@seekrit/cli 0.44.0 → 0.45.0

package/dist/index.js

@@ -562,6 +562,247 @@ z.object({
 z.object({ 
 /** The presented token. In the body, never a URL — it is a credential. */
 token: z.string().trim().min(8).max(512) });
+//#endregion
+//#region ../../packages/core/src/archive.ts
+/**
+* The **break-glass archive** format: one signed JSON file holding everything
+* seekrit stores for an org, in the form seekrit stores it — ciphertext stays
+* ciphertext. Its whole purpose is to be openable on a machine that has never
+* heard of seekrit, so the format is plain JSON, self-describing, and versioned
+* by name (`seekrit-archive/v1`); a breaking change ships a new format string
+* rather than mutating this one, exactly like the `sc1.`/`wd1.` blob prefixes.
+*
+* Three parts:
+*  - `manifest` — what this archive is, and a SHA-256 digest per section.
+*  - `signature` — Ed25519 over the canonical manifest, or null when the
+*    producing deployment has no signing key configured.
+*  - `data` — the sections themselves.
+*
+* Integrity fields (`digest`, `signature.value`, `publicKey`, `keyId`) are
+* lowercase hex. Every blob *inside* `data` keeps its native base64url form, so
+* the one encoding rule to remember is "the archive's own bookkeeping is hex,
+* seekrit's blobs are unchanged".
+*
+* See docs/break-glass-export.md for what is deliberately excluded and why.
+*/
+const ARCHIVE_FORMAT = "seekrit-archive/v1";
+/**
+* Section order is part of the format: `manifest.digest` covers the section
+* headers in this order, so a verifier that re-serializes must produce the same
+* list. Appending a section is backwards-compatible; reordering is not.
+*/
+const ARCHIVE_SECTIONS = [
+	"organization",
+	"users",
+	"memberships",
+	"invites",
+	"applications",
+	"groups",
+	"environments",
+	"environmentGroups",
+	"environmentKeys",
+	"secrets",
+	"secretVersions",
+	"serviceTokens",
+	"m2mClients",
+	"kmsKeys",
+	"kmsKeyVersions",
+	"kmsKeyGrants",
+	"recoveryConfig",
+	"recoveryShares",
+	"rotations",
+	"syncConnections",
+	"syncBindings",
+	"leaseTargets",
+	"agentIdentities",
+	"agentPolicies",
+	"auditLog",
+	"keyMaterial"
+];
+/**
+* Deterministic JSON: object keys sorted recursively, no whitespace. A digest
+* has to be reproducible by a verifier that parsed the file and re-serialized
+* it, and parsing loses key order — so key order must not matter.
+*
+* Arrays keep their order (it is data). Every numeric field in the schema is an
+* integer, so JSON's float formatting never comes into it. `undefined` members
+* are dropped, matching `JSON.stringify`.
+*/
+function canonicalJson(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function bytesToHex(bytes) {
+	let out = "";
+	for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+	return out;
+}
+/** Throws on odd length or a non-hex character — a malformed field, not a mismatch. */
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) throw new Error("hex string has odd length");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) {
+		const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) throw new Error("hex string contains a non-hex character");
+		out[i] = byte;
+	}
+	return out;
+}
+/** `sha256:<hex>` over the UTF-8 bytes of `text`. */
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return `sha256:${bytesToHex(new Uint8Array(digest))}`;
+}
+/** Number a section header reports: array length, or 0/1 for the singleton sections. */
+function sectionCount(value) {
+	if (value === null || value === void 0) return 0;
+	return Array.isArray(value) ? value.length : 1;
+}
+/** Digest one section's value. Absent singletons hash as `null`, not as omitted. */
+function sectionDigest(value) {
+	return sha256Hex(canonicalJson(value ?? null));
+}
+/**
+* Digest over the section-header list. Covers each section's digest, count, and
+* truncation flag, so trimming rows *and* fixing up their digest still breaks
+* the manifest.
+*/
+function manifestDigest(sections) {
+	return sha256Hex(canonicalJson(sections));
+}
+/** The exact bytes the signature covers: the canonical manifest, digest included. */
+function signingPayload(manifest) {
+	return new TextEncoder().encode(canonicalJson(manifest));
+}
+/**
+* Verify an archive's digests and signature. Pure and offline — WebCrypto only,
+* no I/O, so it runs identically in the CLI, a browser page, and a test.
+*
+* Reports every problem it finds rather than throwing on the first, because the
+* useful answer to "my archive won't verify" is *which part*.
+*/
+async function verifyArchive(archive, options = {}) {
+	const declared = new Map(archive.manifest.sections.map((s) => [s.name, s]));
+	const badSections = [];
+	const missingSections = [];
+	const truncatedSections = [];
+	const data = archive.data ?? {};
+	for (const header of archive.manifest.sections) {
+		if (header.truncated) truncatedSections.push(header.name);
+		if (!(header.name in data)) {
+			missingSections.push(header.name);
+			continue;
+		}
+		const value = data[header.name];
+		if (sectionCount(value) !== header.count || await sectionDigest(value) !== header.digest) badSections.push(header.name);
+	}
+	const undeclaredSections = Object.keys(data).filter((key) => !declared.has(key));
+	const manifestDigestOk = await manifestDigest(archive.manifest.sections) === archive.manifest.digest;
+	let signature = "unsigned";
+	let signatureNote;
+	if (options.skipSignature) {
+		signature = "unverifiable";
+		signatureNote = "signature checking was skipped";
+	} else if (archive.signature) if (options.expectKeyId && options.expectKeyId !== archive.signature.keyId) {
+		signature = "invalid";
+		signatureNote = `signed by key ${archive.signature.keyId}, expected ${options.expectKeyId}`;
+	} else try {
+		signature = await verifySignature(archive.manifest, archive.signature) ? "valid" : "invalid";
+	} catch (err) {
+		signature = "unverifiable";
+		signatureNote = err instanceof Error ? err.message : String(err);
+	}
+	return {
+		ok: badSections.length === 0 && missingSections.length === 0 && undeclaredSections.length === 0 && manifestDigestOk && signature === "valid",
+		badSections,
+		undeclaredSections,
+		missingSections,
+		manifestDigestOk,
+		signature,
+		signatureNote,
+		truncatedSections
+	};
+}
+/**
+* Ed25519 verify over the canonical manifest. Plain WebCrypto: raw public-key
+* import plus `verify` is supported in Workers, Node ≥18, and current browsers,
+* so no verifier anywhere needs a dependency. Throws (rather than returning
+* false) when the runtime has no Ed25519 at all, so "old browser" is reported
+* as unverifiable instead of as a bad signature.
+*/
+async function verifySignature(manifest, signature) {
+	if (signature.algorithm !== "ed25519") throw new Error(`unsupported signature algorithm: ${signature.algorithm}`);
+	const publicKey = await crypto.subtle.importKey("raw", hexToBytes(signature.publicKey), { name: "Ed25519" }, false, ["verify"]);
+	return crypto.subtle.verify({ name: "Ed25519" }, publicKey, hexToBytes(signature.value), signingPayload(manifest));
+}
+const sectionHeaderSchema = z.object({
+	name: z.enum(ARCHIVE_SECTIONS),
+	count: z.number().int().min(0),
+	truncated: z.boolean(),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const manifestSchema = z.object({
+	archiveId: z.string().min(1),
+	createdAt: z.string().min(1),
+	org: z.object({
+		id: z.string(),
+		slug: z.string(),
+		name: z.string()
+	}),
+	producer: z.object({
+		service: z.string(),
+		environment: z.string(),
+		formatVersion: z.string()
+	}),
+	requestedBy: z.object({
+		actorType: z.string(),
+		actorId: z.string(),
+		label: z.string().nullable()
+	}),
+	options: z.object({
+		includeVersions: z.boolean(),
+		includeAudit: z.boolean(),
+		auditLimit: z.number().int().min(0)
+	}),
+	sections: z.array(sectionHeaderSchema),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const signatureSchema = z.object({
+	algorithm: z.literal("ed25519"),
+	publicKey: z.string().regex(/^[0-9a-f]{64}$/),
+	keyId: z.string().regex(/^[0-9a-f]{16}$/),
+	value: z.string().regex(/^[0-9a-f]{128}$/)
+});
+/**
+* Envelope schema. `data` is validated only as an object: a v1 verifier must
+* still be able to check and decrypt an archive from a later producer that
+* appended a section, and unknown sections are caught by
+* `verifyArchive`'s undeclared/declared cross-check rather than by rejecting
+* the file outright.
+*/
+const archiveSchema = z.object({
+	format: z.literal(ARCHIVE_FORMAT),
+	manifest: manifestSchema,
+	signature: signatureSchema.nullable(),
+	data: z.record(z.string(), z.unknown())
+});
+/** Parse untrusted JSON text into an archive. Throws with a readable message. */
+function parseArchive(text) {
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		throw new Error("not valid JSON — is this a seekrit archive?");
+	}
+	const parsed = archiveSchema.safeParse(json);
+	if (!parsed.success) {
+		const first = parsed.error.issues[0];
+		const where = first?.path.join(".") || "archive";
+		throw new Error(`not a ${ARCHIVE_FORMAT} archive: ${where}: ${first?.message ?? "invalid"}`);
+	}
+	return parsed.data;
+}
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1663,6 +1904,7 @@ const AUDIT_ACTIONS = [
 	"org.member_invited",
 	"org.invite_revoked",
 	"org.mfa_policy_changed",
+	"org.exported",
 	"user.keys_updated",
 	"user.notification_prefs_updated",
 	"app.created",
@@ -1848,6 +2090,13 @@ const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	/** Include the full append-only ciphertext history of every secret. */
+	includeVersions: z.boolean().optional(),
+	includeAudit: z.boolean().optional(),
+	/** Newest audit rows to keep. Exceeding the server cap is a 400, not a silent trim. */
+	auditLimit: z.number().int().min(0).optional()
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -4624,7 +4873,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.44.0";
+var version = "0.45.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -5207,6 +5456,17 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	/**
+	* Export the org as one signed archive: every row seekrit holds for it, with
+	* ciphertext still ciphertext (docs/break-glass-export.md).
+	*
+	* The archive comes back inline rather than as a job handle, and it can be
+	* megabytes — buffer it to a file rather than holding several copies. Requires
+	* admin; deliberately not entitlement-gated.
+	*/
+	exportArchive(orgId, input = {}) {
+		return this.request("POST", `/v1/orgs/${orgId}/export`, input);
+	}
 	getLogSink(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
 	}
@@ -6513,7 +6773,7 @@ function registerPolicyCommands(policy) {
 //#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
+function collect$7(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -6581,7 +6841,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$6, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$6, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -6800,7 +7060,7 @@ function registerKmsCommands(program) {
 //#endregion
 //#region src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$5(value, acc = []) {
+function collect$6(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -6897,7 +7157,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -6915,7 +7175,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7195,6 +7455,1179 @@ function registerAppCommands(program) {
 	});
 }
 //#endregion
+//#region src/decryptor.ts
+/**
+* The standalone offline decryptor: one self-contained HTML file, written out by
+* `seekrit archive decryptor`, that opens a break-glass archive in any browser
+* with no install, no network, and no seekrit.
+*
+* Why a duplicate of the decrypt path instead of a bundle of `@seekrit/crypto`:
+* the artifact has to be a single file a customer can store next to their
+* archives for years and open from `file://`, which rules out a module graph and
+* a build step. So it is a second implementation — pinned, like every other
+* second implementation in this repo (the four SDKs, `crates/seekrit-core`), by a
+* test that runs *this* script against ciphertext produced by the real library:
+* `test/decryptor.test.ts`. If you change a blob format, that test fails here
+* too, which is the point.
+*
+* Two rules for editing the embedded script:
+*  - **No backticks and no `${`** anywhere inside it — it lives in a template
+*    literal. Use string concatenation.
+*  - **No network of any kind.** The page declares
+*    `Content-Security-Policy: default-src 'none'`, which is the property that
+*    makes it safe to type a passphrase into. Anything that needs a fetch does
+*    not belong here.
+*/
+const OFFLINE_DECRYPTOR_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<!--
+  The whole security argument for this page, in one header: with default-src
+  'none' the browser refuses every outbound request the page could make, so the
+  passphrase you type and the plaintext it produces cannot leave this machine.
+  'unsafe-inline' covers the page's own inline script and styles; there is no
+  connect-src, no img-src, no form-action.
+-->
+<meta http-equiv="Content-Security-Policy"
+      content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+<title>seekrit — offline archive decryptor</title>
+<style>
+  :root {
+    color-scheme: dark light;
+    --bg: #0b0c0e; --fg: #e7e9ea; --dim: #9aa0a6; --line: #23262b;
+    --panel: #101215; --accent: #7dd3a0; --warn: #f0b76b; --bad: #f08a8a;
+  }
+  @media (prefers-color-scheme: light) {
+    :root {
+      --bg: #fbfbfa; --fg: #14161a; --dim: #5f6673; --line: #e3e5e8;
+      --panel: #ffffff; --accent: #1a7f4b; --warn: #9a6413; --bad: #b23b3b;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; padding: 2rem 1.25rem 4rem; background: var(--bg); color: var(--fg);
+    font: 14px/1.55 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  }
+  main { max-width: 62rem; margin: 0 auto; }
+  h1 { font-size: 1.1rem; letter-spacing: 0.02em; margin: 0 0 0.25rem; }
+  h2 { font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.12em;
+       color: var(--dim); margin: 2rem 0 0.75rem; font-weight: 500; }
+  p { margin: 0.4rem 0; color: var(--dim); }
+  .panel { border: 1px solid var(--line); background: var(--panel); border-radius: 6px;
+           padding: 1rem 1.1rem; }
+  .drop { border: 1px dashed var(--line); border-radius: 6px; padding: 2rem 1rem;
+          text-align: center; color: var(--dim); }
+  .drop.over { border-color: var(--accent); color: var(--fg); }
+  label { display: block; color: var(--dim); margin: 0.75rem 0 0.25rem; }
+  input, select, textarea, button {
+    font: inherit; color: var(--fg); background: var(--bg);
+    border: 1px solid var(--line); border-radius: 4px; padding: 0.5rem 0.6rem;
+  }
+  input, select, textarea { width: 100%; }
+  textarea { min-height: 5rem; }
+  button { cursor: pointer; background: var(--panel); }
+  button:hover { border-color: var(--accent); }
+  button.primary { border-color: var(--accent); color: var(--accent); }
+  .row { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; }
+  table { width: 100%; border-collapse: collapse; margin-top: 0.5rem; }
+  th, td { text-align: left; padding: 0.35rem 0.5rem; border-bottom: 1px solid var(--line);
+           vertical-align: top; word-break: break-all; }
+  th { color: var(--dim); font-weight: 500; font-size: 0.85rem; }
+  .kv { display: grid; grid-template-columns: 12rem 1fr; gap: 0.15rem 1rem; }
+  .kv dt { color: var(--dim); }
+  .kv dd { margin: 0; word-break: break-all; }
+  .ok { color: var(--accent); } .warn { color: var(--warn); } .bad { color: var(--bad); }
+  .hidden { display: none; }
+  .env { margin-bottom: 1.5rem; }
+  .muted { color: var(--dim); font-size: 0.85rem; }
+  pre { white-space: pre-wrap; word-break: break-all; margin: 0.5rem 0 0; }
+  .value { font-family: inherit; }
+  ul { margin: 0.3rem 0 0; padding-left: 1.2rem; color: var(--dim); }
+</style>
+</head>
+<body>
+<main>
+  <h1>seekrit — offline archive decryptor</h1>
+  <p>
+    Opens a <code>seekrit-archive/v1</code> file with your own key. This page has
+    no network access at all (see the CSP in its source) &mdash; your passphrase
+    and your secrets never leave this machine. Nothing is uploaded, and nothing
+    needs to be installed.
+  </p>
+
+  <h2>1 &middot; the archive</h2>
+  <div class="drop panel" id="drop">
+    <input type="file" id="file" accept=".json,application/json" style="width:auto">
+    <p class="muted">or drop the file here</p>
+  </div>
+  <div id="manifest" class="panel hidden" style="margin-top:0.75rem"></div>
+
+  <div id="step2" class="hidden">
+    <h2>2 &middot; your key</h2>
+    <div class="panel">
+      <label for="method">how you hold it</label>
+      <select id="method">
+        <option value="passphrase">passphrase (unlocks the key inside the archive)</option>
+        <option value="token">service token (skt_&hellip;)</option>
+        <option value="jwk">private key (JWK)</option>
+        <option value="shares">custodian shares (recovery quorum)</option>
+      </select>
+
+      <div id="field-passphrase">
+        <label for="passphrase">passphrase</label>
+        <input type="password" id="passphrase" autocomplete="off" spellcheck="false">
+        <p class="muted" id="key-owner"></p>
+      </div>
+      <div id="field-token" class="hidden">
+        <label for="token">service token</label>
+        <input type="password" id="token" autocomplete="off" spellcheck="false"
+               placeholder="skt_...">
+      </div>
+      <div id="field-jwk" class="hidden">
+        <label for="jwk">private key JWK</label>
+        <textarea id="jwk" spellcheck="false" placeholder='{"kty":"EC","crv":"P-256",...}'></textarea>
+      </div>
+      <div id="field-shares" class="hidden">
+        <label for="shares">custodian shares</label>
+        <textarea id="shares" spellcheck="false"
+          placeholder="paste the contents of each share file from 'seekrit archive share', one after another"></textarea>
+        <p class="muted">
+          Reconstructs the org recovery key from a quorum, which opens every
+          environment &mdash; for when the key-holder is gone.
+        </p>
+      </div>
+
+      <div class="row" style="margin-top:1rem">
+        <button class="primary" id="decrypt">decrypt</button>
+        <span id="status" class="muted"></span>
+      </div>
+    </div>
+  </div>
+
+  <div id="results"></div>
+</main>
+<script>
+(function () {
+  "use strict";
+
+  // ── encoding ────────────────────────────────────────────────────────────
+  function b64uToBytes(text) {
+    var base64 = text.replace(/-/g, "+").replace(/_/g, "/");
+    var binary = atob(base64);
+    var out = new Uint8Array(binary.length);
+    for (var i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  }
+  function hexToBytes(hex) {
+    if (hex.length % 2 !== 0) throw new Error("malformed hex");
+    var out = new Uint8Array(hex.length / 2);
+    for (var i = 0; i < out.length; i++) {
+      var byte = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      if (Number.isNaN(byte)) throw new Error("malformed hex");
+      out[i] = byte;
+    }
+    return out;
+  }
+  function bytesToHex(bytes) {
+    var out = "";
+    for (var i = 0; i < bytes.length; i++) out += bytes[i].toString(16).padStart(2, "0");
+    return out;
+  }
+  function utf8(text) { return new TextEncoder().encode(text); }
+  function fromUtf8(bytes) { return new TextDecoder().decode(bytes); }
+
+  // ── canonical JSON + digests (must match packages/core/src/archive.ts) ──
+  function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+      var scalar = JSON.stringify(value);
+      return scalar === undefined ? "null" : scalar;
+    }
+    if (Array.isArray(value)) {
+      return "[" + value.map(canonicalJson).join(",") + "]";
+    }
+    var keys = Object.keys(value).filter(function (key) { return value[key] !== undefined; });
+    keys.sort();
+    var parts = keys.map(function (key) {
+      return JSON.stringify(key) + ":" + canonicalJson(value[key]);
+    });
+    return "{" + parts.join(",") + "}";
+  }
+  async function sha256Hex(text) {
+    var digest = await crypto.subtle.digest("SHA-256", utf8(text));
+    return "sha256:" + bytesToHex(new Uint8Array(digest));
+  }
+  function sectionCount(value) {
+    if (value === null || value === undefined) return 0;
+    return Array.isArray(value) ? value.length : 1;
+  }
+
+  // ── the three blob formats ──────────────────────────────────────────────
+  function splitBlob(blob, prefix, parts) {
+    var pieces = String(blob).split(".");
+    if (pieces.length !== parts + 1 || pieces[0] !== prefix) {
+      throw new Error("not a " + prefix + ". blob");
+    }
+    return pieces.slice(1);
+  }
+
+  /** pk1.<iterations>.<salt>.<iv>.<ciphertext> — PBKDF2-SHA256 + AES-256-GCM. */
+  async function decryptPrivateKeyBlob(passphrase, blob) {
+    var parts = splitBlob(blob, "pk1", 4);
+    var iterations = parseInt(parts[0], 10);
+    if (!Number.isFinite(iterations) || iterations < 1) throw new Error("bad iteration count");
+    var material = await crypto.subtle.importKey("raw", utf8(passphrase), "PBKDF2", false, [
+      "deriveKey",
+    ]);
+    var kek = await crypto.subtle.deriveKey(
+      { name: "PBKDF2", hash: "SHA-256", salt: b64uToBytes(parts[1]), iterations: iterations },
+      material,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+    var plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[2]) },
+      kek,
+      b64uToBytes(parts[3])
+    );
+    return fromUtf8(new Uint8Array(plaintext));
+  }
+
+  /** wd1.<ephemeral pub>.<hkdf salt>.<iv>.<ciphertext> — ECDH P-256 + HKDF + AES-GCM. */
+  async function unwrap(blob, privateKey) {
+    var parts = splitBlob(blob, "wd1", 4);
+    var ephemeral = await crypto.subtle.importKey(
+      "raw",
+      b64uToBytes(parts[0]),
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+    var shared = await crypto.subtle.deriveBits(
+      { name: "ECDH", public: ephemeral },
+      privateKey,
+      256
+    );
+    var hkdf = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+    var wrappingKey = await crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: b64uToBytes(parts[1]),
+        info: utf8("seekrit/wrap-dek/v1"),
+      },
+      hkdf,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+    var opened = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[2]) },
+      wrappingKey,
+      b64uToBytes(parts[3])
+    );
+    return new Uint8Array(opened);
+  }
+
+  /** sc1.<iv>.<ciphertext>, authenticated over "<environmentId>/<NAME>". */
+  async function decryptSecret(dek, blob, aad) {
+    var parts = splitBlob(blob, "sc1", 2);
+    var key = await crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, ["decrypt"]);
+    var plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[0]), additionalData: utf8(aad) },
+      key,
+      b64uToBytes(parts[1])
+    );
+    return fromUtf8(new Uint8Array(plaintext));
+  }
+
+  function importPrivateJwk(jwkText) {
+    return crypto.subtle.importKey(
+      "jwk",
+      JSON.parse(jwkText),
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+  }
+
+  /** skt_<id>_<pkcs8 base64url>: a service token carries its own private key. */
+  async function importToken(token) {
+    var match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(String(token).trim());
+    if (!match) throw new Error("not a valid seekrit service token");
+    var privateKey = await crypto.subtle.importKey(
+      "pkcs8",
+      b64uToBytes(match[2]),
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+    return { principalId: match[1], privateKey: privateKey };
+  }
+
+  // ── Shamir over GF(2^8) (must match packages/crypto/src/shamir.ts) ──────
+  function gfMul(a, b) {
+    var result = 0;
+    var x = a;
+    var y = b;
+    for (var i = 0; i < 8; i++) {
+      if (y & 1) result ^= x;
+      var high = x & 0x80;
+      x = (x << 1) & 0xff;
+      if (high) x ^= 0x1b;
+      y >>= 1;
+    }
+    return result & 0xff;
+  }
+  function gfPow(base, exponent) {
+    var result = 1;
+    for (var i = 0; i < exponent; i++) result = gfMul(result, base);
+    return result;
+  }
+  function gfInv(value) {
+    if (value === 0) throw new Error("no inverse for 0");
+    return gfPow(value, 254);
+  }
+  /**
+   * Lagrange interpolation at x=0 over the shares. Each share is
+   * [x, y0, y1, ...]; the secret is the vector of y-intercepts.
+   */
+  function combineShares(shares) {
+    if (shares.length === 0) throw new Error("no shares");
+    var length = shares[0].length - 1;
+    var out = new Uint8Array(length);
+    for (var byte = 0; byte < length; byte++) {
+      var acc = 0;
+      for (var i = 0; i < shares.length; i++) {
+        var xi = shares[i][0];
+        var yi = shares[i][byte + 1];
+        var numerator = 1;
+        var denominator = 1;
+        for (var j = 0; j < shares.length; j++) {
+          if (i === j) continue;
+          var xj = shares[j][0];
+          numerator = gfMul(numerator, xj);
+          denominator = gfMul(denominator, xi ^ xj);
+        }
+        acc ^= gfMul(yi, gfMul(numerator, gfInv(denominator)));
+      }
+      out[byte] = acc;
+    }
+    return out;
+  }
+
+  // ── verification ────────────────────────────────────────────────────────
+  async function verifyArchive(archive) {
+    var problems = [];
+    var truncated = [];
+    var data = archive.data || {};
+    var declared = {};
+    for (var i = 0; i < archive.manifest.sections.length; i++) {
+      var header = archive.manifest.sections[i];
+      declared[header.name] = true;
+      if (header.truncated) truncated.push(header.name);
+      if (!(header.name in data)) {
+        problems.push("section " + header.name + " is missing");
+        continue;
+      }
+      var value = data[header.name] === undefined ? null : data[header.name];
+      var digest = await sha256Hex(canonicalJson(value === undefined ? null : value));
+      if (digest !== header.digest || sectionCount(value) !== header.count) {
+        problems.push("section " + header.name + " does not match its digest");
+      }
+    }
+    Object.keys(data).forEach(function (key) {
+      if (!declared[key]) problems.push("section " + key + " is present but undeclared");
+    });
+    var manifestDigest = await sha256Hex(canonicalJson(archive.manifest.sections));
+    if (manifestDigest !== archive.manifest.digest) {
+      problems.push("the manifest digest does not cover its sections");
+    }
+
+    var signature = "unsigned";
+    var note = "";
+    if (archive.signature) {
+      try {
+        var publicKey = await crypto.subtle.importKey(
+          "raw",
+          hexToBytes(archive.signature.publicKey),
+          { name: "Ed25519" },
+          false,
+          ["verify"]
+        );
+        var valid = await crypto.subtle.verify(
+          { name: "Ed25519" },
+          publicKey,
+          hexToBytes(archive.signature.value),
+          utf8(canonicalJson(archive.manifest))
+        );
+        signature = valid ? "valid" : "invalid";
+        if (!valid) problems.push("the signature does not match the manifest");
+      } catch (err) {
+        signature = "unverifiable";
+        note = "this browser cannot check Ed25519 signatures";
+      }
+    }
+    return {
+      integrityOk: problems.length === 0,
+      problems: problems,
+      truncated: truncated,
+      signature: signature,
+      signatureNote: note,
+    };
+  }
+
+  // ── unlocking + decrypting ──────────────────────────────────────────────
+  async function unlockPassphrase(archive, passphrase) {
+    var keyMaterial = archive.data.keyMaterial;
+    if (!keyMaterial) {
+      throw new Error(
+        "this archive carries no key material - use a service token, a private key, or a custodian quorum"
+      );
+    }
+    var jwk = await decryptPrivateKeyBlob(passphrase, keyMaterial.encryptedPrivateKey);
+    return {
+      principalId: keyMaterial.principalId,
+      privateKey: await importPrivateJwk(jwk),
+      how: keyMaterial.principalType + " " + keyMaterial.principalId,
+    };
+  }
+
+  async function unlockJwk(jwkText) {
+    return {
+      principalId: null,
+      privateKey: await importPrivateJwk(jwkText.trim()),
+      how: "a private key",
+    };
+  }
+
+  async function unlockToken(token) {
+    var opened = await importToken(token);
+    return {
+      principalId: opened.principalId,
+      privateKey: opened.privateKey,
+      how: "service token " + opened.principalId,
+    };
+  }
+
+  /**
+   * Reconstruct the org recovery key from pasted share files. Accepts several
+   * JSON objects one after another, which is what you get from concatenating
+   * the output of "seekrit archive share".
+   */
+  async function unlockShares(archive, text) {
+    var shares = [];
+    var pattern = /"share"\\s*:\\s*"([0-9a-f]+)"/g;
+    var match = pattern.exec(text);
+    while (match !== null) {
+      shares.push(hexToBytes(match[1]));
+      match = pattern.exec(text);
+    }
+    if (shares.length === 0) throw new Error("no shares found in that text");
+    var jwk = fromUtf8(combineShares(shares));
+    return {
+      principalId: archive.manifest.org.id,
+      privateKey: await importPrivateJwk(jwk),
+      how: shares.length + " custodian shares",
+    };
+  }
+
+  function envLabel(archive, env) {
+    var i;
+    if (env.groupId) {
+      for (i = 0; i < archive.data.groups.length; i++) {
+        if (archive.data.groups[i].id === env.groupId) {
+          return archive.data.groups[i].slug + "@" + env.slug;
+        }
+      }
+      return env.groupId + "@" + env.slug;
+    }
+    for (i = 0; i < archive.data.applications.length; i++) {
+      if (archive.data.applications[i].id === env.applicationId) {
+        return archive.data.applications[i].slug + "/" + env.slug;
+      }
+    }
+    return env.applicationId + "/" + env.slug;
+  }
+
+  async function decryptAll(archive, key) {
+    var environments = [];
+    var skipped = [];
+    for (var e = 0; e < archive.data.environments.length; e++) {
+      var env = archive.data.environments[e];
+      var dek = null;
+      for (var g = 0; g < archive.data.environmentKeys.length; g++) {
+        var grant = archive.data.environmentKeys[g];
+        if (grant.environmentId !== env.id) continue;
+        if (key.principalId !== null && grant.principalId !== key.principalId) continue;
+        try {
+          dek = await unwrap(grant.wrappedDek, key.privateKey);
+          break;
+        } catch (err) {
+          // Not this key's grant. A principal with no grant here is normal.
+        }
+      }
+      if (dek === null) {
+        skipped.push(envLabel(archive, env));
+        continue;
+      }
+      var values = [];
+      var failures = [];
+      for (var s = 0; s < archive.data.secrets.length; s++) {
+        var secret = archive.data.secrets[s];
+        if (secret.environmentId !== env.id) continue;
+        try {
+          values.push({
+            name: secret.name,
+            value: await decryptSecret(
+              dek,
+              secret.ciphertext,
+              secret.environmentId + "/" + secret.name
+            ),
+          });
+        } catch (err) {
+          failures.push(secret.name);
+        }
+      }
+      values.sort(function (a, b) { return a.name < b.name ? -1 : a.name > b.name ? 1 : 0; });
+      environments.push({ label: envLabel(archive, env), values: values, failures: failures });
+    }
+    return { environments: environments, skipped: skipped };
+  }
+
+  /**
+   * dotenv quoting, mirroring packages/core/src/dotenv.ts — single quotes when
+   * they are safe (literal, so a JSON credential survives untouched), double
+   * quotes with written-out escapes otherwise.
+   */
+  function needsQuoting(value) {
+    return /[\\s"'\`$\\\\#]/.test(value) || value === "";
+  }
+  function dotenvQuote(value) {
+    if (!needsQuoting(value)) return value;
+    if (value.indexOf("'") === -1 && !/[\\n\\r]/.test(value)) return "'" + value + "'";
+    return (
+      '"' +
+      value
+        .replace(/\\\\/g, "\\\\\\\\")
+        .replace(/"/g, '\\\\"')
+        .replace(/\\n/g, "\\\\n")
+        .replace(/\\r/g, "\\\\r") +
+      '"'
+    );
+  }
+  function toDotenv(values) {
+    return values
+      .map(function (entry) { return entry.name + "=" + dotenvQuote(entry.value); })
+      .join("\\n");
+  }
+
+  var api = {
+    canonicalJson: canonicalJson,
+    verifyArchive: verifyArchive,
+    unlockPassphrase: unlockPassphrase,
+    unlockToken: unlockToken,
+    unlockJwk: unlockJwk,
+    unlockShares: unlockShares,
+    decryptAll: decryptAll,
+    toDotenv: toDotenv,
+  };
+  globalThis.seekritOffline = api;
+
+  // Everything above is pure and runs headless; the test suite drives it through
+  // globalThis.seekritOffline. Only what follows needs a document.
+  if (typeof document === "undefined") return;
+
+  var archive = null;
+  var el = function (id) { return document.getElementById(id); };
+  var text = function (value) { return document.createTextNode(String(value)); };
+
+  function node(tag, className, content) {
+    var element = document.createElement(tag);
+    if (className) element.className = className;
+    if (content !== undefined) element.appendChild(text(content));
+    return element;
+  }
+
+  function setStatus(message, kind) {
+    var status = el("status");
+    status.className = kind ? kind : "muted";
+    status.textContent = message;
+  }
+
+  async function loadArchive(fileText) {
+    try {
+      archive = JSON.parse(fileText);
+    } catch (err) {
+      archive = null;
+      setStatus("that file is not JSON", "bad");
+      return;
+    }
+    if (!archive || archive.format !== "seekrit-archive/v1" || !archive.manifest) {
+      archive = null;
+      el("manifest").className = "panel bad";
+      el("manifest").textContent = "not a seekrit-archive/v1 file";
+      return;
+    }
+    var check = await verifyArchive(archive);
+    var panel = el("manifest");
+    panel.className = "panel";
+    panel.textContent = "";
+
+    var list = document.createElement("dl");
+    list.className = "kv";
+    var rows = [
+      ["organization", archive.manifest.org.name + " (" + archive.manifest.org.slug + ")"],
+      ["created", archive.manifest.createdAt],
+      ["exported by", archive.manifest.requestedBy.label || archive.manifest.requestedBy.actorId],
+      ["producer", archive.manifest.producer.service + " / " + archive.manifest.producer.environment],
+      ["environments", String(sectionCount(archive.data.environments))],
+      ["secrets", String(sectionCount(archive.data.secrets))],
+      ["key grants", String(sectionCount(archive.data.environmentKeys))],
+      ["integrity", check.integrityOk ? "every section matches its digest" : "FAILED"],
+      [
+        "signature",
+        check.signature === "valid"
+          ? "valid, key " + archive.signature.keyId
+          : check.signature + (check.signatureNote ? " (" + check.signatureNote + ")" : ""),
+      ],
+    ];
+    rows.forEach(function (row) {
+      list.appendChild(node("dt", null, row[0]));
+      var value = node("dd", null, row[1]);
+      if (row[0] === "integrity") value.className = check.integrityOk ? "ok" : "bad";
+      if (row[0] === "signature") {
+        value.className =
+          check.signature === "valid" ? "ok" : check.signature === "invalid" ? "bad" : "warn";
+      }
+      list.appendChild(value);
+    });
+    panel.appendChild(list);
+
+    if (check.problems.length > 0) {
+      var problems = document.createElement("ul");
+      check.problems.forEach(function (problem) {
+        problems.appendChild(node("li", "bad", problem));
+      });
+      panel.appendChild(problems);
+    }
+    if (check.truncated.length > 0) {
+      panel.appendChild(
+        node("p", "warn", "truncated sections: " + check.truncated.join(", "))
+      );
+    }
+    panel.classList.remove("hidden");
+    el("step2").classList.remove("hidden");
+    el("key-owner").textContent = archive.data.keyMaterial
+      ? "unlocks " + archive.data.keyMaterial.principalType + " " + archive.data.keyMaterial.principalId
+      : "this archive carries no key material - use another method";
+    setStatus("");
+  }
+
+  function showResults(result, key) {
+    var container = el("results");
+    container.textContent = "";
+    container.appendChild(node("h2", null, "3 - plaintext"));
+    container.appendChild(
+      node("p", "muted", "unlocked with " + key.how + ". Values are as stored: a \${REF} reference is expanded when an app reads it, not here.")
+    );
+
+    result.environments.forEach(function (entry) {
+      var panel = node("div", "panel env");
+      panel.appendChild(node("strong", null, entry.label));
+      panel.appendChild(
+        node("span", "muted", "  " + entry.values.length + (entry.values.length === 1 ? " secret" : " secrets"))
+      );
+
+      var table = document.createElement("table");
+      var head = document.createElement("tr");
+      head.appendChild(node("th", null, "name"));
+      head.appendChild(node("th", null, "value"));
+      table.appendChild(head);
+      entry.values.forEach(function (item) {
+        var row = document.createElement("tr");
+        row.appendChild(node("td", null, item.name));
+        var cell = node("td", "value");
+        var masked = node("span", null, "•".repeat(Math.min(24, Math.max(6, item.value.length))));
+        var reveal = node("button", null, "reveal");
+        reveal.style.marginLeft = "0.5rem";
+        reveal.addEventListener("click", function () {
+          if (reveal.textContent === "reveal") {
+            masked.textContent = item.value;
+            reveal.textContent = "hide";
+          } else {
+            masked.textContent = "•".repeat(Math.min(24, Math.max(6, item.value.length)));
+            reveal.textContent = "reveal";
+          }
+        });
+        cell.appendChild(masked);
+        cell.appendChild(reveal);
+        row.appendChild(cell);
+        table.appendChild(row);
+      });
+      panel.appendChild(table);
+
+      if (entry.failures.length > 0) {
+        panel.appendChild(node("p", "bad", "failed to decrypt: " + entry.failures.join(", ")));
+      }
+
+      var area = document.createElement("textarea");
+      area.readOnly = true;
+      area.spellcheck = false;
+      area.className = "hidden";
+      area.value = toDotenv(entry.values);
+
+      var show = node("button", null, "show as .env");
+      show.addEventListener("click", function () {
+        area.classList.toggle("hidden");
+        show.textContent = area.classList.contains("hidden") ? "show as .env" : "hide .env";
+      });
+      var copy = node("button", null, "copy .env");
+      copy.addEventListener("click", function () {
+        area.classList.remove("hidden");
+        area.select();
+        try {
+          document.execCommand("copy");
+          copy.textContent = "copied";
+        } catch (err) {
+          copy.textContent = "select and copy";
+        }
+      });
+      var actions = node("div", "row");
+      actions.style.marginTop = "0.75rem";
+      actions.appendChild(show);
+      actions.appendChild(copy);
+      panel.appendChild(actions);
+      panel.appendChild(area);
+      container.appendChild(panel);
+    });
+
+    if (result.skipped.length > 0) {
+      container.appendChild(
+        node(
+          "p",
+          "muted",
+          "skipped " + result.skipped.length +
+            (result.skipped.length === 1 ? " environment" : " environments") +
+            " this key holds no grant on: " + result.skipped.join(", ")
+        )
+      );
+    }
+    if (result.environments.length === 0) {
+      container.appendChild(
+        node("p", "bad", "this key opens none of the environments in the archive")
+      );
+    }
+  }
+
+  el("file").addEventListener("change", function (event) {
+    var file = event.target.files && event.target.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = function () { loadArchive(String(reader.result)); };
+    reader.readAsText(file);
+  });
+
+  var drop = el("drop");
+  ["dragenter", "dragover"].forEach(function (name) {
+    drop.addEventListener(name, function (event) {
+      event.preventDefault();
+      drop.classList.add("over");
+    });
+  });
+  ["dragleave", "drop"].forEach(function (name) {
+    drop.addEventListener(name, function (event) {
+      event.preventDefault();
+      drop.classList.remove("over");
+    });
+  });
+  drop.addEventListener("drop", function (event) {
+    var file = event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = function () { loadArchive(String(reader.result)); };
+    reader.readAsText(file);
+  });
+
+  el("method").addEventListener("change", function () {
+    var method = el("method").value;
+    ["passphrase", "token", "jwk", "shares"].forEach(function (name) {
+      el("field-" + name).classList.toggle("hidden", name !== method);
+    });
+  });
+
+  el("decrypt").addEventListener("click", async function () {
+    if (!archive) {
+      setStatus("load an archive first", "warn");
+      return;
+    }
+    setStatus("working...");
+    try {
+      var method = el("method").value;
+      var key;
+      if (method === "passphrase") key = await unlockPassphrase(archive, el("passphrase").value);
+      else if (method === "token") key = await unlockToken(el("token").value);
+      else if (method === "jwk") key = await unlockJwk(el("jwk").value);
+      else key = await unlockShares(archive, el("shares").value);
+      var result = await decryptAll(archive, key);
+      showResults(result, key);
+      setStatus(
+        "decrypted " + result.environments.length +
+          (result.environments.length === 1 ? " environment" : " environments"),
+        "ok"
+      );
+    } catch (err) {
+      setStatus(err && err.message ? err.message : "could not decrypt", "bad");
+    }
+  });
+})();
+<\/script>
+</body>
+</html>
+`;
+//#endregion
+//#region src/format.ts
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/archive.ts
+/**
+* Break-glass archives (docs/break-glass-export.md).
+*
+* `create` is the only subcommand that talks to the API. `info`, `verify`,
+* `share`, `decrypt`, and `decryptor` are **strictly offline**: they never build
+* a client, never read credentials, and never touch the network, because the day
+* you need them is the day seekrit may not be there. Keep it that way — a
+* `buildContext()` in any of them silently breaks the promise the feature makes.
+*/
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** "1 secret" / "2 secrets" — these lines are read by people, not parsed. */
+function count(n, noun) {
+	return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+function readArchiveFile(path) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (err) {
+		return fail(`cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		return parseArchive(text);
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
+	}
+}
+function writeOut(path, contents) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, contents, { mode: 384 });
+}
+/** One line per problem, for a verification that failed. */
+function verificationProblems(result) {
+	const problems = [];
+	if (!result.manifestDigestOk) problems.push("the manifest's digest does not cover its sections");
+	for (const name of result.badSections) problems.push(`section "${name}" does not match its digest`);
+	for (const name of result.missingSections) problems.push(`section "${name}" is missing`);
+	for (const name of result.undeclaredSections) problems.push(`section "${name}" is present but undeclared`);
+	if (result.signature === "invalid") problems.push(`signature is invalid${result.signatureNote ? ` (${result.signatureNote})` : ""}`);
+	if (result.signature === "unsigned") problems.push("archive is unsigned — integrity is checkable, provenance is not");
+	if (result.signature === "unverifiable") problems.push(`signature could not be checked: ${result.signatureNote ?? "unknown reason"}`);
+	return problems;
+}
+function printVerification(result) {
+	printFields([
+		["integrity", result.badSections.length === 0 && result.manifestDigestOk ? "ok" : "FAILED"],
+		["signature", result.signature],
+		["truncated", result.truncatedSections.length > 0 ? result.truncatedSections.join(", ") : "no"]
+	]);
+	const problems = verificationProblems(result);
+	if (problems.length > 0) {
+		section("problems");
+		for (const problem of problems) console.log(`- ${problem}`);
+	}
+}
+/** `app/env`, or `group@env` for a group-owned environment. */
+function envLabel(archive, env) {
+	if (env.groupId) return `${archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId}@${env.slug}`;
+	return `${archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId}/${env.slug}`;
+}
+/** Filesystem path for an environment's output file, mirroring its label. */
+function envPath(archive, env, extension) {
+	if (env.groupId) return join("groups", archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId, `${env.slug}.${extension}`);
+	return join("apps", archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId ?? "unknown", `${env.slug}.${extension}`);
+}
+/**
+* Recover a private key to open the archive with, from (in order) a service
+* token, a private-key JWK file, a custodian quorum, or the archive's own
+* `keyMaterial` plus a passphrase.
+*/
+async function resolveDecryptKey(archive, options) {
+	if (options.token) {
+		if (!isServiceToken(options.token)) fail("--token expects a `skt_…` service token");
+		const { tokenId, privateKey } = await parseServiceToken(options.token);
+		return {
+			privateKey,
+			principalId: tokenId,
+			how: `service token ${tokenId}`
+		};
+	}
+	if (options.keyFile) {
+		let jwk;
+		try {
+			jwk = readFileSync(options.keyFile, "utf8").trim();
+		} catch (err) {
+			fail(`cannot read ${options.keyFile}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return {
+			privateKey: await importPrivateKey(jwk).catch(() => fail(`${options.keyFile} is not a P-256 private key JWK`)),
+			principalId: null,
+			how: `private key from ${options.keyFile}`
+		};
+	}
+	if (options.share && options.share.length > 0) {
+		const shares = options.share.map((path) => readShareFile(path));
+		return {
+			privateKey: await combineRecoveryShares(shares).catch((err) => fail(`could not reconstruct the recovery key from ${count(shares.length, "share")}: ${err instanceof Error ? err.message : String(err)}`)),
+			principalId: archive.manifest.org.id,
+			how: count(shares.length, "custodian share")
+		};
+	}
+	const keyMaterial = archive.data.keyMaterial;
+	if (!keyMaterial) fail("this archive carries no key material — decrypt it with --token, --key-file, or a custodian quorum (--share)");
+	return {
+		privateKey: await importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden(`Passphrase for ${keyMaterial.principalId}: `), keyMaterial.encryptedPrivateKey).catch((err) => fail(err instanceof Error ? err.message : String(err)))),
+		principalId: keyMaterial.principalId,
+		how: `${keyMaterial.principalType} ${keyMaterial.principalId} (passphrase)`
+	};
+}
+const SHARE_FORMAT = "seekrit-recovery-share/v1";
+function readShareFile(path) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		return fail(`cannot read share ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (parsed.format !== SHARE_FORMAT || typeof parsed.share !== "string") return fail(`${path} is not a ${SHARE_FORMAT} file`);
+	try {
+		return hexToBytes(parsed.share);
+	} catch {
+		return fail(`${path} holds a malformed share`);
+	}
+}
+/**
+* Decrypt what one key can reach. Environments the key holds no grant on are
+* *skipped*, not failed: an archive spans the whole org and no single principal
+* is expected to open all of it.
+*/
+async function decryptArchive(archive, key, filter) {
+	const environments = [];
+	const skipped = [];
+	const failures = [];
+	for (const env of archive.data.environments) {
+		const label = envLabel(archive, env);
+		if (filter && label !== filter && env.slug !== filter && env.id !== filter) continue;
+		const grants = archive.data.environmentKeys.filter((grant) => grant.environmentId === env.id && (key.principalId === null || grant.principalId === key.principalId));
+		let dek = null;
+		for (const grant of grants) try {
+			dek = await unwrapDek(grant.wrappedDek, key.privateKey);
+			break;
+		} catch {}
+		if (!dek) {
+			skipped.push(label);
+			continue;
+		}
+		const values = {};
+		for (const secret of archive.data.secrets.filter((s) => s.environmentId === env.id)) try {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(secret.environmentId, secret.name));
+		} catch (err) {
+			failures.push(`${label} ${secret.name}: ${err instanceof Error ? err.message : "failed"}`);
+		}
+		environments.push({
+			env,
+			label,
+			values
+		});
+	}
+	return {
+		environments,
+		skipped,
+		failures
+	};
+}
+function registerArchiveCommands(program) {
+	const archive = program.command("archive").description("export the whole org as one signed file, and open it offline");
+	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const input = {
+			includeVersions: options.versions,
+			includeAudit: options.audit
+		};
+		if (options.auditLimit !== void 0) input.auditLimit = options.auditLimit;
+		const result = await ctx.client.exportArchive(ref.id, input);
+		if (options.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const stamp = result.manifest.createdAt.slice(0, 10);
+		const path = options.out ?? `seekrit-${result.manifest.org.slug}-${stamp}.json`;
+		writeOut(path, JSON.stringify(result, null, 2));
+		const check = await verifyArchive(result);
+		console.error(`wrote ${path}`);
+		printTable(result.manifest.sections.filter((s) => s.count > 0), [
+			{
+				header: "section",
+				value: (s) => s.name
+			},
+			{
+				header: "rows",
+				value: (s) => String(s.count)
+			},
+			{
+				header: "truncated",
+				value: (s) => s.truncated ? "yes" : ""
+			}
+		], "the archive is empty");
+		console.error(check.ok ? `verified: digests ok, signed by key ${result.signature?.keyId}` : `WARNING: ${verificationProblems(check).join("; ")}`);
+		console.error("keep it with `seekrit archive decryptor` — together they open without seekrit, offline.");
+	});
+	archive.command("info <file>").description("summarize an archive (offline)").option("--json", "print the manifest as JSON").action(async (file, options) => {
+		const parsed = readArchiveFile(file);
+		const check = await verifyArchive(parsed);
+		emit(options, {
+			manifest: parsed.manifest,
+			verification: check
+		}, () => {
+			printFields([
+				["archive", parsed.manifest.archiveId],
+				["created", parsed.manifest.createdAt],
+				["org", `${parsed.manifest.org.name} (${parsed.manifest.org.slug})`],
+				["producer", `${parsed.manifest.producer.service} / ${parsed.manifest.producer.environment}`],
+				["format", parsed.manifest.producer.formatVersion],
+				["requested by", parsed.manifest.requestedBy.label ?? parsed.manifest.requestedBy.actorId],
+				["key material", parsed.data.keyMaterial ? parsed.data.keyMaterial.principalId : "none"],
+				["signature", parsed.signature ? `${parsed.signature.algorithm} / ${parsed.signature.keyId}` : "unsigned"]
+			]);
+			section("sections");
+			printTable(parsed.manifest.sections, [
+				{
+					header: "section",
+					value: (s) => s.name
+				},
+				{
+					header: "rows",
+					value: (s) => String(s.count)
+				},
+				{
+					header: "truncated",
+					value: (s) => s.truncated ? "yes" : ""
+				}
+			], "none");
+			section("verification");
+			printVerification(check);
+		});
+	});
+	archive.command("verify <file>").description("check an archive's digests and signature (offline); exits non-zero if it fails").option("--key-id <id>", "require this signing key id (see /.well-known/seekrit-export-signing-key)").option("--skip-signature", "check digests only").option("--json", "print the verification result as JSON").action(async (file, options) => {
+		const check = await verifyArchive(readArchiveFile(file), {
+			expectKeyId: options.keyId,
+			skipSignature: options.skipSignature
+		});
+		const integrityOk = check.badSections.length === 0 && check.missingSections.length === 0 && check.undeclaredSections.length === 0 && check.manifestDigestOk;
+		const passed = options.skipSignature ? integrityOk : check.ok;
+		emit(options, check, () => printVerification(check));
+		if (!passed) process.exit(1);
+	});
+	archive.command("share <file>").description("unwrap your own recovery share from an archive, for an offline quorum (offline)").option("-o, --out <file>", "write the share here (default: stdout)").option("--token <skt_…>", "unwrap with a service token instead of a passphrase").option("--key-file <path>", "unwrap with a private key JWK file").action(async (file, options) => {
+		const parsed = readArchiveFile(file);
+		if (parsed.data.recoveryShares.length === 0) fail("this archive holds no recovery shares — customer-controlled recovery is not set up");
+		const key = await resolveDecryptKey(parsed, {
+			token: options.token,
+			keyFile: options.keyFile
+		});
+		const candidates = parsed.data.recoveryShares.filter((share) => key.principalId === null || share.custodianId === key.principalId);
+		for (const candidate of candidates) try {
+			const bytes = await unwrapRecoveryShare(candidate.wrappedShare, key.privateKey);
+			const payload = {
+				format: SHARE_FORMAT,
+				org: {
+					id: parsed.manifest.org.id,
+					slug: parsed.manifest.org.slug
+				},
+				custodianType: candidate.custodianType,
+				custodianId: candidate.custodianId,
+				shareIndex: candidate.shareIndex,
+				share: bytesToHex(bytes),
+				note: "Sensitive: a threshold of these shares reconstructs the org recovery key, which opens every environment. Destroy this file after the ceremony."
+			};
+			const text = JSON.stringify(payload, null, 2);
+			if (options.out) {
+				writeOut(options.out, text);
+				console.error(`wrote share ${candidate.shareIndex} to ${options.out}`);
+			} else console.log(text);
+			console.error(`combine ${parsed.data.recoveryConfig?.threshold ?? "M"} shares with: seekrit archive decrypt ${file} --share … --share …`);
+			return;
+		} catch {}
+		fail("none of the recovery shares in this archive unwrap with that key");
+	});
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("--yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
+		if (![
+			"dotenv",
+			"json",
+			"shell"
+		].includes(options.format)) fail(`unknown --format "${options.format}" (dotenv | json | shell)`);
+		const parsed = readArchiveFile(file);
+		const check = await verifyArchive(parsed);
+		if (check.badSections.length > 0 || !check.manifestDigestOk) fail(`refusing to decrypt: ${verificationProblems(check).join("; ")} — run \`seekrit archive verify ${file}\``);
+		if (check.signature !== "valid") console.error(`warning: ${verificationProblems(check).join("; ")}`);
+		if (options.stdout) await confirmDestructive(options.yes, "This prints decrypted secret values to stdout, where they may land in scrollback or CI logs. Continue?");
+		const key = await resolveDecryptKey(parsed, options);
+		const result = await decryptArchive(parsed, key, options.env);
+		console.error(`unlocked with ${key.how}`);
+		const extension = options.format === "json" ? "json" : options.format === "shell" ? "sh" : "env";
+		let written = 0;
+		for (const entry of result.environments) {
+			const body = formatSecrets(entry.values, options.format);
+			if (options.out) {
+				const path = join(options.out, envPath(parsed, entry.env, extension));
+				writeOut(path, `${body}\n`);
+				written += 1;
+				console.error(`${path}  (${count(Object.keys(entry.values).length, "secret")})`);
+			} else {
+				console.log(`# ${entry.label}`);
+				console.log(body);
+				console.log("");
+			}
+		}
+		if (result.skipped.length > 0) console.error(`skipped ${count(result.skipped.length, "environment")} this key holds no grant on: ${result.skipped.join(", ")}`);
+		for (const failure of result.failures) console.error(`failed: ${failure}`);
+		if (options.out) console.error(`wrote ${count(written, "file")} under ${options.out}`);
+		if (result.environments.length === 0) fail("nothing decrypted — this key opens none of the environments in the archive");
+		console.error(`note: values are as stored — \`\${REF}\` references are expanded at read time, not here.`);
+	});
+	archive.command("decryptor").description("write the standalone offline decryptor (a single HTML file, no install, no network)").option("-o, --out <file>", "where to write it", "seekrit-decrypt.html").action((options) => {
+		writeOut(options.out, OFFLINE_DECRYPTOR_HTML);
+		console.error(`wrote ${options.out}`);
+		console.error("open it in any browser — it declares a Content-Security-Policy of `default-src 'none'`, so it cannot reach the network.");
+	});
+}
+//#endregion
 //#region src/audit.ts
 /** The API's per-page ceiling (`auditQuerySchema.limit`). */
 const MAX_PAGE = 200;
@@ -7721,19 +9154,6 @@ function message(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-//#region src/format.ts
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function formatSecrets(values, format) {
-	const names = Object.keys(values).sort();
-	switch (format) {
-		case "json": return JSON.stringify(values, names, 2);
-		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
-	}
-}
-//#endregion
 //#region src/gcp.ts
 /**
 * `seekrit gcp` — temporary GCP credentials via IAM Credentials
@@ -11840,6 +13260,7 @@ program.command("mcp").description("run an MCP server over stdio so AI agents ca
 });
 registerAuditCommands(program);
 registerAccountCommands(program);
+registerArchiveCommands(program);
 registerLogSinkCommands(program);
 registerSyncCommands(program);
 registerBillingCommands(program);