer");
 	return body;
 }
+/**
+* Match a request path against a glob pattern: `*` matches within one segment,
+* `**` matches any number of segments (including none, so `/v1/**` covers
+* `/v1`). Case-sensitive, and the query string never participates.
+*/
+function matchPolicyPath(pattern, path) {
+	const bare = path.split("?")[0] ?? path;
+	return matchSegments(pattern.split("/"), bare.split("/"));
+}
+function matchSegments(pattern, segments) {
+	if (pattern.length === 0) return segments.length === 0;
+	const [head, ...rest] = pattern;
+	if (head === "**") {
+		for (let skip = 0; skip <= segments.length; skip++) if (matchSegments(rest, segments.slice(skip))) return true;
+		return false;
+	}
+	if (segments.length === 0) return false;
+	return matchSegment(head, segments[0]) && matchSegments(rest, segments.slice(1));
+}
+function matchSegment(pattern, segment) {
+	if (!pattern.includes("*")) return pattern === segment;
+	const parts = pattern.split("*");
+	let rest = segment;
+	for (let i = 0; i < parts.length; i++) {
+		const part = parts[i];
+		if (part === "") continue;
+		if (i === 0) {
+			if (!rest.startsWith(part)) return false;
+			rest = rest.slice(part.length);
+		} else if (i === parts.length - 1) return rest.length >= part.length && rest.endsWith(part);
+		else {
+			const at = rest.indexOf(part);
+			if (at === -1) return false;
+			rest = rest.slice(at + part.length);
+		}
+	}
+	return true;
+}
+function ruleCoversMethod(rule, method) {
+	if (rule.methods.length === 0) return true;
+	const wanted = method.trim().toUpperCase();
+	return rule.methods.some((m) => m.trim().toUpperCase() === wanted);
+}
+function ruleCoversPath(rule, path) {
+	if (rule.paths.length === 0) return true;
+	return rule.paths.some((p) => matchPolicyPath(p, path));
+}
+/**
+* Decide a request against an ordered rule set, first match wins — the same
+* evaluation `RuleSet::decide` performs in the proxy, including which rule
+* decided and *why* a refusal happened. Naming the constraint matters: a
+* default-deny policy fails in exactly the confusing direction.
+*/
+function evaluatePolicy(rules, query) {
+	const host = query.host.trim().toLowerCase();
+	let hostMatched = false;
+	let pathMatchedIndex = null;
+	for (let i = 0; i < rules.length; i++) {
+		const rule = rules[i];
+		if (rule.host.trim().toLowerCase() !== host) continue;
+		hostMatched = true;
+		const pathsOk = ruleCoversPath(rule, query.path);
+		if (pathsOk && ruleCoversMethod(rule, query.method)) {
+			if (query.secret !== void 0 && !rule.allow.includes(query.secret)) return {
+				decision: "secret_not_allowed",
+				ruleIndex: i
+			};
+			return {
+				decision: "allow",
+				ruleIndex: i
+			};
+		}
+		if (pathsOk && pathMatchedIndex === null) pathMatchedIndex = i;
+	}
+	if (pathMatchedIndex !== null) return {
+		decision: "method_not_allowed",
+		ruleIndex: pathMatchedIndex
+	};
+	return {
+		decision: hostMatched ? "path_not_allowed" : "no_rule",
+		ruleIndex: null
+	};
+}
+/** A one-line, human-readable reason for a verdict — shared by UI and API. */
+function describePolicyVerdict(verdict, rules) {
+	const rule = verdict.ruleIndex === null ? null : rules[verdict.ruleIndex];
+	switch (verdict.decision) {
+		case "allow": return `permitted by rule ${(verdict.ruleIndex ?? 0) + 1}${rule?.label ? ` (${rule.label})` : ""}`;
+		case "no_rule": return "no rule covers this host";
+		case "method_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} covers this path but not this method`;
+		case "path_not_allowed": return "this host has rules, but none cover this path";
+		case "secret_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} permits the request but not this secret`;
+	}
+}
+/** Every host a rule set names — what a forward proxy would intercept. */
+function policyHosts(rules) {
+	return [...new Set(rules.map((r) => r.host.trim().toLowerCase()))].sort();
+}
+function diffPolicyRules(before, after) {
+	const out = [];
+	const same = (a, b) => JSON.stringify(normalizeRule(a)) === JSON.stringify(normalizeRule(b));
+	for (let i = 0; i < Math.max(before.length, after.length); i++) {
+		const b = before[i];
+		const a = after[i];
+		if (b && a) out.push({
+			kind: same(b, a) ? "unchanged" : "changed",
+			index: i,
+			before: b,
+			after: a
+		});
+		else if (a) out.push({
+			kind: "added",
+			index: i,
+			after: a
+		});
+		else if (b) out.push({
+			kind: "removed",
+			index: i,
+			before: b
+		});
+	}
+	return out;
+}
+function normalizeRule(rule) {
+	return {
+		host: rule.host.trim().toLowerCase(),
+		methods: rule.methods.map((m) => m.toUpperCase()).sort(),
+		paths: [...rule.paths],
+		allow: [...rule.allow].sort(),
+		label: rule.label?.trim() || void 0
+	};
+}
+function utf8(text) {
+	return new TextEncoder().encode(text);
+}
 function utf8Decode$1(bytes) {
 	return new TextDecoder().decode(bytes);
 }
+function base64url(bytes) {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function fromBase64url(text) {
 	const padded = text.replace(/-/g, "+").replace(/_/g, "/");
 	const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
@@ -82,6 +309,500 @@ function fromBase64url(text) {
 	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
 	return out;
 }
+/** One aggregated cell: a dimension tuple and how many times it happened. */
+const activityEntrySchema = z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	decision: z.enum([
+		"allow",
+		"no_rule",
+		"method_not_allowed",
+		"path_not_allowed",
+		"secret_not_allowed",
+		"unknown_secret",
+		"ratchet_withdrawn",
+		"policy_unavailable"
+	]),
+	/**
+	* Which published rule decided, when one did. Null for refusals that never
+	* reached a rule (`no_rule`, `policy_unavailable`) — the distinction matters to
+	* a review, because "rule 3 refused this" and "nothing covered this" call for
+	* opposite changes.
+	*/
+	ruleIndex: z.number().int().min(0).max(255).nullable(),
+	count: z.number().int().min(1).max(1e6),
+	/**
+	* Secret names actually injected, name → count. Only meaningful on `allow`.
+	* This is what lets a review say "rule 2 permits three secrets and the agent
+	* has only ever used one" — the most useful narrowing there is, and impossible
+	* to see from policy alone.
+	*/
+	secrets: z.record(policySecretNameSchema, z.number().int().min(1)).optional()
+});
+z.object({
+	/** Start of the window these counts cover (ISO 8601). */
+	windowStart: z.string().trim().min(20).max(40),
+	/** Policy version in force while they were collected, for the ledger. */
+	policyVersion: z.number().int().min(0).optional(),
+	/**
+	* Capped so one report cannot be unbounded work. A proxy with more distinct
+	* cells than this in a window has a policy far broader than a review can help
+	* with, and truncating loudly beats accepting anything.
+	*/
+	entries: z.array(activityEntrySchema).min(1).max(500)
+});
+//#endregion
+//#region ../../packages/core/src/agent-review.ts
+function emptyStats() {
+	return {
+		allows: 0,
+		denials: 0,
+		methods: /* @__PURE__ */ new Set(),
+		secrets: /* @__PURE__ */ new Set()
+	};
+}
+/**
+* Compare an agent's live rules against what it actually did.
+*
+* Returns proposals ordered narrowing-first, because that is the order they
+* should be read in: the safe changes, then the ones needing a judgment call.
+*/
+function reviewPolicy(input) {
+	const { rules, activity } = input;
+	const byRule = /* @__PURE__ */ new Map();
+	/** Hosts refused with no rule to attribute it to → candidates for widening. */
+	const uncovered = /* @__PURE__ */ new Map();
+	for (const row of activity) {
+		if (row.ruleIndex === null) {
+			if (row.decision === "no_rule" || row.decision === "path_not_allowed") {
+				const entry = uncovered.get(row.host) ?? {
+					denials: 0,
+					methods: /* @__PURE__ */ new Set()
+				};
+				entry.denials += row.count;
+				entry.methods.add(row.method);
+				uncovered.set(row.host, entry);
+			}
+			continue;
+		}
+		const stats = byRule.get(row.ruleIndex) ?? emptyStats();
+		if (row.decision === "allow") {
+			stats.allows += row.count;
+			stats.methods.add(row.method);
+			for (const name of Object.keys(row.secrets ?? {})) stats.secrets.add(name);
+		} else stats.denials += row.count;
+		byRule.set(row.ruleIndex, stats);
+	}
+	const narrowing = [];
+	const widening = [];
+	/**
+	* Did this agent demonstrably do anything in the window?
+	*
+	* This is what licenses a conclusion from *absence*. With permitted traffic on
+	* the record, a rule that never came up is unused. With none, the window says
+	* nothing about any rule, and every proposal below would be noise.
+	*/
+	const workedAtAll = [...byRule.values()].some((s) => s.allows > 0);
+	for (const [index, rule] of rules.entries()) {
+		const stats = byRule.get(index);
+		if (!stats) {
+			if (workedAtAll) narrowing.push({
+				kind: "remove_rule",
+				ruleIndex: index,
+				host: rule.host,
+				evidence: {
+					allows: 0,
+					denials: 0,
+					observations: 0
+				},
+				rationale: `rule ${index + 1} (${rule.host}) never matched a request, while other rules did`,
+				applicable: true
+			});
+			continue;
+		}
+		const evidence = {
+			allows: stats.allows,
+			denials: stats.denials,
+			observations: stats.allows + stats.denials
+		};
+		if (stats.allows === 0) {
+			narrowing.push({
+				kind: "remove_rule",
+				ruleIndex: index,
+				host: rule.host,
+				evidence,
+				rationale: stats.denials > 0 ? `rule ${index + 1} (${rule.host}) authorized nothing in this window and refused ${stats.denials} — it may be misconfigured rather than unused` : `rule ${index + 1} (${rule.host}) authorized nothing in this window`,
+				applicable: true
+			});
+			continue;
+		}
+		const unusedSecrets = rule.allow.filter((name) => !stats.secrets.has(name));
+		if (unusedSecrets.length > 0) narrowing.push({
+			kind: "remove_secret",
+			ruleIndex: index,
+			host: rule.host,
+			names: unusedSecrets,
+			evidence,
+			rationale: `rule ${index + 1} (${rule.host}) permits ${unusedSecrets.join(", ")}, never injected in ${stats.allows} permitted request(s)`,
+			applicable: true
+		});
+		const unusedMethods = rule.methods.filter((m) => !stats.methods.has(m.toUpperCase()));
+		if (rule.methods.length > 0 && unusedMethods.length > 0) narrowing.push({
+			kind: "narrow_methods",
+			ruleIndex: index,
+			host: rule.host,
+			names: unusedMethods,
+			evidence,
+			rationale: `rule ${index + 1} (${rule.host}) permits ${unusedMethods.join(", ")}, never used in ${stats.allows} permitted request(s)`,
+			applicable: true
+		});
+	}
+	for (const [host, entry] of uncovered) widening.push({
+		kind: "widen",
+		ruleIndex: null,
+		host,
+		names: [...entry.methods].sort(),
+		evidence: {
+			allows: 0,
+			denials: entry.denials,
+			observations: entry.denials
+		},
+		rationale: `${entry.denials} request(s) to ${host} matched no rule (${[...entry.methods].sort().join(", ")}) — the agent wants this and cannot have it`,
+		applicable: false
+	});
+	narrowing.sort((a, b) => (a.ruleIndex ?? 0) - (b.ruleIndex ?? 0));
+	widening.sort((a, b) => b.evidence.denials - a.evidence.denials);
+	return [...narrowing, ...widening];
+}
+/**
+* Apply the accepted narrowing proposals, returning a new rule list.
+*
+* Pure and total: the input rules are untouched, and anything not applicable is
+* skipped rather than throwing, so a caller can pass the whole review back.
+*
+* Rule *positions* shift when one is removed, which matters because order decides
+* (first match wins). Removals are therefore applied last, after the by-index
+* edits, so an index in a proposal always refers to the policy the review was
+* computed against.
+*/
+function applyProposals(rules, accepted) {
+	const applicable = accepted.filter((p) => p.applicable && p.ruleIndex !== null);
+	const next = rules.map((rule) => ({
+		...rule,
+		methods: [...rule.methods],
+		paths: [...rule.paths],
+		allow: [...rule.allow]
+	}));
+	for (const proposal of applicable) {
+		const index = proposal.ruleIndex;
+		const rule = next[index];
+		if (!rule) continue;
+		if (proposal.kind === "remove_secret") {
+			const drop = new Set(proposal.names ?? []);
+			rule.allow = rule.allow.filter((name) => !drop.has(name));
+		} else if (proposal.kind === "narrow_methods") {
+			const drop = new Set((proposal.names ?? []).map((m) => m.toUpperCase()));
+			rule.methods = rule.methods.filter((m) => !drop.has(m.toUpperCase()));
+			if (rule.methods.length === 0) rule.methods = [...rules[index]?.methods ?? []];
+		}
+	}
+	const removed = new Set(applicable.filter((p) => p.kind === "remove_rule").map((p) => p.ruleIndex));
+	return next.filter((_, index) => !removed.has(index));
+}
+/** How many of a review's proposals `applyProposals` would act on. */
+function countApplicable(proposals) {
+	return proposals.filter((p) => p.applicable).length;
+}
+/**
+* Twelve hours, matching `[control] max_ttl` in a proxy config. A task is meant
+* to bound one run; something that needs longer wants a policy change, not a
+* longer ticket.
+*/
+const TASK_MAX_TTL_SECONDS = 720 * 60;
+/** An EC P-256 public JWK, for a sender-constraint proof key. */
+const taskProofJwkSchema = z.object({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().min(1).max(128),
+	y: z.string().min(1).max(128)
+});
+z.object({
+	/**
+	* The public `skd_…` segment of the minted token. Sent because the API never
+	* sees the token at dispatch and still needs a readable handle for the audit
+	* row and for a revoke to name — the id half of a credential, without the
+	* secret half.
+	*/
+	taskRef: z.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
+	/**
+	* SHA-256 (base64url) of the token the dispatcher minted. The token itself
+	* never reaches this API on the dispatch path — only on introspection, where
+	* it is hashed and discarded.
+	*/
+	tokenHash: z.string().trim().min(16).max(128),
+	/**
+	* Secret names this run may use. Omit for "whatever the agent's policy
+	* allows" — mirroring `Session.scopes: Option<BTreeSet<String>>` in the proxy,
+	* so absent means unnarrowed in both places.
+	*/
+	scopes: z.array(policySecretNameSchema).max(64).optional(),
+	ttlSeconds: z.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
+	/**
+	* What this run is for, for the audit row and the operator's task list. Free
+	* text, and **not** a security input: never put a secret value in it.
+	*/
+	label: z.string().trim().max(200).optional(),
+	/**
+	* Public half of a proof key the presenter holds, recorded as an RFC 7638
+	* thumbprint. See `AgentTaskSession.proofThumbprint` for what this does and —
+	* importantly — does not yet do.
+	*/
+	proofJwk: taskProofJwkSchema.optional()
+});
+z.object({ 
+/** The presented token. In the body, never a URL — it is a credential. */
+token: z.string().trim().min(8).max(512) });
+//#endregion
+//#region ../../packages/core/src/archive.ts
+/**
+* The **break-glass archive** format: one signed JSON file holding everything
+* seekrit stores for an org, in the form seekrit stores it — ciphertext stays
+* ciphertext. Its whole purpose is to be openable on a machine that has never
+* heard of seekrit, so the format is plain JSON, self-describing, and versioned
+* by name (`seekrit-archive/v1`); a breaking change ships a new format string
+* rather than mutating this one, exactly like the `sc1.`/`wd1.` blob prefixes.
+*
+* Three parts:
+*  - `manifest` — what this archive is, and a SHA-256 digest per section.
+*  - `signature` — Ed25519 over the canonical manifest, or null when the
+*    producing deployment has no signing key configured.
+*  - `data` — the sections themselves.
+*
+* Integrity fields (`digest`, `signature.value`, `publicKey`, `keyId`) are
+* lowercase hex. Every blob *inside* `data` keeps its native base64url form, so
+* the one encoding rule to remember is "the archive's own bookkeeping is hex,
+* seekrit's blobs are unchanged".
+*
+* See docs/break-glass-export.md for what is deliberately excluded and why.
+*/
+const ARCHIVE_FORMAT = "seekrit-archive/v1";
+/**
+* Section order is part of the format: `manifest.digest` covers the section
+* headers in this order, so a verifier that re-serializes must produce the same
+* list. Appending a section is backwards-compatible; reordering is not.
+*/
+const ARCHIVE_SECTIONS = [
+	"organization",
+	"users",
+	"memberships",
+	"invites",
+	"applications",
+	"groups",
+	"environments",
+	"environmentGroups",
+	"environmentKeys",
+	"secrets",
+	"secretVersions",
+	"serviceTokens",
+	"m2mClients",
+	"kmsKeys",
+	"kmsKeyVersions",
+	"kmsKeyGrants",
+	"recoveryConfig",
+	"recoveryShares",
+	"rotations",
+	"syncConnections",
+	"syncBindings",
+	"leaseTargets",
+	"agentIdentities",
+	"agentPolicies",
+	"auditLog",
+	"keyMaterial"
+];
+/**
+* Deterministic JSON: object keys sorted recursively, no whitespace. A digest
+* has to be reproducible by a verifier that parsed the file and re-serialized
+* it, and parsing loses key order — so key order must not matter.
+*
+* Arrays keep their order (it is data). Every numeric field in the schema is an
+* integer, so JSON's float formatting never comes into it. `undefined` members
+* are dropped, matching `JSON.stringify`.
+*/
+function canonicalJson(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function bytesToHex(bytes) {
+	let out = "";
+	for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+	return out;
+}
+/** Throws on odd length or a non-hex character — a malformed field, not a mismatch. */
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) throw new Error("hex string has odd length");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) {
+		const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) throw new Error("hex string contains a non-hex character");
+		out[i] = byte;
+	}
+	return out;
+}
+/** `sha256:<hex>` over the UTF-8 bytes of `text`. */
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return `sha256:${bytesToHex(new Uint8Array(digest))}`;
+}
+/** Number a section header reports: array length, or 0/1 for the singleton sections. */
+function sectionCount(value) {
+	if (value === null || value === void 0) return 0;
+	return Array.isArray(value) ? value.length : 1;
+}
+/** Digest one section's value. Absent singletons hash as `null`, not as omitted. */
+function sectionDigest(value) {
+	return sha256Hex(canonicalJson(value ?? null));
+}
+/**
+* Digest over the section-header list. Covers each section's digest, count, and
+* truncation flag, so trimming rows *and* fixing up their digest still breaks
+* the manifest.
+*/
+function manifestDigest(sections) {
+	return sha256Hex(canonicalJson(sections));
+}
+/** The exact bytes the signature covers: the canonical manifest, digest included. */
+function signingPayload(manifest) {
+	return new TextEncoder().encode(canonicalJson(manifest));
+}
+/**
+* Verify an archive's digests and signature. Pure and offline — WebCrypto only,
+* no I/O, so it runs identically in the CLI, a browser page, and a test.
+*
+* Reports every problem it finds rather than throwing on the first, because the
+* useful answer to "my archive won't verify" is *which part*.
+*/
+async function verifyArchive(archive, options = {}) {
+	const declared = new Map(archive.manifest.sections.map((s) => [s.name, s]));
+	const badSections = [];
+	const missingSections = [];
+	const truncatedSections = [];
+	const data = archive.data ?? {};
+	for (const header of archive.manifest.sections) {
+		if (header.truncated) truncatedSections.push(header.name);
+		if (!(header.name in data)) {
+			missingSections.push(header.name);
+			continue;
+		}
+		const value = data[header.name];
+		if (sectionCount(value) !== header.count || await sectionDigest(value) !== header.digest) badSections.push(header.name);
+	}
+	const undeclaredSections = Object.keys(data).filter((key) => !declared.has(key));
+	const manifestDigestOk = await manifestDigest(archive.manifest.sections) === archive.manifest.digest;
+	let signature = "unsigned";
+	let signatureNote;
+	if (options.skipSignature) {
+		signature = "unverifiable";
+		signatureNote = "signature checking was skipped";
+	} else if (archive.signature) if (options.expectKeyId && options.expectKeyId !== archive.signature.keyId) {
+		signature = "invalid";
+		signatureNote = `signed by key ${archive.signature.keyId}, expected ${options.expectKeyId}`;
+	} else try {
+		signature = await verifySignature(archive.manifest, archive.signature) ? "valid" : "invalid";
+	} catch (err) {
+		signature = "unverifiable";
+		signatureNote = err instanceof Error ? err.message : String(err);
+	}
+	return {
+		ok: badSections.length === 0 && missingSections.length === 0 && undeclaredSections.length === 0 && manifestDigestOk && signature === "valid",
+		badSections,
+		undeclaredSections,
+		missingSections,
+		manifestDigestOk,
+		signature,
+		signatureNote,
+		truncatedSections
+	};
+}
+/**
+* Ed25519 verify over the canonical manifest. Plain WebCrypto: raw public-key
+* import plus `verify` is supported in Workers, Node ≥18, and current browsers,
+* so no verifier anywhere needs a dependency. Throws (rather than returning
+* false) when the runtime has no Ed25519 at all, so "old browser" is reported
+* as unverifiable instead of as a bad signature.
+*/
+async function verifySignature(manifest, signature) {
+	if (signature.algorithm !== "ed25519") throw new Error(`unsupported signature algorithm: ${signature.algorithm}`);
+	const publicKey = await crypto.subtle.importKey("raw", hexToBytes(signature.publicKey), { name: "Ed25519" }, false, ["verify"]);
+	return crypto.subtle.verify({ name: "Ed25519" }, publicKey, hexToBytes(signature.value), signingPayload(manifest));
+}
+const sectionHeaderSchema = z.object({
+	name: z.enum(ARCHIVE_SECTIONS),
+	count: z.number().int().min(0),
+	truncated: z.boolean(),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const manifestSchema = z.object({
+	archiveId: z.string().min(1),
+	createdAt: z.string().min(1),
+	org: z.object({
+		id: z.string(),
+		slug: z.string(),
+		name: z.string()
+	}),
+	producer: z.object({
+		service: z.string(),
+		environment: z.string(),
+		formatVersion: z.string()
+	}),
+	requestedBy: z.object({
+		actorType: z.string(),
+		actorId: z.string(),
+		label: z.string().nullable()
+	}),
+	options: z.object({
+		includeVersions: z.boolean(),
+		includeAudit: z.boolean(),
+		auditLimit: z.number().int().min(0)
+	}),
+	sections: z.array(sectionHeaderSchema),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const signatureSchema = z.object({
+	algorithm: z.literal("ed25519"),
+	publicKey: z.string().regex(/^[0-9a-f]{64}$/),
+	keyId: z.string().regex(/^[0-9a-f]{16}$/),
+	value: z.string().regex(/^[0-9a-f]{128}$/)
+});
+/**
+* Envelope schema. `data` is validated only as an object: a v1 verifier must
+* still be able to check and decrypt an archive from a later producer that
+* appended a section, and unknown sections are caught by
+* `verifyArchive`'s undeclared/declared cross-check rather than by rejecting
+* the file outright.
+*/
+const archiveSchema = z.object({
+	format: z.literal(ARCHIVE_FORMAT),
+	manifest: manifestSchema,
+	signature: signatureSchema.nullable(),
+	data: z.record(z.string(), z.unknown())
+});
+/** Parse untrusted JSON text into an archive. Throws with a readable message. */
+function parseArchive(text) {
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		throw new Error("not valid JSON — is this a seekrit archive?");
+	}
+	const parsed = archiveSchema.safeParse(json);
+	if (!parsed.success) {
+		const first = parsed.error.issues[0];
+		const where = first?.path.join(".") || "archive";
+		throw new Error(`not a ${ARCHIVE_FORMAT} archive: ${where}: ${first?.message ?? "invalid"}`);
+	}
+	return parsed.data;
+}
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1183,6 +1904,7 @@ const AUDIT_ACTIONS = [
 	"org.member_invited",
 	"org.invite_revoked",
 	"org.mfa_policy_changed",
+	"org.exported",
 	"user.keys_updated",
 	"user.notification_prefs_updated",
 	"app.created",
@@ -1267,7 +1989,9 @@ const AUDIT_ACTIONS = [
 	"agent.updated",
 	"agent.deleted",
 	"agent.policy_published",
-	"agent.policy_rolled_back"
+	"agent.policy_rolled_back",
+	"agent.task_dispatched",
+	"agent.task_revoked"
 ];
 /**
 * Transactional notification emails seekrit can send. Each id is one
@@ -1366,6 +2090,13 @@ const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	/** Include the full append-only ciphertext history of every secret. */
+	includeVersions: z.boolean().optional(),
+	includeAudit: z.boolean().optional(),
+	/** Newest audit rows to keep. Exceeding the server cap is a 400, not a silent trim. */
+	auditLimit: z.number().int().min(0).optional()
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -3492,6 +4223,76 @@ async function decryptPrivateKey(passphrase, blob) {
 	}
 }
 //#endregion
+//#region ../../packages/crypto/src/policy-key.ts
+/**
+* Signing with a principal's **existing** keypair, for agent access policy.
+*
+* Policy bundles are signed in the browser so the API can serve a blob it cannot
+* forge (`docs/agent-access-governance.md` §1). Every user already has a P-256
+* keypair whose private half is passphrase-encrypted and opaque to the server
+* (`users.public_key_jwk`), so this feature needs **no new key material**: no
+* second passphrase, no wrapping, no schema, and nothing extra for an admin to
+* lose. That was a deliberate condition of the design.
+*
+* The catch is that WebCrypto keys are algorithm-bound. A principal key is
+* imported for ECDH (`deriveBits`) and cannot sign, even though the underlying
+* curve is the same one ECDSA uses. So the JWK is re-imported here with the
+* algorithm hints stripped — the same private scalar, presented as an ECDSA key.
+*
+* **The tradeoff, stated plainly:** this reuses one key for two algorithms,
+* which key-management hygiene (NIST SP 800-57 §5.2) advises against. We accept
+* it because the alternative — a second keypair per admin — is the kind of
+* ceremony that gets skipped, and because both uses stay inside the same trust
+* boundary: the key already authorizes reading every secret the admin can read,
+* so a signature capability adds no reach an attacker holding it wouldn't have.
+* If a future version wants separation, the clean path is a managed KMS `sign`
+* key granted to publishers — the thumbprint pinning in the proxy works
+* unchanged, which is why the format carries the key rather than a user id.
+*/
+const ECDSA_PARAMS$1 = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/**
+* Re-import a principal's private key JWK as an ECDSA signing key.
+*
+* `key_ops`, `alg`, and `use` are dropped: they say "ECDH" on a principal key,
+* and WebCrypto refuses an import whose declared operations don't include the
+* requested usage. Everything that determines the key — `crv`, `d`, `x`, `y` —
+* is passed through untouched.
+*/
+async function importPolicySigningKey(privateKeyJwk) {
+	const jwk = JSON.parse(privateKeyJwk);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256") throw new SeekritCryptoError("MALFORMED_BLOB", "policy signing needs an EC P-256 principal key");
+	if (!jwk.d) throw new SeekritCryptoError("MALFORMED_BLOB", "policy signing needs the private half of the key");
+	const { kty, crv, d, x, y } = jwk;
+	return crypto.subtle.importKey("jwk", {
+		kty,
+		crv,
+		d,
+		x,
+		y
+	}, ECDSA_PARAMS$1, false, ["sign"]);
+}
+/**
+* Trim a principal's public key JWK to the members a policy bundle carries.
+*
+* The bundle names its signer by thumbprint, which is computed over exactly
+* these four members — so anything else in the stored JWK (`key_ops`, `ext`,
+* `alg`) must be dropped here, or the thumbprint an admin pins would depend on
+* incidental fields.
+*/
+function policySignerJwk(publicKeyJwk) {
+	const jwk = JSON.parse(publicKeyJwk);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.x || !jwk.y) throw new SeekritCryptoError("MALFORMED_BLOB", "not an EC P-256 public key");
+	return {
+		kty: "EC",
+		crv: "P-256",
+		x: jwk.x,
+		y: jwk.y
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/shamir.ts
 /**
 * Shamir's Secret Sharing over GF(2^8) — the same field AES uses, with the
@@ -3985,10 +4786,13 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 */
 const TOKEN_PREFIX = "skt";
 const CLI_SESSION_PREFIX = "skc";
+const TASK_PREFIX = "skd";
 const TOKEN_ID_LENGTH = 22;
 const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 /** 32 bytes of entropy for the CLI session secret. */
 const CLI_SESSION_SECRET_BYTES = 32;
+/** 32 bytes for a task token's secret, matching the CLI session. */
+const TASK_SECRET_BYTES = 32;
 function randomTokenId(prefix = TOKEN_PREFIX) {
 	let out = "";
 	while (out.length < TOKEN_ID_LENGTH) {
@@ -4058,9 +4862,18 @@ function parseCliSessionToken(token) {
 function isCliSessionToken(value) {
 	return value.startsWith(`${CLI_SESSION_PREFIX}_`);
 }
+async function createAgentTaskToken() {
+	const taskRef = randomTokenId(TASK_PREFIX);
+	const token = `${taskRef}_${toBase64Url(crypto.getRandomValues(new Uint8Array(TASK_SECRET_BYTES)))}`;
+	return {
+		token,
+		taskRef,
+		tokenHash: await hashToken(token)
+	};
+}
 //#endregion
 //#region package.json
-var version = "0.43.0";
+var version = "0.45.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4437,6 +5250,60 @@ var SeekritClient = class {
 	getAgentPolicyBundle(agentRef) {
 		return this.request("GET", `/v1/agents/${encodeURIComponent(agentRef)}/policy`);
 	}
+	/**
+	* Dispatch a task for one agent run.
+	*
+	* The caller mints the token (`createAgentTaskToken` in `@seekrit/crypto`) and
+	* sends only its hash plus the public `skd_…` segment, so no presentable
+	* credential ever reaches this API — the same shape as service-token and CLI
+	* session creation. `scopes` may only narrow what the agent's published policy
+	* already permits; a name outside it is refused rather than dropped.
+	*
+	* Not org-scoped, because an orchestrator is not: it knows an agent slug.
+	*/
+	dispatchAgentTask(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/dispatch`, input);
+	}
+	/**
+	* Exchange a presented token for the session it authorizes — what an
+	* enforcement point calls once per task and caches until expiry.
+	*
+	* A POST because the token is a credential and must not land in a URL or an
+	* access log. Fails closed and says which way: revoked, expired, or a disabled
+	* identity are three different answers.
+	*/
+	introspectAgentTask(token) {
+		return this.request("POST", "/v1/tasks/introspect", { token });
+	}
+	/** End a run's authority now. Idempotent. */
+	revokeAgentTask(taskId) {
+		return this.request("POST", `/v1/tasks/${taskId}/revoke`);
+	}
+	getAgentTask(taskId) {
+		return this.request("GET", `/v1/tasks/${taskId}`);
+	}
+	/** Runs dispatched for one identity, newest first (admin). */
+	listAgentTasks(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/tasks`);
+	}
+	/**
+	* Report aggregate decisions. Called by an enforcement point, not a person.
+	*
+	* Counts only — hosts, methods, secret *names*, decisions, and rule indices.
+	* Never a request path: see the module comment in `agent-activity.ts` for why
+	* that line is drawn where it is.
+	*/
+	reportAgentActivity(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/activity`, input);
+	}
+	/**
+	* What an agent actually did, collapsed onto its dimensions — the evidence a
+	* grant review reasons over. The proposals themselves are computed client-side
+	* (`reviewPolicy` in `@seekrit/core`), so the API never opines on policy.
+	*/
+	getAgentActivity(orgId, agentId, days = 14) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/activity?days=${encodeURIComponent(String(days))}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -4589,6 +5456,17 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	/**
+	* Export the org as one signed archive: every row seekrit holds for it, with
+	* ciphertext still ciphertext (docs/break-glass-export.md).
+	*
+	* The archive comes back inline rather than as a job handle, and it can be
+	* megabytes — buffer it to a file rather than holding several copies. Requires
+	* admin; deliberately not entitlement-gated.
+	*/
+	exportArchive(orgId, input = {}) {
+		return this.request("POST", `/v1/orgs/${orgId}/export`, input);
+	}
 	getLogSink(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
 	}
@@ -4748,6 +5626,24 @@ function fail(message) {
 	console.error(`error: ${message}`);
 	process.exit(1);
 }
+/**
+* Parse a duration flag like `30m`, `24h`, `90d`, or a bare seconds count.
+*
+* Lives here rather than in a command module because more than one command
+* takes a duration and they must agree: `--every 7d` and `--ttl 7d` meaning
+* different things would be a nasty surprise. Invalid input is a flag error, so
+* it exits through `fail` with the accepted forms named.
+*/
+function parseDurationSeconds(input, flag) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
 /** Prompt without echoing input (for passphrases). */
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
@@ -4883,6 +5779,31 @@ async function getPrivateKey(ctx) {
 	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
 	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
 }
+/**
+* Recover the caller's **policy signing** key: the same P-256 principal key,
+* re-imported for ECDSA rather than ECDH. The dashboard does exactly this in
+* `keyring.getPolicySigner`, so a bundle signed here and one signed in a browser
+* are indistinguishable — same key, same thumbprint, same pin in a proxy config.
+*
+* Service tokens are refused *here* rather than at the API, so the reason is
+* legible at the point of use: publishing policy is deliberately gated on a
+* human's key, because an agent that can widen its own authorization is not
+* governed by it. See the module comment in `apps/api/src/routes/agents.ts`.
+*
+* The honest caveat is `SEEKRIT_PASSPHRASE`: where it is set, anything that can
+* read the environment can sign. That is already true of every other CLI
+* decryption, but it matters more here, so the docs say to leave it unset on any
+* machine an agent shares.
+*/
+async function getPolicySigner(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login` (a service token cannot publish, by design)");
+	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+	const privateKeyJwk = await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey);
+	return {
+		signingKey: await importPolicySigningKey(privateKeyJwk),
+		jwk: policySignerJwk(privateKeyJwk)
+	};
+}
 /** Recover one environment's DEK for the current principal. */
 async function getDek(ctx, orgId, envId) {
 	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
@@ -5213,24 +6134,661 @@ function registerAccountCommands(program) {
 	});
 }
 //#endregion
-//#region src/kms.ts
-/** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
-	acc.push(value);
-	return acc;
-}
-/** The calling principal's identity + public key (for a self-grant). */
-async function kmsCallerIdentity(ctx) {
-	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
-		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
-		return {
-			principalType: "service_token",
-			principalId: tokenId,
-			publicKeyJwk: JSON.stringify(pub)
-		};
+//#region src/agents.ts
+/**
+* Agent access governance from the CLI.
+*
+* Policy lived only in the dashboard until now, which was backwards: the people
+* deploying agents work in a terminal and a repo, and a rule set is exactly the
+* kind of thing that wants review and version control. So the loop this module
+* exists for is:
+*
+*   seekrit agents policy pull nova -o nova.policy.json   # current rules
+*   $EDITOR nova.policy.json                              # commit it, review it
+*   seekrit agents policy publish nova -f nova.policy.json
+*
+* **Signing still happens here, on this machine, with the operator's own key**
+* (`getPolicySigner` in `context.ts`), so nothing about the trust argument in
+* `docs/agent-access-governance.md` §1 changes: the API receives an opaque
+* envelope it cannot forge, and a proxy verifies it against thumbprints pinned in
+* its own local file. A service token is refused — an agent that can publish its
+* own policy is not governed by it.
+*
+* Everything else here is read-only, and two commands are deliberately *local*
+* evaluations rather than API calls:
+*
+* - `simulate` runs `evaluatePolicy` from `@seekrit/core`, the mirror of
+*   `RuleSet::decide` in the proxy — so a dry run and a real refusal give the
+*   same verdict in the same words.
+* - `fetch` asks for the bytes a proxy would get (`GET /v1/agents/:ref/policy`)
+*   and re-derives the signer thumbprint from the bundle itself, rather than
+*   trusting the field the API echoes beside it.
+*/
+/** How many published versions the API returns per page. */
+const POLICY_PAGE = 50;
+/** The `-` sentinel every other seekrit command uses to mean stdin. */
+const STDIN = "-";
+/**
+* Resolve `nova`, or `agt_…`, to an identity.
+*
+* The org-scoped API routes take an id, but nobody types ids — so a slug is
+* resolved from the list. The list is small (agents are a per-deployment thing,
+* not a per-request one), which is why this costs one request rather than
+* needing a lookup route.
+*/
+async function resolveAgent(ctx, orgId, ref) {
+	const { agents } = await ctx.client.listAgents(orgId);
+	const found = agents.find((a) => a.slug === ref || a.id === ref);
+	if (!found) {
+		const known = agents.map((a) => a.slug).join(", ");
+		fail(`no agent "${ref}"${known ? ` — this org has: ${known}` : " in this org"}`);
 	}
-	const { user } = await ctx.client.me();
+	return found;
+}
+/**
+* One published version: the newest by default, or an explicit `--version`.
+*
+* An agent with no published policy is a real state, not an error — a proxy for
+* it fails closed — so the caller decides how to report it.
+*/
+async function loadVersion(ctx, orgId, agent, version) {
+	const { policies } = await ctx.client.listAgentPolicies(orgId, agent.id);
+	if (version === void 0) return policies[0] ?? null;
+	const found = policies.find((p) => p.version === version);
+	if (!found) fail(policies.length >= POLICY_PAGE ? `no version ${version} in the last ${POLICY_PAGE} published` : `no version ${version} — published: ${policies.map((p) => p.version).join(", ") || "none"}`);
+	return found;
+}
+/**
+* Read a rule file: either a bare array or `{ "rules": [...] }`, from a path or
+* stdin. Both shapes are accepted because `policy pull` writes the second and
+* hand-written files tend to be the first.
+*
+* Validation is the same zod schema the API and the dashboard use, so a file
+* rejected here would have been rejected there — before anything is signed.
+*
+* Exported for its own test: this is the one place a hand-written file meets the
+* schema, and its error messages are the whole user experience of a typo.
+*/
+function parseRuleFile(raw, source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		fail(`${source} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const list = Array.isArray(parsed) ? parsed : parsed?.rules === void 0 ? fail(`${source} must be a JSON array of rules, or an object with a "rules" array`) : parsed.rules;
+	if (!Array.isArray(list)) fail(`${source}: "rules" must be an array`);
+	if (list.length === 0) console.error(`note: ${source} has no rules — publishing it denies every request`);
+	return list.map((rule, i) => {
+		const result = agentPolicyRuleSchema.safeParse(rule);
+		if (!result.success) {
+			const first = result.error.issues[0];
+			fail(`${source}: rule ${i + 1} is invalid — ${first?.path.join(".") || "rule"}: ${first?.message ?? "unknown error"}`);
+		}
+		return result.data;
+	});
+}
+/** `--file path` or `--file -`. */
+async function readRuleSource(file) {
+	if (file === STDIN) return {
+		raw: await readStdin(),
+		label: "stdin"
+	};
+	try {
+		return {
+			raw: readFileSync(file, "utf8"),
+			label: file
+		};
+	} catch (err) {
+		return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/**
+* An empty `methods` or `paths` list means *any*: those fields narrow a rule that
+* already matched its host, so absent means unconstrained. A blank column would
+* read as the opposite, so it renders as `any`.
+*
+* Exported for its own test — this is a real invariant of the format, not a
+* cosmetic choice.
+*/
+function describeList(values) {
+	return values.length === 0 ? "any" : values.join(" ");
+}
+/**
+* `allow` is the field where empty means the **opposite** — no secret may be
+* injected toward this host at all (`Decision::SecretNotAllowed` for every name;
+* see `crates/seekrit-core/src/policy.rs`). Such a rule is useful and
+* intentional: it permits the *request* while granting no credential, which is
+* how you let an agent read a public API through the proxy without handing it a
+* key. Rendering that as `any` would invert the meaning of the one column an
+* operator reviews most carefully, so it gets its own function.
+*/
+function describeSecrets(values) {
+	return values.length === 0 ? "none" : values.join(" ");
+}
+function printRules(rules) {
+	printTable(rules.map((rule, i) => ({
+		n: i + 1,
+		rule
+	})), [
+		col("#", (r) => r.n),
+		col("host", (r) => r.rule.host),
+		col("methods", (r) => describeList(r.rule.methods)),
+		col("paths", (r) => describeList(r.rule.paths)),
+		col("secrets", (r) => describeSecrets(r.rule.allow)),
+		col("label", (r) => r.rule.label ?? "-")
+	], "no rules — this policy denies every request");
+}
+/** One rule as a single line, for the publish diff. */
+function ruleLine(rule) {
+	const parts = [
+		rule.host,
+		describeList(rule.methods),
+		describeList(rule.paths),
+		`secrets=${describeSecrets(rule.allow)}`
+	];
+	return rule.label ? `${parts.join(" ")}  (${rule.label})` : parts.join(" ");
+}
+/**
+* The change a publish would make. Rules are compared by *position* because
+* order decides — first match wins — so a reordering is a real change and shows
+* up as one.
+*/
+function printPolicyDiff(before, after) {
+	const changes = diffPolicyRules(before, after).filter((c) => c.kind !== "unchanged");
+	if (changes.length === 0) {
+		console.error(after.length === 0 ? "no rules — this policy denies every request" : "no rule changes — publishing would only extend the expiry");
+		return;
+	}
+	for (const change of changes) {
+		const n = change.index + 1;
+		if (change.kind === "added") console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		else if (change.kind === "removed") console.log(`- ${n}  ${ruleLine(change.before)}`);
+		else {
+			console.log(`- ${n}  ${ruleLine(change.before)}`);
+			console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		}
+	}
+}
+/** Seconds until an ISO instant, or a negative number when it has passed. */
+function secondsUntil(iso) {
+	return Math.round((new Date(iso).getTime() - Date.now()) / 1e3);
+}
+/** Collect a repeated `--scope NAME` into a list. */
+function collectScope(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* A task's state, derived rather than stored: `revoked` beats `expired`, so a run
+* somebody killed does not read as one that merely lapsed.
+*
+* Exported for its own test — it mirrors `taskState` in
+* `apps/api/src/lib/agent-tasks.ts`, and the two disagreeing would mean the list
+* screen and the enforcement point describe the same run differently.
+*/
+function taskStateOf(task, now) {
+	if (task.revokedAt) return "revoked";
+	return Date.parse(task.expiresAt) <= now ? "expired" : "active";
+}
+/**
+* A detail view on **stderr**, so a command whose stdout is a credential can
+* still explain itself to a person without corrupting `$(…)`.
+*/
+function printFieldsToStderr(fields) {
+	const present = fields.filter(([, value]) => value !== null && value !== void 0);
+	const width = Math.max(...present.map(([label]) => label.length));
+	for (const [label, value] of present) console.error(`${label.padEnd(width)}  ${value}`);
+}
+/**
+* Exported for its own test: the expired branch is the one that must be loud.
+*
+* The granularity has to span both users of this — a policy bundle lasting a
+* week and a task lasting fifteen minutes. Rounding a task to the nearest hour
+* printed "in 0h", which is worse than no estimate at all.
+*/
+function describeExpiry(iso) {
+	const seconds = secondsUntil(iso);
+	if (seconds <= 0) return `${iso} (EXPIRED — proxies for this agent fail closed)`;
+	const days = Math.floor(seconds / 86400);
+	const hours = Math.floor(seconds % 86400 / 3600);
+	const minutes = Math.floor(seconds % 3600 / 60);
+	if (days > 0) return `${iso} (in ${days}d ${hours}h)`;
+	if (hours > 0) return `${iso} (in ${hours}h ${minutes}m)`;
+	if (minutes > 0) return `${iso} (in ${minutes}m)`;
+	return `${iso} (in ${seconds}s)`;
+}
+function registerAgentCommands(program) {
+	const agents = program.command("agents").description("agent access policy — which agent may reach which upstream with which secret");
+	agents.command("list", { isDefault: true }).description("list agent identities").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { agents: rows } = await ctx.client.listAgents(org.id);
+		emit(options, { agents: rows }, () => printTable(rows, [
+			col("slug", (a) => a.slug),
+			col("name", (a) => a.name),
+			col("policy", (a) => a.currentPolicyVersion === 0 ? "none" : `v${a.currentPolicyVersion}`),
+			col("enabled", (a) => a.enabled ? "yes" : "no"),
+			col("last fetch", (a) => a.lastPolicyFetchAt ?? "never")
+		], "no agent identities — create one with `seekrit agents create`"));
+	});
+	agents.command("create <name>").description("create an agent identity (a policy subject; it holds no key material)").requiredOption("--slug <slug>", "short name a proxy config and a ticket refer to").option("--org <slug>", "organization").option("--app <slug>", "application, when scoping the agent to one environment").option("--env <slug>", "environment whose secret names its rules may reference").option("--json", "machine-readable output").action(async (name, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const environmentId = options.env ? (await resolveAppEnv(ctx, {
+			org: options.org,
+			app: options.app,
+			env: options.env
+		})).envId : void 0;
+		const { agent } = await ctx.client.createAgent(org.id, {
+			name,
+			slug: options.slug,
+			...environmentId ? { environmentId } : {}
+		});
+		emit(options, { agent }, () => {
+			console.error(`created ${agent.slug} — no policy published yet, so any proxy for it fails closed`);
+			console.error(`next: seekrit agents policy publish ${agent.slug} -f rules.json`);
+		});
+	});
+	agents.command("show <ref>").description("an identity and its live rules").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { environment } = await ctx.client.getAgent(org.id, agent.id);
+		const live = await loadVersion(ctx, org.id, agent);
+		emit(options, {
+			agent,
+			environment,
+			policy: live
+		}, () => {
+			printFields([
+				["name", agent.name],
+				["slug", agent.slug],
+				["id", agent.id],
+				["environment", environment ? environment.slug : "any in the org"],
+				["enabled", agent.enabled ? "yes" : "no"],
+				["policy", live ? `v${live.version}` : "none published"],
+				["signer", live?.signerThumbprint],
+				["expires", live ? describeExpiry(live.expiresAt) : void 0],
+				["last fetch", agent.lastPolicyFetchAt ?? "never"]
+			]);
+			if (live) {
+				section(`rules (v${live.version})`);
+				printRules(live.rules);
+				section("hosts a forward proxy would intercept");
+				console.log(policyHosts(live.rules).join("\n") || "none");
+			}
+		});
+	});
+	agents.command("disable <ref>").description("stop serving this identity's policy (the revocation path)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Disable ${agent.slug}? Running proxies keep their current bundle until it expires.`);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: false });
+		console.error(`${agent.slug} disabled — its next policy refresh is refused`);
+	});
+	agents.command("enable <ref>").description("serve this identity's policy again").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: true });
+		console.error(`${agent.slug} enabled`);
+	});
+	agents.command("rm <ref>").description("delete an identity and its published history").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Delete ${agent.slug} and all ${agent.currentPolicyVersion} published version(s)? The audit_log rows survive.`);
+		await ctx.client.deleteAgent(org.id, agent.id);
+		console.error(`${agent.slug} deleted`);
+	});
+	/**
+	* The trust anchor. This prints a *public* key fingerprint — the security of
+	* pinning comes from the operator putting it in a local file the API cannot
+	* reach, not from this command being honest. Which is why it prints the TOML
+	* line to paste rather than offering to write the config.
+	*/
+	agents.command("signer").description("your policy signing thumbprint, to pin in a proxy config").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { signer } = await ctx.client.getMyPolicySigner(org.id);
+		if (!signer) fail("your account has no keypair yet — run `seekrit keys setup`");
+		emit(options, { signer }, () => {
+			printFields([["thumbprint", signer.thumbprint], ["user", signer.userId]]);
+			section("pin it in seekrit-proxy.toml");
+			console.log("[policy]");
+			console.log(`signers = ["${signer.thumbprint}"]`);
+			console.error("");
+			console.error("pin a second admin's key too — one pinned signer means one lost passphrase leaves nobody able to publish");
+		});
+	});
+	/**
+	* The token is printed to **stdout** and everything else to stderr, so the
+	* common thing works without parsing:
+	*
+	*   TASK=$(seekrit agents dispatch nova --scope GITHUB_TOKEN --ttl 15m)
+	*
+	* It is shown exactly once. The API stores only a hash, so a lost token cannot
+	* be recovered — dispatch another and revoke the first.
+	*/
+	agents.command("dispatch <ref>").description("mint task-scoped authority for one agent run").option("--scope <NAME>", "narrow this run to one secret (repeatable)", collectScope).option("--ttl <duration>", "how long the run stays authorized (e.g. 15m, 2h)").option("--label <text>", "what this run is for — recorded in the audit trail").option("--json", "machine-readable output (includes the token)").action(async (ref, options) => {
+		const ctx = buildContext();
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : 900;
+		if (ttlSeconds < 60 || ttlSeconds > 43200) fail(`--ttl must be between 60s and ${TASK_MAX_TTL_SECONDS / 3600}h`);
+		const minted = await createAgentTaskToken();
+		const { task, header } = await ctx.client.dispatchAgentTask(ref, {
+			taskRef: minted.taskRef,
+			tokenHash: minted.tokenHash,
+			ttlSeconds,
+			...options.scope ? { scopes: options.scope } : {},
+			...options.label ? { label: options.label } : {}
+		});
+		if (options.json) {
+			console.log(JSON.stringify({
+				task,
+				header,
+				token: minted.token
+			}, null, 2));
+			return;
+		}
+		console.log(minted.token);
+		printFieldsToStderr([
+			["task", task.id],
+			["agent", ref],
+			["scopes", task.scopes ? describeSecrets(task.scopes) : "the agent's full policy"],
+			["policy", `v${task.policyVersion}`],
+			["expires", describeExpiry(task.expiresAt)],
+			["header", header]
+		]);
+	});
+	agents.command("tasks <ref>").description("runs dispatched for an agent identity, newest first").option("--org <slug>", "organization").option("--all", "include expired and revoked runs").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { tasks } = await ctx.client.listAgentTasks(org.id, agent.id);
+		const now = Date.now();
+		const rows = options.all ? tasks : tasks.filter((t) => taskStateOf(t, now) === "active");
+		emit(options, { tasks: rows }, () => printTable(rows, [
+			col("task", (t) => t.id),
+			col("state", (t) => taskStateOf(t, now)),
+			col("scopes", (t) => t.scopes ? describeSecrets(t.scopes) : "policy"),
+			col("policy", (t) => `v${t.policyVersion}`),
+			col("expires", (t) => t.expiresAt),
+			col("last seen", (t) => t.lastSeenAt ?? "never"),
+			col("label", (t) => t.label ?? "-")
+		], options.all ? "no runs dispatched yet" : "no live runs (try --all)"));
+	});
+	agents.command("revoke <taskId>").description("end a run's authority now").action(async (taskId) => {
+		const { task } = await buildContext().client.revokeAgentTask(taskId);
+		console.error(`${task.id} revoked — enforcement points refuse it at their next introspection`);
+	});
+	registerPolicyCommands(agents.command("policy").description("published policy versions (`seekrit agents policy --help`)"));
+	agents.command("activity <ref>").description("what this agent actually did — aggregate decisions, not a request log").option("--days <n>", "how far back to look (1–90)", "14").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		emit(options, {
+			activity,
+			summary
+		}, () => {
+			printFields([
+				["window", `${days}d`],
+				["allowed", summary.allowed],
+				["denied", summary.denied],
+				["hosts", summary.hosts],
+				["earliest", summary.from ?? "no activity reported"]
+			]);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("nothing reported — add an [activity] block to the proxy (`seekrit proxy init --activity`)");
+				return;
+			}
+			section("decisions");
+			printTable(activity, [
+				col("host", (a) => a.host),
+				col("method", (a) => a.method),
+				col("decision", (a) => a.decision),
+				col("rule", (a) => a.ruleIndex === null ? "-" : String(a.ruleIndex + 1)),
+				col("count", (a) => a.count),
+				col("secrets", (a) => a.secrets ? Object.entries(a.secrets).map(([name, n]) => `${name}×${n}`).join(" ") : "-")
+			]);
+		});
+	});
+	/**
+	* The grant review loop. Proposals are computed *here*, from activity the API
+	* served — the API is deliberately not in the business of saying what a policy
+	* should be. And `--out` writes a rule file rather than publishing: the change
+	* still goes through `policy publish`, which still needs a human's key.
+	*/
+	agents.command("review <ref>").description("compare published policy against observed activity, and propose changes").option("--days <n>", "how far back to look (1–90)", "14").option("-o, --out <path>", "write the narrowed rules to a file, ready to publish").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const live = await loadVersion(ctx, org.id, agent);
+		if (!live) fail(`${agent.slug} has no published policy to review`);
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		const proposals = reviewPolicy({
+			rules: live.rules,
+			activity
+		});
+		emit(options, {
+			proposals,
+			summary,
+			version: live.version
+		}, () => {
+			console.error(`${agent.slug} — policy v${live.version}, ${summary.allowed + summary.denied} decision(s) over ${days}d`);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("no activity reported yet — nothing to review against");
+				return;
+			}
+			if (proposals.length === 0) {
+				console.error("");
+				console.error("no changes proposed: every rule is in use and nothing was refused");
+				return;
+			}
+			section("proposals");
+			for (const p of proposals) {
+				const marker = p.applicable ? "-" : "?";
+				console.log(`${marker} ${p.rationale}`);
+			}
+			const applicable = countApplicable(proposals);
+			console.error("");
+			console.error(`${applicable} narrowing change(s) can be applied; ${proposals.length - applicable} need a human decision`);
+		});
+		if (options.out) {
+			const narrowed = applyProposals(live.rules, proposals);
+			writeFileSync(options.out, `${JSON.stringify({ rules: narrowed }, null, 2)}\n`);
+			console.error(`wrote ${narrowed.length} rule(s) to ${options.out} — review the diff, then: seekrit agents policy publish ${agent.slug} -f ${options.out}`);
+			console.error("widening proposals are never applied: an agent must not earn permissions by retrying");
+		}
+	});
+	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy — every request is denied`);
+		const verdict = evaluatePolicy(published.rules, {
+			host: options.host,
+			method: options.method,
+			path: options.path,
+			...options.secret === void 0 ? {} : { secret: options.secret }
+		});
+		const reason = describePolicyVerdict(verdict, published.rules);
+		emit(options, {
+			version: published.version,
+			verdict,
+			reason
+		}, () => {
+			const target = `${options.method.toUpperCase()} ${options.host}${options.path}`;
+			console.log(`${verdict.decision === "allow" ? "allow" : "DENY"}  ${target}${options.secret ? ` [${options.secret}]` : ""}`);
+			console.log(`  v${published.version}: ${reason}`);
+		});
+		if (verdict.decision !== "allow") process.exitCode = 1;
+	});
+}
+function registerPolicyCommands(policy) {
+	policy.command("list <ref>").description("published versions, newest first").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { policies } = await ctx.client.listAgentPolicies(org.id, agent.id);
+		emit(options, { policies }, () => printTable(policies, [
+			col("version", (p) => `v${p.version}`),
+			col("rules", (p) => p.ruleCount),
+			col("signer", (p) => p.signerThumbprint.slice(0, 12)),
+			col("published", (p) => p.publishedAt),
+			col("expires", (p) => secondsUntil(p.expiresAt) <= 0 ? `${p.expiresAt} (expired)` : p.expiresAt),
+			col("note", (p) => p.rolledBackFromVersion ? `restored v${p.rolledBackFromVersion}` : "-")
+		], "nothing published yet"));
+	});
+	policy.command("show <ref>").description("the rules in a published version (live by default)").option("--version <n>", "a specific version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy`);
+		emit(options, { policy: published }, () => {
+			printFields([
+				["version", `v${published.version}`],
+				["signer", published.signerThumbprint],
+				["published", published.publishedAt],
+				["expires", describeExpiry(published.expiresAt)]
+			]);
+			section("rules");
+			printRules(published.rules);
+		});
+	});
+	/**
+	* Write the live rules out as the editable source for the next publish. This
+	* is the half that makes policy-as-code work: what comes back out is exactly
+	* the shape `publish` takes in, so a round trip is a no-op diff.
+	*/
+	policy.command("pull <ref>").description("write a version's rules to a JSON file you can edit and publish").option("-o, --out <path>", "where to write it (default: stdout)").option("--version <n>", "a specific version").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		const rules = published?.rules ?? [];
+		const body = `${JSON.stringify({ rules }, null, 2)}\n`;
+		if (options.out) {
+			writeFileSync(options.out, body);
+			console.error(published ? `wrote ${rules.length} rule(s) from v${published.version} to ${options.out}` : `wrote an empty rule set to ${options.out} (nothing published yet)`);
+			return;
+		}
+		process.stdout.write(body);
+	});
+	policy.command("publish <ref>").description("sign a rule file with your own key and publish it").requiredOption("-f, --file <path>", `rule file, or ${STDIN} for stdin`).option("--ttl <duration>", "how long the bundle stays valid (e.g. 7d, 12h)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		if (isTokenAuth(ctx)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login`. A service token cannot publish, so an agent cannot widen its own policy.");
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : POLICY_DEFAULT_TTL_SECONDS;
+		if (ttlSeconds < 3600 || ttlSeconds > 7776e3) fail(`--ttl must be between ${POLICY_MIN_TTL_SECONDS / 3600}h and ${POLICY_MAX_TTL_SECONDS / 86400}d`);
+		const { raw, label } = await readRuleSource(options.file);
+		const rules = parseRuleFile(raw, label);
+		const live = await loadVersion(ctx, org.id, agent);
+		const nextVersion = agent.currentPolicyVersion + 1;
+		const from = agent.currentPolicyVersion === 0 ? "nothing" : `v${agent.currentPolicyVersion}`;
+		console.error(`${agent.slug}: ${from} → v${nextVersion}`);
+		printPolicyDiff(live?.rules ?? [], rules);
+		await confirmDestructive(options.yes, `Publish v${nextVersion} for ${agent.slug} (${rules.length} rule(s), valid ${options.ttl ?? "7d"})?`);
+		const { signingKey, jwk } = await getPolicySigner(ctx);
+		const issuedAt = Math.floor(Date.now() / 1e3);
+		const bundle = await signAgentPolicy(signingKey, jwk, {
+			v: 1,
+			org: org.id,
+			agent: agent.id,
+			agent_slug: agent.slug,
+			policy_version: nextVersion,
+			issued_at: issuedAt,
+			expires_at: issuedAt + ttlSeconds,
+			rules
+		});
+		const { policy: published } = await ctx.client.publishAgentPolicy(org.id, agent.id, bundle);
+		emit(options, { policy: published }, () => {
+			console.error(`published v${published.version} — signed with ${published.signerThumbprint.slice(0, 12)}…, expires ${published.expiresAt}`);
+			console.error("proxies pick it up at their next refresh");
+		});
+	});
+	policy.command("rollback <ref> <version>").description("republish an earlier version's bundle as the newest one").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, versionArg, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = Number(versionArg);
+		if (!Number.isInteger(version) || version < 1) fail("version must be a positive integer");
+		const source = await loadVersion(ctx, org.id, agent, version);
+		if (!source) fail(`no version ${version}`);
+		if (secondsUntil(source.expiresAt) <= 0) fail(`v${version} expired at ${source.expiresAt} — a rollback keeps the original expiry, so it would be inert. Publish the rules again instead: seekrit agents policy pull ${agent.slug} --version ${version} -o rules.json`);
+		await confirmDestructive(options.yes, `Roll ${agent.slug} back to v${version} (${source.ruleCount} rule(s))?`);
+		const { policy: published } = await ctx.client.rollbackAgentPolicy(org.id, agent.id, version);
+		console.error(`published v${published.version} carrying v${version}'s bundle`);
+	});
+	/**
+	* What a proxy actually gets. Useful when a deployment misbehaves and the
+	* question is whether the API, the pin, or the rules are at fault — so it
+	* re-derives the thumbprint from the bundle rather than reporting the one the
+	* API sends beside it, and says plainly when the two disagree.
+	*/
+	policy.command("fetch <ref>").description("the bundle a proxy would fetch, with its signer re-derived locally").option("--bundle", "print the raw ap1. envelope and nothing else").option("--json", "machine-readable output").action(async (ref, options) => {
+		const fetched = await buildContext().client.getAgentPolicyBundle(ref);
+		if (options.bundle) {
+			process.stdout.write(`${fetched.bundle}\n`);
+			return;
+		}
+		const body = parseAgentPolicyUnverified(fetched.bundle);
+		const derived = await policySignerThumbprint(body.signer.jwk);
+		emit(options, {
+			...fetched,
+			derivedThumbprint: derived,
+			rules: body.rules
+		}, () => {
+			printFields([
+				["agent", `${fetched.agent.slug} (${fetched.agent.name})`],
+				["version", `v${fetched.version}`],
+				["expires", describeExpiry(fetched.expiresAt)],
+				["signer (in bundle)", derived],
+				["signer (reported)", fetched.signerThumbprint === derived ? "matches" : `${fetched.signerThumbprint} — DOES NOT MATCH the bundle; a proxy would refuse this`]
+			]);
+			section("rules");
+			printRules(body.rules);
+			console.error("");
+			console.error("this command does not verify the signature — only a pinned signer list can, which lives in the proxy's own config");
+		});
+	});
+}
+//#endregion
+//#region src/kms.ts
+/** Collect a repeatable option into a list. */
+function collect$7(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
+	}
+	const { user } = await ctx.client.me();
 	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
 	return {
 		principalType: "user",
@@ -5283,7 +6841,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$6, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$6, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -5502,7 +7060,7 @@ function registerKmsCommands(program) {
 //#endregion
 //#region src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$5(value, acc = []) {
+function collect$6(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -5599,7 +7157,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -5617,7 +7175,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -5897,6 +7455,1179 @@ function registerAppCommands(program) {
 	});
 }
 //#endregion
+//#region src/decryptor.ts
+/**
+* The standalone offline decryptor: one self-contained HTML file, written out by
+* `seekrit archive decryptor`, that opens a break-glass archive in any browser
+* with no install, no network, and no seekrit.
+*
+* Why a duplicate of the decrypt path instead of a bundle of `@seekrit/crypto`:
+* the artifact has to be a single file a customer can store next to their
+* archives for years and open from `file://`, which rules out a module graph and
+* a build step. So it is a second implementation — pinned, like every other
+* second implementation in this repo (the four SDKs, `crates/seekrit-core`), by a
+* test that runs *this* script against ciphertext produced by the real library:
+* `test/decryptor.test.ts`. If you change a blob format, that test fails here
+* too, which is the point.
+*
+* Two rules for editing the embedded script:
+*  - **No backticks and no `${`** anywhere inside it — it lives in a template
+*    literal. Use string concatenation.
+*  - **No network of any kind.** The page declares
+*    `Content-Security-Policy: default-src 'none'`, which is the property that
+*    makes it safe to type a passphrase into. Anything that needs a fetch does
+*    not belong here.
+*/
+const OFFLINE_DECRYPTOR_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<!--
+  The whole security argument for this page, in one header: with default-src
+  'none' the browser refuses every outbound request the page could make, so the
+  passphrase you type and the plaintext it produces cannot leave this machine.
+  'unsafe-inline' covers the page's own inline script and styles; there is no
+  connect-src, no img-src, no form-action.
+-->
+<meta http-equiv="Content-Security-Policy"
+      content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+<title>seekrit — offline archive decryptor</title>
+<style>
+  :root {
+    color-scheme: dark light;
+    --bg: #0b0c0e; --fg: #e7e9ea; --dim: #9aa0a6; --line: #23262b;
+    --panel: #101215; --accent: #7dd3a0; --warn: #f0b76b; --bad: #f08a8a;
+  }
+  @media (prefers-color-scheme: light) {
+    :root {
+      --bg: #fbfbfa; --fg: #14161a; --dim: #5f6673; --line: #e3e5e8;
+      --panel: #ffffff; --accent: #1a7f4b; --warn: #9a6413; --bad: #b23b3b;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; padding: 2rem 1.25rem 4rem; background: var(--bg); color: var(--fg);
+    font: 14px/1.55 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  }
+  main { max-width: 62rem; margin: 0 auto; }
+  h1 { font-size: 1.1rem; letter-spacing: 0.02em; margin: 0 0 0.25rem; }
+  h2 { font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.12em;
+       color: var(--dim); margin: 2rem 0 0.75rem; font-weight: 500; }
+  p { margin: 0.4rem 0; color: var(--dim); }
+  .panel { border: 1px solid var(--line); background: var(--panel); border-radius: 6px;
+           padding: 1rem 1.1rem; }
+  .drop { border: 1px dashed var(--line); border-radius: 6px; padding: 2rem 1rem;
+          text-align: center; color: var(--dim); }
+  .drop.over { border-color: var(--accent); color: var(--fg); }
+  label { display: block; color: var(--dim); margin: 0.75rem 0 0.25rem; }
+  input, select, textarea, button {
+    font: inherit; color: var(--fg); background: var(--bg);
+    border: 1px solid var(--line); border-radius: 4px; padding: 0.5rem 0.6rem;
+  }
+  input, select, textarea { width: 100%; }
+  textarea { min-height: 5rem; }
+  button { cursor: pointer; background: var(--panel); }
+  button:hover { border-color: var(--accent); }
+  button.primary { border-color: var(--accent); color: var(--accent); }
+  .row { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; }
+  table { width: 100%; border-collapse: collapse; margin-top: 0.5rem; }
+  th, td { text-align: left; padding: 0.35rem 0.5rem; border-bottom: 1px solid var(--line);
+           vertical-align: top; word-break: break-all; }
+  th { color: var(--dim); font-weight: 500; font-size: 0.85rem; }
+  .kv { display: grid; grid-template-columns: 12rem 1fr; gap: 0.15rem 1rem; }
+  .kv dt { color: var(--dim); }
+  .kv dd { margin: 0; word-break: break-all; }
+  .ok { color: var(--accent); } .warn { color: var(--warn); } .bad { color: var(--bad); }
+  .hidden { display: none; }
+  .env { margin-bottom: 1.5rem; }
+  .muted { color: var(--dim); font-size: 0.85rem; }
+  pre { white-space: pre-wrap; word-break: break-all; margin: 0.5rem 0 0; }
+  .value { font-family: inherit; }
+  ul { margin: 0.3rem 0 0; padding-left: 1.2rem; color: var(--dim); }
+</style>
+</head>
+<body>
+<main>
+  <h1>seekrit — offline archive decryptor</h1>
+  <p>
+    Opens a <code>seekrit-archive/v1</code> file with your own key. This page has
+    no network access at all (see the CSP in its source) &mdash; your passphrase
+    and your secrets never leave this machine. Nothing is uploaded, and nothing
+    needs to be installed.
+  </p>
+
+  <h2>1 &middot; the archive</h2>
+  <div class="drop panel" id="drop">
+    <input type="file" id="file" accept=".json,application/json" style="width:auto">
+    <p class="muted">or drop the file here</p>
+  </div>
+  <div id="manifest" class="panel hidden" style="margin-top:0.75rem"></div>
+
+  <div id="step2" class="hidden">
+    <h2>2 &middot; your key</h2>
+    <div class="panel">
+      <label for="method">how you hold it</label>
+      <select id="method">
+        <option value="passphrase">passphrase (unlocks the key inside the archive)</option>
+        <option value="token">service token (skt_&hellip;)</option>
+        <option value="jwk">private key (JWK)</option>
+        <option value="shares">custodian shares (recovery quorum)</option>
+      </select>
+
+      <div id="field-passphrase">
+        <label for="passphrase">passphrase</label>
+        <input type="password" id="passphrase" autocomplete="off" spellcheck="false">
+        <p class="muted" id="key-owner"></p>
+      </div>
+      <div id="field-token" class="hidden">
+        <label for="token">service token</label>
+        <input type="password" id="token" autocomplete="off" spellcheck="false"
+               placeholder="skt_...">
+      </div>
+      <div id="field-jwk" class="hidden">
+        <label for="jwk">private key JWK</label>
+        <textarea id="jwk" spellcheck="false" placeholder='{"kty":"EC","crv":"P-256",...}'></textarea>
+      </div>
+      <div id="field-shares" class="hidden">
+        <label for="shares">custodian shares</label>
+        <textarea id="shares" spellcheck="false"
+          placeholder="paste the contents of each share file from 'seekrit archive share', one after another"></textarea>
+        <p class="muted">
+          Reconstructs the org recovery key from a quorum, which opens every
+          environment &mdash; for when the key-holder is gone.
+        </p>
+      </div>
+
+      <div class="row" style="margin-top:1rem">
+        <button class="primary" id="decrypt">decrypt</button>
+        <span id="status" class="muted"></span>
+      </div>
+    </div>
+  </div>
+
+  <div id="results"></div>
+</main>
+<script>
+(function () {
+  "use strict";
+
+  // ── encoding ────────────────────────────────────────────────────────────
+  function b64uToBytes(text) {
+    var base64 = text.replace(/-/g, "+").replace(/_/g, "/");
+    var binary = atob(base64);
+    var out = new Uint8Array(binary.length);
+    for (var i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  }
+  function hexToBytes(hex) {
+    if (hex.length % 2 !== 0) throw new Error("malformed hex");
+    var out = new Uint8Array(hex.length / 2);
+    for (var i = 0; i < out.length; i++) {
+      var byte = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      if (Number.isNaN(byte)) throw new Error("malformed hex");
+      out[i] = byte;
+    }
+    return out;
+  }
+  function bytesToHex(bytes) {
+    var out = "";
+    for (var i = 0; i < bytes.length; i++) out += bytes[i].toString(16).padStart(2, "0");
+    return out;
+  }
+  function utf8(text) { return new TextEncoder().encode(text); }
+  function fromUtf8(bytes) { return new TextDecoder().decode(bytes); }
+
+  // ── canonical JSON + digests (must match packages/core/src/archive.ts) ──
+  function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+      var scalar = JSON.stringify(value);
+      return scalar === undefined ? "null" : scalar;
+    }
+    if (Array.isArray(value)) {
+      return "[" + value.map(canonicalJson).join(",") + "]";
+    }
+    var keys = Object.keys(value).filter(function (key) { return value[key] !== undefined; });
+    keys.sort();
+    var parts = keys.map(function (key) {
+      return JSON.stringify(key) + ":" + canonicalJson(value[key]);
+    });
+    return "{" + parts.join(",") + "}";
+  }
+  async function sha256Hex(text) {
+    var digest = await crypto.subtle.digest("SHA-256", utf8(text));
+    return "sha256:" + bytesToHex(new Uint8Array(digest));
+  }
+  function sectionCount(value) {
+    if (value === null || value === undefined) return 0;
+    return Array.isArray(value) ? value.length : 1;
+  }
+
+  // ── the three blob formats ──────────────────────────────────────────────
+  function splitBlob(blob, prefix, parts) {
+    var pieces = String(blob).split(".");
+    if (pieces.length !== parts + 1 || pieces[0] !== prefix) {
+      throw new Error("not a " + prefix + ". blob");
+    }
+    return pieces.slice(1);
+  }
+
+  /** pk1.<iterations>.<salt>.<iv>.<ciphertext> — PBKDF2-SHA256 + AES-256-GCM. */
+  async function decryptPrivateKeyBlob(passphrase, blob) {
+    var parts = splitBlob(blob, "pk1", 4);
+    var iterations = parseInt(parts[0], 10);
+    if (!Number.isFinite(iterations) || iterations < 1) throw new Error("bad iteration count");
+    var material = await crypto.subtle.importKey("raw", utf8(passphrase), "PBKDF2", false, [
+      "deriveKey",
+    ]);
+    var kek = await crypto.subtle.deriveKey(
+      { name: "PBKDF2", hash: "SHA-256", salt: b64uToBytes(parts[1]), iterations: iterations },
+      material,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+    var plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[2]) },
+      kek,
+      b64uToBytes(parts[3])
+    );
+    return fromUtf8(new Uint8Array(plaintext));
+  }
+
+  /** wd1.<ephemeral pub>.<hkdf salt>.<iv>.<ciphertext> — ECDH P-256 + HKDF + AES-GCM. */
+  async function unwrap(blob, privateKey) {
+    var parts = splitBlob(blob, "wd1", 4);
+    var ephemeral = await crypto.subtle.importKey(
+      "raw",
+      b64uToBytes(parts[0]),
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+    var shared = await crypto.subtle.deriveBits(
+      { name: "ECDH", public: ephemeral },
+      privateKey,
+      256
+    );
+    var hkdf = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+    var wrappingKey = await crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: b64uToBytes(parts[1]),
+        info: utf8("seekrit/wrap-dek/v1"),
+      },
+      hkdf,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+    var opened = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[2]) },
+      wrappingKey,
+      b64uToBytes(parts[3])
+    );
+    return new Uint8Array(opened);
+  }
+
+  /** sc1.<iv>.<ciphertext>, authenticated over "<environmentId>/<NAME>". */
+  async function decryptSecret(dek, blob, aad) {
+    var parts = splitBlob(blob, "sc1", 2);
+    var key = await crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, ["decrypt"]);
+    var plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[0]), additionalData: utf8(aad) },
+      key,
+      b64uToBytes(parts[1])
+    );
+    return fromUtf8(new Uint8Array(plaintext));
+  }
+
+  function importPrivateJwk(jwkText) {
+    return crypto.subtle.importKey(
+      "jwk",
+      JSON.parse(jwkText),
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+  }
+
+  /** skt_<id>_<pkcs8 base64url>: a service token carries its own private key. */
+  async function importToken(token) {
+    var match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(String(token).trim());
+    if (!match) throw new Error("not a valid seekrit service token");
+    var privateKey = await crypto.subtle.importKey(
+      "pkcs8",
+      b64uToBytes(match[2]),
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+    return { principalId: match[1], privateKey: privateKey };
+  }
+
+  // ── Shamir over GF(2^8) (must match packages/crypto/src/shamir.ts) ──────
+  function gfMul(a, b) {
+    var result = 0;
+    var x = a;
+    var y = b;
+    for (var i = 0; i < 8; i++) {
+      if (y & 1) result ^= x;
+      var high = x & 0x80;
+      x = (x << 1) & 0xff;
+      if (high) x ^= 0x1b;
+      y >>= 1;
+    }
+    return result & 0xff;
+  }
+  function gfPow(base, exponent) {
+    var result = 1;
+    for (var i = 0; i < exponent; i++) result = gfMul(result, base);
+    return result;
+  }
+  function gfInv(value) {
+    if (value === 0) throw new Error("no inverse for 0");
+    return gfPow(value, 254);
+  }
+  /**
+   * Lagrange interpolation at x=0 over the shares. Each share is
+   * [x, y0, y1, ...]; the secret is the vector of y-intercepts.
+   */
+  function combineShares(shares) {
+    if (shares.length === 0) throw new Error("no shares");
+    var length = shares[0].length - 1;
+    var out = new Uint8Array(length);
+    for (var byte = 0; byte < length; byte++) {
+      var acc = 0;
+      for (var i = 0; i < shares.length; i++) {
+        var xi = shares[i][0];
+        var yi = shares[i][byte + 1];
+        var numerator = 1;
+        var denominator = 1;
+        for (var j = 0; j < shares.length; j++) {
+          if (i === j) continue;
+          var xj = shares[j][0];
+          numerator = gfMul(numerator, xj);
+          denominator = gfMul(denominator, xi ^ xj);
+        }
+        acc ^= gfMul(yi, gfMul(numerator, gfInv(denominator)));
+      }
+      out[byte] = acc;
+    }
+    return out;
+  }
+
+  // ── verification ────────────────────────────────────────────────────────
+  async function verifyArchive(archive) {
+    var problems = [];
+    var truncated = [];
+    var data = archive.data || {};
+    var declared = {};
+    for (var i = 0; i < archive.manifest.sections.length; i++) {
+      var header = archive.manifest.sections[i];
+      declared[header.name] = true;
+      if (header.truncated) truncated.push(header.name);
+      if (!(header.name in data)) {
+        problems.push("section " + header.name + " is missing");
+        continue;
+      }
+      var value = data[header.name] === undefined ? null : data[header.name];
+      var digest = await sha256Hex(canonicalJson(value === undefined ? null : value));
+      if (digest !== header.digest || sectionCount(value) !== header.count) {
+        problems.push("section " + header.name + " does not match its digest");
+      }
+    }
+    Object.keys(data).forEach(function (key) {
+      if (!declared[key]) problems.push("section " + key + " is present but undeclared");
+    });
+    var manifestDigest = await sha256Hex(canonicalJson(archive.manifest.sections));
+    if (manifestDigest !== archive.manifest.digest) {
+      problems.push("the manifest digest does not cover its sections");
+    }
+
+    var signature = "unsigned";
+    var note = "";
+    if (archive.signature) {
+      try {
+        var publicKey = await crypto.subtle.importKey(
+          "raw",
+          hexToBytes(archive.signature.publicKey),
+          { name: "Ed25519" },
+          false,
+          ["verify"]
+        );
+        var valid = await crypto.subtle.verify(
+          { name: "Ed25519" },
+          publicKey,
+          hexToBytes(archive.signature.value),
+          utf8(canonicalJson(archive.manifest))
+        );
+        signature = valid ? "valid" : "invalid";
+        if (!valid) problems.push("the signature does not match the manifest");
+      } catch (err) {
+        signature = "unverifiable";
+        note = "this browser cannot check Ed25519 signatures";
+      }
+    }
+    return {
+      integrityOk: problems.length === 0,
+      problems: problems,
+      truncated: truncated,
+      signature: signature,
+      signatureNote: note,
+    };
+  }
+
+  // ── unlocking + decrypting ──────────────────────────────────────────────
+  async function unlockPassphrase(archive, passphrase) {
+    var keyMaterial = archive.data.keyMaterial;
+    if (!keyMaterial) {
+      throw new Error(
+        "this archive carries no key material - use a service token, a private key, or a custodian quorum"
+      );
+    }
+    var jwk = await decryptPrivateKeyBlob(passphrase, keyMaterial.encryptedPrivateKey);
+    return {
+      principalId: keyMaterial.principalId,
+      privateKey: await importPrivateJwk(jwk),
+      how: keyMaterial.principalType + " " + keyMaterial.principalId,
+    };
+  }
+
+  async function unlockJwk(jwkText) {
+    return {
+      principalId: null,
+      privateKey: await importPrivateJwk(jwkText.trim()),
+      how: "a private key",
+    };
+  }
+
+  async function unlockToken(token) {
+    var opened = await importToken(token);
+    return {
+      principalId: opened.principalId,
+      privateKey: opened.privateKey,
+      how: "service token " + opened.principalId,
+    };
+  }
+
+  /**
+   * Reconstruct the org recovery key from pasted share files. Accepts several
+   * JSON objects one after another, which is what you get from concatenating
+   * the output of "seekrit archive share".
+   */
+  async function unlockShares(archive, text) {
+    var shares = [];
+    var pattern = /"share"\\s*:\\s*"([0-9a-f]+)"/g;
+    var match = pattern.exec(text);
+    while (match !== null) {
+      shares.push(hexToBytes(match[1]));
+      match = pattern.exec(text);
+    }
+    if (shares.length === 0) throw new Error("no shares found in that text");
+    var jwk = fromUtf8(combineShares(shares));
+    return {
+      principalId: archive.manifest.org.id,
+      privateKey: await importPrivateJwk(jwk),
+      how: shares.length + " custodian shares",
+    };
+  }
+
+  function envLabel(archive, env) {
+    var i;
+    if (env.groupId) {
+      for (i = 0; i < archive.data.groups.length; i++) {
+        if (archive.data.groups[i].id === env.groupId) {
+          return archive.data.groups[i].slug + "@" + env.slug;
+        }
+      }
+      return env.groupId + "@" + env.slug;
+    }
+    for (i = 0; i < archive.data.applications.length; i++) {
+      if (archive.data.applications[i].id === env.applicationId) {
+        return archive.data.applications[i].slug + "/" + env.slug;
+      }
+    }
+    return env.applicationId + "/" + env.slug;
+  }
+
+  async function decryptAll(archive, key) {
+    var environments = [];
+    var skipped = [];
+    for (var e = 0; e < archive.data.environments.length; e++) {
+      var env = archive.data.environments[e];
+      var dek = null;
+      for (var g = 0; g < archive.data.environmentKeys.length; g++) {
+        var grant = archive.data.environmentKeys[g];
+        if (grant.environmentId !== env.id) continue;
+        if (key.principalId !== null && grant.principalId !== key.principalId) continue;
+        try {
+          dek = await unwrap(grant.wrappedDek, key.privateKey);
+          break;
+        } catch (err) {
+          // Not this key's grant. A principal with no grant here is normal.
+        }
+      }
+      if (dek === null) {
+        skipped.push(envLabel(archive, env));
+        continue;
+      }
+      var values = [];
+      var failures = [];
+      for (var s = 0; s < archive.data.secrets.length; s++) {
+        var secret = archive.data.secrets[s];
+        if (secret.environmentId !== env.id) continue;
+        try {
+          values.push({
+            name: secret.name,
+            value: await decryptSecret(
+              dek,
+              secret.ciphertext,
+              secret.environmentId + "/" + secret.name
+            ),
+          });
+        } catch (err) {
+          failures.push(secret.name);
+        }
+      }
+      values.sort(function (a, b) { return a.name < b.name ? -1 : a.name > b.name ? 1 : 0; });
+      environments.push({ label: envLabel(archive, env), values: values, failures: failures });
+    }
+    return { environments: environments, skipped: skipped };
+  }
+
+  /**
+   * dotenv quoting, mirroring packages/core/src/dotenv.ts — single quotes when
+   * they are safe (literal, so a JSON credential survives untouched), double
+   * quotes with written-out escapes otherwise.
+   */
+  function needsQuoting(value) {
+    return /[\\s"'\`$\\\\#]/.test(value) || value === "";
+  }
+  function dotenvQuote(value) {
+    if (!needsQuoting(value)) return value;
+    if (value.indexOf("'") === -1 && !/[\\n\\r]/.test(value)) return "'" + value + "'";
+    return (
+      '"' +
+      value
+        .replace(/\\\\/g, "\\\\\\\\")
+        .replace(/"/g, '\\\\"')
+        .replace(/\\n/g, "\\\\n")
+        .replace(/\\r/g, "\\\\r") +
+      '"'
+    );
+  }
+  function toDotenv(values) {
+    return values
+      .map(function (entry) { return entry.name + "=" + dotenvQuote(entry.value); })
+      .join("\\n");
+  }
+
+  var api = {
+    canonicalJson: canonicalJson,
+    verifyArchive: verifyArchive,
+    unlockPassphrase: unlockPassphrase,
+    unlockToken: unlockToken,
+    unlockJwk: unlockJwk,
+    unlockShares: unlockShares,
+    decryptAll: decryptAll,
+    toDotenv: toDotenv,
+  };
+  globalThis.seekritOffline = api;
+
+  // Everything above is pure and runs headless; the test suite drives it through
+  // globalThis.seekritOffline. Only what follows needs a document.
+  if (typeof document === "undefined") return;
+
+  var archive = null;
+  var el = function (id) { return document.getElementById(id); };
+  var text = function (value) { return document.createTextNode(String(value)); };
+
+  function node(tag, className, content) {
+    var element = document.createElement(tag);
+    if (className) element.className = className;
+    if (content !== undefined) element.appendChild(text(content));
+    return element;
+  }
+
+  function setStatus(message, kind) {
+    var status = el("status");
+    status.className = kind ? kind : "muted";
+    status.textContent = message;
+  }
+
+  async function loadArchive(fileText) {
+    try {
+      archive = JSON.parse(fileText);
+    } catch (err) {
+      archive = null;
+      setStatus("that file is not JSON", "bad");
+      return;
+    }
+    if (!archive || archive.format !== "seekrit-archive/v1" || !archive.manifest) {
+      archive = null;
+      el("manifest").className = "panel bad";
+      el("manifest").textContent = "not a seekrit-archive/v1 file";
+      return;
+    }
+    var check = await verifyArchive(archive);
+    var panel = el("manifest");
+    panel.className = "panel";
+    panel.textContent = "";
+
+    var list = document.createElement("dl");
+    list.className = "kv";
+    var rows = [
+      ["organization", archive.manifest.org.name + " (" + archive.manifest.org.slug + ")"],
+      ["created", archive.manifest.createdAt],
+      ["exported by", archive.manifest.requestedBy.label || archive.manifest.requestedBy.actorId],
+      ["producer", archive.manifest.producer.service + " / " + archive.manifest.producer.environment],
+      ["environments", String(sectionCount(archive.data.environments))],
+      ["secrets", String(sectionCount(archive.data.secrets))],
+      ["key grants", String(sectionCount(archive.data.environmentKeys))],
+      ["integrity", check.integrityOk ? "every section matches its digest" : "FAILED"],
+      [
+        "signature",
+        check.signature === "valid"
+          ? "valid, key " + archive.signature.keyId
+          : check.signature + (check.signatureNote ? " (" + check.signatureNote + ")" : ""),
+      ],
+    ];
+    rows.forEach(function (row) {
+      list.appendChild(node("dt", null, row[0]));
+      var value = node("dd", null, row[1]);
+      if (row[0] === "integrity") value.className = check.integrityOk ? "ok" : "bad";
+      if (row[0] === "signature") {
+        value.className =
+          check.signature === "valid" ? "ok" : check.signature === "invalid" ? "bad" : "warn";
+      }
+      list.appendChild(value);
+    });
+    panel.appendChild(list);
+
+    if (check.problems.length > 0) {
+      var problems = document.createElement("ul");
+      check.problems.forEach(function (problem) {
+        problems.appendChild(node("li", "bad", problem));
+      });
+      panel.appendChild(problems);
+    }
+    if (check.truncated.length > 0) {
+      panel.appendChild(
+        node("p", "warn", "truncated sections: " + check.truncated.join(", "))
+      );
+    }
+    panel.classList.remove("hidden");
+    el("step2").classList.remove("hidden");
+    el("key-owner").textContent = archive.data.keyMaterial
+      ? "unlocks " + archive.data.keyMaterial.principalType + " " + archive.data.keyMaterial.principalId
+      : "this archive carries no key material - use another method";
+    setStatus("");
+  }
+
+  function showResults(result, key) {
+    var container = el("results");
+    container.textContent = "";
+    container.appendChild(node("h2", null, "3 - plaintext"));
+    container.appendChild(
+      node("p", "muted", "unlocked with " + key.how + ". Values are as stored: a \${REF} reference is expanded when an app reads it, not here.")
+    );
+
+    result.environments.forEach(function (entry) {
+      var panel = node("div", "panel env");
+      panel.appendChild(node("strong", null, entry.label));
+      panel.appendChild(
+        node("span", "muted", "  " + entry.values.length + (entry.values.length === 1 ? " secret" : " secrets"))
+      );
+
+      var table = document.createElement("table");
+      var head = document.createElement("tr");
+      head.appendChild(node("th", null, "name"));
+      head.appendChild(node("th", null, "value"));
+      table.appendChild(head);
+      entry.values.forEach(function (item) {
+        var row = document.createElement("tr");
+        row.appendChild(node("td", null, item.name));
+        var cell = node("td", "value");
+        var masked = node("span", null, "•".repeat(Math.min(24, Math.max(6, item.value.length))));
+        var reveal = node("button", null, "reveal");
+        reveal.style.marginLeft = "0.5rem";
+        reveal.addEventListener("click", function () {
+          if (reveal.textContent === "reveal") {
+            masked.textContent = item.value;
+            reveal.textContent = "hide";
+          } else {
+            masked.textContent = "•".repeat(Math.min(24, Math.max(6, item.value.length)));
+            reveal.textContent = "reveal";
+          }
+        });
+        cell.appendChild(masked);
+        cell.appendChild(reveal);
+        row.appendChild(cell);
+        table.appendChild(row);
+      });
+      panel.appendChild(table);
+
+      if (entry.failures.length > 0) {
+        panel.appendChild(node("p", "bad", "failed to decrypt: " + entry.failures.join(", ")));
+      }
+
+      var area = document.createElement("textarea");
+      area.readOnly = true;
+      area.spellcheck = false;
+      area.className = "hidden";
+      area.value = toDotenv(entry.values);
+
+      var show = node("button", null, "show as .env");
+      show.addEventListener("click", function () {
+        area.classList.toggle("hidden");
+        show.textContent = area.classList.contains("hidden") ? "show as .env" : "hide .env";
+      });
+      var copy = node("button", null, "copy .env");
+      copy.addEventListener("click", function () {
+        area.classList.remove("hidden");
+        area.select();
+        try {
+          document.execCommand("copy");
+          copy.textContent = "copied";
+        } catch (err) {
+          copy.textContent = "select and copy";
+        }
+      });
+      var actions = node("div", "row");
+      actions.style.marginTop = "0.75rem";
+      actions.appendChild(show);
+      actions.appendChild(copy);
+      panel.appendChild(actions);
+      panel.appendChild(area);
+      container.appendChild(panel);
+    });
+
+    if (result.skipped.length > 0) {
+      container.appendChild(
+        node(
+          "p",
+          "muted",
+          "skipped " + result.skipped.length +
+            (result.skipped.length === 1 ? " environment" : " environments") +
+            " this key holds no grant on: " + result.skipped.join(", ")
+        )
+      );
+    }
+    if (result.environments.length === 0) {
+      container.appendChild(
+        node("p", "bad", "this key opens none of the environments in the archive")
+      );
+    }
+  }
+
+  el("file").addEventListener("change", function (event) {
+    var file = event.target.files && event.target.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = function () { loadArchive(String(reader.result)); };
+    reader.readAsText(file);
+  });
+
+  var drop = el("drop");
+  ["dragenter", "dragover"].forEach(function (name) {
+    drop.addEventListener(name, function (event) {
+      event.preventDefault();
+      drop.classList.add("over");
+    });
+  });
+  ["dragleave", "drop"].forEach(function (name) {
+    drop.addEventListener(name, function (event) {
+      event.preventDefault();
+      drop.classList.remove("over");
+    });
+  });
+  drop.addEventListener("drop", function (event) {
+    var file = event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = function () { loadArchive(String(reader.result)); };
+    reader.readAsText(file);
+  });
+
+  el("method").addEventListener("change", function () {
+    var method = el("method").value;
+    ["passphrase", "token", "jwk", "shares"].forEach(function (name) {
+      el("field-" + name).classList.toggle("hidden", name !== method);
+    });
+  });
+
+  el("decrypt").addEventListener("click", async function () {
+    if (!archive) {
+      setStatus("load an archive first", "warn");
+      return;
+    }
+    setStatus("working...");
+    try {
+      var method = el("method").value;
+      var key;
+      if (method === "passphrase") key = await unlockPassphrase(archive, el("passphrase").value);
+      else if (method === "token") key = await unlockToken(el("token").value);
+      else if (method === "jwk") key = await unlockJwk(el("jwk").value);
+      else key = await unlockShares(archive, el("shares").value);
+      var result = await decryptAll(archive, key);
+      showResults(result, key);
+      setStatus(
+        "decrypted " + result.environments.length +
+          (result.environments.length === 1 ? " environment" : " environments"),
+        "ok"
+      );
+    } catch (err) {
+      setStatus(err && err.message ? err.message : "could not decrypt", "bad");
+    }
+  });
+})();
+<\/script>
+</body>
+</html>
+`;
+//#endregion
+//#region src/format.ts
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/archive.ts
+/**
+* Break-glass archives (docs/break-glass-export.md).
+*
+* `create` is the only subcommand that talks to the API. `info`, `verify`,
+* `share`, `decrypt`, and `decryptor` are **strictly offline**: they never build
+* a client, never read credentials, and never touch the network, because the day
+* you need them is the day seekrit may not be there. Keep it that way — a
+* `buildContext()` in any of them silently breaks the promise the feature makes.
+*/
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** "1 secret" / "2 secrets" — these lines are read by people, not parsed. */
+function count(n, noun) {
+	return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+function readArchiveFile(path) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (err) {
+		return fail(`cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		return parseArchive(text);
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
+	}
+}
+function writeOut(path, contents) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, contents, { mode: 384 });
+}
+/** One line per problem, for a verification that failed. */
+function verificationProblems(result) {
+	const problems = [];
+	if (!result.manifestDigestOk) problems.push("the manifest's digest does not cover its sections");
+	for (const name of result.badSections) problems.push(`section "${name}" does not match its digest`);
+	for (const name of result.missingSections) problems.push(`section "${name}" is missing`);
+	for (const name of result.undeclaredSections) problems.push(`section "${name}" is present but undeclared`);
+	if (result.signature === "invalid") problems.push(`signature is invalid${result.signatureNote ? ` (${result.signatureNote})` : ""}`);
+	if (result.signature === "unsigned") problems.push("archive is unsigned — integrity is checkable, provenance is not");
+	if (result.signature === "unverifiable") problems.push(`signature could not be checked: ${result.signatureNote ?? "unknown reason"}`);
+	return problems;
+}
+function printVerification(result) {
+	printFields([
+		["integrity", result.badSections.length === 0 && result.manifestDigestOk ? "ok" : "FAILED"],
+		["signature", result.signature],
+		["truncated", result.truncatedSections.length > 0 ? result.truncatedSections.join(", ") : "no"]
+	]);
+	const problems = verificationProblems(result);
+	if (problems.length > 0) {
+		section("problems");
+		for (const problem of problems) console.log(`- ${problem}`);
+	}
+}
+/** `app/env`, or `group@env` for a group-owned environment. */
+function envLabel(archive, env) {
+	if (env.groupId) return `${archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId}@${env.slug}`;
+	return `${archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId}/${env.slug}`;
+}
+/** Filesystem path for an environment's output file, mirroring its label. */
+function envPath(archive, env, extension) {
+	if (env.groupId) return join("groups", archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId, `${env.slug}.${extension}`);
+	return join("apps", archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId ?? "unknown", `${env.slug}.${extension}`);
+}
+/**
+* Recover a private key to open the archive with, from (in order) a service
+* token, a private-key JWK file, a custodian quorum, or the archive's own
+* `keyMaterial` plus a passphrase.
+*/
+async function resolveDecryptKey(archive, options) {
+	if (options.token) {
+		if (!isServiceToken(options.token)) fail("--token expects a `skt_…` service token");
+		const { tokenId, privateKey } = await parseServiceToken(options.token);
+		return {
+			privateKey,
+			principalId: tokenId,
+			how: `service token ${tokenId}`
+		};
+	}
+	if (options.keyFile) {
+		let jwk;
+		try {
+			jwk = readFileSync(options.keyFile, "utf8").trim();
+		} catch (err) {
+			fail(`cannot read ${options.keyFile}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return {
+			privateKey: await importPrivateKey(jwk).catch(() => fail(`${options.keyFile} is not a P-256 private key JWK`)),
+			principalId: null,
+			how: `private key from ${options.keyFile}`
+		};
+	}
+	if (options.share && options.share.length > 0) {
+		const shares = options.share.map((path) => readShareFile(path));
+		return {
+			privateKey: await combineRecoveryShares(shares).catch((err) => fail(`could not reconstruct the recovery key from ${count(shares.length, "share")}: ${err instanceof Error ? err.message : String(err)}`)),
+			principalId: archive.manifest.org.id,
+			how: count(shares.length, "custodian share")
+		};
+	}
+	const keyMaterial = archive.data.keyMaterial;
+	if (!keyMaterial) fail("this archive carries no key material — decrypt it with --token, --key-file, or a custodian quorum (--share)");
+	return {
+		privateKey: await importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden(`Passphrase for ${keyMaterial.principalId}: `), keyMaterial.encryptedPrivateKey).catch((err) => fail(err instanceof Error ? err.message : String(err)))),
+		principalId: keyMaterial.principalId,
+		how: `${keyMaterial.principalType} ${keyMaterial.principalId} (passphrase)`
+	};
+}
+const SHARE_FORMAT = "seekrit-recovery-share/v1";
+function readShareFile(path) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		return fail(`cannot read share ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (parsed.format !== SHARE_FORMAT || typeof parsed.share !== "string") return fail(`${path} is not a ${SHARE_FORMAT} file`);
+	try {
+		return hexToBytes(parsed.share);
+	} catch {
+		return fail(`${path} holds a malformed share`);
+	}
+}
+/**
+* Decrypt what one key can reach. Environments the key holds no grant on are
+* *skipped*, not failed: an archive spans the whole org and no single principal
+* is expected to open all of it.
+*/
+async function decryptArchive(archive, key, filter) {
+	const environments = [];
+	const skipped = [];
+	const failures = [];
+	for (const env of archive.data.environments) {
+		const label = envLabel(archive, env);
+		if (filter && label !== filter && env.slug !== filter && env.id !== filter) continue;
+		const grants = archive.data.environmentKeys.filter((grant) => grant.environmentId === env.id && (key.principalId === null || grant.principalId === key.principalId));
+		let dek = null;
+		for (const grant of grants) try {
+			dek = await unwrapDek(grant.wrappedDek, key.privateKey);
+			break;
+		} catch {}
+		if (!dek) {
+			skipped.push(label);
+			continue;
+		}
+		const values = {};
+		for (const secret of archive.data.secrets.filter((s) => s.environmentId === env.id)) try {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(secret.environmentId, secret.name));
+		} catch (err) {
+			failures.push(`${label} ${secret.name}: ${err instanceof Error ? err.message : "failed"}`);
+		}
+		environments.push({
+			env,
+			label,
+			values
+		});
+	}
+	return {
+		environments,
+		skipped,
+		failures
+	};
+}
+function registerArchiveCommands(program) {
+	const archive = program.command("archive").description("export the whole org as one signed file, and open it offline");
+	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const input = {
+			includeVersions: options.versions,
+			includeAudit: options.audit
+		};
+		if (options.auditLimit !== void 0) input.auditLimit = options.auditLimit;
+		const result = await ctx.client.exportArchive(ref.id, input);
+		if (options.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const stamp = result.manifest.createdAt.slice(0, 10);
+		const path = options.out ?? `seekrit-${result.manifest.org.slug}-${stamp}.json`;
+		writeOut(path, JSON.stringify(result, null, 2));
+		const check = await verifyArchive(result);
+		console.error(`wrote ${path}`);
+		printTable(result.manifest.sections.filter((s) => s.count > 0), [
+			{
+				header: "section",
+				value: (s) => s.name
+			},
+			{
+				header: "rows",
+				value: (s) => String(s.count)
+			},
+			{
+				header: "truncated",
+				value: (s) => s.truncated ? "yes" : ""
+			}
+		], "the archive is empty");
+		console.error(check.ok ? `verified: digests ok, signed by key ${result.signature?.keyId}` : `WARNING: ${verificationProblems(check).join("; ")}`);
+		console.error("keep it with `seekrit archive decryptor` — together they open without seekrit, offline.");
+	});
+	archive.command("info <file>").description("summarize an archive (offline)").option("--json", "print the manifest as JSON").action(async (file, options) => {
+		const parsed = readArchiveFile(file);
+		const check = await verifyArchive(parsed);
+		emit(options, {
+			manifest: parsed.manifest,
+			verification: check
+		}, () => {
+			printFields([
+				["archive", parsed.manifest.archiveId],
+				["created", parsed.manifest.createdAt],
+				["org", `${parsed.manifest.org.name} (${parsed.manifest.org.slug})`],
+				["producer", `${parsed.manifest.producer.service} / ${parsed.manifest.producer.environment}`],
+				["format", parsed.manifest.producer.formatVersion],
+				["requested by", parsed.manifest.requestedBy.label ?? parsed.manifest.requestedBy.actorId],
+				["key material", parsed.data.keyMaterial ? parsed.data.keyMaterial.principalId : "none"],
+				["signature", parsed.signature ? `${parsed.signature.algorithm} / ${parsed.signature.keyId}` : "unsigned"]
+			]);
+			section("sections");
+			printTable(parsed.manifest.sections, [
+				{
+					header: "section",
+					value: (s) => s.name
+				},
+				{
+					header: "rows",
+					value: (s) => String(s.count)
+				},
+				{
+					header: "truncated",
+					value: (s) => s.truncated ? "yes" : ""
+				}
+			], "none");
+			section("verification");
+			printVerification(check);
+		});
+	});
+	archive.command("verify <file>").description("check an archive's digests and signature (offline); exits non-zero if it fails").option("--key-id <id>", "require this signing key id (see /.well-known/seekrit-export-signing-key)").option("--skip-signature", "check digests only").option("--json", "print the verification result as JSON").action(async (file, options) => {
+		const check = await verifyArchive(readArchiveFile(file), {
+			expectKeyId: options.keyId,
+			skipSignature: options.skipSignature
+		});
+		const integrityOk = check.badSections.length === 0 && check.missingSections.length === 0 && check.undeclaredSections.length === 0 && check.manifestDigestOk;
+		const passed = options.skipSignature ? integrityOk : check.ok;
+		emit(options, check, () => printVerification(check));
+		if (!passed) process.exit(1);
+	});
+	archive.command("share <file>").description("unwrap your own recovery share from an archive, for an offline quorum (offline)").option("-o, --out <file>", "write the share here (default: stdout)").option("--token <skt_…>", "unwrap with a service token instead of a passphrase").option("--key-file <path>", "unwrap with a private key JWK file").action(async (file, options) => {
+		const parsed = readArchiveFile(file);
+		if (parsed.data.recoveryShares.length === 0) fail("this archive holds no recovery shares — customer-controlled recovery is not set up");
+		const key = await resolveDecryptKey(parsed, {
+			token: options.token,
+			keyFile: options.keyFile
+		});
+		const candidates = parsed.data.recoveryShares.filter((share) => key.principalId === null || share.custodianId === key.principalId);
+		for (const candidate of candidates) try {
+			const bytes = await unwrapRecoveryShare(candidate.wrappedShare, key.privateKey);
+			const payload = {
+				format: SHARE_FORMAT,
+				org: {
+					id: parsed.manifest.org.id,
+					slug: parsed.manifest.org.slug
+				},
+				custodianType: candidate.custodianType,
+				custodianId: candidate.custodianId,
+				shareIndex: candidate.shareIndex,
+				share: bytesToHex(bytes),
+				note: "Sensitive: a threshold of these shares reconstructs the org recovery key, which opens every environment. Destroy this file after the ceremony."
+			};
+			const text = JSON.stringify(payload, null, 2);
+			if (options.out) {
+				writeOut(options.out, text);
+				console.error(`wrote share ${candidate.shareIndex} to ${options.out}`);
+			} else console.log(text);
+			console.error(`combine ${parsed.data.recoveryConfig?.threshold ?? "M"} shares with: seekrit archive decrypt ${file} --share … --share …`);
+			return;
+		} catch {}
+		fail("none of the recovery shares in this archive unwrap with that key");
+	});
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("--yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
+		if (![
+			"dotenv",
+			"json",
+			"shell"
+		].includes(options.format)) fail(`unknown --format "${options.format}" (dotenv | json | shell)`);
+		const parsed = readArchiveFile(file);
+		const check = await verifyArchive(parsed);
+		if (check.badSections.length > 0 || !check.manifestDigestOk) fail(`refusing to decrypt: ${verificationProblems(check).join("; ")} — run \`seekrit archive verify ${file}\``);
+		if (check.signature !== "valid") console.error(`warning: ${verificationProblems(check).join("; ")}`);
+		if (options.stdout) await confirmDestructive(options.yes, "This prints decrypted secret values to stdout, where they may land in scrollback or CI logs. Continue?");
+		const key = await resolveDecryptKey(parsed, options);
+		const result = await decryptArchive(parsed, key, options.env);
+		console.error(`unlocked with ${key.how}`);
+		const extension = options.format === "json" ? "json" : options.format === "shell" ? "sh" : "env";
+		let written = 0;
+		for (const entry of result.environments) {
+			const body = formatSecrets(entry.values, options.format);
+			if (options.out) {
+				const path = join(options.out, envPath(parsed, entry.env, extension));
+				writeOut(path, `${body}\n`);
+				written += 1;
+				console.error(`${path}  (${count(Object.keys(entry.values).length, "secret")})`);
+			} else {
+				console.log(`# ${entry.label}`);
+				console.log(body);
+				console.log("");
+			}
+		}
+		if (result.skipped.length > 0) console.error(`skipped ${count(result.skipped.length, "environment")} this key holds no grant on: ${result.skipped.join(", ")}`);
+		for (const failure of result.failures) console.error(`failed: ${failure}`);
+		if (options.out) console.error(`wrote ${count(written, "file")} under ${options.out}`);
+		if (result.environments.length === 0) fail("nothing decrypted — this key opens none of the environments in the archive");
+		console.error(`note: values are as stored — \`\${REF}\` references are expanded at read time, not here.`);
+	});
+	archive.command("decryptor").description("write the standalone offline decryptor (a single HTML file, no install, no network)").option("-o, --out <file>", "where to write it", "seekrit-decrypt.html").action((options) => {
+		writeOut(options.out, OFFLINE_DECRYPTOR_HTML);
+		console.error(`wrote ${options.out}`);
+		console.error("open it in any browser — it declares a Content-Security-Policy of `default-src 'none'`, so it cannot reach the network.");
+	});
+}
+//#endregion
 //#region src/audit.ts
 /** The API's per-page ceiling (`auditQuerySchema.limit`). */
 const MAX_PAGE = 200;
@@ -6423,19 +9154,6 @@ function message(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-//#region src/format.ts
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function formatSecrets(values, format) {
-	const names = Object.keys(values).sort();
-	switch (format) {
-		case "json": return JSON.stringify(values, names, 2);
-		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
-	}
-}
-//#endregion
 //#region src/gcp.ts
 /**
 * `seekrit gcp` — temporary GCP credentials via IAM Credentials
@@ -7533,7 +10251,7 @@ function collect$2(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.8.0";
+const PROXY_VERSION = "0.10.0";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -7569,7 +10287,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.8.0";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -7999,6 +10717,27 @@ function renderProxyConfig(plan) {
 		out.push(`max_ttl = ${tomlString(plan.control.maxTtl)}`);
 		out.push("");
 	}
+	if (plan.tasks) {
+		out.push("# Honour tasks dispatched through the API (`seekrit agents dispatch`): a run");
+		out.push("# presents its skd_… token in the same header a local ticket uses, and this");
+		out.push("# proxy asks the API what it authorizes. Opt-in, because it makes authorizing");
+		out.push("# a new run depend on reaching seekrit — a refused or unreachable check denies");
+		out.push("# the request rather than admitting it.");
+		out.push("#");
+		out.push("# cache_ttl bounds how long a revoked run keeps working. Short on purpose.");
+		out.push("[tasks]");
+		out.push(`cache_ttl = ${tomlString(plan.tasks.cacheTtl)}`);
+		out.push("");
+	}
+	if (plan.activity) {
+		out.push("# Report aggregate decisions back, so `seekrit agents review` can compare this");
+		out.push("# policy against what the agent actually does. Counts only: hosts, methods,");
+		out.push("# secret *names*, and which rule decided — never a request path, never a value.");
+		out.push("# Full per-request detail stays in your own OTLP collector.");
+		out.push("[activity]");
+		out.push(`flush_interval = ${tomlString(plan.activity.flushInterval)}`);
+		out.push("");
+	}
 	if (plan.envHints.length > 0) {
 		out.push("# ---------------------------------------------------------------------------");
 		out.push("# Point the workload at the proxy (these go in its environment, not here):");
@@ -8077,6 +10816,8 @@ function planFromPresets(presets, options) {
 		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
 		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
 		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
 		envHints,
 		notes
 	};
@@ -8142,6 +10883,8 @@ function planFromPolicy(args, options) {
 		caKey: options.caKey,
 		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
 		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
 		envHints,
 		notes
 	};
@@ -8300,7 +11043,9 @@ function planOptions(options) {
 			listen: options.control,
 			ttl: "1h",
 			maxTtl: "12h"
-		} } : {}
+		} } : {},
+		...options.tasks || options.tasksCacheTtl ? { tasks: { cacheTtl: duration(options.tasksCacheTtl, "--tasks-cache-ttl") ?? "30s" } } : {},
+		...options.activity || options.activityInterval ? { activity: { flushInterval: duration(options.activityInterval, "--activity-interval") ?? "60s" } } : {}
 	};
 }
 /**
@@ -8419,7 +11164,7 @@ async function buildPlan(options) {
 }
 /** Add the generation flags to a command, so `init` and `run` stay in step. */
 function withGenerateOptions(cmd) {
-	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets");
+	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets").option("--tasks", "add a [tasks] block so this proxy honours runs dispatched with `seekrit agents dispatch`").option("--tasks-cache-ttl <dur>", "how long an introspected task is reused (implies --tasks)").option("--activity", "add an [activity] block so this proxy reports aggregate decisions for `seekrit agents review`").option("--activity-interval <dur>", "how often counts are flushed (implies --activity)");
 }
 function registerProxyCommands(program) {
 	const proxy = program.command("proxy").description("run and configure the agent egress proxy (`seekrit proxy --help`)");
@@ -8486,10 +11231,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.8.0")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.10.0")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.8.0";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -8510,7 +11255,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.8.0`,
+			image: options.image ?? `seekritdev/proxy:0.10.0`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -8668,17 +11413,6 @@ function collect$1(value, acc) {
 * Rotated values are never printed here. Read them like any other secret
 * (`seekrit secrets get NAME`), which decrypts locally.
 */
-/** Parse a duration like `30m`, `24h`, `90d`, or a bare seconds count. */
-function parseDurationSeconds(input, flag) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
-}
 function formatInterval(seconds) {
 	if (seconds % 86400 === 0) return `${seconds / 86400}d`;
 	if (seconds % 3600 === 0) return `${seconds / 3600}h`;
@@ -10512,6 +13246,7 @@ registerMysqlCommands(program);
 registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerProxyCommands(program);
+registerAgentCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
@@ -10525,6 +13260,7 @@ program.command("mcp").description("run an MCP server over stdio so AI agents ca
 });
 registerAuditCommands(program);
 registerAccountCommands(program);
+registerArchiveCommands(program);
 registerLogSinkCommands(program);
 registerSyncCommands(program);
 registerBillingCommands(program);