@stravica-ai/digital-operator-pa 0.1.0

package/dist/engineering-pa-cli/src/scheduler/cli.mjs

@@ -0,0 +1,197 @@
+// scheduler — CLI wrapper.
+//
+// Routes verbs to the library functions in @stravica-ai/engineering-pa-core's
+// scheduler module. Each verb gets a thin wrapper that translates argv into
+// the library call shape.
+//
+// Exit codes (§6 of the tooling standard):
+//   0 ok | 1 usage | 2 logical/operational failure | 3 transport/io
+
+import { parseArgs } from 'node:util';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+// Cross-package import via package-name + subpath. core declares
+// `./src/*` in its `exports` map; cli declares core as a workspace
+// dependency. The publish-time bundler (packages/engineering-pa/build.mjs)
+// rewrites this string to a relative path inside the single-bundled
+// tarball.
+import { detect, install, list, remove, verify } from '../../../engineering-pa-core/src/scheduler/index.mjs';
+
+const USAGE = `scheduler — operator-facing scheduling primitives
+
+Usage:
+  scheduler detect                      Detect available scheduling backends
+  scheduler install <schedule.json> [--force-host]
+                                         Install a schedule onto its declared backend
+  scheduler list [--backend <name>] [--agent <name>]
+                                         List installed schedules
+  scheduler remove <id> [--backend N] [--agent <name>] [--delete-file]
+                                         Remove an installed schedule
+  scheduler verify <schedule.json>      Verify a schedule fires correctly
+  scheduler -h, --help                  Show this help
+
+Schedule files live at <repoRoot>/schedules/<id>.json. The canonical
+schema is bundled at @stravica-ai/engineering-pa-core/schema/schedule.json.
+
+--agent (launchd only) targets a specific agent's label prefix
+(com.<agent>.<id>). A schedule file's own top-level "agent" field drives
+install; list/remove take it explicitly since they don't read a schedule
+file. Defaults to "dave" everywhere — omitting it is unchanged behaviour.
+
+Host enforcement (install): a schedule's "host" field is matched against
+this machine's hostname (exact, then short-name-before-first-dot). A
+mismatch refuses install (exit 2) unless --force-host is passed (still
+warns). A missing "host" field is a warning-only pass, never a refusal.
+Name-collision check (install): refuses (exit 2) when another .json file
+in the same schedules directory declares the same "id".
+
+Exit codes:
+  0  ok
+  1  usage error
+  2  operational failure
+  3  transport/io failure
+`;
+
+export async function run(argv) {
+  if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+    process.stdout.write(USAGE);
+    return 0;
+  }
+
+  const verb = argv[0];
+  const rest = argv.slice(1);
+
+  try {
+    switch (verb) {
+      case 'detect': {
+        const report = await detect();
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return 0;
+      }
+      case 'install': {
+        const { values, positionals } = parseArgs({
+          args: rest,
+          options: {
+            backend: { type: 'string' },
+            'force-host': { type: 'boolean', default: false },
+          },
+          strict: true,
+          allowPositionals: true,
+        });
+        if (positionals.length === 0) {
+          process.stderr.write('[scheduler] install: expected a schedule.json path\n');
+          return 1;
+        }
+        // BUG 1 fix: core's install() reads the schedule file itself
+        // (readFileSync(path)) — it always expected a PATH, never a parsed
+        // object. This CLI used to JSON.parse the file and hand install()
+        // the resulting object, which readFileSync then choked on with
+        // ERR_INVALID_ARG_TYPE on every invocation. We still parse the file
+        // here, but only to read schedule.backend as the --backend fallback
+        // (core has no other way to know the CLI's flag-vs-file precedence
+        // rule); the value actually passed to install() is the path.
+        const schedulePath = resolve(positionals[0]);
+        const schedule = JSON.parse(await readFile(schedulePath, 'utf8'));
+        const result = await install(schedulePath, values.backend || schedule.backend, {
+          forceHost: values['force-host'],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        // BUG 2 fix: install() used to fall off the end of the function
+        // with no return value, so `result.ok` was `undefined.ok` — a
+        // TypeError swallowed by the outer catch, always reporting exit 2
+        // even on a successful install. install() now always returns an
+        // { ok, ... } object.
+        return result.ok ? 0 : 2;
+      }
+      case 'list': {
+        const { values } = parseArgs({
+          args: rest,
+          options: { backend: { type: 'string' }, agent: { type: 'string' } },
+          strict: true,
+        });
+        // Auto-detect the backend if --backend is not supplied. Falling
+        // through to list(undefined) used to throw "Unknown backend: undefined"
+        // and the catch-block translated that to a confusing exit-2 with a
+        // stack-trace-shaped error. Now: try detect() first; if there is no
+        // available backend, surface a clean exit-2 with a remediation message.
+        let backend = values.backend;
+        if (!backend) {
+          const info = await detect();
+          const pick = (info.available || []).find((b) => b.recommended)
+            || (info.available || [])[0];
+          if (pick) {
+            backend = pick.backend;
+          } else {
+            process.stderr.write('[scheduler] list: no scheduling backend detected on this host. Pass --backend cron|launchd|systemd|schtasks to force one.\n');
+            return 2;
+          }
+        }
+        // Signature-audit fix (sibling of BUG 1/2): core's list() returns
+        // an already-formatted human-readable STRING (see
+        // packages/workspace/src/api.mjs, which does
+        // `String(scheduler.list(backend)).trim()`), not JSON data. This
+        // CLI used to JSON.stringify() that string, printing a single
+        // quoted, escaped-newline blob instead of the listing. Write it
+        // through as-is.
+        const items = await list(backend, { agent: values.agent });
+        process.stdout.write(items + '\n');
+        return 0;
+      }
+      case 'remove': {
+        const { values, positionals } = parseArgs({
+          args: rest,
+          options: {
+            backend: { type: 'string' },
+            agent: { type: 'string' },
+            'delete-file': { type: 'boolean', default: false },
+          },
+          strict: true,
+          allowPositionals: true,
+        });
+        if (positionals.length === 0) {
+          process.stderr.write('[scheduler] remove: expected a schedule id\n');
+          return 1;
+        }
+        const result = await remove(positionals[0], values.backend, {
+          deleteFile: values['delete-file'],
+          agent: values.agent,
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        // Same BUG-2-class fix as install(): remove() now always returns
+        // { ok, ... } instead of undefined.
+        return result.ok ? 0 : 2;
+      }
+      case 'verify': {
+        const { values, positionals } = parseArgs({
+          args: rest,
+          options: { backend: { type: 'string' }, timeout: { type: 'string' } },
+          strict: true,
+          allowPositionals: true,
+        });
+        if (positionals.length === 0) {
+          process.stderr.write('[scheduler] verify: expected a schedule.json path\n');
+          return 1;
+        }
+        // Same BUG 1 class as install(): core's verify() also reads the
+        // schedule file itself and expects a PATH. Its own backend
+        // fallback (opts.backend || sched.backend || detectDefaultBackend())
+        // already lives inside verify(), so — unlike install() — nothing
+        // needs pre-parsing here at all.
+        const schedulePath = resolve(positionals[0]);
+        const opts = {};
+        if (values.backend) opts.backend = values.backend;
+        if (values.timeout) opts.timeoutMs = parseInt(values.timeout, 10);
+        const result = await verify(schedulePath, opts);
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return result.exitCode ?? (result.ok ? 0 : 2);
+      }
+      default:
+        process.stderr.write(`[scheduler] unknown verb: ${verb}\n`);
+        process.stderr.write(USAGE);
+        return 1;
+    }
+  } catch (err) {
+    process.stderr.write(`[scheduler] ${err.message || err}\n`);
+    return err.exitCode ?? 2;
+  }
+}

package/dist/engineering-pa-cli/src/secrets/cli.mjs

@@ -0,0 +1,254 @@
+// secrets — SOPS+age secrets CLI. Verb routing + exit-code translation.
+//
+// Exit code contract (@stravica-ai/engineering-pa-core/docs/standards/tooling.md §6):
+//   0 OK
+//   1 usage / not-found / uninitialised vault
+//   2 operational failure (sops decrypt/encrypt failed, cannot parse)
+//   3 transport failure (spawn failed, binary missing and unreachable)
+//
+import { runInit } from './commands/init.mjs';
+import { runGet } from './commands/get.mjs';
+import { runSet } from './commands/set.mjs';
+import { runList } from './commands/list.mjs';
+import { runDelete } from './commands/delete.mjs';
+import { runRotate } from './commands/rotate.mjs';
+import { runStatus } from './commands/status.mjs';
+import { runBackup } from './commands/backup.mjs';
+import { runVaults } from './commands/vaults.mjs';
+import { runFind } from './commands/find.mjs';
+import { runVerify } from './commands/verify.mjs';
+import { resolveScopePaths, VaultError } from './vault.mjs';
+
+const HELP = `secrets — SOPS+age secrets management
+
+Usage:
+  secrets init              Initialise the vault (generate keys, create empty secrets file)
+  secrets get KEY           Retrieve a secret
+  secrets set KEY VALUE     Store or update a secret (use \`-\` as VALUE to read from stdin)
+                             --canonical-clone PATH: write the canonical
+                             clone's vault file FIRST, then this workspace
+                             copy. If the canonical write fails, aborts
+                             before touching the workspace copy at all.
+  secrets list              List all secret key names (not values)
+  secrets delete KEY        Remove a secret
+  secrets rotate            Re-encrypt with current recipients
+  secrets status            Check vault health and report key info
+  secrets backup            Show QR code of master key for backup (opens browser)
+  secrets vaults            List every vault visible from the workspace
+                             (scope, layout, key count, path — no decryption)
+  secrets find KEY          Report which vault(s) contain KEY by name
+                             (alias: which; names/paths only, never values;
+                              exits 1 when not found)
+  secrets verify --values --against <path>
+                             Byte-level comparison of DECRYPTED values
+                             between this vault and a reference vault at
+                             <path>. Reports per-key same/differs/missing.
+                             --values is required — decrypt-only is never
+                             a valid pass (see below). Never prints values.
+
+Private key:      ~/.config/stravica-pa/age-key.txt  (never committed)
+Public key:       .vault/recipients.txt       (committed to repo)
+Encrypted store:  .vault/secrets.enc.json     (committed to repo)
+SOPS config:      .vault/.sops.yaml           (committed to repo)
+
+Workspace resolution (all verbs), in order:
+  1. Walk up from the current directory for a vault-bearing workspace
+     (.vault/ or vault/*.enc.json). A git repo WITHOUT a vault does not
+     stop resolution — it falls through to the next tiers with a stderr
+     notice naming the store actually targeted.
+  2. $DAVE_ROOT (or $DAVE_REPO_ROOT / $PA_REPO_ROOT).
+  3. "workspaceRoot" in ~/.config/stravica-pa/defaults.json (written by
+     you or provisioning; the CLI never creates it).
+  4. Error listing what was tried.
+  NOTE: this precedence is a change — the environment variable used to be
+  checked BEFORE the directory walk. Standing inside a workspace now
+  always targets THAT workspace, even when $DAVE_ROOT points elsewhere.
+  Exception: 'secrets init' inside a vault-less git repo initialises the
+  vault there (it creates; the repo you are standing in is its target).
+
+Scoped vaults:
+  --scope NAME              Target the scoped vault "NAME" instead of the
+                             legacy single-file vault. Resolved by walking
+                             up to the repo root and checking, in order:
+                               .vault/scopes/NAME.enc.json   (workspace layout)
+                               vault/NAME.enc.json           (canonical layout)
+                             Both present is an error — pass --file to
+                             disambiguate. Supported on: get, set, list,
+                             delete, rotate, status, vaults, find.
+  --file PATH                Bypass scope resolution and operate directly on
+                             the encrypted file at PATH (its .sops.yaml is
+                             expected alongside it, same directory). Escape
+                             hatch for canonical-layout clones. Supported on
+                             the same verbs as --scope.
+
+  Flags may appear anywhere in argv, e.g.:
+    secrets --scope wsd get API_KEY
+    secrets get API_KEY --scope wsd
+    secrets --file ./vault/api.enc.json set KEY -
+
+  With neither flag, get/set resolve a DEFAULT scope (see below) before
+  falling back to the legacy .vault/ vault. Other verbs (list, delete,
+  rotate, status, vaults, find, verify) are unaffected by this and always
+  use the legacy vault unless --scope/--file is given explicitly.
+
+Default scope (get/set only, when neither --scope nor --file is given):
+  A one-line stderr notice always fires BEFORE the operation runs, naming
+  the vault actually targeted and where that default came from. Resolved
+  in order:
+    1. $SECRETS_DEFAULT_SCOPE env var.
+    2. "defaultScope" in ~/.config/stravica-pa/defaults.json (same file
+       as "workspaceRoot" above; written by you or provisioning — the
+       CLI never creates it).
+    3. The calling PA's own agents/<name>/identity.json "defaultScope"
+       field, found by walking up from the current directory (or, for
+       Dave specifically, $DAVE_ROOT/agents/dave/identity.json). A
+       malformed identity.json is a stderr warning, not a crash.
+    4. Legacy fallback: the single-file .vault/ vault — the notice says
+       so explicitly ("no scope specified and no default configured").
+  Example notices:
+    note: writing to 'hq-estate' pot (default from SECRETS_DEFAULT_SCOPE env var)
+    note: writing to 'wsd' pot (default from /home/dex/agents/barry/dex/identity.json)
+    note: writing to '(legacy)' pot — no scope specified and no default configured. Use --scope <name> or configure a default.
+
+Canonical-first writes (set only):
+  --canonical-clone PATH    Write PATH (a canonical clone's encrypted
+                             vault file) FIRST, then the resolved
+                             workspace copy SECOND. If the canonical
+                             write fails for any reason (existing store
+                             undecryptable, sops encrypt failure), the
+                             command aborts with exit 2 BEFORE touching
+                             the workspace copy at all — a device-side
+                             vault mutation never round-trips only
+                             halfway. Without this flag, 'set' behaves
+                             exactly as before (workspace copy only).
+
+Value-compare verification:
+  secrets verify --values --against <path>
+    Decrypts BOTH the resolved vault and the vault at <path>, then
+    compares every key's VALUE byte-for-byte — never decrypt-only. A
+    vault clobbered by an always-take-canonical materialisation still
+    decrypts cleanly with placeholder/stale values (same recipients);
+    only a value comparison against a known-good reference catches that.
+    Reports per-key same/differs/missing-in-working/missing-in-reference.
+    Exits 2 if any key differs or is missing on either side. Never
+    prints a decrypted value — only the comparison result per key name.
+`;
+
+const USAGE = `Usage: secrets {init|get|set|list|delete|rotate|status|backup|vaults|find|verify} [KEY] [VALUE]
+
+Commands:
+  init              Initialise the vault (generate keys, create config)
+  get KEY           Retrieve a secret value
+  set KEY VALUE     Store or update a secret (--canonical-clone PATH: write canonical first)
+  list              List all secret key names
+  delete KEY        Remove a secret
+  rotate            Re-encrypt with current recipients
+  status            Check vault health
+  backup            Show QR code of master key for backup
+  vaults            List every visible vault (scope, layout, key count, path)
+  find KEY          Report which vault(s) contain KEY (alias: which)
+  verify --values --against <path>
+                    Byte-level DECRYPTED-value comparison against another vault
+
+Scoped vault flags (get/set/list/delete/rotate/status/vaults/find/verify only):
+  --scope NAME      Target .vault/scopes/NAME.enc.json or vault/NAME.enc.json
+  --file PATH       Bypass resolution, operate directly on PATH
+
+Run 'secrets --help' for full documentation.
+`;
+
+// Commands that know how to operate against a scoped `paths` object.
+// init/backup deal in vault-wide key material, not a single scope's
+// secrets file, so --scope/--file are rejected rather than silently
+// ignored (silently targeting the wrong vault would be worse than an
+// explicit "not supported").
+const SCOPE_AWARE_COMMANDS = new Set(['get', 'set', 'list', 'delete', 'rotate', 'status', 'vaults', 'find', 'which', 'verify']);
+
+/**
+ * Pull --scope/--file (and --scope=X/--file=X) out of argv wherever they
+ * appear, leaving the verb + positional args in original relative order.
+ */
+function extractGlobalFlags(argv) {
+  const rest = [];
+  let scope;
+  let file;
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--scope') { scope = argv[i + 1]; i += 1; continue; }
+    if (a.startsWith('--scope=')) { scope = a.slice('--scope='.length); continue; }
+    if (a === '--file') { file = argv[i + 1]; i += 1; continue; }
+    if (a.startsWith('--file=')) { file = a.slice('--file='.length); continue; }
+    rest.push(a);
+  }
+  return { scope, file, rest };
+}
+
+export async function run(argv, overrides = {}) {
+  const { scope, file, rest } = extractGlobalFlags(argv);
+  const cmd = rest[0];
+  const cmdArgs = rest.slice(1);
+
+  if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
+    process.stdout.write(HELP);
+    return 0;
+  }
+
+  // Validated up front regardless of overrides.paths — overrides.paths is
+  // a test-only injection point, not a legitimate way to make an
+  // unsupported verb accept --scope/--file in real usage.
+  if ((scope || file) && !SCOPE_AWARE_COMMANDS.has(cmd)) {
+    console.error(`Error: --scope/--file are not supported for '${cmd || '(no command)'}'. Supported: ${[...SCOPE_AWARE_COMMANDS].join(', ')}.`);
+    throw new VaultError('scope not supported for command', 1);
+  }
+
+  let paths = overrides.paths;
+  if (!paths && (scope || file)) {
+    paths = resolveScopePaths({
+      scope,
+      file,
+      cwd: overrides.cwd,
+      env: overrides.env,
+      home: overrides.home,
+      keyDir: overrides.keyDir,
+      keyFile: overrides.keyFile,
+    });
+  }
+  const cmdOverrides = paths ? { ...overrides, paths } : overrides;
+
+  switch (cmd) {
+    case 'init':   return runInit(cmdOverrides);
+    case 'get':    return runGet(cmdArgs, cmdOverrides);
+    case 'set':    return runSet(cmdArgs, cmdOverrides);
+    case 'list':   return runList(cmdOverrides);
+    case 'delete': return runDelete(cmdArgs, cmdOverrides);
+    case 'rotate': return runRotate(cmdOverrides);
+    case 'status': return runStatus(cmdOverrides);
+    case 'vaults': return runVaults(cmdOverrides);
+    case 'find':
+    case 'which':  return runFind(cmdArgs, cmdOverrides);
+    case 'verify': return runVerify(cmdArgs, cmdOverrides);
+    case 'backup': {
+      await runBackup(cmdOverrides);
+      return 0;
+    }
+    default: {
+      process.stdout.write(USAGE);
+      return 1;
+    }
+  }
+}
+
+export async function main(argv, overrides = {}) {
+  try {
+    const code = await run(argv, overrides);
+    process.exit(code ?? 0);
+  } catch (err) {
+    const code = err && typeof err.exitCode === 'number' ? err.exitCode : 2;
+    // Error messages for expected failures are already printed by the
+    // command modules. For unexpected errors we surface .message here.
+    if (!err || err.exitCode == null) {
+      console.error(`secrets: ${err && err.message ? err.message : err}`);
+    }
+    process.exit(code);
+  }
+}

package/dist/engineering-pa-cli/src/secrets/commands/backup-template.mjs

@@ -0,0 +1,67 @@
+// backup-template.mjs — HTML template + embedded QR generator for the
+// backup command. Split out so backup.mjs stays readable and so tests
+// can assert on the structural pieces without grepping the generator.
+//
+// The QR generator is the same alphanumeric-mode implementation used in
+// core/tools/workspace/app/onboarding.html — kept in sync to preserve
+// identical rendering.
+
+export const HTML_HEAD = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Dave — Master Key Backup</title>
+<style>
+  :root { --bg: #121218; --bg-surface: #1a1a24; --border: #333346; --text: #d4d4d8; --text-dim: #a1a1aa; --text-bright: #f4f4f5; --accent: #6366f1; --red: #ef4444; --yellow: #f59e0b; }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: 'SF Mono', 'JetBrains Mono', 'Fira Code', monospace; background: var(--bg); color: var(--text); display: flex; align-items: center; justify-content: center; min-height: 100vh; padding: 2rem; }
+  .container { max-width: 540px; width: 100%; }
+  h1 { color: var(--text-bright); font-size: 1.4rem; margin-bottom: 0.5rem; text-align: center; }
+  .subtitle { color: var(--text-dim); font-size: 0.8rem; text-align: center; margin-bottom: 2rem; }
+  .qr-box { background: var(--bg-surface); border: 1px solid var(--border); border-radius: 12px; padding: 2rem; text-align: center; margin-bottom: 1.5rem; }
+  canvas { margin: 0 auto; display: block; }
+  .warning { background: rgba(239,68,68,0.1); border: 1px solid rgba(239,68,68,0.3); border-radius: 8px; padding: 1rem; margin: 1.5rem 0; color: var(--red); font-size: 0.8rem; line-height: 1.6; text-align: center; }
+  .key-section { margin-top: 1.5rem; }
+  .key-label { color: var(--text-dim); font-size: 0.65rem; text-transform: uppercase; letter-spacing: 0.08em; margin-bottom: 0.3rem; }
+  .key-value { background: var(--bg-surface); border: 1px solid var(--border); border-radius: 6px; padding: 0.75rem; font-size: 0.7rem; word-break: break-all; color: var(--text-bright); user-select: all; cursor: text; }
+  .key-value.public { color: var(--accent); }
+  .note { color: var(--text-dim); font-size: 0.7rem; text-align: center; margin-top: 1.5rem; line-height: 1.6; }
+</style>
+</head>
+<body>
+<div class="container">
+  <h1>Master Key Backup</h1>
+  <p class="subtitle">Scan this QR code with your password manager or phone</p>
+  <div class="qr-box"><canvas id="qr-canvas"></canvas></div>
+  <div class="warning">This is your master encryption key. If you lose it, your encrypted secrets cannot be recovered. Store it somewhere safe and offline.</div>
+  <div class="key-section">
+    <div class="key-label">Secret Key (click to select)</div>
+    <div class="key-value" id="secret-key"></div>
+  </div>
+  <div class="key-section" id="pub-section" style="display:none">
+    <div class="key-label">Public Key (for reference)</div>
+    <div class="key-value public" id="public-key"></div>
+  </div>
+  <p class="note">This page is a temporary file and will not persist.<br>Close this tab when you have backed up your key.</p>
+</div>
+<script>
+`;
+
+// Shared with onboarding.html — hand-rolled alphanumeric QR generator.
+export const QR_JS = `var QR=(function(){var EXP=new Array(256),LOG=new Array(256);(function(){var x=1;for(var i=0;i<255;i++){EXP[i]=x;LOG[x]=i;x=x*2;if(x>=256)x^=0x11d;}EXP[255]=EXP[0];})();function gfMul(a,b){return a===0||b===0?0:EXP[(LOG[a]+LOG[b])%255];}function rsGenPoly(n){var poly=[1];for(var i=0;i<n;i++){var next=new Array(poly.length+1);next[0]=0;for(var j=0;j<poly.length;j++)next[j+1]=poly[j];var factor=EXP[i];for(var j=0;j<poly.length;j++)next[j]^=gfMul(poly[j],factor);poly=next;}return poly;}function rsEncode(data,ecLen){var gen=rsGenPoly(ecLen);var msg=new Array(data.length+ecLen);for(var i=0;i<data.length;i++)msg[i]=data[i];for(var i=data.length;i<msg.length;i++)msg[i]=0;for(var i=0;i<data.length;i++){var coef=msg[i];if(coef!==0){for(var j=0;j<gen.length;j++)msg[i+j]^=gfMul(gen[j],coef);}}return msg.slice(data.length);}var ALNUM_CAP=[0,25,47,77,114,154,195,224,279,335,395];var EC_CODEWORDS=[0,7,10,15,20,26,18,20,24,30,18];var DATA_CODEWORDS=[0,19,34,55,80,108,136,156,194,232,274];var NUM_BLOCKS=[0,1,1,1,1,1,2,2,2,2,4];var BLOCK_SIZES={7:[[2,68]],8:[[2,97]],9:[[2,116]],10:[[2,68],[2,69]]};var ALNUM_TABLE='0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:';function getVersion(len){for(var v=1;v<=10;v++){if(ALNUM_CAP[v]>=len)return v;}return-1;}function encodeAlphanumeric(str){var bits=[];function push(val,len){for(var i=len-1;i>=0;i--)bits.push((val>>i)&1);}push(0x2,4);var version=getVersion(str.length);var ccLen=version<=9?9:11;push(str.length,ccLen);for(var i=0;i<str.length-1;i+=2){var val=ALNUM_TABLE.indexOf(str.charAt(i))*45+ALNUM_TABLE.indexOf(str.charAt(i+1));push(val,11);}if(str.length%2===1){push(ALNUM_TABLE.indexOf(str.charAt(str.length-1)),6);}return bits;}function encodeData(str){var version=getVersion(str.length);if(version<0)return null;var bits=encodeAlphanumeric(str);var totalBits=DATA_CODEWORDS[version]*8;var termLen=Math.min(4,totalBits-bits.length);for(var i=0;i<termLen;i++)bits.push(0);while(bits.length%8!==0)bits.push(0);var pads=[0xEC,0x11],pi=0;while(bits.length<totalBits){for(var i=7;i>=0;i--)bits.push((pads[pi]>>i)&1);pi=(pi+1)%2;}var bytes=[];for(var i=0;i<bits.length;i+=8){var b=0;for(var j=0;j<8;j++)b=(b<<1)|bits[i+j];bytes.push(b);}return{version:version,data:bytes};}function interleaveBlocks(version,data){var ecLen=EC_CODEWORDS[version];var blocks=[];var offset=0;if(NUM_BLOCKS[version]<=2&&!BLOCK_SIZES[version]){var n=NUM_BLOCKS[version];var blockSize=Math.floor(data.length/n);for(var i=0;i<n;i++){var sz=i<n-1?blockSize:data.length-offset;blocks.push(data.slice(offset,offset+sz));offset+=sz;}}else if(BLOCK_SIZES[version]){var groups=BLOCK_SIZES[version];for(var g=0;g<groups.length;g++){var count=groups[g][0],sz=groups[g][1];for(var b=0;b<count;b++){blocks.push(data.slice(offset,offset+sz));offset+=sz;}}}else{blocks.push(data);}var ecBlocks=[];for(var i=0;i<blocks.length;i++){ecBlocks.push(rsEncode(blocks[i],ecLen));}var result=[];var maxDataLen=0;for(var i=0;i<blocks.length;i++)if(blocks[i].length>maxDataLen)maxDataLen=blocks[i].length;for(var j=0;j<maxDataLen;j++){for(var i=0;i<blocks.length;i++){if(j<blocks[i].length)result.push(blocks[i][j]);}}for(var j=0;j<ecLen;j++){for(var i=0;i<ecBlocks.length;i++){result.push(ecBlocks[i][j]);}}return result;}function moduleSize(version){return 17+version*4;}function createMatrix(size){var m=[],r=[];for(var i=0;i<size;i++){m.push(new Array(size));r.push(new Array(size));for(var j=0;j<size;j++){m[i][j]=0;r[i][j]=false;}}return{m:m,r:r,size:size};}function setModule(mat,row,col,val){mat.m[row][col]=val?1:0;mat.r[row][col]=true;}function placeFinderPattern(mat,row,col){for(var dr=-1;dr<=7;dr++){for(var dc=-1;dc<=7;dc++){var r=row+dr,c=col+dc;if(r<0||r>=mat.size||c<0||c>=mat.size)continue;var inOuter=dr>=0&&dr<=6&&dc>=0&&dc<=6;var inInner=dr>=2&&dr<=4&&dc>=2&&dc<=4;var onBorder=dr===0||dr===6||dc===0||dc===6;var val=inInner||(inOuter&&onBorder);setModule(mat,r,c,val);}}}function placeAlignmentPattern(mat,row,col){for(var dr=-2;dr<=2;dr++){for(var dc=-2;dc<=2;dc++){var r=row+dr,c=col+dc;if(mat.r[r][c])continue;var val=Math.abs(dr)===2||Math.abs(dc)===2||(dr===0&&dc===0);setModule(mat,r,c,val);}}}var ALIGNMENT_POS=[0,[],[6,18],[6,22],[6,26],[6,30],[6,34],[6,22,38],[6,24,42],[6,26,46],[6,28,52]];function placeFixedPatterns(mat,version){var sz=mat.size;placeFinderPattern(mat,0,0);placeFinderPattern(mat,0,sz-7);placeFinderPattern(mat,sz-7,0);for(var i=8;i<sz-8;i++){if(!mat.r[6][i])setModule(mat,6,i,i%2===0);if(!mat.r[i][6])setModule(mat,i,6,i%2===0);}if(version>=2){var pos=ALIGNMENT_POS[version];for(var i=0;i<pos.length;i++){for(var j=0;j<pos.length;j++){if((i===0&&j===0)||(i===0&&j===pos.length-1)||(i===pos.length-1&&j===0))continue;placeAlignmentPattern(mat,pos[i],pos[j]);}}}setModule(mat,sz-8,8,1);}function reserveFormatArea(mat){var sz=mat.size;for(var i=0;i<=8;i++){if(!mat.r[8][i])mat.r[8][i]=true;}for(var i=0;i<=8;i++){if(!mat.r[i][8])mat.r[i][8]=true;}for(var i=sz-8;i<sz;i++)mat.r[8][i]=true;for(var i=sz-7;i<sz;i++)mat.r[i][8]=true;}function reserveVersionArea(mat,version){if(version<7)return;var sz=mat.size;for(var i=0;i<6;i++){for(var j=0;j<3;j++){mat.r[i][sz-11+j]=true;mat.r[sz-11+j][i]=true;}}}function placeData(mat,codewords){var sz=mat.size;var bits=[];for(var i=0;i<codewords.length;i++){for(var j=7;j>=0;j--)bits.push((codewords[i]>>j)&1);}var bitIdx=0;var col=sz-1;var upward=true;while(col>0){if(col===6)col--;var rows=upward?range(sz-1,-1):range(0,sz);for(var ri=0;ri<rows.length;ri++){var row=rows[ri];for(var dc=0;dc<=1;dc++){var c=col-dc;if(mat.r[row][c])continue;mat.m[row][c]=bitIdx<bits.length?bits[bitIdx++]:0;}}upward=!upward;col-=2;}}function range(a,b){var r=[];if(a>b){for(var i=a;i>=b+1;i--)r.push(i);}else{for(var i=a;i<b;i++)r.push(i);}return r;}var MASK_FNS=[function(r,c){return(r+c)%2===0;},function(r,c){return r%2===0;},function(r,c){return c%3===0;},function(r,c){return(r+c)%3===0;},function(r,c){return(Math.floor(r/2)+Math.floor(c/3))%2===0;},function(r,c){return(r*c)%2+(r*c)%3===0;},function(r,c){return((r*c)%2+(r*c)%3)%2===0;},function(r,c){return((r+c)%2+(r*c)%3)%2===0;}];function applyMask(mat,maskIdx,reserved){var fn=MASK_FNS[maskIdx];for(var r=0;r<mat.size;r++){for(var c=0;c<mat.size;c++){if(reserved[r][c])continue;if(fn(r,c))mat.m[r][c]^=1;}}}var FORMAT_BITS=[0x77C4,0x72F3,0x7DAA,0x789D,0x662F,0x6318,0x6C41,0x6976];function writeFormatBits(mat,maskIdx){var bits=FORMAT_BITS[maskIdx];var sz=mat.size;var coords1=[[8,0],[8,1],[8,2],[8,3],[8,4],[8,5],[8,7],[8,8],[7,8],[5,8],[4,8],[3,8],[2,8],[1,8],[0,8]];var coords2=[];for(var i=sz-1;i>=sz-8;i--)coords2.push([8,i]);for(var i=sz-7;i<sz;i++)coords2.push([i,8]);for(var i=0;i<15;i++){var bit=(bits>>i)&1;mat.m[coords1[i][0]][coords1[i][1]]=bit;mat.m[coords2[i][0]][coords2[i][1]]=bit;}}function penalty(mat){var sz=mat.size,score=0;for(var r=0;r<sz;r++){var run=1;for(var c=1;c<sz;c++){if(mat.m[r][c]===mat.m[r][c-1]){run++;}else{if(run>=5)score+=run-2;run=1;}}if(run>=5)score+=run-2;}for(var c=0;c<sz;c++){var run=1;for(var r=1;r<sz;r++){if(mat.m[r][c]===mat.m[r-1][c]){run++;}else{if(run>=5)score+=run-2;run=1;}}if(run>=5)score+=run-2;}var dark=0;for(var r=0;r<sz;r++)for(var c=0;c<sz;c++)if(mat.m[r][c])dark++;var pct=dark*100/(sz*sz);score+=Math.abs(Math.floor(pct/5)*5-50)*2;return score;}function generate(text){text=text.toUpperCase();var encoded=encodeData(text);if(!encoded)return null;var version=encoded.version;var codewords=interleaveBlocks(version,encoded.data);var sz=moduleSize(version);var bestMat=null,bestScore=Infinity;for(var mi=0;mi<8;mi++){var mat=createMatrix(sz);placeFixedPatterns(mat,version);reserveFormatArea(mat);reserveVersionArea(mat,version);var reserved=[];for(var r=0;r<sz;r++)reserved.push(mat.r[r].slice());placeData(mat,codewords);applyMask(mat,mi,reserved);writeFormatBits(mat,mi);var sc=penalty(mat);if(sc<bestScore){bestScore=sc;bestMat=mat;}}return bestMat.m;}function toCanvas(canvas,matrix,scale){scale=scale||4;var sz=matrix.length;var quiet=4;var totalSize=(sz+quiet*2)*scale;canvas.width=totalSize;canvas.height=totalSize;var ctx=canvas.getContext('2d');ctx.fillStyle='#ffffff';ctx.fillRect(0,0,totalSize,totalSize);ctx.fillStyle='#000000';for(var r=0;r<sz;r++){for(var c=0;c<sz;c++){if(matrix[r][c]){ctx.fillRect((c+quiet)*scale,(r+quiet)*scale,scale,scale);}}}}return{generate:generate,toCanvas:toCanvas};})();
+`;
+
+export const HTML_TAIL = `document.getElementById('secret-key').textContent = SECRET_KEY;
+if (PUBLIC_KEY) {
+  document.getElementById('public-key').textContent = PUBLIC_KEY;
+  document.getElementById('pub-section').style.display = 'block';
+}
+var matrix = QR.generate(SECRET_KEY);
+if (matrix) {
+  QR.toCanvas(document.getElementById('qr-canvas'), matrix, 6);
+} else {
+  document.getElementById('qr-canvas').parentElement.innerHTML = '<p style="color:#ef4444">Could not generate QR code — key may be too long for alphanumeric encoding.</p>';
+}
+</script></body></html>
+`;

package/dist/engineering-pa-cli/src/secrets/commands/backup.mjs

@@ -0,0 +1,85 @@
+// backup — render an HTML file containing the master key as a QR code
+// and open it in the default browser. Cleans up the temp HTML after 30s.
+//
+// The QR-generation JS is the same minified generator used in
+// onboarding.html, so the output looks identical. No browser automation,
+// no npm deps.
+
+import { mkdtempSync, writeFileSync, existsSync, unlinkSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { spawn } from 'node:child_process';
+import { defaultPaths, secretKeyFromKeyFile, VaultError } from '../vault.mjs';
+import { HTML_HEAD, QR_JS, HTML_TAIL } from './backup-template.mjs';
+
+// JSON-encode for embedding inside a <script> tag. Escapes `<` so that
+// `</script>` in a payload cannot break out of the tag. The real age key
+// format cannot contain these characters, but defence in depth is cheap.
+function jsLiteral(s) {
+  return JSON.stringify(s).replace(/</g, '\\u003c');
+}
+
+export function buildBackupHtml(secretKey, publicKey) {
+  const pub = publicKey || '';
+  const dataScript = `var SECRET_KEY = ${jsLiteral(secretKey)};\nvar PUBLIC_KEY = ${jsLiteral(pub)};\n`;
+  return HTML_HEAD + QR_JS + dataScript + HTML_TAIL;
+}
+
+export async function runBackup(overrides = {}) {
+  const paths = overrides.paths || defaultPaths(overrides);
+  const opener = overrides.opener || defaultOpener;
+  const scheduleCleanup = overrides.scheduleCleanup ?? true;
+
+  if (!existsSync(paths.keyFile)) {
+    // Missing key is an operational failure (exit 2), not an "uninitialised"
+    // state — see v0.1.3 secrets/vault.mjs::checkVault rationale. Remediation
+    // requires backup-restore, not a fresh `secrets init`.
+    console.error(`Error: No private key found at ${paths.keyFile}`);
+    console.error('Restore your key from backup before running `secrets backup`.');
+    throw new VaultError('no private key', 2);
+  }
+
+  const secretKey = secretKeyFromKeyFile(paths.keyFile);
+  if (!secretKey) {
+    console.error(`Error: Could not extract secret key from ${paths.keyFile}`);
+    throw new VaultError('could not extract secret key', 1);
+  }
+
+  let publicKey = '';
+  if (existsSync(paths.recipientsFile)) {
+    publicKey = (readFileSync(paths.recipientsFile, 'utf-8').split('\n')[0] || '').trim();
+  }
+
+  const html = buildBackupHtml(secretKey, publicKey);
+  const dir = mkdtempSync(join(tmpdir(), 'dave-key-backup-'));
+  const htmlPath = join(dir, 'backup.html');
+  writeFileSync(htmlPath, html);
+
+  console.log('Opening master key backup in browser...');
+  console.log('IMPORTANT: Back up the key shown, then close the browser tab.');
+
+  opener(htmlPath);
+
+  if (scheduleCleanup) {
+    // Detach a lightweight cleaner so the CLI can exit.
+    setTimeout(() => {
+      try { unlinkSync(htmlPath); } catch { /* ignore */ }
+    }, 30000).unref?.();
+  }
+
+  return { htmlPath, html };
+}
+
+function defaultOpener(path) {
+  const platform = process.platform;
+  if (platform === 'darwin') {
+    spawn('open', [path], { detached: true, stdio: 'ignore' }).unref();
+    return;
+  }
+  // Linux-ish: try xdg-open, fall back to printing the path.
+  const child = spawn('xdg-open', [path], { detached: true, stdio: 'ignore' });
+  child.on('error', () => {
+    console.log(`Open this file in your browser: ${path}`);
+  });
+  child.unref();
+}