@seekrit/cli 0.44.0 → 0.46.0

package/dist/index.js

@@ -562,6 +562,247 @@ z.object({
 z.object({ 
 /** The presented token. In the body, never a URL — it is a credential. */
 token: z.string().trim().min(8).max(512) });
+//#endregion
+//#region ../../packages/core/src/archive.ts
+/**
+* The **break-glass archive** format: one signed JSON file holding everything
+* seekrit stores for an org, in the form seekrit stores it — ciphertext stays
+* ciphertext. Its whole purpose is to be openable on a machine that has never
+* heard of seekrit, so the format is plain JSON, self-describing, and versioned
+* by name (`seekrit-archive/v1`); a breaking change ships a new format string
+* rather than mutating this one, exactly like the `sc1.`/`wd1.` blob prefixes.
+*
+* Three parts:
+*  - `manifest` — what this archive is, and a SHA-256 digest per section.
+*  - `signature` — Ed25519 over the canonical manifest, or null when the
+*    producing deployment has no signing key configured.
+*  - `data` — the sections themselves.
+*
+* Integrity fields (`digest`, `signature.value`, `publicKey`, `keyId`) are
+* lowercase hex. Every blob *inside* `data` keeps its native base64url form, so
+* the one encoding rule to remember is "the archive's own bookkeeping is hex,
+* seekrit's blobs are unchanged".
+*
+* See docs/break-glass-export.md for what is deliberately excluded and why.
+*/
+const ARCHIVE_FORMAT = "seekrit-archive/v1";
+/**
+* Section order is part of the format: `manifest.digest` covers the section
+* headers in this order, so a verifier that re-serializes must produce the same
+* list. Appending a section is backwards-compatible; reordering is not.
+*/
+const ARCHIVE_SECTIONS = [
+	"organization",
+	"users",
+	"memberships",
+	"invites",
+	"applications",
+	"groups",
+	"environments",
+	"environmentGroups",
+	"environmentKeys",
+	"secrets",
+	"secretVersions",
+	"serviceTokens",
+	"m2mClients",
+	"kmsKeys",
+	"kmsKeyVersions",
+	"kmsKeyGrants",
+	"recoveryConfig",
+	"recoveryShares",
+	"rotations",
+	"syncConnections",
+	"syncBindings",
+	"leaseTargets",
+	"agentIdentities",
+	"agentPolicies",
+	"auditLog",
+	"keyMaterial"
+];
+/**
+* Deterministic JSON: object keys sorted recursively, no whitespace. A digest
+* has to be reproducible by a verifier that parsed the file and re-serialized
+* it, and parsing loses key order — so key order must not matter.
+*
+* Arrays keep their order (it is data). Every numeric field in the schema is an
+* integer, so JSON's float formatting never comes into it. `undefined` members
+* are dropped, matching `JSON.stringify`.
+*/
+function canonicalJson(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function bytesToHex(bytes) {
+	let out = "";
+	for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+	return out;
+}
+/** Throws on odd length or a non-hex character — a malformed field, not a mismatch. */
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) throw new Error("hex string has odd length");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) {
+		const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) throw new Error("hex string contains a non-hex character");
+		out[i] = byte;
+	}
+	return out;
+}
+/** `sha256:<hex>` over the UTF-8 bytes of `text`. */
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return `sha256:${bytesToHex(new Uint8Array(digest))}`;
+}
+/** Number a section header reports: array length, or 0/1 for the singleton sections. */
+function sectionCount(value) {
+	if (value === null || value === void 0) return 0;
+	return Array.isArray(value) ? value.length : 1;
+}
+/** Digest one section's value. Absent singletons hash as `null`, not as omitted. */
+function sectionDigest(value) {
+	return sha256Hex(canonicalJson(value ?? null));
+}
+/**
+* Digest over the section-header list. Covers each section's digest, count, and
+* truncation flag, so trimming rows *and* fixing up their digest still breaks
+* the manifest.
+*/
+function manifestDigest(sections) {
+	return sha256Hex(canonicalJson(sections));
+}
+/** The exact bytes the signature covers: the canonical manifest, digest included. */
+function signingPayload(manifest) {
+	return new TextEncoder().encode(canonicalJson(manifest));
+}
+/**
+* Verify an archive's digests and signature. Pure and offline — WebCrypto only,
+* no I/O, so it runs identically in the CLI, a browser page, and a test.
+*
+* Reports every problem it finds rather than throwing on the first, because the
+* useful answer to "my archive won't verify" is *which part*.
+*/
+async function verifyArchive(archive, options = {}) {
+	const declared = new Map(archive.manifest.sections.map((s) => [s.name, s]));
+	const badSections = [];
+	const missingSections = [];
+	const truncatedSections = [];
+	const data = archive.data ?? {};
+	for (const header of archive.manifest.sections) {
+		if (header.truncated) truncatedSections.push(header.name);
+		if (!(header.name in data)) {
+			missingSections.push(header.name);
+			continue;
+		}
+		const value = data[header.name];
+		if (sectionCount(value) !== header.count || await sectionDigest(value) !== header.digest) badSections.push(header.name);
+	}
+	const undeclaredSections = Object.keys(data).filter((key) => !declared.has(key));
+	const manifestDigestOk = await manifestDigest(archive.manifest.sections) === archive.manifest.digest;
+	let signature = "unsigned";
+	let signatureNote;
+	if (options.skipSignature) {
+		signature = "unverifiable";
+		signatureNote = "signature checking was skipped";
+	} else if (archive.signature) if (options.expectKeyId && options.expectKeyId !== archive.signature.keyId) {
+		signature = "invalid";
+		signatureNote = `signed by key ${archive.signature.keyId}, expected ${options.expectKeyId}`;
+	} else try {
+		signature = await verifySignature(archive.manifest, archive.signature) ? "valid" : "invalid";
+	} catch (err) {
+		signature = "unverifiable";
+		signatureNote = err instanceof Error ? err.message : String(err);
+	}
+	return {
+		ok: badSections.length === 0 && missingSections.length === 0 && undeclaredSections.length === 0 && manifestDigestOk && signature === "valid",
+		badSections,
+		undeclaredSections,
+		missingSections,
+		manifestDigestOk,
+		signature,
+		signatureNote,
+		truncatedSections
+	};
+}
+/**
+* Ed25519 verify over the canonical manifest. Plain WebCrypto: raw public-key
+* import plus `verify` is supported in Workers, Node ≥18, and current browsers,
+* so no verifier anywhere needs a dependency. Throws (rather than returning
+* false) when the runtime has no Ed25519 at all, so "old browser" is reported
+* as unverifiable instead of as a bad signature.
+*/
+async function verifySignature(manifest, signature) {
+	if (signature.algorithm !== "ed25519") throw new Error(`unsupported signature algorithm: ${signature.algorithm}`);
+	const publicKey = await crypto.subtle.importKey("raw", hexToBytes(signature.publicKey), { name: "Ed25519" }, false, ["verify"]);
+	return crypto.subtle.verify({ name: "Ed25519" }, publicKey, hexToBytes(signature.value), signingPayload(manifest));
+}
+const sectionHeaderSchema = z.object({
+	name: z.enum(ARCHIVE_SECTIONS),
+	count: z.number().int().min(0),
+	truncated: z.boolean(),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const manifestSchema = z.object({
+	archiveId: z.string().min(1),
+	createdAt: z.string().min(1),
+	org: z.object({
+		id: z.string(),
+		slug: z.string(),
+		name: z.string()
+	}),
+	producer: z.object({
+		service: z.string(),
+		environment: z.string(),
+		formatVersion: z.string()
+	}),
+	requestedBy: z.object({
+		actorType: z.string(),
+		actorId: z.string(),
+		label: z.string().nullable()
+	}),
+	options: z.object({
+		includeVersions: z.boolean(),
+		includeAudit: z.boolean(),
+		auditLimit: z.number().int().min(0)
+	}),
+	sections: z.array(sectionHeaderSchema),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const signatureSchema = z.object({
+	algorithm: z.literal("ed25519"),
+	publicKey: z.string().regex(/^[0-9a-f]{64}$/),
+	keyId: z.string().regex(/^[0-9a-f]{16}$/),
+	value: z.string().regex(/^[0-9a-f]{128}$/)
+});
+/**
+* Envelope schema. `data` is validated only as an object: a v1 verifier must
+* still be able to check and decrypt an archive from a later producer that
+* appended a section, and unknown sections are caught by
+* `verifyArchive`'s undeclared/declared cross-check rather than by rejecting
+* the file outright.
+*/
+const archiveSchema = z.object({
+	format: z.literal(ARCHIVE_FORMAT),
+	manifest: manifestSchema,
+	signature: signatureSchema.nullable(),
+	data: z.record(z.string(), z.unknown())
+});
+/** Parse untrusted JSON text into an archive. Throws with a readable message. */
+function parseArchive(text) {
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		throw new Error("not valid JSON — is this a seekrit archive?");
+	}
+	const parsed = archiveSchema.safeParse(json);
+	if (!parsed.success) {
+		const first = parsed.error.issues[0];
+		const where = first?.path.join(".") || "archive";
+		throw new Error(`not a ${ARCHIVE_FORMAT} archive: ${where}: ${first?.message ?? "invalid"}`);
+	}
+	return parsed.data;
+}
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1663,6 +1904,7 @@ const AUDIT_ACTIONS = [
 	"org.member_invited",
 	"org.invite_revoked",
 	"org.mfa_policy_changed",
+	"org.exported",
 	"user.keys_updated",
 	"user.notification_prefs_updated",
 	"app.created",
@@ -1694,6 +1936,7 @@ const AUDIT_ACTIONS = [
 	"secret.rotated",
 	"secret.rotation_failed",
 	"token.created",
+	"token.updated",
 	"token.revoked",
 	"token.deleted",
 	"honey_token.created",
@@ -1848,6 +2091,13 @@ const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	/** Include the full append-only ciphertext history of every secret. */
+	includeVersions: z.boolean().optional(),
+	includeAudit: z.boolean().optional(),
+	/** Newest audit rows to keep. Exceeding the server cap is a 400, not a silent trim. */
+	auditLimit: z.number().int().min(0).optional()
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -1859,6 +2109,8 @@ z.object({
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
 z.object({ required: z.boolean() });
 z.object({
 	email: emailSchema,
@@ -4624,7 +4876,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.44.0";
+var version = "0.46.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4776,6 +5028,10 @@ var SeekritClient = class {
 	getEnv(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/** Rename an environment (display name only — the slug is immutable). */
+	updateEnv(orgId, envId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/envs/${envId}`, input);
+	}
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
@@ -4929,6 +5185,10 @@ var SeekritClient = class {
 	createToken(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
 	}
+	/** Rename a token. Role, environment binding, and expiry are immutable. */
+	updateToken(orgId, tokenId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/tokens/${tokenId}`, input);
+	}
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
@@ -5207,6 +5467,17 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	/**
+	* Export the org as one signed archive: every row seekrit holds for it, with
+	* ciphertext still ciphertext (docs/break-glass-export.md).
+	*
+	* The archive comes back inline rather than as a job handle, and it can be
+	* megabytes — buffer it to a file rather than holding several copies. Requires
+	* admin; deliberately not entitlement-gated.
+	*/
+	exportArchive(orgId, input = {}) {
+		return this.request("POST", `/v1/orgs/${orgId}/export`, input);
+	}
 	getLogSink(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
 	}
@@ -6513,7 +6784,7 @@ function registerPolicyCommands(policy) {
 //#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
+function collect$7(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -6581,7 +6852,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$6, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$6, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -6800,7 +7071,7 @@ function registerKmsCommands(program) {
 //#endregion
 //#region src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$5(value, acc = []) {
+function collect$6(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -6897,7 +7168,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -6915,7 +7186,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7195,6 +7466,1179 @@ function registerAppCommands(program) {
 	});
 }
 //#endregion
+//#region src/decryptor.ts
+/**
+* The standalone offline decryptor: one self-contained HTML file, written out by
+* `seekrit archive decryptor`, that opens a break-glass archive in any browser
+* with no install, no network, and no seekrit.
+*
+* Why a duplicate of the decrypt path instead of a bundle of `@seekrit/crypto`:
+* the artifact has to be a single file a customer can store next to their
+* archives for years and open from `file://`, which rules out a module graph and
+* a build step. So it is a second implementation — pinned, like every other
+* second implementation in this repo (the four SDKs, `crates/seekrit-core`), by a
+* test that runs *this* script against ciphertext produced by the real library:
+* `test/decryptor.test.ts`. If you change a blob format, that test fails here
+* too, which is the point.
+*
+* Two rules for editing the embedded script:
+*  - **No backticks and no `${`** anywhere inside it — it lives in a template
+*    literal. Use string concatenation.
+*  - **No network of any kind.** The page declares
+*    `Content-Security-Policy: default-src 'none'`, which is the property that
+*    makes it safe to type a passphrase into. Anything that needs a fetch does
+*    not belong here.
+*/
+const OFFLINE_DECRYPTOR_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<!--
+  The whole security argument for this page, in one header: with default-src
+  'none' the browser refuses every outbound request the page could make, so the
+  passphrase you type and the plaintext it produces cannot leave this machine.
+  'unsafe-inline' covers the page's own inline script and styles; there is no
+  connect-src, no img-src, no form-action.
+-->
+<meta http-equiv="Content-Security-Policy"
+      content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+<title>seekrit — offline archive decryptor</title>
+<style>
+  :root {
+    color-scheme: dark light;
+    --bg: #0b0c0e; --fg: #e7e9ea; --dim: #9aa0a6; --line: #23262b;
+    --panel: #101215; --accent: #7dd3a0; --warn: #f0b76b; --bad: #f08a8a;
+  }
+  @media (prefers-color-scheme: light) {
+    :root {
+      --bg: #fbfbfa; --fg: #14161a; --dim: #5f6673; --line: #e3e5e8;
+      --panel: #ffffff; --accent: #1a7f4b; --warn: #9a6413; --bad: #b23b3b;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; padding: 2rem 1.25rem 4rem; background: var(--bg); color: var(--fg);
+    font: 14px/1.55 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  }
+  main { max-width: 62rem; margin: 0 auto; }
+  h1 { font-size: 1.1rem; letter-spacing: 0.02em; margin: 0 0 0.25rem; }
+  h2 { font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.12em;
+       color: var(--dim); margin: 2rem 0 0.75rem; font-weight: 500; }
+  p { margin: 0.4rem 0; color: var(--dim); }
+  .panel { border: 1px solid var(--line); background: var(--panel); border-radius: 6px;
+           padding: 1rem 1.1rem; }
+  .drop { border: 1px dashed var(--line); border-radius: 6px; padding: 2rem 1rem;
+          text-align: center; color: var(--dim); }
+  .drop.over { border-color: var(--accent); color: var(--fg); }
+  label { display: block; color: var(--dim); margin: 0.75rem 0 0.25rem; }
+  input, select, textarea, button {
+    font: inherit; color: var(--fg); background: var(--bg);
+    border: 1px solid var(--line); border-radius: 4px; padding: 0.5rem 0.6rem;
+  }
+  input, select, textarea { width: 100%; }
+  textarea { min-height: 5rem; }
+  button { cursor: pointer; background: var(--panel); }
+  button:hover { border-color: var(--accent); }
+  button.primary { border-color: var(--accent); color: var(--accent); }
+  .row { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; }
+  table { width: 100%; border-collapse: collapse; margin-top: 0.5rem; }
+  th, td { text-align: left; padding: 0.35rem 0.5rem; border-bottom: 1px solid var(--line);
+           vertical-align: top; word-break: break-all; }
+  th { color: var(--dim); font-weight: 500; font-size: 0.85rem; }
+  .kv { display: grid; grid-template-columns: 12rem 1fr; gap: 0.15rem 1rem; }
+  .kv dt { color: var(--dim); }
+  .kv dd { margin: 0; word-break: break-all; }
+  .ok { color: var(--accent); } .warn { color: var(--warn); } .bad { color: var(--bad); }
+  .hidden { display: none; }
+  .env { margin-bottom: 1.5rem; }
+  .muted { color: var(--dim); font-size: 0.85rem; }
+  pre { white-space: pre-wrap; word-break: break-all; margin: 0.5rem 0 0; }
+  .value { font-family: inherit; }
+  ul { margin: 0.3rem 0 0; padding-left: 1.2rem; color: var(--dim); }
+</style>
+</head>
+<body>
+<main>
+  <h1>seekrit — offline archive decryptor</h1>
+  <p>
+    Opens a <code>seekrit-archive/v1</code> file with your own key. This page has
+    no network access at all (see the CSP in its source) &mdash; your passphrase
+    and your secrets never leave this machine. Nothing is uploaded, and nothing
+    needs to be installed.
+  </p>
+
+  <h2>1 &middot; the archive</h2>
+  <div class="drop panel" id="drop">
+    <input type="file" id="file" accept=".json,application/json" style="width:auto">
+    <p class="muted">or drop the file here</p>
+  </div>
+  <div id="manifest" class="panel hidden" style="margin-top:0.75rem"></div>
+
+  <div id="step2" class="hidden">
+    <h2>2 &middot; your key</h2>
+    <div class="panel">
+      <label for="method">how you hold it</label>
+      <select id="method">
+        <option value="passphrase">passphrase (unlocks the key inside the archive)</option>
+        <option value="token">service token (skt_&hellip;)</option>
+        <option value="jwk">private key (JWK)</option>
+        <option value="shares">custodian shares (recovery quorum)</option>
+      </select>
+
+      <div id="field-passphrase">
+        <label for="passphrase">passphrase</label>
+        <input type="password" id="passphrase" autocomplete="off" spellcheck="false">
+        <p class="muted" id="key-owner"></p>
+      </div>
+      <div id="field-token" class="hidden">
+        <label for="token">service token</label>
+        <input type="password" id="token" autocomplete="off" spellcheck="false"
+               placeholder="skt_...">
+      </div>
+      <div id="field-jwk" class="hidden">
+        <label for="jwk">private key JWK</label>
+        <textarea id="jwk" spellcheck="false" placeholder='{"kty":"EC","crv":"P-256",...}'></textarea>
+      </div>
+      <div id="field-shares" class="hidden">
+        <label for="shares">custodian shares</label>
+        <textarea id="shares" spellcheck="false"
+          placeholder="paste the contents of each share file from 'seekrit archive share', one after another"></textarea>
+        <p class="muted">
+          Reconstructs the org recovery key from a quorum, which opens every
+          environment &mdash; for when the key-holder is gone.
+        </p>
+      </div>
+
+      <div class="row" style="margin-top:1rem">
+        <button class="primary" id="decrypt">decrypt</button>
+        <span id="status" class="muted"></span>
+      </div>
+    </div>
+  </div>
+
+  <div id="results"></div>
+</main>
+<script>
+(function () {
+  "use strict";
+
+  // ── encoding ────────────────────────────────────────────────────────────
+  function b64uToBytes(text) {
+    var base64 = text.replace(/-/g, "+").replace(/_/g, "/");
+    var binary = atob(base64);
+    var out = new Uint8Array(binary.length);
+    for (var i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  }
+  function hexToBytes(hex) {
+    if (hex.length % 2 !== 0) throw new Error("malformed hex");
+    var out = new Uint8Array(hex.length / 2);
+    for (var i = 0; i < out.length; i++) {
+      var byte = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      if (Number.isNaN(byte)) throw new Error("malformed hex");
+      out[i] = byte;
+    }
+    return out;
+  }
+  function bytesToHex(bytes) {
+    var out = "";
+    for (var i = 0; i < bytes.length; i++) out += bytes[i].toString(16).padStart(2, "0");
+    return out;
+  }
+  function utf8(text) { return new TextEncoder().encode(text); }
+  function fromUtf8(bytes) { return new TextDecoder().decode(bytes); }
+
+  // ── canonical JSON + digests (must match packages/core/src/archive.ts) ──
+  function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+      var scalar = JSON.stringify(value);
+      return scalar === undefined ? "null" : scalar;
+    }
+    if (Array.isArray(value)) {
+      return "[" + value.map(canonicalJson).join(",") + "]";
+    }
+    var keys = Object.keys(value).filter(function (key) { return value[key] !== undefined; });
+    keys.sort();
+    var parts = keys.map(function (key) {
+      return JSON.stringify(key) + ":" + canonicalJson(value[key]);
+    });
+    return "{" + parts.join(",") + "}";
+  }
+  async function sha256Hex(text) {
+    var digest = await crypto.subtle.digest("SHA-256", utf8(text));
+    return "sha256:" + bytesToHex(new Uint8Array(digest));
+  }
+  function sectionCount(value) {
+    if (value === null || value === undefined) return 0;
+    return Array.isArray(value) ? value.length : 1;
+  }
+
+  // ── the three blob formats ──────────────────────────────────────────────
+  function splitBlob(blob, prefix, parts) {
+    var pieces = String(blob).split(".");
+    if (pieces.length !== parts + 1 || pieces[0] !== prefix) {
+      throw new Error("not a " + prefix + ". blob");
+    }
+    return pieces.slice(1);
+  }
+
+  /** pk1.<iterations>.<salt>.<iv>.<ciphertext> — PBKDF2-SHA256 + AES-256-GCM. */
+  async function decryptPrivateKeyBlob(passphrase, blob) {
+    var parts = splitBlob(blob, "pk1", 4);
+    var iterations = parseInt(parts[0], 10);
+    if (!Number.isFinite(iterations) || iterations < 1) throw new Error("bad iteration count");
+    var material = await crypto.subtle.importKey("raw", utf8(passphrase), "PBKDF2", false, [
+      "deriveKey",
+    ]);
+    var kek = await crypto.subtle.deriveKey(
+      { name: "PBKDF2", hash: "SHA-256", salt: b64uToBytes(parts[1]), iterations: iterations },
+      material,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+    var plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[2]) },
+      kek,
+      b64uToBytes(parts[3])
+    );
+    return fromUtf8(new Uint8Array(plaintext));
+  }
+
+  /** wd1.<ephemeral pub>.<hkdf salt>.<iv>.<ciphertext> — ECDH P-256 + HKDF + AES-GCM. */
+  async function unwrap(blob, privateKey) {
+    var parts = splitBlob(blob, "wd1", 4);
+    var ephemeral = await crypto.subtle.importKey(
+      "raw",
+      b64uToBytes(parts[0]),
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+    var shared = await crypto.subtle.deriveBits(
+      { name: "ECDH", public: ephemeral },
+      privateKey,
+      256
+    );
+    var hkdf = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+    var wrappingKey = await crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: b64uToBytes(parts[1]),
+        info: utf8("seekrit/wrap-dek/v1"),
+      },
+      hkdf,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+    var opened = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[2]) },
+      wrappingKey,
+      b64uToBytes(parts[3])
+    );
+    return new Uint8Array(opened);
+  }
+
+  /** sc1.<iv>.<ciphertext>, authenticated over "<environmentId>/<NAME>". */
+  async function decryptSecret(dek, blob, aad) {
+    var parts = splitBlob(blob, "sc1", 2);
+    var key = await crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, ["decrypt"]);
+    var plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: b64uToBytes(parts[0]), additionalData: utf8(aad) },
+      key,
+      b64uToBytes(parts[1])
+    );
+    return fromUtf8(new Uint8Array(plaintext));
+  }
+
+  function importPrivateJwk(jwkText) {
+    return crypto.subtle.importKey(
+      "jwk",
+      JSON.parse(jwkText),
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+  }
+
+  /** skt_<id>_<pkcs8 base64url>: a service token carries its own private key. */
+  async function importToken(token) {
+    var match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(String(token).trim());
+    if (!match) throw new Error("not a valid seekrit service token");
+    var privateKey = await crypto.subtle.importKey(
+      "pkcs8",
+      b64uToBytes(match[2]),
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+    return { principalId: match[1], privateKey: privateKey };
+  }
+
+  // ── Shamir over GF(2^8) (must match packages/crypto/src/shamir.ts) ──────
+  function gfMul(a, b) {
+    var result = 0;
+    var x = a;
+    var y = b;
+    for (var i = 0; i < 8; i++) {
+      if (y & 1) result ^= x;
+      var high = x & 0x80;
+      x = (x << 1) & 0xff;
+      if (high) x ^= 0x1b;
+      y >>= 1;
+    }
+    return result & 0xff;
+  }
+  function gfPow(base, exponent) {
+    var result = 1;
+    for (var i = 0; i < exponent; i++) result = gfMul(result, base);
+    return result;
+  }
+  function gfInv(value) {
+    if (value === 0) throw new Error("no inverse for 0");
+    return gfPow(value, 254);
+  }
+  /**
+   * Lagrange interpolation at x=0 over the shares. Each share is
+   * [x, y0, y1, ...]; the secret is the vector of y-intercepts.
+   */
+  function combineShares(shares) {
+    if (shares.length === 0) throw new Error("no shares");
+    var length = shares[0].length - 1;
+    var out = new Uint8Array(length);
+    for (var byte = 0; byte < length; byte++) {
+      var acc = 0;
+      for (var i = 0; i < shares.length; i++) {
+        var xi = shares[i][0];
+        var yi = shares[i][byte + 1];
+        var numerator = 1;
+        var denominator = 1;
+        for (var j = 0; j < shares.length; j++) {
+          if (i === j) continue;
+          var xj = shares[j][0];
+          numerator = gfMul(numerator, xj);
+          denominator = gfMul(denominator, xi ^ xj);
+        }
+        acc ^= gfMul(yi, gfMul(numerator, gfInv(denominator)));
+      }
+      out[byte] = acc;
+    }
+    return out;
+  }
+
+  // ── verification ────────────────────────────────────────────────────────
+  async function verifyArchive(archive) {
+    var problems = [];
+    var truncated = [];
+    var data = archive.data || {};
+    var declared = {};
+    for (var i = 0; i < archive.manifest.sections.length; i++) {
+      var header = archive.manifest.sections[i];
+      declared[header.name] = true;
+      if (header.truncated) truncated.push(header.name);
+      if (!(header.name in data)) {
+        problems.push("section " + header.name + " is missing");
+        continue;
+      }
+      var value = data[header.name] === undefined ? null : data[header.name];
+      var digest = await sha256Hex(canonicalJson(value === undefined ? null : value));
+      if (digest !== header.digest || sectionCount(value) !== header.count) {
+        problems.push("section " + header.name + " does not match its digest");
+      }
+    }
+    Object.keys(data).forEach(function (key) {
+      if (!declared[key]) problems.push("section " + key + " is present but undeclared");
+    });
+    var manifestDigest = await sha256Hex(canonicalJson(archive.manifest.sections));
+    if (manifestDigest !== archive.manifest.digest) {
+      problems.push("the manifest digest does not cover its sections");
+    }
+
+    var signature = "unsigned";
+    var note = "";
+    if (archive.signature) {
+      try {
+        var publicKey = await crypto.subtle.importKey(
+          "raw",
+          hexToBytes(archive.signature.publicKey),
+          { name: "Ed25519" },
+          false,
+          ["verify"]
+        );
+        var valid = await crypto.subtle.verify(
+          { name: "Ed25519" },
+          publicKey,
+          hexToBytes(archive.signature.value),
+          utf8(canonicalJson(archive.manifest))
+        );
+        signature = valid ? "valid" : "invalid";
+        if (!valid) problems.push("the signature does not match the manifest");
+      } catch (err) {
+        signature = "unverifiable";
+        note = "this browser cannot check Ed25519 signatures";
+      }
+    }
+    return {
+      integrityOk: problems.length === 0,
+      problems: problems,
+      truncated: truncated,
+      signature: signature,
+      signatureNote: note,
+    };
+  }
+
+  // ── unlocking + decrypting ──────────────────────────────────────────────
+  async function unlockPassphrase(archive, passphrase) {
+    var keyMaterial = archive.data.keyMaterial;
+    if (!keyMaterial) {
+      throw new Error(
+        "this archive carries no key material - use a service token, a private key, or a custodian quorum"
+      );
+    }
+    var jwk = await decryptPrivateKeyBlob(passphrase, keyMaterial.encryptedPrivateKey);
+    return {
+      principalId: keyMaterial.principalId,
+      privateKey: await importPrivateJwk(jwk),
+      how: keyMaterial.principalType + " " + keyMaterial.principalId,
+    };
+  }
+
+  async function unlockJwk(jwkText) {
+    return {
+      principalId: null,
+      privateKey: await importPrivateJwk(jwkText.trim()),
+      how: "a private key",
+    };
+  }
+
+  async function unlockToken(token) {
+    var opened = await importToken(token);
+    return {
+      principalId: opened.principalId,
+      privateKey: opened.privateKey,
+      how: "service token " + opened.principalId,
+    };
+  }
+
+  /**
+   * Reconstruct the org recovery key from pasted share files. Accepts several
+   * JSON objects one after another, which is what you get from concatenating
+   * the output of "seekrit archive share".
+   */
+  async function unlockShares(archive, text) {
+    var shares = [];
+    var pattern = /"share"\\s*:\\s*"([0-9a-f]+)"/g;
+    var match = pattern.exec(text);
+    while (match !== null) {
+      shares.push(hexToBytes(match[1]));
+      match = pattern.exec(text);
+    }
+    if (shares.length === 0) throw new Error("no shares found in that text");
+    var jwk = fromUtf8(combineShares(shares));
+    return {
+      principalId: archive.manifest.org.id,
+      privateKey: await importPrivateJwk(jwk),
+      how: shares.length + " custodian shares",
+    };
+  }
+
+  function envLabel(archive, env) {
+    var i;
+    if (env.groupId) {
+      for (i = 0; i < archive.data.groups.length; i++) {
+        if (archive.data.groups[i].id === env.groupId) {
+          return archive.data.groups[i].slug + "@" + env.slug;
+        }
+      }
+      return env.groupId + "@" + env.slug;
+    }
+    for (i = 0; i < archive.data.applications.length; i++) {
+      if (archive.data.applications[i].id === env.applicationId) {
+        return archive.data.applications[i].slug + "/" + env.slug;
+      }
+    }
+    return env.applicationId + "/" + env.slug;
+  }
+
+  async function decryptAll(archive, key) {
+    var environments = [];
+    var skipped = [];
+    for (var e = 0; e < archive.data.environments.length; e++) {
+      var env = archive.data.environments[e];
+      var dek = null;
+      for (var g = 0; g < archive.data.environmentKeys.length; g++) {
+        var grant = archive.data.environmentKeys[g];
+        if (grant.environmentId !== env.id) continue;
+        if (key.principalId !== null && grant.principalId !== key.principalId) continue;
+        try {
+          dek = await unwrap(grant.wrappedDek, key.privateKey);
+          break;
+        } catch (err) {
+          // Not this key's grant. A principal with no grant here is normal.
+        }
+      }
+      if (dek === null) {
+        skipped.push(envLabel(archive, env));
+        continue;
+      }
+      var values = [];
+      var failures = [];
+      for (var s = 0; s < archive.data.secrets.length; s++) {
+        var secret = archive.data.secrets[s];
+        if (secret.environmentId !== env.id) continue;
+        try {
+          values.push({
+            name: secret.name,
+            value: await decryptSecret(
+              dek,
+              secret.ciphertext,
+              secret.environmentId + "/" + secret.name
+            ),
+          });
+        } catch (err) {
+          failures.push(secret.name);
+        }
+      }
+      values.sort(function (a, b) { return a.name < b.name ? -1 : a.name > b.name ? 1 : 0; });
+      environments.push({ label: envLabel(archive, env), values: values, failures: failures });
+    }
+    return { environments: environments, skipped: skipped };
+  }
+
+  /**
+   * dotenv quoting, mirroring packages/core/src/dotenv.ts — single quotes when
+   * they are safe (literal, so a JSON credential survives untouched), double
+   * quotes with written-out escapes otherwise.
+   */
+  function needsQuoting(value) {
+    return /[\\s"'\`$\\\\#]/.test(value) || value === "";
+  }
+  function dotenvQuote(value) {
+    if (!needsQuoting(value)) return value;
+    if (value.indexOf("'") === -1 && !/[\\n\\r]/.test(value)) return "'" + value + "'";
+    return (
+      '"' +
+      value
+        .replace(/\\\\/g, "\\\\\\\\")
+        .replace(/"/g, '\\\\"')
+        .replace(/\\n/g, "\\\\n")
+        .replace(/\\r/g, "\\\\r") +
+      '"'
+    );
+  }
+  function toDotenv(values) {
+    return values
+      .map(function (entry) { return entry.name + "=" + dotenvQuote(entry.value); })
+      .join("\\n");
+  }
+
+  var api = {
+    canonicalJson: canonicalJson,
+    verifyArchive: verifyArchive,
+    unlockPassphrase: unlockPassphrase,
+    unlockToken: unlockToken,
+    unlockJwk: unlockJwk,
+    unlockShares: unlockShares,
+    decryptAll: decryptAll,
+    toDotenv: toDotenv,
+  };
+  globalThis.seekritOffline = api;
+
+  // Everything above is pure and runs headless; the test suite drives it through
+  // globalThis.seekritOffline. Only what follows needs a document.
+  if (typeof document === "undefined") return;
+
+  var archive = null;
+  var el = function (id) { return document.getElementById(id); };
+  var text = function (value) { return document.createTextNode(String(value)); };
+
+  function node(tag, className, content) {
+    var element = document.createElement(tag);
+    if (className) element.className = className;
+    if (content !== undefined) element.appendChild(text(content));
+    return element;
+  }
+
+  function setStatus(message, kind) {
+    var status = el("status");
+    status.className = kind ? kind : "muted";
+    status.textContent = message;
+  }
+
+  async function loadArchive(fileText) {
+    try {
+      archive = JSON.parse(fileText);
+    } catch (err) {
+      archive = null;
+      setStatus("that file is not JSON", "bad");
+      return;
+    }
+    if (!archive || archive.format !== "seekrit-archive/v1" || !archive.manifest) {
+      archive = null;
+      el("manifest").className = "panel bad";
+      el("manifest").textContent = "not a seekrit-archive/v1 file";
+      return;
+    }
+    var check = await verifyArchive(archive);
+    var panel = el("manifest");
+    panel.className = "panel";
+    panel.textContent = "";
+
+    var list = document.createElement("dl");
+    list.className = "kv";
+    var rows = [
+      ["organization", archive.manifest.org.name + " (" + archive.manifest.org.slug + ")"],
+      ["created", archive.manifest.createdAt],
+      ["exported by", archive.manifest.requestedBy.label || archive.manifest.requestedBy.actorId],
+      ["producer", archive.manifest.producer.service + " / " + archive.manifest.producer.environment],
+      ["environments", String(sectionCount(archive.data.environments))],
+      ["secrets", String(sectionCount(archive.data.secrets))],
+      ["key grants", String(sectionCount(archive.data.environmentKeys))],
+      ["integrity", check.integrityOk ? "every section matches its digest" : "FAILED"],
+      [
+        "signature",
+        check.signature === "valid"
+          ? "valid, key " + archive.signature.keyId
+          : check.signature + (check.signatureNote ? " (" + check.signatureNote + ")" : ""),
+      ],
+    ];
+    rows.forEach(function (row) {
+      list.appendChild(node("dt", null, row[0]));
+      var value = node("dd", null, row[1]);
+      if (row[0] === "integrity") value.className = check.integrityOk ? "ok" : "bad";
+      if (row[0] === "signature") {
+        value.className =
+          check.signature === "valid" ? "ok" : check.signature === "invalid" ? "bad" : "warn";
+      }
+      list.appendChild(value);
+    });
+    panel.appendChild(list);
+
+    if (check.problems.length > 0) {
+      var problems = document.createElement("ul");
+      check.problems.forEach(function (problem) {
+        problems.appendChild(node("li", "bad", problem));
+      });
+      panel.appendChild(problems);
+    }
+    if (check.truncated.length > 0) {
+      panel.appendChild(
+        node("p", "warn", "truncated sections: " + check.truncated.join(", "))
+      );
+    }
+    panel.classList.remove("hidden");
+    el("step2").classList.remove("hidden");
+    el("key-owner").textContent = archive.data.keyMaterial
+      ? "unlocks " + archive.data.keyMaterial.principalType + " " + archive.data.keyMaterial.principalId
+      : "this archive carries no key material - use another method";
+    setStatus("");
+  }
+
+  function showResults(result, key) {
+    var container = el("results");
+    container.textContent = "";
+    container.appendChild(node("h2", null, "3 - plaintext"));
+    container.appendChild(
+      node("p", "muted", "unlocked with " + key.how + ". Values are as stored: a \${REF} reference is expanded when an app reads it, not here.")
+    );
+
+    result.environments.forEach(function (entry) {
+      var panel = node("div", "panel env");
+      panel.appendChild(node("strong", null, entry.label));
+      panel.appendChild(
+        node("span", "muted", "  " + entry.values.length + (entry.values.length === 1 ? " secret" : " secrets"))
+      );
+
+      var table = document.createElement("table");
+      var head = document.createElement("tr");
+      head.appendChild(node("th", null, "name"));
+      head.appendChild(node("th", null, "value"));
+      table.appendChild(head);
+      entry.values.forEach(function (item) {
+        var row = document.createElement("tr");
+        row.appendChild(node("td", null, item.name));
+        var cell = node("td", "value");
+        var masked = node("span", null, "•".repeat(Math.min(24, Math.max(6, item.value.length))));
+        var reveal = node("button", null, "reveal");
+        reveal.style.marginLeft = "0.5rem";
+        reveal.addEventListener("click", function () {
+          if (reveal.textContent === "reveal") {
+            masked.textContent = item.value;
+            reveal.textContent = "hide";
+          } else {
+            masked.textContent = "•".repeat(Math.min(24, Math.max(6, item.value.length)));
+            reveal.textContent = "reveal";
+          }
+        });
+        cell.appendChild(masked);
+        cell.appendChild(reveal);
+        row.appendChild(cell);
+        table.appendChild(row);
+      });
+      panel.appendChild(table);
+
+      if (entry.failures.length > 0) {
+        panel.appendChild(node("p", "bad", "failed to decrypt: " + entry.failures.join(", ")));
+      }
+
+      var area = document.createElement("textarea");
+      area.readOnly = true;
+      area.spellcheck = false;
+      area.className = "hidden";
+      area.value = toDotenv(entry.values);
+
+      var show = node("button", null, "show as .env");
+      show.addEventListener("click", function () {
+        area.classList.toggle("hidden");
+        show.textContent = area.classList.contains("hidden") ? "show as .env" : "hide .env";
+      });
+      var copy = node("button", null, "copy .env");
+      copy.addEventListener("click", function () {
+        area.classList.remove("hidden");
+        area.select();
+        try {
+          document.execCommand("copy");
+          copy.textContent = "copied";
+        } catch (err) {
+          copy.textContent = "select and copy";
+        }
+      });
+      var actions = node("div", "row");
+      actions.style.marginTop = "0.75rem";
+      actions.appendChild(show);
+      actions.appendChild(copy);
+      panel.appendChild(actions);
+      panel.appendChild(area);
+      container.appendChild(panel);
+    });
+
+    if (result.skipped.length > 0) {
+      container.appendChild(
+        node(
+          "p",
+          "muted",
+          "skipped " + result.skipped.length +
+            (result.skipped.length === 1 ? " environment" : " environments") +
+            " this key holds no grant on: " + result.skipped.join(", ")
+        )
+      );
+    }
+    if (result.environments.length === 0) {
+      container.appendChild(
+        node("p", "bad", "this key opens none of the environments in the archive")
+      );
+    }
+  }
+
+  el("file").addEventListener("change", function (event) {
+    var file = event.target.files && event.target.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = function () { loadArchive(String(reader.result)); };
+    reader.readAsText(file);
+  });
+
+  var drop = el("drop");
+  ["dragenter", "dragover"].forEach(function (name) {
+    drop.addEventListener(name, function (event) {
+      event.preventDefault();
+      drop.classList.add("over");
+    });
+  });
+  ["dragleave", "drop"].forEach(function (name) {
+    drop.addEventListener(name, function (event) {
+      event.preventDefault();
+      drop.classList.remove("over");
+    });
+  });
+  drop.addEventListener("drop", function (event) {
+    var file = event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files[0];
+    if (!file) return;
+    var reader = new FileReader();
+    reader.onload = function () { loadArchive(String(reader.result)); };
+    reader.readAsText(file);
+  });
+
+  el("method").addEventListener("change", function () {
+    var method = el("method").value;
+    ["passphrase", "token", "jwk", "shares"].forEach(function (name) {
+      el("field-" + name).classList.toggle("hidden", name !== method);
+    });
+  });
+
+  el("decrypt").addEventListener("click", async function () {
+    if (!archive) {
+      setStatus("load an archive first", "warn");
+      return;
+    }
+    setStatus("working...");
+    try {
+      var method = el("method").value;
+      var key;
+      if (method === "passphrase") key = await unlockPassphrase(archive, el("passphrase").value);
+      else if (method === "token") key = await unlockToken(el("token").value);
+      else if (method === "jwk") key = await unlockJwk(el("jwk").value);
+      else key = await unlockShares(archive, el("shares").value);
+      var result = await decryptAll(archive, key);
+      showResults(result, key);
+      setStatus(
+        "decrypted " + result.environments.length +
+          (result.environments.length === 1 ? " environment" : " environments"),
+        "ok"
+      );
+    } catch (err) {
+      setStatus(err && err.message ? err.message : "could not decrypt", "bad");
+    }
+  });
+})();
+<\/script>
+</body>
+</html>
+`;
+//#endregion
+//#region src/format.ts
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/archive.ts
+/**
+* Break-glass archives (docs/break-glass-export.md).
+*
+* `create` is the only subcommand that talks to the API. `info`, `verify`,
+* `share`, `decrypt`, and `decryptor` are **strictly offline**: they never build
+* a client, never read credentials, and never touch the network, because the day
+* you need them is the day seekrit may not be there. Keep it that way — a
+* `buildContext()` in any of them silently breaks the promise the feature makes.
+*/
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** "1 secret" / "2 secrets" — these lines are read by people, not parsed. */
+function count(n, noun) {
+	return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+function readArchiveFile(path) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (err) {
+		return fail(`cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		return parseArchive(text);
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
+	}
+}
+function writeOut(path, contents) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, contents, { mode: 384 });
+}
+/** One line per problem, for a verification that failed. */
+function verificationProblems(result) {
+	const problems = [];
+	if (!result.manifestDigestOk) problems.push("the manifest's digest does not cover its sections");
+	for (const name of result.badSections) problems.push(`section "${name}" does not match its digest`);
+	for (const name of result.missingSections) problems.push(`section "${name}" is missing`);
+	for (const name of result.undeclaredSections) problems.push(`section "${name}" is present but undeclared`);
+	if (result.signature === "invalid") problems.push(`signature is invalid${result.signatureNote ? ` (${result.signatureNote})` : ""}`);
+	if (result.signature === "unsigned") problems.push("archive is unsigned — integrity is checkable, provenance is not");
+	if (result.signature === "unverifiable") problems.push(`signature could not be checked: ${result.signatureNote ?? "unknown reason"}`);
+	return problems;
+}
+function printVerification(result) {
+	printFields([
+		["integrity", result.badSections.length === 0 && result.manifestDigestOk ? "ok" : "FAILED"],
+		["signature", result.signature],
+		["truncated", result.truncatedSections.length > 0 ? result.truncatedSections.join(", ") : "no"]
+	]);
+	const problems = verificationProblems(result);
+	if (problems.length > 0) {
+		section("problems");
+		for (const problem of problems) console.log(`- ${problem}`);
+	}
+}
+/** `app/env`, or `group@env` for a group-owned environment. */
+function envLabel(archive, env) {
+	if (env.groupId) return `${archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId}@${env.slug}`;
+	return `${archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId}/${env.slug}`;
+}
+/** Filesystem path for an environment's output file, mirroring its label. */
+function envPath(archive, env, extension) {
+	if (env.groupId) return join("groups", archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId, `${env.slug}.${extension}`);
+	return join("apps", archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId ?? "unknown", `${env.slug}.${extension}`);
+}
+/**
+* Recover a private key to open the archive with, from (in order) a service
+* token, a private-key JWK file, a custodian quorum, or the archive's own
+* `keyMaterial` plus a passphrase.
+*/
+async function resolveDecryptKey(archive, options) {
+	if (options.token) {
+		if (!isServiceToken(options.token)) fail("--token expects a `skt_…` service token");
+		const { tokenId, privateKey } = await parseServiceToken(options.token);
+		return {
+			privateKey,
+			principalId: tokenId,
+			how: `service token ${tokenId}`
+		};
+	}
+	if (options.keyFile) {
+		let jwk;
+		try {
+			jwk = readFileSync(options.keyFile, "utf8").trim();
+		} catch (err) {
+			fail(`cannot read ${options.keyFile}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return {
+			privateKey: await importPrivateKey(jwk).catch(() => fail(`${options.keyFile} is not a P-256 private key JWK`)),
+			principalId: null,
+			how: `private key from ${options.keyFile}`
+		};
+	}
+	if (options.share && options.share.length > 0) {
+		const shares = options.share.map((path) => readShareFile(path));
+		return {
+			privateKey: await combineRecoveryShares(shares).catch((err) => fail(`could not reconstruct the recovery key from ${count(shares.length, "share")}: ${err instanceof Error ? err.message : String(err)}`)),
+			principalId: archive.manifest.org.id,
+			how: count(shares.length, "custodian share")
+		};
+	}
+	const keyMaterial = archive.data.keyMaterial;
+	if (!keyMaterial) fail("this archive carries no key material — decrypt it with --token, --key-file, or a custodian quorum (--share)");
+	return {
+		privateKey: await importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden(`Passphrase for ${keyMaterial.principalId}: `), keyMaterial.encryptedPrivateKey).catch((err) => fail(err instanceof Error ? err.message : String(err)))),
+		principalId: keyMaterial.principalId,
+		how: `${keyMaterial.principalType} ${keyMaterial.principalId} (passphrase)`
+	};
+}
+const SHARE_FORMAT = "seekrit-recovery-share/v1";
+function readShareFile(path) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		return fail(`cannot read share ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (parsed.format !== SHARE_FORMAT || typeof parsed.share !== "string") return fail(`${path} is not a ${SHARE_FORMAT} file`);
+	try {
+		return hexToBytes(parsed.share);
+	} catch {
+		return fail(`${path} holds a malformed share`);
+	}
+}
+/**
+* Decrypt what one key can reach. Environments the key holds no grant on are
+* *skipped*, not failed: an archive spans the whole org and no single principal
+* is expected to open all of it.
+*/
+async function decryptArchive(archive, key, filter) {
+	const environments = [];
+	const skipped = [];
+	const failures = [];
+	for (const env of archive.data.environments) {
+		const label = envLabel(archive, env);
+		if (filter && label !== filter && env.slug !== filter && env.id !== filter) continue;
+		const grants = archive.data.environmentKeys.filter((grant) => grant.environmentId === env.id && (key.principalId === null || grant.principalId === key.principalId));
+		let dek = null;
+		for (const grant of grants) try {
+			dek = await unwrapDek(grant.wrappedDek, key.privateKey);
+			break;
+		} catch {}
+		if (!dek) {
+			skipped.push(label);
+			continue;
+		}
+		const values = {};
+		for (const secret of archive.data.secrets.filter((s) => s.environmentId === env.id)) try {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(secret.environmentId, secret.name));
+		} catch (err) {
+			failures.push(`${label} ${secret.name}: ${err instanceof Error ? err.message : "failed"}`);
+		}
+		environments.push({
+			env,
+			label,
+			values
+		});
+	}
+	return {
+		environments,
+		skipped,
+		failures
+	};
+}
+function registerArchiveCommands(program) {
+	const archive = program.command("archive").description("export the whole org as one signed file, and open it offline");
+	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const input = {
+			includeVersions: options.versions,
+			includeAudit: options.audit
+		};
+		if (options.auditLimit !== void 0) input.auditLimit = options.auditLimit;
+		const result = await ctx.client.exportArchive(ref.id, input);
+		if (options.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const stamp = result.manifest.createdAt.slice(0, 10);
+		const path = options.out ?? `seekrit-${result.manifest.org.slug}-${stamp}.json`;
+		writeOut(path, JSON.stringify(result, null, 2));
+		const check = await verifyArchive(result);
+		console.error(`wrote ${path}`);
+		printTable(result.manifest.sections.filter((s) => s.count > 0), [
+			{
+				header: "section",
+				value: (s) => s.name
+			},
+			{
+				header: "rows",
+				value: (s) => String(s.count)
+			},
+			{
+				header: "truncated",
+				value: (s) => s.truncated ? "yes" : ""
+			}
+		], "the archive is empty");
+		console.error(check.ok ? `verified: digests ok, signed by key ${result.signature?.keyId}` : `WARNING: ${verificationProblems(check).join("; ")}`);
+		console.error("keep it with `seekrit archive decryptor` — together they open without seekrit, offline.");
+	});
+	archive.command("info <file>").description("summarize an archive (offline)").option("--json", "print the manifest as JSON").action(async (file, options) => {
+		const parsed = readArchiveFile(file);
+		const check = await verifyArchive(parsed);
+		emit(options, {
+			manifest: parsed.manifest,
+			verification: check
+		}, () => {
+			printFields([
+				["archive", parsed.manifest.archiveId],
+				["created", parsed.manifest.createdAt],
+				["org", `${parsed.manifest.org.name} (${parsed.manifest.org.slug})`],
+				["producer", `${parsed.manifest.producer.service} / ${parsed.manifest.producer.environment}`],
+				["format", parsed.manifest.producer.formatVersion],
+				["requested by", parsed.manifest.requestedBy.label ?? parsed.manifest.requestedBy.actorId],
+				["key material", parsed.data.keyMaterial ? parsed.data.keyMaterial.principalId : "none"],
+				["signature", parsed.signature ? `${parsed.signature.algorithm} / ${parsed.signature.keyId}` : "unsigned"]
+			]);
+			section("sections");
+			printTable(parsed.manifest.sections, [
+				{
+					header: "section",
+					value: (s) => s.name
+				},
+				{
+					header: "rows",
+					value: (s) => String(s.count)
+				},
+				{
+					header: "truncated",
+					value: (s) => s.truncated ? "yes" : ""
+				}
+			], "none");
+			section("verification");
+			printVerification(check);
+		});
+	});
+	archive.command("verify <file>").description("check an archive's digests and signature (offline); exits non-zero if it fails").option("--key-id <id>", "require this signing key id (see /.well-known/seekrit-export-signing-key)").option("--skip-signature", "check digests only").option("--json", "print the verification result as JSON").action(async (file, options) => {
+		const check = await verifyArchive(readArchiveFile(file), {
+			expectKeyId: options.keyId,
+			skipSignature: options.skipSignature
+		});
+		const integrityOk = check.badSections.length === 0 && check.missingSections.length === 0 && check.undeclaredSections.length === 0 && check.manifestDigestOk;
+		const passed = options.skipSignature ? integrityOk : check.ok;
+		emit(options, check, () => printVerification(check));
+		if (!passed) process.exit(1);
+	});
+	archive.command("share <file>").description("unwrap your own recovery share from an archive, for an offline quorum (offline)").option("-o, --out <file>", "write the share here (default: stdout)").option("--token <skt_…>", "unwrap with a service token instead of a passphrase").option("--key-file <path>", "unwrap with a private key JWK file").action(async (file, options) => {
+		const parsed = readArchiveFile(file);
+		if (parsed.data.recoveryShares.length === 0) fail("this archive holds no recovery shares — customer-controlled recovery is not set up");
+		const key = await resolveDecryptKey(parsed, {
+			token: options.token,
+			keyFile: options.keyFile
+		});
+		const candidates = parsed.data.recoveryShares.filter((share) => key.principalId === null || share.custodianId === key.principalId);
+		for (const candidate of candidates) try {
+			const bytes = await unwrapRecoveryShare(candidate.wrappedShare, key.privateKey);
+			const payload = {
+				format: SHARE_FORMAT,
+				org: {
+					id: parsed.manifest.org.id,
+					slug: parsed.manifest.org.slug
+				},
+				custodianType: candidate.custodianType,
+				custodianId: candidate.custodianId,
+				shareIndex: candidate.shareIndex,
+				share: bytesToHex(bytes),
+				note: "Sensitive: a threshold of these shares reconstructs the org recovery key, which opens every environment. Destroy this file after the ceremony."
+			};
+			const text = JSON.stringify(payload, null, 2);
+			if (options.out) {
+				writeOut(options.out, text);
+				console.error(`wrote share ${candidate.shareIndex} to ${options.out}`);
+			} else console.log(text);
+			console.error(`combine ${parsed.data.recoveryConfig?.threshold ?? "M"} shares with: seekrit archive decrypt ${file} --share … --share …`);
+			return;
+		} catch {}
+		fail("none of the recovery shares in this archive unwrap with that key");
+	});
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("--yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
+		if (![
+			"dotenv",
+			"json",
+			"shell"
+		].includes(options.format)) fail(`unknown --format "${options.format}" (dotenv | json | shell)`);
+		const parsed = readArchiveFile(file);
+		const check = await verifyArchive(parsed);
+		if (check.badSections.length > 0 || !check.manifestDigestOk) fail(`refusing to decrypt: ${verificationProblems(check).join("; ")} — run \`seekrit archive verify ${file}\``);
+		if (check.signature !== "valid") console.error(`warning: ${verificationProblems(check).join("; ")}`);
+		if (options.stdout) await confirmDestructive(options.yes, "This prints decrypted secret values to stdout, where they may land in scrollback or CI logs. Continue?");
+		const key = await resolveDecryptKey(parsed, options);
+		const result = await decryptArchive(parsed, key, options.env);
+		console.error(`unlocked with ${key.how}`);
+		const extension = options.format === "json" ? "json" : options.format === "shell" ? "sh" : "env";
+		let written = 0;
+		for (const entry of result.environments) {
+			const body = formatSecrets(entry.values, options.format);
+			if (options.out) {
+				const path = join(options.out, envPath(parsed, entry.env, extension));
+				writeOut(path, `${body}\n`);
+				written += 1;
+				console.error(`${path}  (${count(Object.keys(entry.values).length, "secret")})`);
+			} else {
+				console.log(`# ${entry.label}`);
+				console.log(body);
+				console.log("");
+			}
+		}
+		if (result.skipped.length > 0) console.error(`skipped ${count(result.skipped.length, "environment")} this key holds no grant on: ${result.skipped.join(", ")}`);
+		for (const failure of result.failures) console.error(`failed: ${failure}`);
+		if (options.out) console.error(`wrote ${count(written, "file")} under ${options.out}`);
+		if (result.environments.length === 0) fail("nothing decrypted — this key opens none of the environments in the archive");
+		console.error(`note: values are as stored — \`\${REF}\` references are expanded at read time, not here.`);
+	});
+	archive.command("decryptor").description("write the standalone offline decryptor (a single HTML file, no install, no network)").option("-o, --out <file>", "where to write it", "seekrit-decrypt.html").action((options) => {
+		writeOut(options.out, OFFLINE_DECRYPTOR_HTML);
+		console.error(`wrote ${options.out}`);
+		console.error("open it in any browser — it declares a Content-Security-Policy of `default-src 'none'`, so it cannot reach the network.");
+	});
+}
+//#endregion
 //#region src/audit.ts
 /** The API's per-page ceiling (`auditQuerySchema.limit`). */
 const MAX_PAGE = 200;
@@ -7721,19 +9165,6 @@ function message(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-//#region src/format.ts
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function formatSecrets(values, format) {
-	const names = Object.keys(values).sort();
-	switch (format) {
-		case "json": return JSON.stringify(values, names, 2);
-		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
-	}
-}
-//#endregion
 //#region src/gcp.ts
 /**
 * `seekrit gcp` — temporary GCP credentials via IAM Credentials
@@ -8645,348 +10076,15 @@ function registerOrgCommands(program) {
 	});
 }
 //#endregion
-//#region src/pg.ts
+//#region src/proxy-presets.ts
+/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
+function placeholder(secret) {
+	return `{{seekrit:${secret}}}`;
+}
 /**
-* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
-*
-* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
-* machine and sends only the verifier; the plaintext password never reaches the
-* API or gets stored. Registering a target wraps the admin connection string to
-* the broker's public key locally, so the control plane only ever stores
-* ciphertext.
-*/
-/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$2(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
-}
-/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
-function generateRoleName(prefix = "tmp") {
-	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-	let out = "";
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	for (const b of bytes) out += alphabet[b % 36];
-	return `${prefix}_${out}`;
-}
-function registerPgCommands(program) {
-	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
-	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const executor = options.executor === "remote" ? "remote" : "in_do";
-		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
-		if (![
-			"readonly",
-			"readwrite",
-			"custom"
-		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
-		const accessLevel = options.access;
-		const adminSecret = resolveLeaseAdminSecret({
-			executor,
-			hmacKey: options.hmacKey,
-			adminUrl: options.adminUrl,
-			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
-		});
-		const config = {
-			provider: "postgres",
-			executor,
-			accessLevel,
-			connection: {
-				host: options.host,
-				port: Number.parseInt(options.port, 10),
-				database: options.database
-			},
-			...accessLevel === "custom" ? {
-				...options.createStatement.length ? { createStatements: options.createStatement } : {},
-				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
-			} : { schema: options.schema },
-			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
-		};
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
-		});
-		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
-		const bootstrap = postgresGroupBootstrapSql(config);
-		if (bootstrap) {
-			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
-			console.log(bootstrap);
-		}
-	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "postgres") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
-		}
-	});
-	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
-		const bootstrap = postgresGroupBootstrapSql(cfg);
-		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
-		console.log(bootstrap);
-	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`removed ${targetId}`);
-	});
-	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
-		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
-		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds$2(options.ttl);
-		const { password, verifier } = await generatePostgresCredential();
-		const { connection } = await ctx.client.mintLease(org.id, {
-			provider: "postgres",
-			targetId: target.id,
-			roleName,
-			verifier,
-			ttlSeconds
-		});
-		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
-		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
-		if (options.json) console.log(JSON.stringify({
-			...connection,
-			password,
-			url
-		}, null, 2));
-		else console.log(url);
-	});
-	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
-	});
-	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId}`);
-	});
-}
-/** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
-	acc.push(value);
-	return acc;
-}
-//#endregion
-//#region src/proxy-binary.ts
-/**
-* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
-*
-* The proxy is the strongest answer seekrit has for an untrusted workload — the
-* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
-* thing here to *try*, because trying it meant `cargo` and a TOML file. This
-* module removes the first half: it resolves a prebuilt, checksum-verified
-* binary for the host platform and execs it, so `npx @seekrit/proxy` and
-* `seekrit proxy run` behave like the proxy was already installed.
-*
-* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
-* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
-* entrypoint over it, and the two must not drift.
-*
-* Three properties worth stating, since this downloads and executes code:
-*
-* - **The checksum is verified before anything is executed**, against a
-*   `.sha256` fetched from the same release. That is integrity, not provenance —
-*   it proves the bytes match what the release published, which is exactly the
-*   guarantee `install.sh` gives and no more.
-* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
-*   short-circuits entirely, and a cached download for the same version+target is
-*   reused, so this is a one-time cost per version.
-* - **Version is pinned, not floating.** A default of `latest` would make two
-*   machines run different proxies from the same command; the pinned constant is
-*   what this CLI was built against, overridable when you want otherwise.
-*/
-/**
-* The proxy version this CLI was built against.
-*
-* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
-* release-please-config.json), so the pin follows the crate without anyone
-* remembering to move it.
-*/
-const PROXY_VERSION = "0.10.0";
-const BIN = "seekrit-proxy";
-/**
-* Host → Rust target triple.
-*
-* Linux always resolves to **musl**: that build is statically linked, so one
-* artifact covers glibc, musl, alpine, and distroless, and there is no libc
-* detection to get wrong on a machine where `ldd` says something unexpected.
-*/
-function detectTarget(os = platform(), cpu = arch()) {
-	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
-	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	switch (os) {
-		case "linux": return {
-			target: `${machine}-unknown-linux-musl`,
-			exe: ""
-		};
-		case "darwin": return {
-			target: `${machine}-apple-darwin`,
-			exe: ""
-		};
-		case "win32":
-			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
-			return {
-				target: "x86_64-pc-windows-msvc",
-				exe: ".exe"
-			};
-		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	}
-}
-/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
-function versionPrefix(version) {
-	if (version === "latest") return "latest";
-	return version.startsWith("v") ? version : `v${version}`;
-}
-function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
-}
-function resolveBaseUrl(explicit) {
-	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
-}
-/** Where a resolved binary is kept, keyed so versions and targets never collide. */
-function proxyBinaryPath(version, target, exe) {
-	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
-}
-async function fetchBytes(url) {
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
-	return new Uint8Array(await res.arrayBuffer());
-}
-/**
-* Ensure a `seekrit-proxy` binary exists locally and return its path.
-*
-* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
-* version+target, then a fresh download. A binary already on `PATH` is
-* deliberately *not* used — silently running a different version than the one
-* this CLI pins is the kind of surprise that costs an afternoon.
-*/
-async function resolveProxyBinary(options = {}) {
-	const override = process.env.SEEKRIT_PROXY_BIN;
-	if (override) {
-		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
-		return override;
-	}
-	const version = resolveVersion(options.version);
-	const { target, exe } = detectTarget();
-	const dest = proxyBinaryPath(version, target, exe);
-	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
-	const baseUrl = resolveBaseUrl(options.baseUrl);
-	const prefix = versionPrefix(version);
-	const name = `${BIN}-${target}${exe}`;
-	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
-	const sumUrl = `${binUrl}.sha256`;
-	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
-	let bytes;
-	let expected;
-	try {
-		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
-	}
-	const actual = createHash("sha256").update(bytes).digest("hex");
-	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
-	const dir = dirname(dest);
-	mkdirSync(dir, { recursive: true });
-	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
-	try {
-		writeFileSync(staging, bytes, { mode: 493 });
-		renameSync(staging, dest);
-	} catch (err) {
-		rmSync(staging, { force: true });
-		throw err;
-	}
-	chmodSync(dest, 493);
-	return dest;
-}
-/**
-* Run the proxy, forwarding stdio, signals, and its exit status.
-*
-* The proxy is a long-lived foreground process, so this wrapper has to be
-* transparent: Node cannot exec-replace itself, and without relaying signals
-* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
-* the proxy running, holding decrypted secrets, with the shell prompt back.
-*/
-async function runProxyBinary(argv, options = {}) {
-	const bin = await resolveProxyBinary(options);
-	const child = spawn(bin, argv, {
-		stdio: "inherit",
-		env: {
-			...process.env,
-			...options.env
-		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		child.kill(signal);
-	};
-	for (const signal of signals) process.on(signal, forward);
-	return new Promise((resolve, reject) => {
-		child.on("error", (err) => {
-			for (const s of signals) process.off(s, forward);
-			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
-		});
-		child.on("exit", (code, signal) => {
-			for (const s of signals) process.off(s, forward);
-			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
-		});
-	});
-}
-/** Signal name → number, for the 128+n exit convention. */
-function signalNumber(signal) {
-	return {
-		SIGHUP: 1,
-		SIGINT: 2,
-		SIGQUIT: 3,
-		SIGKILL: 9,
-		SIGTERM: 15
-	}[signal] ?? 0;
-}
-//#endregion
-//#region src/proxy-presets.ts
-/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
-function placeholder(secret) {
-	return `{{seekrit:${secret}}}`;
-}
-/**
-* The catalogue. Ordered as `seekrit proxy presets` prints it: the two model
-* APIs an agent almost certainly calls, then the aggregators, then the generic
-* escape hatches.
+* The catalogue. Ordered as `seekrit proxy presets` prints it: the three model
+* APIs an agent almost certainly calls, then the aggregators, then the generic
+* escape hatches.
 */
 const PROXY_PRESETS = [
 	{
@@ -9029,6 +10127,28 @@ const PROXY_PRESETS = [
 			value: placeholder("ANTHROPIC_API_KEY")
 		}]
 	},
+	{
+		id: "gemini",
+		label: "Gemini API (generativelanguage.googleapis.com)",
+		host: "generativelanguage.googleapis.com",
+		prefix: "/gemini",
+		secret: "GEMINI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1beta/**", "/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GOOGLE_GEMINI_BASE_URL",
+			value: "{{base}}",
+			note: "gemini-cli reads GEMINI_BASE_URL instead — set both if you run either."
+		}, {
+			name: "GEMINI_API_KEY",
+			value: placeholder("GEMINI_API_KEY")
+		}] : [{
+			name: "GEMINI_API_KEY",
+			value: placeholder("GEMINI_API_KEY")
+		}],
+		note: "Gemini authenticates with an x-goog-api-key header; a ?key= query string is substituted too, but prefer the header."
+	},
 	{
 		id: "openrouter",
 		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
@@ -9388,186 +10508,708 @@ function planFromPresets(presets, options) {
 	return {
 		mode: options.mode,
 		listen: options.listen,
-		forwardListen: options.forwardListen,
-		routes,
-		unmatched: options.unmatched,
-		caCert: options.caCert,
-		caKey: options.caKey,
-		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
-		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
-		...options.control ? { control: options.control } : {},
-		...options.tasks ? { tasks: options.tasks } : {},
-		...options.activity ? { activity: options.activity } : {},
-		envHints,
-		notes
-	};
+		forwardListen: options.forwardListen,
+		routes,
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/**
+* Build a server-policy plan from an agent's published rules.
+*
+* The rules are used for **routing only** — one `[[route]]` per distinct host,
+* so the workload has a base URL to point at — and never copied into the file as
+* authorization. That is the whole trade of server mode: adding an upstream
+* becomes a dashboard change, and a rule this file also stated would be a
+* startup error rather than a belt-and-braces duplicate.
+*/
+function planFromPolicy(args, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	const seen = /* @__PURE__ */ new Set();
+	for (const rule of args.rules) {
+		if (!rule.host || seen.has(rule.host)) continue;
+		seen.add(rule.host);
+		const preset = PRESET_BY_HOST.get(rule.host);
+		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
+		routes.push({
+			prefix,
+			upstream: `https://${rule.host}`,
+			host: rule.host,
+			allow: [],
+			methods: [],
+			paths: [],
+			baseUrl
+		});
+		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		policy: {
+			agent: args.agent,
+			agents: args.agents,
+			refreshInterval: args.refreshInterval,
+			signers: args.signers
+		},
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/** Host → preset, for naming routes generated from published policy. */
+const PRESET_BY_HOST = /* @__PURE__ */ new Map();
+for (const id of [
+	"openai",
+	"anthropic",
+	"openrouter",
+	"github"
+]) {
+	const preset = findPreset(id);
+	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+}
+/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
+function yamlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+const COMPOSE_DEFAULTS = {
+	service: "seekrit-proxy",
+	workload: "agent",
+	publish: false
+};
+/**
+* A `docker compose` sidecar snippet for a generated config.
+*
+* The container case differs from the local one in exactly the ways that break a
+* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
+* reachable from a sibling container, the workload dials it by *service name*
+* rather than loopback, and in forward mode the CA has to live on a shared
+* volume or the workload trusts a certificate the proxy no longer has.
+*/
+function renderComposeSnippet(plan, options) {
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	const [, listenPort = "8080"] = splitHostPort(plan.listen);
+	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
+	const host = options.service;
+	const out = [
+		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
+		"#",
+		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
+		"# Keeping them in separate containers is what makes that boundary real: the",
+		"# service token is in the proxy's environment, where the workload cannot read it.",
+		"services:",
+		`  ${host}:`,
+		`    image: ${options.image}`
+	];
+	const command = [];
+	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
+	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
+	if (forward) {
+		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
+		out.push("    # config too — there is no flag for the forward plane's address.");
+	}
+	out.push("    environment:");
+	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
+	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
+	out.push("    volumes:");
+	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
+	if (forward) {
+		out.push("      # The interception CA must survive restarts, or the certificate the");
+		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
+		out.push("      - seekrit-proxy-ca:/ca");
+	}
+	if (options.publish) {
+		out.push("    ports:");
+		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
+		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
+	} else {
+		out.push("    # No `ports`: reachable on the compose network only, which is what you");
+		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
+	}
+	out.push("    restart: unless-stopped");
+	out.push("");
+	out.push(`  ${options.workload}:`);
+	out.push("    # ← your workload. It never holds a real credential.");
+	out.push("    image: your-agent:latest");
+	out.push("    depends_on:");
+	out.push(`      - ${host}`);
+	out.push("    environment:");
+	if (forward) {
+		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
+		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+	}
+	for (const hint of plan.envHints) {
+		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
+		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
+		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	}
+	out.push("");
+	if (forward) {
+		out.push("volumes:");
+		out.push("  seekrit-proxy-ca:");
+		out.push("");
+	}
+	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
+	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
+	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+//#endregion
+//#region src/paperclip.ts
+/**
+* `seekrit paperclip` — wire seekrit into a [Paperclip](https://docs.paperclip.ing)
+* agent.
+*
+* Paperclip is a control plane: it decides which agent runs, and its *adapter*
+* launches the runtime that does the work. Two consequences shape this command.
+*
+* First, **MCP config is per-runtime, not per-Paperclip-agent.** There is no
+* field in Paperclip's database that means "give this agent the seekrit tools" —
+* the adapter's runtime (Claude Code, Codex, Gemini CLI, OpenCode) reads its own
+* MCP config from the working directory Paperclip points it at. So attaching the
+* seekrit servers means writing a `.mcp.json` *there*, which is what this does.
+*
+* Second, **a seekrit secret cannot be a Paperclip `secret_ref`.** Paperclip's
+* provider list is closed (`local_encrypted`, `aws_secrets_manager`,
+* `gcp_secret_manager`, `vault`), so there is nothing to select. Values reach a
+* run through `seekrit run` / the `run_command` tool, or — better, for a run
+* whose output you cannot predict — through the egress proxy, where the adapter
+* env holds `{{seekrit:NAME}}` placeholders and never a key. The env block this
+* command prints is that second shape, ready to paste into the agent's
+* Configuration tab.
+*
+* The proxy's own config file stays with `seekrit proxy init`. That command
+* already owns the reviewable-security-artifact warnings, and a second
+* generator behind a different name is how the two drift apart.
+*/
+/** Claude Code and friends read this name from the runtime's working directory. */
+const MCP_FILE = ".mcp.json";
+/**
+* The two seekrit MCP servers, in the shape a *runtime's* `.mcp.json` wants.
+*
+* These are the same two servers `agent-plugin/mcp.json` declares, and a test
+* pins them to that file so a rename cannot land in one place only. The one
+* field that is deliberately **not** copied is the remote transport's spelling:
+* the Agent Plugins manifest says `streamable-http`, while Claude Code's own
+* `.mcp.json` says `http`. Writing the manifest's spelling into a runtime config
+* produces a server the runtime silently declines to load, which reads as "the
+* hosted server is down".
+*/
+const PAPERCLIP_MCP_SERVERS = {
+	seekrit: {
+		type: "stdio",
+		command: "npx",
+		args: ["-y", "@seekrit/mcp"]
+	},
+	"seekrit-cloud": {
+		type: "http",
+		url: "https://mcp.seekrit.dev/mcp"
+	}
+};
+/**
+* Merge the seekrit servers into an existing `.mcp.json` without disturbing it.
+*
+* An agent's working directory is usually a real repository, so this file may
+* already carry servers someone else depends on — replacing it wholesale is a
+* silent regression in whatever they were doing. Unknown top-level keys are
+* preserved for the same reason: runtimes keep growing new ones.
+*
+* A `seekrit` entry that already exists and *differs* is left alone unless
+* forced. Someone pinning a version or adding an `env` did it on purpose.
+*/
+function mergeMcpServers(existing, force) {
+	const servers = { ...existing.mcpServers ?? {} };
+	const added = [];
+	const kept = [];
+	for (const [name, entry] of Object.entries(PAPERCLIP_MCP_SERVERS)) {
+		const current = servers[name];
+		if (current && !force) {
+			if (JSON.stringify(current) === JSON.stringify(entry)) continue;
+			kept.push(name);
+			continue;
+		}
+		servers[name] = entry;
+		added.push(name);
+	}
+	return {
+		merged: {
+			...existing,
+			mcpServers: servers
+		},
+		added,
+		kept
+	};
+}
+function readMcpFile(path) {
+	if (!existsSync(path)) return {};
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) fail(`${path} is not a JSON object — fix or move it before writing MCP servers there`);
+		return parsed;
+	} catch (err) {
+		if (err instanceof SyntaxError) fail(`${path} is not valid JSON (${err.message}) — fix or move it first`);
+		throw err;
+	}
+}
+/**
+* The env a Paperclip agent needs, given the upstreams it calls.
+*
+* Every value here is a plain string: a placeholder is not a secret, so none of
+* it needs a `secret_ref` and none of it trips
+* `PAPERCLIP_SECRETS_STRICT_MODE` — which is exactly why this is the path to
+* recommend. The env is derived from the same preset catalogue and the same
+* plan builder `seekrit proxy init` uses, so what gets pasted into Paperclip and
+* what the proxy enforces cannot disagree.
+*
+* One hint has to be rewritten on the way through. The shared generator writes
+* the CA path as `$PWD/seekrit-proxy-ca.pem`, which is correct for the `export`
+* lines it normally produces — a shell expands it. **Paperclip's env map is not a
+* shell.** Pasted verbatim it becomes a literal `$PWD/…`, the runtime cannot find
+* the CA, and every HTTPS call fails with a certificate error that looks like a
+* proxy bug. So it is replaced with a marker that cannot be mistaken for a
+* working value.
+*/
+const ABSOLUTE_PATH_MARKER = "<absolute path to>";
+function adapterEnv(presets, options) {
+	if (presets.length === 0) return [];
+	return planFromPresets(presets, {
+		...PLAN_DEFAULTS,
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen
+	}).envHints.map((hint) => {
+		if (!hint.value.includes("$PWD/")) return { ...hint };
+		return {
+			...hint,
+			value: hint.value.replace("$PWD/", `${ABSOLUTE_PATH_MARKER} `),
+			note: `${hint.note ? `${hint.note} ` : ""}Paperclip does not expand shell variables — paste the real path the proxy wrote this to.`
+		};
+	});
+}
+function registerPaperclipCommands(program) {
+	program.command("paperclip").description("wire seekrit into a Paperclip agent (`seekrit paperclip --help`)").command("init").description("attach the seekrit MCP servers to a Paperclip agent's working directory").option("-d, --dir <path>", "the agent's working directory", ".").option("--preset <id...>", `upstreams the agent calls, for the printed adapter env (${presetIds().join(", ")})`).option("--mode <mode>", "proxy mode the printed env assumes: forward or reverse", "forward").option("--listen <addr>", "reverse-mode proxy address", PLAN_DEFAULTS.listen).option("--forward-listen <addr>", "forward-mode proxy address", PLAN_DEFAULTS.forwardListen).option("--no-mcp", "print the adapter env only, without writing .mcp.json").option("--force", "overwrite a seekrit entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.mode !== "forward" && options.mode !== "reverse") fail(`--mode must be forward or reverse (got "${options.mode}")`);
+		const presets = [];
+		for (const id of options.preset ?? []) {
+			const preset = findPreset(id);
+			if (!preset) fail(`unknown preset "${id}" — try one of: ${presetIds().join(", ")}`);
+			if (preset.requiresBaseUrl) fail(`preset "${id}" needs a base URL, which this command does not take —\n  generate its env with: seekrit proxy init --preset ${id} --base-url https://…`);
+			presets.push(preset);
+		}
+		const dir = resolve(options.dir);
+		const mcpPath = join(dir, MCP_FILE);
+		let added = [];
+		let kept = [];
+		if (options.mcp) {
+			if (!existsSync(dir)) fail(`no such directory: ${options.dir}\n  Pass --dir with the agent's working directory (its Configuration tab shows it).`);
+			const result = mergeMcpServers(readMcpFile(mcpPath), Boolean(options.force));
+			added = result.added;
+			kept = result.kept;
+			writeFileSync(mcpPath, `${JSON.stringify(result.merged, null, 2)}\n`, { mode: 420 });
+		}
+		const env = adapterEnv(presets, {
+			mode: options.mode,
+			listen: options.listen,
+			forwardListen: options.forwardListen
+		});
+		emit(options, {
+			mcpFile: options.mcp ? mcpPath : null,
+			added,
+			kept,
+			env
+		}, () => {
+			if (options.mcp) {
+				process.stderr.write(added.length > 0 ? `Wrote ${mcpPath} (${added.join(", ")})\n` : `${mcpPath} already had both seekrit servers\n`);
+				for (const name of kept) process.stderr.write(`seekrit: left the existing "${name}" entry alone — pass --force to replace it\n`);
+			}
+			if (env.length > 0) {
+				process.stderr.write("\nAdapter environment variables (Agent → Configuration → Environment variables).\nEvery value is a plain string — a placeholder is not a secret, so none of\nthese needs a Paperclip secret_ref:\n\n");
+				printTable(env, [col("VARIABLE", (h) => h.name), col("VALUE", (h) => h.value)], "no env for these presets");
+				const notes = env.filter((h) => h.note);
+				if (notes.length > 0) {
+					process.stderr.write("\n");
+					for (const hint of notes) process.stderr.write(`  ${hint.name}: ${hint.note}\n`);
+				}
+				const presetFlags = presets.map((p) => `--preset ${p.id}`).join(" ");
+				process.stderr.write(`\nThose values only resolve behind a running proxy. Write its config with:\n  seekrit proxy init --mode ${options.mode} ${presetFlags}\n`);
+			} else process.stderr.write("\nNo --preset given, so no adapter env was printed. Pass the upstreams this\nagent calls to get the placeholder env for them, e.g.\n  seekrit paperclip init --preset anthropic --preset openai\n");
+			process.stderr.write("\nAlso worth doing once per company:\n  npx paperclipai plugin install @seekrit/paperclip-plugin   # tools, skills, panel\n  Skills page → https://github.com/seekritdev/agent-plugin   # skills alone\n");
+		});
+	});
 }
+//#endregion
+//#region src/pg.ts
 /**
-* Build a server-policy plan from an agent's published rules.
+* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
 *
-* The rules are used for **routing only** — one `[[route]]` per distinct host,
-* so the workload has a base URL to point at — and never copied into the file as
-* authorization. That is the whole trade of server mode: adding an upstream
-* becomes a dashboard change, and a rule this file also stated would be a
-* startup error rather than a belt-and-braces duplicate.
+* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
+* machine and sends only the verifier; the plaintext password never reaches the
+* API or gets stored. Registering a target wraps the admin connection string to
+* the broker's public key locally, so the control plane only ever stores
+* ciphertext.
 */
-function planFromPolicy(args, options) {
-	const taken = /* @__PURE__ */ new Set();
-	const routes = [];
-	const envHints = [];
-	const notes = [];
-	const hintMode = options.mode === "forward" ? "forward" : "reverse";
-	const seen = /* @__PURE__ */ new Set();
-	for (const rule of args.rules) {
-		if (!rule.host || seen.has(rule.host)) continue;
-		seen.add(rule.host);
-		const preset = PRESET_BY_HOST.get(rule.host);
-		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
-		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
-		routes.push({
-			prefix,
-			upstream: `https://${rule.host}`,
-			host: rule.host,
-			allow: [],
-			methods: [],
-			paths: [],
-			baseUrl
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$2(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
+function generateRoleName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerPgCommands(program) {
+	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
+	const target = pg.command("target").description("manage provisioning targets");
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
 		});
-		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
-			...hint,
-			value: hint.value.replace("{{base}}", baseUrl)
+		const config = {
+			provider: "postgres",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : { schema: options.schema },
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+		const bootstrap = postgresGroupBootstrapSql(config);
+		if (bootstrap) {
+			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
+			console.log(bootstrap);
+		}
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "postgres") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
+		const bootstrap = postgresGroupBootstrapSql(cfg);
+		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
+		console.log(bootstrap);
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
+		const roleName = options.role ?? generateRoleName();
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const { password, verifier } = await generatePostgresCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "postgres",
+			targetId: target.id,
+			roleName,
+			verifier,
+			ttlSeconds
 		});
+		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+	});
+	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
+//#region src/proxy-binary.ts
+/**
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
+*
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
+*/
+/**
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
+*/
+const PROXY_VERSION = "0.10.0";
+const BIN = "seekrit-proxy";
+/**
+* Host → Rust target triple.
+*
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
+*/
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
 	}
-	if (hintMode === "forward") envHints.unshift({
-		name: "HTTPS_PROXY",
-		value: `http://${options.forwardListen}`
-	}, {
-		name: "NODE_EXTRA_CA_CERTS",
-		value: `$PWD/${options.caCert}`,
-		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
-	});
-	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
-	return {
-		mode: options.mode,
-		listen: options.listen,
-		forwardListen: options.forwardListen,
-		routes,
-		policy: {
-			agent: args.agent,
-			agents: args.agents,
-			refreshInterval: args.refreshInterval,
-			signers: args.signers
-		},
-		unmatched: options.unmatched,
-		caCert: options.caCert,
-		caKey: options.caKey,
-		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
-		...options.control ? { control: options.control } : {},
-		...options.tasks ? { tasks: options.tasks } : {},
-		...options.activity ? { activity: options.activity } : {},
-		envHints,
-		notes
-	};
 }
-/** Host → preset, for naming routes generated from published policy. */
-const PRESET_BY_HOST = /* @__PURE__ */ new Map();
-for (const id of [
-	"openai",
-	"anthropic",
-	"openrouter",
-	"github"
-]) {
-	const preset = findPreset(id);
-	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
 }
-/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
-function yamlString(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
+}
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
 }
-const COMPOSE_DEFAULTS = {
-	service: "seekrit-proxy",
-	workload: "agent",
-	publish: false
-};
 /**
-* A `docker compose` sidecar snippet for a generated config.
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
 *
-* The container case differs from the local one in exactly the ways that break a
-* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
-* reachable from a sibling container, the workload dials it by *service name*
-* rather than loopback, and in forward mode the CA has to live on a shared
-* volume or the workload trusts a certificate the proxy no longer has.
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
 */
-function renderComposeSnippet(plan, options) {
-	const reverse = plan.mode === "reverse" || plan.mode === "both";
-	const forward = plan.mode === "forward" || plan.mode === "both";
-	const [, listenPort = "8080"] = splitHostPort(plan.listen);
-	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
-	const host = options.service;
-	const out = [
-		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
-		"#",
-		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
-		"# Keeping them in separate containers is what makes that boundary real: the",
-		"# service token is in the proxy's environment, where the workload cannot read it.",
-		"services:",
-		`  ${host}:`,
-		`    image: ${options.image}`
-	];
-	const command = [];
-	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
-	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
-	if (forward) {
-		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
-		out.push("    # config too — there is no flag for the forward plane's address.");
-	}
-	out.push("    environment:");
-	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
-	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
-	out.push("    volumes:");
-	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
-	if (forward) {
-		out.push("      # The interception CA must survive restarts, or the certificate the");
-		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
-		out.push("      - seekrit-proxy-ca:/ca");
-	}
-	if (options.publish) {
-		out.push("    ports:");
-		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
-		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
-	} else {
-		out.push("    # No `ports`: reachable on the compose network only, which is what you");
-		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
-	}
-	out.push("    restart: unless-stopped");
-	out.push("");
-	out.push(`  ${options.workload}:`);
-	out.push("    # ← your workload. It never holds a real credential.");
-	out.push("    image: your-agent:latest");
-	out.push("    depends_on:");
-	out.push(`      - ${host}`);
-	out.push("    environment:");
-	if (forward) {
-		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
-		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
-		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
-		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
 	}
-	for (const hint of plan.envHints) {
-		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
-		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
-		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
 	}
-	out.push("");
-	if (forward) {
-		out.push("volumes:");
-		out.push("  seekrit-proxy-ca:");
-		out.push("");
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
 	}
-	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
-	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
-	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
-	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+	chmodSync(dest, 493);
+	return dest;
+}
+/**
+* Run the proxy, forwarding stdio, signals, and its exit status.
+*
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
+*/
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
+}
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
 }
 //#endregion
 //#region src/proxy.ts
@@ -11827,6 +13469,7 @@ registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
+registerPaperclipCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
@@ -11840,6 +13483,7 @@ program.command("mcp").description("run an MCP server over stdio so AI agents ca
 });
 registerAuditCommands(program);
 registerAccountCommands(program);
+registerArchiveCommands(program);
 registerLogSinkCommands(program);
 registerSyncCommands(program);
 registerBillingCommands(program);