autho 3.0.3 → 3.0.4

package/dist/autho.js

@@ -590,7 +590,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "autho",
-    version: "3.0.3",
+    version: "3.0.4",
     description: "Local-first secret manager for humans and coding agents, rebuilt on Bun",
     type: "module",
     bin: {
@@ -632,6 +632,19 @@ var init_package = __esm(() => {
 import { Database } from "bun:sqlite";
 import { chmodSync, existsSync, mkdirSync } from "fs";
 import { dirname } from "path";
+function protectedTable(tableName) {
+  if (!Object.hasOwn(PROTECTED_COLUMNS, tableName)) {
+    throw new Error(`Not a sealed table: ${tableName}`);
+  }
+  return tableName;
+}
+function protectedRowWhere(table, rowId) {
+  if (table === "secret_links") {
+    const [primaryId, linkedId] = rowId.split(">");
+    return { sql: "primary_id = ?1 AND linked_id = ?2", values: [primaryId ?? "", linkedId ?? ""] };
+  }
+  return { sql: `${table === "meta" ? "key" : "id"} = ?1`, values: [rowId] };
+}
 function parseJson(value) {
   return JSON.parse(value);
 }
@@ -660,6 +673,12 @@ class AuthoDatabase {
   transaction(fn) {
     return this.db.transaction(fn)();
   }
+  immediateTransaction(fn) {
+    return this.db.transaction(fn).immediate();
+  }
+  get inTransaction() {
+    return this.db.inTransaction;
+  }
   close() {
     this.hardenStorageFiles();
     this.db.close();
@@ -711,7 +730,30 @@ class AuthoDatabase {
         metadata TEXT NOT NULL,
         created_at TEXT NOT NULL
       );
+
+      CREATE TABLE IF NOT EXISTS secret_links (
+        primary_id TEXT NOT NULL,
+        linked_id TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        PRIMARY KEY (primary_id, linked_id)
+      );
+      CREATE INDEX IF NOT EXISTS secret_links_linked ON secret_links (linked_id);
+
+      CREATE TABLE IF NOT EXISTS seal_rows (
+        table_name TEXT NOT NULL,
+        row_id TEXT NOT NULL,
+        mac TEXT NOT NULL,
+        PRIMARY KEY (table_name, row_id)
+      );
     `);
+    const leaseColumns = this.db.query("PRAGMA table_info(leases)").all();
+    if (!leaseColumns.some((column) => column.name === "include_links")) {
+      this.db.exec("ALTER TABLE leases ADD COLUMN include_links INTEGER NOT NULL DEFAULT 1");
+    }
+    const sealRowColumns = this.db.query("PRAGMA table_info(seal_rows)").all();
+    if (!sealRowColumns.some((column) => column.name === "row_json")) {
+      this.db.exec("ALTER TABLE seal_rows ADD COLUMN row_json TEXT");
+    }
   }
   getVaultConfig() {
     const row = this.db.query("SELECT value FROM meta WHERE key = ?1").get("vault.config");
@@ -797,11 +839,32 @@ class AuthoDatabase {
     this.db.query(`UPDATE secrets SET ${parts.join(", ")} WHERE id = ?${idx}`).run(...values);
   }
   deleteSecret(id) {
+    this.db.query("DELETE FROM secret_links WHERE primary_id = ?1 OR linked_id = ?1").run(id);
     this.db.query("DELETE FROM secrets WHERE id = ?1").run(id);
   }
+  insertLink(link) {
+    this.db.query("INSERT OR IGNORE INTO secret_links (primary_id, linked_id, created_at) VALUES (?1, ?2, ?3)").run(link.primaryId, link.linkedId, link.createdAt);
+  }
+  deleteLink(primaryId, linkedId) {
+    return this.db.query("DELETE FROM secret_links WHERE primary_id = ?1 AND linked_id = ?2").run(primaryId, linkedId).changes > 0;
+  }
+  hasLink(primaryId, linkedId) {
+    return this.db.query("SELECT 1 FROM secret_links WHERE primary_id = ?1 AND linked_id = ?2").get(primaryId, linkedId) !== null;
+  }
+  listLinksFrom(id) {
+    return this.db.query(`SELECT primary_id AS primaryId, linked_id AS linkedId, created_at AS createdAt
+         FROM secret_links WHERE primary_id = ?1 ORDER BY created_at ASC`).all(id);
+  }
+  listLinksTo(id) {
+    return this.db.query(`SELECT primary_id AS primaryId, linked_id AS linkedId, created_at AS createdAt
+         FROM secret_links WHERE linked_id = ?1 ORDER BY created_at ASC`).all(id);
+  }
+  listLinks() {
+    return this.db.query("SELECT primary_id AS primaryId, linked_id AS linkedId, created_at AS createdAt FROM secret_links").all();
+  }
   insertLease(lease) {
-    this.db.query(`INSERT INTO leases (id, name, secret_refs, expires_at, revoked_at, created_at)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6)`).run(lease.id, lease.name, lease.secretRefs, lease.expiresAt, lease.revokedAt, lease.createdAt);
+    this.db.query(`INSERT INTO leases (id, name, secret_refs, expires_at, revoked_at, created_at, include_links)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)`).run(lease.id, lease.name, lease.secretRefs, lease.expiresAt, lease.revokedAt, lease.createdAt, lease.includeLinks);
   }
   findLease(id) {
     const row = this.db.query(`SELECT
@@ -810,7 +873,8 @@ class AuthoDatabase {
            secret_refs AS secretRefs,
            expires_at AS expiresAt,
            revoked_at AS revokedAt,
-           created_at AS createdAt
+           created_at AS createdAt,
+           include_links AS includeLinks
          FROM leases
          WHERE id = ?1
          LIMIT 1`).get(id);
@@ -819,6 +883,55 @@ class AuthoDatabase {
   revokeLease(id, revokedAt) {
     this.db.query("UPDATE leases SET revoked_at = ?2 WHERE id = ?1").run(id, revokedAt);
   }
+  revokeActiveLeases(nowIso) {
+    return this.db.query("UPDATE leases SET revoked_at = ?1 WHERE revoked_at IS NULL AND expires_at > ?1").run(nowIso).changes;
+  }
+  listProtectedRows() {
+    const select = (table) => `SELECT ${PROTECTED_COLUMNS[table].join(", ")} FROM ${table}`;
+    const secrets = this.db.query(select("secrets")).all();
+    const links = this.db.query(select("secret_links")).all();
+    const leases = this.db.query(select("leases")).all();
+    const meta = this.db.query(`${select("meta")} WHERE key != ?1`).all(SEAL_META_KEY);
+    return [
+      ...secrets.map((row) => ({ row, rowId: String(row.id), tableName: "secrets" })),
+      ...links.map((row) => ({ row, rowId: `${row.primary_id}>${row.linked_id}`, tableName: "secret_links" })),
+      ...leases.map((row) => ({ row, rowId: String(row.id), tableName: "leases" })),
+      ...meta.map((row) => ({ row, rowId: String(row.key), tableName: "meta" }))
+    ];
+  }
+  getSeal() {
+    const row = this.db.query("SELECT value FROM meta WHERE key = ?1").get(SEAL_META_KEY);
+    return row?.value ?? null;
+  }
+  setSeal(seal, rows) {
+    this.db.query("INSERT OR REPLACE INTO meta (key, value) VALUES (?1, ?2)").run(SEAL_META_KEY, seal);
+    this.db.exec("DELETE FROM seal_rows");
+    const insert = this.db.query("INSERT INTO seal_rows (table_name, row_id, mac, row_json) VALUES (?1, ?2, ?3, ?4)");
+    for (const row of rows) {
+      insert.run(row.tableName, row.rowId, row.mac, row.snapshot);
+    }
+  }
+  listSealRows() {
+    return this.db.query("SELECT table_name AS tableName, row_id AS rowId, mac, row_json AS snapshot FROM seal_rows").all();
+  }
+  deleteProtectedRow(tableName, rowId) {
+    const table = protectedTable(tableName);
+    if (table === "meta" && rowId === SEAL_META_KEY) {
+      throw new Error("The seal is not a protected row");
+    }
+    const where = protectedRowWhere(table, rowId);
+    this.db.query(`DELETE FROM ${table} WHERE ${where.sql}`).run(...where.values);
+  }
+  insertProtectedRow(tableName, row) {
+    const table = protectedTable(tableName);
+    const columns = PROTECTED_COLUMNS[table];
+    if (table === "meta" && row.key === SEAL_META_KEY) {
+      throw new Error("The seal is not a protected row");
+    }
+    const placeholders = columns.map((_, index) => `?${index + 1}`).join(", ");
+    const values = columns.map((column) => row[column] ?? null);
+    this.db.query(`INSERT INTO ${table} (${columns.join(", ")}) VALUES (${placeholders})`).run(...values);
+  }
   insertAudit(event) {
     this.db.query(`INSERT INTO audit_events (id, event_type, subject_type, subject_ref, message, metadata, created_at)
          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)`).run(event.id, event.eventType, event.subjectType, event.subjectRef, event.message, event.metadata, event.createdAt);
@@ -837,7 +950,15 @@ class AuthoDatabase {
          LIMIT ?1`).all(limit);
   }
 }
-var init_src = () => {};
+var PROTECTED_COLUMNS, SEAL_META_KEY = "vault.seal";
+var init_src = __esm(() => {
+  PROTECTED_COLUMNS = {
+    leases: ["id", "name", "secret_refs", "expires_at", "revoked_at", "created_at", "include_links"],
+    meta: ["key", "value"],
+    secret_links: ["primary_id", "linked_id", "created_at"],
+    secrets: ["id", "name", "type", "payload", "wrapped_key", "created_at", "updated_at"]
+  };
+});
 
 // packages/crypto/src/index.ts
 import {
@@ -889,7 +1010,10 @@ function decryptWithKey(blob, key, aad) {
     decipher.final()
   ]);
 }
-function createVaultConfig(password, rootKey = randomBytes2(32)) {
+function wrapRootKey(rootKey, passwordKey, sealed) {
+  return encryptWithKey(rootKey, passwordKey, sealed ? SEALED_ROOT_AAD : ROOT_AAD);
+}
+function createVaultConfig(password, rootKey = randomBytes2(32), options) {
   const kdf = {
     ...DEFAULT_KDF,
     salt: randomBytes2(16).toString("base64")
@@ -900,14 +1024,20 @@ function createVaultConfig(password, rootKey = randomBytes2(32)) {
       createdAt: new Date().toISOString(),
       kdf,
       version: 1,
-      wrappedRootKey: encryptWithKey(rootKey, key, "autho:vault-root")
+      wrappedRootKey: wrapRootKey(rootKey, key, options?.sealed ?? false)
     },
     rootKey
   };
 }
+function unwrapRootKey(config, passwordKey) {
+  try {
+    return { rootKey: decryptWithKey(config.wrappedRootKey, passwordKey, SEALED_ROOT_AAD), sealed: true };
+  } catch {
+    return { rootKey: decryptWithKey(config.wrappedRootKey, passwordKey, ROOT_AAD), sealed: false };
+  }
+}
 function unlockRootKey(password, config) {
-  const key = deriveKeyFromPassword(password, config.kdf);
-  return decryptWithKey(config.wrappedRootKey, key, "autho:vault-root");
+  return unwrapRootKey(config, deriveKeyFromPassword(password, config.kdf)).rootKey;
 }
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
@@ -981,7 +1111,7 @@ function verifyTotpCode(secret, code, opts) {
   }
   return false;
 }
-var DEFAULT_KDF;
+var DEFAULT_KDF, ROOT_AAD = "autho:vault-root", SEALED_ROOT_AAD = "autho:vault-root:sealed";
 var init_src2 = __esm(() => {
   DEFAULT_KDF = {
     keyLength: 32,
@@ -1209,6 +1339,182 @@ var init_artifacts = __esm(() => {
   init_paths();
 });
 
+// packages/core/src/seal.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+function sealKey(rootKey) {
+  return deriveKeyFromSecret(rootKey, Buffer.from(`${SEAL_INFO}:v1`, "utf8"), SEAL_INFO);
+}
+function canonical(row) {
+  return JSON.stringify(Object.keys(row).sort().map((key) => [key, row[key] ?? null]));
+}
+function computeRowMac(key, row) {
+  return createHmac2("sha256", key).update(`${ROW_MAC_VERSION}\x00${row.tableName}\x00${row.rowId}\x00${canonical(row.row)}`).digest("base64");
+}
+function rowMac(key, row) {
+  return { mac: computeRowMac(key, row), rowId: row.rowId, snapshot: JSON.stringify(row.row), tableName: row.tableName };
+}
+function rowKey(row) {
+  return `${row.tableName}\x00${row.rowId}`;
+}
+function rootMac(key, seal, rows) {
+  const lines = rows.map((row) => `${rowKey(row)}\x00${row.mac}`).sort();
+  const header = seal.version === 1 ? "autho-seal:v1" : `autho-seal:v2
+${seal.vaultId}
+${seal.counter}`;
+  return createHmac2("sha256", key).update(`${header}
+${lines.join(`
+`)}`).digest("base64");
+}
+function validSeal(seal) {
+  if (seal.version === 1)
+    return true;
+  return seal.version === 2 && Number.isSafeInteger(seal.counter) && typeof seal.vaultId === "string" && seal.vaultId !== "";
+}
+function sameMac(a, b) {
+  const left = Buffer.from(a, "utf8");
+  const right = Buffer.from(b, "utf8");
+  return left.length === right.length && timingSafeEqual2(left, right);
+}
+function readSeal(db) {
+  const raw = db.getSeal();
+  if (raw === null)
+    return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { mac: "", sealedAt: "", version: -1 };
+  }
+}
+function diffRows(stored, current) {
+  const before = new Map(stored.map((row) => [rowKey(row), row]));
+  const after = new Map(current.map((row) => [rowKey(row), row]));
+  const changes = [];
+  for (const [id, row] of after) {
+    const old = before.get(id);
+    if (!old)
+      changes.push({ change: "added", rowId: row.rowId, table: row.tableName });
+    else if (!sameMac(old.mac, row.mac))
+      changes.push({ change: "modified", rowId: row.rowId, table: row.tableName });
+  }
+  for (const [id, row] of before) {
+    if (!after.has(id))
+      changes.push({ change: "removed", rowId: row.rowId, table: row.tableName });
+  }
+  return changes;
+}
+function verifySeal(db, key, expectSealed, record) {
+  const stored = readSeal(db);
+  if (!stored) {
+    if (!expectSealed && !record)
+      return { state: "unsealed" };
+    return { changes: [], diffTrusted: false, reason: "the seal was removed", state: "tampered" };
+  }
+  if (!validSeal(stored)) {
+    return { changes: [], diffTrusted: false, reason: "unknown seal format", state: "tampered" };
+  }
+  const current = db.listProtectedRows().map((row) => rowMac(key, row));
+  if (sameMac(rootMac(key, stored, current), stored.mac)) {
+    return rolledBack(stored, record) ? ROLLED_BACK : { state: "intact" };
+  }
+  const storedRows = db.listSealRows();
+  const diffTrusted = sameMac(rootMac(key, stored, storedRows), stored.mac);
+  return {
+    changes: diffRows(storedRows, current),
+    diffTrusted,
+    reason: "rows changed without the vault key",
+    state: "tampered"
+  };
+}
+function rolledBack(stored, record) {
+  if (!record)
+    return false;
+  if (stored.vaultId !== undefined && stored.vaultId !== record.vaultId)
+    return false;
+  return (stored.counter ?? 0) < record.counter;
+}
+function currentSealRecord(db) {
+  const stored = readSeal(db);
+  if (!stored || stored.version !== 2 || !validSeal(stored))
+    return null;
+  return { counter: stored.counter, vaultId: stored.vaultId };
+}
+function writeSeal(db, key, options) {
+  const previous = readSeal(db);
+  const previousCounter = Number.isSafeInteger(previous?.counter) ? previous.counter : 0;
+  const vaultId = typeof previous?.vaultId === "string" && previous.vaultId !== "" ? previous.vaultId : randomId();
+  const counter = Math.max(previousCounter + 1, options?.minCounter ?? 0);
+  const rows = db.listProtectedRows().map((row) => rowMac(key, row));
+  const header = { counter, vaultId, version: SEAL_VERSION };
+  const seal = { ...header, mac: rootMac(key, header, rows), sealedAt: new Date().toISOString() };
+  db.setSeal(JSON.stringify(seal), rows);
+  return { counter, vaultId };
+}
+function sealedSnapshot(key, sealRow) {
+  if (!sealRow.snapshot)
+    return null;
+  let row;
+  try {
+    row = JSON.parse(sealRow.snapshot);
+  } catch {
+    return null;
+  }
+  if (typeof row !== "object" || row === null || Array.isArray(row))
+    return null;
+  const record = row;
+  const mac = computeRowMac(key, { row: record, rowId: sealRow.rowId, tableName: sealRow.tableName });
+  return sameMac(mac, sealRow.mac) ? record : null;
+}
+function unlockWithPassword(db, password, beforeUnwrap, record) {
+  const config = db.getVaultConfig();
+  if (!config) {
+    throw new Error("Vault is not initialized");
+  }
+  const passwordKey = deriveKeyFromPassword(password, config.kdf);
+  beforeUnwrap?.(passwordKey);
+  const { rootKey, sealed } = unwrapRootKey(config, passwordKey);
+  if (sealed) {
+    return { rootKey, sealBound: true };
+  }
+  if (record) {
+    return { rootKey, sealBound: false };
+  }
+  const sealedNow = db.immediateTransaction(() => {
+    if (db.getSeal() !== null)
+      return false;
+    db.setVaultConfig({ ...config, wrappedRootKey: wrapRootKey(rootKey, passwordKey, true) });
+    writeSeal(db, sealKey(rootKey));
+    db.insertAudit({
+      createdAt: new Date().toISOString(),
+      eventType: "vault.sealed.initial",
+      id: randomId(),
+      message: "Vault sealed for the first time",
+      metadata: JSON.stringify({}),
+      subjectRef: null,
+      subjectType: "vault"
+    });
+    return true;
+  });
+  return { rootKey, sealBound: sealedNow };
+}
+var ROW_MAC_VERSION = 1, SEAL_VERSION = 2, SEAL_INFO = "autho:vault-seal", VaultTamperedError, ROLLED_BACK;
+var init_seal = __esm(() => {
+  init_src2();
+  VaultTamperedError = class VaultTamperedError extends Error {
+    seal;
+    constructor(seal) {
+      super(`Vault was modified outside autho (${seal.reason}). Run \`autho vault verify\` to see what changed, then \`autho vault reseal\`.`);
+      this.seal = seal;
+      this.name = "VaultTamperedError";
+    }
+  };
+  ROLLED_BACK = {
+    changes: [],
+    diffTrusted: false,
+    reason: "the vault file was replaced with an older copy",
+    state: "tampered"
+  };
+});
+
 // packages/core/src/settings.ts
 function preferenceSpec(key) {
   return PREFERENCES.find((spec) => spec.key === key);
@@ -1309,7 +1615,7 @@ var init_settings = __esm(() => {
 
 // packages/core/src/index.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { createHmac as createHmac2, randomBytes as randomBytes4 } from "crypto";
+import { createHmac as createHmac3, randomBytes as randomBytes4 } from "crypto";
 import {
   existsSync as existsSync3,
   readFileSync as readFileSync3
@@ -1365,7 +1671,7 @@ function generateTotp(secret, options, now = Date.now()) {
     message[index] = cursor & 255;
     cursor >>= 8;
   }
-  const hash = createHmac2(algorithm, Buffer.from(key)).update(message).digest();
+  const hash = createHmac3(algorithm, Buffer.from(key)).update(message).digest();
   const offset = hash[hash.length - 1] & 15;
   const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
   const mod = 10 ** digits;
@@ -1391,6 +1697,7 @@ function parseLease(row) {
     createdAt: row.createdAt,
     expiresAt: row.expiresAt,
     id: row.id,
+    includeLinks: row.includeLinks !== 0,
     name: row.name,
     revokedAt: row.revokedAt,
     secretRefs: JSON.parse(row.secretRefs)
@@ -1515,17 +1822,21 @@ class VaultService {
       if (db.getVaultConfig()) {
         throw new Error(`Vault already initialized at ${vaultPath}`);
       }
-      const { config } = createVaultConfig(password);
-      db.setVaultConfig(config);
-      db.insertAudit({
-        createdAt: new Date().toISOString(),
-        eventType: "vault.initialized",
-        id: randomId(),
-        message: "Vault initialized",
-        metadata: JSON.stringify({ version: config.version }),
-        subjectRef: null,
-        subjectType: "vault"
+      const { config, rootKey } = createVaultConfig(password, undefined, { sealed: true });
+      db.immediateTransaction(() => {
+        db.setVaultConfig(config);
+        writeSeal(db, sealKey(rootKey));
+        db.insertAudit({
+          createdAt: new Date().toISOString(),
+          eventType: "vault.initialized",
+          id: randomId(),
+          message: "Vault initialized",
+          metadata: JSON.stringify({ version: config.version }),
+          subjectRef: null,
+          subjectType: "vault"
+        });
       });
+      rootKey.fill(0);
       return { vaultPath };
     } finally {
       db.close();
@@ -1593,7 +1904,7 @@ class VaultService {
           subjectRef: null,
           subjectType: "vault"
         });
-        return new VaultSession(db, rootKey);
+        return new VaultSession(db, rootKey, { sealRecord: creds.sealRecord });
       } catch (error) {
         db.close();
         throw new Error("Invalid recovery token", { cause: error });
@@ -1617,22 +1928,15 @@ class VaultService {
           subjectRef: passkey.id,
           subjectType: "vault"
         });
-        return new VaultSession(db, rootKey);
+        return new VaultSession(db, rootKey, { sealRecord: creds.sealRecord });
       } catch (error) {
         db.close();
         throw new Error("Passkey did not unlock the vault", { cause: error });
       }
     }
     try {
-      const passwordKEK = deriveKeyFromPassword(creds.password, config.kdf);
-      if (vaultAuth?.totp) {
-        const totpSecret = decryptWithKey(vaultAuth.totp.encryptedSecret, passwordKEK, "autho:vault-totp").toString("utf8");
-        if (!creds.totp || !verifyTotpCode(totpSecret, creds.totp)) {
-          throw new Error("Invalid or missing TOTP code");
-        }
-      }
-      const rootKey = decryptWithKey(config.wrappedRootKey, passwordKEK, "autho:vault-root");
-      return new VaultSession(db, rootKey);
+      const { rootKey, sealBound } = unlockWithPassword(db, creds.password, (passwordKEK) => checkVaultTotp(vaultAuth, passwordKEK, creds.totp), creds.sealRecord);
+      return new VaultSession(db, rootKey, { sealBound, sealRecord: creds.sealRecord });
     } catch (error) {
       db.close();
       if (error instanceof Error && error.message === "Invalid or missing TOTP code") {
@@ -1657,9 +1961,25 @@ class VaultService {
   static authorize(vaultPath, credentials) {
     const session = VaultService.unlock(vaultPath, credentials);
     const rootKey = session.getRootKey();
+    const sealBound = session.sealBound;
     session.close();
     const viaPassword = !credentials.passkey && !credentials.recovery;
-    return new VaultAdmin(vaultPath, rootKey, viaPassword ? credentials.password : null);
+    return new VaultAdmin(vaultPath, rootKey, viaPassword ? credentials.password : null, sealBound, credentials.sealRecord);
+  }
+  static unlockRootKey(vaultPath, credentials) {
+    const db = new AuthoDatabase(vaultPath);
+    try {
+      if (!db.getVaultConfig()) {
+        throw new Error(`Vault is not initialized at ${vaultPath}`);
+      }
+      const vaultAuth = db.getVaultAuth();
+      return unlockWithPassword(db, credentials.password, (passwordKEK) => checkVaultTotp(vaultAuth, passwordKEK, credentials.totp), credentials.sealRecord);
+    } finally {
+      db.close();
+    }
+  }
+  static reseal(vaultPath, credentials, mode) {
+    return VaultService.withAdmin(vaultPath, credentials, (admin) => admin.reseal(mode));
   }
   static withAdmin(vaultPath, credentials, fn) {
     const admin = VaultService.authorize(vaultPath, credentials);
@@ -1695,6 +2015,14 @@ class VaultService {
     return VaultService.withAdmin(vaultPath, credentials, (admin) => admin.removePasskey(ref));
   }
 }
+function checkVaultTotp(vaultAuth, passwordKEK, totp) {
+  if (!vaultAuth?.totp)
+    return;
+  const totpSecret = decryptWithKey(vaultAuth.totp.encryptedSecret, passwordKEK, "autho:vault-totp").toString("utf8");
+  if (!totp || !verifyTotpCode(totpSecret, totp)) {
+    throw new Error("Invalid or missing TOTP code");
+  }
+}
 function assertTotpCode(secret, code) {
   if (!verifyTotpCode(secret, code)) {
     throw new Error("Invalid TOTP code \u2014 make sure your authenticator app is showing the right code");
@@ -1705,11 +2033,18 @@ class VaultAdmin {
   vaultPath;
   rootKey;
   password;
+  sealBound;
+  record;
   closed = false;
-  constructor(vaultPath, rootKey, password) {
+  constructor(vaultPath, rootKey, password, sealBound = false, record = null) {
     this.vaultPath = vaultPath;
     this.rootKey = rootKey;
     this.password = password;
+    this.sealBound = sealBound;
+    this.record = record;
+  }
+  sealRecord() {
+    return this.record;
   }
   get hasPassword() {
     return this.password !== null;
@@ -1752,9 +2087,9 @@ class VaultAdmin {
     if (newPassword.length < MIN_PASSWORD_LENGTH) {
       throw new Error(`The new password must be at least ${MIN_PASSWORD_LENGTH} characters`);
     }
-    this.write((db) => {
+    this.write((db, sealed) => {
       const auth = db.getVaultAuth();
-      const { config } = createVaultConfig(newPassword, this.liveRootKey());
+      const { config } = createVaultConfig(newPassword, this.liveRootKey(), { sealed });
       if (auth?.totp) {
         const oldPassword = this.requirePassword("Two-factor codes are on: authorize with the current master password to change it");
         const oldKEK = deriveKeyFromPassword(oldPassword, db.getVaultConfig().kdf);
@@ -1857,16 +2192,116 @@ class VaultAdmin {
     }
     return this.password;
   }
+  reseal(mode) {
+    const rootKey = this.liveRootKey();
+    const key = sealKey(rootKey);
+    const db = new AuthoDatabase(this.vaultPath);
+    try {
+      return db.immediateTransaction(() => {
+        const seal = verifySeal(db, key, true, this.record);
+        const result = {
+          changes: seal.state === "tampered" ? seal.changes : [],
+          diffTrusted: seal.state === "tampered" ? seal.diffTrusted : true,
+          kept: [],
+          mode,
+          reason: seal.state === "tampered" ? seal.reason : seal.state === "unsealed" ? "unsealed" : null,
+          rebound: false,
+          revokedLeases: 0,
+          sealRecord: null,
+          undone: [],
+          wasIntact: seal.state === "intact"
+        };
+        if (seal.state === "intact")
+          return result;
+        if (mode === "quarantine") {
+          Object.assign(result, quarantineChanges(db, key, result.changes, result.diffTrusted));
+          result.revokedLeases = db.revokeActiveLeases(new Date().toISOString());
+        } else {
+          result.kept = result.changes;
+        }
+        if (this.password !== null) {
+          const config = db.getVaultConfig();
+          const passwordKey = deriveKeyFromPassword(this.password, config.kdf);
+          if (!unwrapRootKey(config, passwordKey).sealed) {
+            db.setVaultConfig({ ...config, wrappedRootKey: wrapRootKey(rootKey, passwordKey, true) });
+            result.rebound = true;
+          }
+        }
+        result.sealRecord = writeSeal(db, key, { minCounter: this.record ? this.record.counter + 1 : 0 });
+        this.record = result.sealRecord;
+        audit(db, `vault.reseal.${mode}`, mode === "accept" ? "Vault re-sealed as is" : "Vault re-sealed after quarantine", {
+          changes: result.changes.slice(0, 200),
+          diffTrusted: result.diffTrusted,
+          kept: result.kept.length,
+          reason: result.reason,
+          revokedLeases: result.revokedLeases,
+          undone: result.undone.length
+        });
+        return result;
+      });
+    } finally {
+      key.fill(0);
+      db.close();
+    }
+  }
   write(fn) {
-    this.liveRootKey();
+    const key = sealKey(this.liveRootKey());
     const db = new AuthoDatabase(this.vaultPath);
     try {
-      return db.transaction(() => fn(db));
+      return db.immediateTransaction(() => {
+        const seal = verifySeal(db, key, this.sealBound, this.record);
+        if (seal.state === "tampered")
+          throw new VaultTamperedError(seal);
+        const result = fn(db, seal.state === "intact");
+        if (seal.state === "intact")
+          this.record = writeSeal(db, key);
+        return result;
+      });
     } finally {
+      key.fill(0);
       db.close();
     }
   }
 }
+function quarantineChanges(db, key, changes, diffTrusted) {
+  const sealed = new Map(db.listSealRows().map((row) => [`${row.tableName}\x00${row.rowId}`, row]));
+  const current = new Map(db.listProtectedRows().map((row) => [`${row.tableName}\x00${row.rowId}`, row.row]));
+  const undone = [];
+  const kept = [];
+  const restores = [];
+  const deletes = [];
+  for (const change of changes) {
+    const sealedRow = sealed.get(`${change.table}\x00${change.rowId}`);
+    const snapshot = diffTrusted && change.change !== "added" && sealedRow ? sealedSnapshot(key, sealedRow) : null;
+    if (snapshot) {
+      if (change.change === "modified")
+        deletes.push(change);
+      restores.push({ change, row: snapshot });
+    } else if (change.change === "added" && diffTrusted) {
+      deletes.push(change);
+      undone.push(change);
+    } else if (change.change !== "removed" && ACCESS_TABLES.has(change.table)) {
+      deletes.push(change);
+      undone.push(change);
+    } else {
+      kept.push(change);
+    }
+  }
+  for (const change of deletes)
+    db.deleteProtectedRow(change.table, change.rowId);
+  for (const { change, row } of restores) {
+    try {
+      db.insertProtectedRow(change.table, row);
+      undone.push(change);
+    } catch {
+      const modified = change.change === "modified" ? current.get(`${change.table}\x00${change.rowId}`) : undefined;
+      if (modified)
+        db.insertProtectedRow(change.table, modified);
+      kept.push(change);
+    }
+  }
+  return { kept, undone };
+}
 function audit(db, eventType, message, metadata = {}, subjectRef = null) {
   db.insertAudit({
     createdAt: new Date().toISOString(),
@@ -1903,16 +2338,54 @@ function recoveryFileContent(vaultPath, token) {
 class VaultSession {
   db;
   rootKey;
-  constructor(db, rootKey) {
+  sealKey;
+  sealBound;
+  sealRecord;
+  constructor(db, rootKey, options = {}) {
     this.db = db;
     this.rootKey = rootKey;
+    this.sealKey = sealKey(rootKey);
+    this.sealBound = options.sealBound ?? false;
+    this.sealRecord = options.sealRecord ?? null;
+  }
+  sealCheckpoint() {
+    return this.verifySeal().state === "intact" ? currentSealRecord(this.db) : null;
   }
   getRootKey() {
     return Buffer.from(this.rootKey);
   }
   close() {
+    this.sealKey.fill(0);
     this.db.close();
   }
+  verifySeal() {
+    return verifySeal(this.db, this.sealKey, this.sealBound, this.sealRecord);
+  }
+  sealedWrite(fn, options) {
+    if (this.db.inTransaction) {
+      return fn();
+    }
+    return this.db.immediateTransaction(() => {
+      const seal = this.verifySeal();
+      if (seal.state === "tampered" && !options?.allowTampered) {
+        throw new VaultTamperedError(seal);
+      }
+      const result = fn();
+      if (seal.state === "intact") {
+        writeSeal(this.db, this.sealKey);
+      }
+      return result;
+    });
+  }
+  requireIntactSeal() {
+    const seal = this.verifySeal();
+    if (seal.state === "tampered") {
+      throw new VaultTamperedError(seal);
+    }
+    if (seal.state === "unsealed") {
+      throw new Error("This vault isn't sealed yet: unlock it once with the master password, then retry");
+    }
+  }
   status(vaultPath, projectFile, projectMappings = []) {
     return {
       activeLeaseCount: this.db.countActiveLeases(new Date().toISOString()),
@@ -1966,26 +2439,40 @@ class VaultSession {
     }
     return parseLease(row);
   }
-  assertLeaseAllows(leaseId, secretRef) {
-    if (!leaseId) {
-      return;
-    }
-    const lease = this.getLeaseOrThrow(leaseId);
+  getActiveLeaseOrThrow(id) {
+    const lease = this.getLeaseOrThrow(id);
     if (lease.revokedAt) {
       throw new Error(`Lease revoked: ${lease.id}`);
     }
     if (Date.parse(lease.expiresAt) <= Date.now()) {
       throw new Error(`Lease expired: ${lease.id}`);
     }
-    const secret = this.getSecretOrThrow(secretRef);
-    if (!lease.secretRefs.includes(secret.id) && !lease.secretRefs.includes(secret.name)) {
-      throw new Error(`Lease ${lease.id} does not allow secret ${secretRef}`);
+    return lease;
+  }
+  linkedSecret(id) {
+    const row = this.db.findSecret(id);
+    return row ? { id: row.id, name: row.name, type: normalizeSecretType(row.type) } : null;
+  }
+  leaseAccess(lease, secret) {
+    if (lease.secretRefs.includes(secret.id) || lease.secretRefs.includes(secret.name)) {
+      return { via: null };
     }
+    if (lease.includeLinks) {
+      for (const link of this.db.listLinksTo(secret.id)) {
+        if (lease.secretRefs.includes(link.primaryId)) {
+          return { via: this.linkedSecret(link.primaryId) };
+        }
+      }
+    }
+    throw new Error(`Lease ${lease.id} does not allow secret ${secret.name}`);
   }
   addSecret(input) {
     requireValue(input.name, "--name");
     requireValue(input.value, "--value");
     const type = normalizeSecretType(input.type);
+    return this.sealedWrite(() => this.insertNewSecret(input, type));
+  }
+  insertNewSecret(input, type) {
     if (this.db.findSecret(input.name)) {
       throw new Error(`Secret already exists: ${input.name}`);
     }
@@ -2020,6 +2507,9 @@ class VaultSession {
     };
   }
   updateSecret(ref, updates) {
+    return this.sealedWrite(() => this.applySecretUpdate(ref, updates));
+  }
+  applySecretUpdate(ref, updates) {
     const existing = this.getSecretOrThrow(ref);
     if (updates.name && updates.name !== existing.name) {
       const conflict = this.db.findSecret(updates.name);
@@ -2059,6 +2549,9 @@ class VaultSession {
   }
   importLegacyFile(filePath, options) {
     const raw = JSON.parse(readFileSync3(filePath, "utf8"));
+    return this.sealedWrite(() => this.importLegacyEntries(raw, options));
+  }
+  importLegacyEntries(raw, options) {
     let imported = 0;
     let skipped = 0;
     for (const entry of raw) {
@@ -2092,6 +2585,10 @@ class VaultSession {
     }));
   }
   listSecretIndex() {
+    const linkCounts = new Map;
+    for (const link of this.db.listLinks()) {
+      linkCounts.set(link.primaryId, (linkCounts.get(link.primaryId) ?? 0) + 1);
+    }
     const entries = this.db.listSecrets().map((row) => {
       const secret = this.unwrapSecret(row);
       const { url, description } = secret.metadata;
@@ -2099,6 +2596,7 @@ class VaultSession {
         createdAt: secret.createdAt,
         description: typeof description === "string" && description ? description : null,
         id: secret.id,
+        linkCount: linkCounts.get(secret.id) ?? 0,
         name: secret.name,
         type: secret.type,
         updatedAt: secret.updatedAt,
@@ -2117,33 +2615,128 @@ class VaultSession {
     });
     return secret;
   }
-  removeSecret(ref) {
-    const secret = this.getSecretOrThrow(ref);
-    this.db.deleteSecret(secret.id);
-    this.audit("secret.deleted", "secret", secret.id, "Secret deleted", {
-      type: secret.type
+  removeSecret(ref, options) {
+    return this.sealedWrite(() => {
+      const secret = this.getSecretOrThrow(ref);
+      const removedLinked = [];
+      const keptLinked = [];
+      if (options?.withLinked) {
+        for (const link of this.db.listLinksFrom(secret.id)) {
+          const linked = this.linkedSecret(link.linkedId);
+          if (!linked)
+            continue;
+          const otherPrimaries = this.db.listLinksTo(linked.id).filter((l) => l.primaryId !== secret.id);
+          (otherPrimaries.length > 0 ? keptLinked : removedLinked).push(linked);
+        }
+      }
+      for (const target of [{ id: secret.id, type: secret.type }, ...removedLinked]) {
+        this.db.deleteSecret(target.id);
+        this.audit("secret.deleted", "secret", target.id, "Secret deleted", {
+          type: target.type,
+          ...target.id === secret.id ? {} : { withPrimary: secret.id }
+        });
+      }
+      return { id: secret.id, keptLinked, name: secret.name, removedLinked };
     });
-    return { id: secret.id, name: secret.name };
   }
-  generateOtp(ref) {
+  linkSecrets(primaryRef, linkedRef) {
+    return this.sealedWrite(() => {
+      const primary = this.requireLinkedSecret(primaryRef);
+      const linked = this.requireLinkedSecret(linkedRef);
+      if (primary.id === linked.id) {
+        throw new Error("A secret can't be linked to itself");
+      }
+      if (this.db.hasLink(primary.id, linked.id)) {
+        return { created: false, linked, primary };
+      }
+      this.db.insertLink({ createdAt: new Date().toISOString(), linkedId: linked.id, primaryId: primary.id });
+      this.audit("secret.linked", "secret", primary.id, `Linked ${linked.name} under ${primary.name}`, {
+        linkedId: linked.id,
+        primaryId: primary.id
+      });
+      return { created: true, linked, primary };
+    });
+  }
+  unlinkSecrets(primaryRef, linkedRef) {
+    return this.sealedWrite(() => {
+      const primary = this.requireLinkedSecret(primaryRef);
+      const linked = this.requireLinkedSecret(linkedRef);
+      if (!this.db.deleteLink(primary.id, linked.id)) {
+        throw new Error(`${linked.name} is not linked under ${primary.name}`);
+      }
+      this.audit("secret.unlinked", "secret", primary.id, `Unlinked ${linked.name} from ${primary.name}`, {
+        linkedId: linked.id,
+        primaryId: primary.id
+      });
+      return { linked, primary };
+    });
+  }
+  getLinks(ref) {
+    const secret = this.requireLinkedSecret(ref);
+    const resolve = (ids) => ids.map((id) => this.linkedSecret(id)).filter((entry) => entry !== null);
+    return {
+      linkedFrom: resolve(this.db.listLinksTo(secret.id).map((link) => link.primaryId)),
+      links: resolve(this.db.listLinksFrom(secret.id).map((link) => link.linkedId))
+    };
+  }
+  requireLinkedSecret(ref) {
+    const row = this.db.findSecret(ref);
+    if (!row) {
+      throw new Error(`Secret not found: ${ref}`);
+    }
+    return { id: row.id, name: row.name, type: normalizeSecretType(row.type) };
+  }
+  generateOtp(ref, options) {
     const secret = this.getSecretOrThrow(ref);
     if (secret.type !== "otp") {
       throw new Error(`Secret is not an OTP secret: ${ref}`);
     }
-    const result = generateTotp(secret.value, {
-      algorithm: secret.metadata.algorithm,
-      digits: secret.metadata.digits
-    });
-    this.audit("otp.generated", "secret", secret.id, "OTP code generated", {
-      expiresAt: result.expiresAt
-    });
+    const result = this.otpCode(secret);
+    if (options?.audit ?? true) {
+      this.audit("otp.generated", "secret", secret.id, "OTP code generated", {
+        expiresAt: result.expiresAt
+      });
+    }
     return {
       code: result.code,
       expiresAt: result.expiresAt,
       secret: secret.name
     };
   }
+  otpCode(secret) {
+    return generateTotp(secret.value, {
+      algorithm: secret.metadata.algorithm,
+      digits: secret.metadata.digits
+    });
+  }
+  showLease(id) {
+    const lease = this.getLeaseOrThrow(id);
+    const coverage = [];
+    const seen = new Set;
+    for (const ref of lease.secretRefs) {
+      const direct = this.linkedSecret(ref);
+      if (!direct || seen.has(direct.id))
+        continue;
+      seen.add(direct.id);
+      coverage.push({ ...direct, via: null });
+    }
+    if (lease.includeLinks) {
+      for (const primary of [...coverage]) {
+        for (const link of this.db.listLinksFrom(primary.id)) {
+          const linked = this.linkedSecret(link.linkedId);
+          if (!linked || seen.has(linked.id))
+            continue;
+          seen.add(linked.id);
+          coverage.push({ ...linked, via: { id: primary.id, name: primary.name, type: primary.type } });
+        }
+      }
+    }
+    return { coverage, lease };
+  }
   createLease(input) {
+    return this.sealedWrite(() => this.insertLease(input));
+  }
+  insertLease(input) {
     if (input.secretRefs.length === 0) {
       throw new Error("Lease requires at least one --secret");
     }
@@ -2157,6 +2750,7 @@ class VaultSession {
       createdAt: now,
       expiresAt,
       id: randomId(),
+      includeLinks: !input.noLinks,
       name: input.name || "session",
       revokedAt: null,
       secretRefs: resolved.map((secret) => secret.id)
@@ -2165,39 +2759,55 @@ class VaultSession {
       createdAt: lease.createdAt,
       expiresAt: lease.expiresAt,
       id: lease.id,
+      includeLinks: lease.includeLinks ? 1 : 0,
       name: lease.name,
       revokedAt: lease.revokedAt,
       secretRefs: JSON.stringify(lease.secretRefs)
     });
     this.audit("lease.created", "lease", lease.id, "Lease created", {
       expiresAt,
+      includeLinks: lease.includeLinks,
       secretCount: lease.secretRefs.length
     });
     return lease;
   }
   revokeLease(id) {
-    const lease = this.getLeaseOrThrow(id);
-    const revokedAt = new Date().toISOString();
-    this.db.revokeLease(id, revokedAt);
-    this.audit("lease.revoked", "lease", id, "Lease revoked", {
-      id
-    });
-    return {
-      ...lease,
-      revokedAt
-    };
+    return this.sealedWrite(() => {
+      const lease = this.getLeaseOrThrow(id);
+      const revokedAt = new Date().toISOString();
+      this.db.revokeLease(id, revokedAt);
+      this.audit("lease.revoked", "lease", id, "Lease revoked", {
+        id
+      });
+      return {
+        ...lease,
+        revokedAt
+      };
+    }, { allowTampered: true });
   }
   buildEnv(mappings, leaseId) {
     if (mappings.length === 0) {
       throw new Error("Provide at least one env mapping");
     }
-    const output = {};
-    for (const mapping of mappings) {
-      this.assertLeaseAllows(leaseId, mapping.secretRef);
-      const secret = this.getSecretOrThrow(mapping.secretRef);
-      output[mapping.envName] = secret.value;
-    }
-    return output;
+    return this.db.immediateTransaction(() => {
+      this.requireIntactSeal();
+      const lease = leaseId ? this.getActiveLeaseOrThrow(leaseId) : null;
+      const output = {};
+      for (const mapping of mappings) {
+        const secret = this.getSecretOrThrow(mapping.secretRef);
+        if (lease) {
+          const { via } = this.leaseAccess(lease, secret);
+          if (via) {
+            this.audit("lease.link_access", "secret", secret.id, `Secret read via link from ${via.name}`, {
+              leaseId: lease.id,
+              primaryId: via.id
+            });
+          }
+        }
+        output[mapping.envName] = secret.type === "otp" ? this.otpCode(secret).code : secret.value;
+      }
+      return output;
+    });
   }
   renderEnv(mappings, leaseId) {
     const env = this.buildEnv(mappings, leaseId);
@@ -2312,21 +2922,24 @@ class VaultSession {
     return this.db.listAudit(limit).map(toAuditEvent);
   }
 }
-var PASSKEY_INFO = "autho:vault-passkey", MIN_PASSWORD_LENGTH = 8;
+var PASSKEY_INFO = "autho:vault-passkey", MIN_PASSWORD_LENGTH = 8, ACCESS_TABLES;
 var init_src3 = __esm(() => {
   init_src2();
   init_artifacts();
   init_src();
+  init_seal();
   init_paths();
+  init_seal();
   init_paths();
   init_settings();
+  ACCESS_TABLES = new Set(["leases", "secret_links"]);
 });
 
 // packages/core/src/os-secrets.ts
-import { createHash as createHash3, randomBytes as randomBytes5, scryptSync as scryptSync2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes5, scryptSync as scryptSync2, timingSafeEqual as timingSafeEqual3 } from "crypto";
 import { resolve as resolve3 } from "path";
 function vaultPasswordName(vaultPath) {
-  return createHash3("sha256").update(resolve3(vaultPath)).digest("hex");
+  return createHash2("sha256").update(resolve3(vaultPath)).digest("hex");
 }
 function osSecretsDisabled() {
   return process.env.AUTHO_DISABLE_OS_SECRETS === "1";
@@ -2373,6 +2986,41 @@ async function deleteVaultPassword(vaultPath) {
     return false;
   }
 }
+async function loadSealRecord(vaultPath) {
+  if (osSecretsDisabled()) {
+    return null;
+  }
+  try {
+    const raw = await Bun.secrets.get({ name: vaultPasswordName(vaultPath), service: SEAL_SERVICE });
+    if (!raw)
+      return null;
+    const parsed = JSON.parse(raw);
+    if (!Number.isSafeInteger(parsed.counter) || typeof parsed.vaultId !== "string")
+      return null;
+    return { counter: parsed.counter, vaultId: parsed.vaultId };
+  } catch {
+    return null;
+  }
+}
+async function saveSealRecord(vaultPath, record) {
+  if (!record || osSecretsDisabled()) {
+    return;
+  }
+  try {
+    const stored = await loadSealRecord(vaultPath);
+    if (stored && stored.vaultId === record.vaultId && stored.counter >= record.counter)
+      return;
+    await Bun.secrets.set({ name: vaultPasswordName(vaultPath), service: SEAL_SERVICE, value: JSON.stringify(record) });
+  } catch {}
+}
+async function closeSessionAndRecordSeal(vaultPath, session) {
+  let record = null;
+  try {
+    record = session.sealCheckpoint();
+  } catch {}
+  session.close();
+  await saveSealRecord(vaultPath, record);
+}
 async function setOsSecret(name, value) {
   if (osSecretsDisabled()) {
     return false;
@@ -2459,7 +3107,7 @@ async function deletePin(vaultPath) {
     return false;
   }
 }
-var VAULT_PASSWORD_SERVICE = "autho.vault", USER_SECRETS_SERVICE = "autho", PIN_SERVICE = "autho.pin";
+var VAULT_PASSWORD_SERVICE = "autho.vault", USER_SECRETS_SERVICE = "autho", PIN_SERVICE = "autho.pin", SEAL_SERVICE = "autho.seal";
 var init_os_secrets = () => {};
 
 // apps/cli/src/tui/theme.ts
@@ -2568,7 +3216,7 @@ function Chip({ label, color = theme.accent }) {
     ]
   });
 }
-function StatusBar({ hints, toast }) {
+function StatusBar({ hints, pinned = [], toast }) {
   const { width } = useTerminalDimensions();
   if (toast) {
     const color = toast.kind === "error" ? theme.danger : toast.kind === "info" ? theme.info : theme.success;
@@ -2590,31 +3238,62 @@ function StatusBar({ hints, toast }) {
       })
     });
   }
-  return /* @__PURE__ */ jsx("box", {
+  return /* @__PURE__ */ jsxs("box", {
     width: "100%",
     height: 1,
     backgroundColor: theme.panel,
     paddingX: 1,
     flexDirection: "row",
-    gap: 2,
+    justifyContent: "space-between",
     overflow: "hidden",
-    children: fitHints(hints, width - 2).map(([key, label]) => /* @__PURE__ */ jsxs("text", {
-      flexShrink: 0,
-      children: [
-        /* @__PURE__ */ jsx(Chip, {
-          label: key
-        }),
-        /* @__PURE__ */ jsxs("span", {
-          fg: theme.muted,
+    children: [
+      /* @__PURE__ */ jsx("box", {
+        flexDirection: "row",
+        gap: 2,
+        flexShrink: 1,
+        overflow: "hidden",
+        children: fitHints(hints, width - 2 - hintsWidth(pinned) - (pinned.length ? 3 : 0)).map(([key, label]) => /* @__PURE__ */ jsxs("text", {
+          flexShrink: 0,
           children: [
-            " ",
-            label
+            /* @__PURE__ */ jsx(Chip, {
+              label: key
+            }),
+            /* @__PURE__ */ jsxs("span", {
+              fg: theme.muted,
+              children: [
+                " ",
+                label
+              ]
+            })
           ]
-        })
-      ]
-    }, `${key}-${label}`))
+        }, `${key}-${label}`))
+      }),
+      pinned.length ? /* @__PURE__ */ jsx("box", {
+        flexDirection: "row",
+        gap: 2,
+        flexShrink: 0,
+        children: pinned.map(([key, label]) => /* @__PURE__ */ jsxs("text", {
+          flexShrink: 0,
+          children: [
+            /* @__PURE__ */ jsx(Chip, {
+              label: key
+            }),
+            /* @__PURE__ */ jsxs("span", {
+              fg: theme.muted,
+              children: [
+                " ",
+                label
+              ]
+            })
+          ]
+        }, `${key}-${label}`))
+      }) : null
+    ]
   });
 }
+function hintsWidth(hints) {
+  return hints.reduce((sum, [key, label], i) => sum + key.length + 2 + 1 + label.length + (i ? 2 : 0), 0);
+}
 function fitHints(hints, width) {
   const shown = [];
   let used = 0;
@@ -2627,7 +3306,7 @@ function fitHints(hints, width) {
   }
   return shown;
 }
-function Button({ label, hotkey, onPress, color = theme.accent }) {
+function Button({ label, hotkey, onPress, color = theme.accent, focused = false }) {
   return /* @__PURE__ */ jsx("box", {
     onMouseDown: (event) => {
       event.preventDefault();
@@ -2635,6 +3314,7 @@ function Button({ label, hotkey, onPress, color = theme.accent }) {
     },
     height: 1,
     flexShrink: 0,
+    backgroundColor: focused ? theme.selection : undefined,
     children: /* @__PURE__ */ jsxs("text", {
       children: [
         hotkey ? /* @__PURE__ */ jsx("span", {
@@ -2648,7 +3328,14 @@ function Button({ label, hotkey, onPress, color = theme.accent }) {
             ]
           })
         }) : null,
-        /* @__PURE__ */ jsxs("span", {
+        focused ? /* @__PURE__ */ jsxs("strong", {
+          fg: color,
+          children: [
+            " ",
+            label,
+            " \u2039"
+          ]
+        }) : /* @__PURE__ */ jsxs("span", {
           fg: color,
           children: [
             " ",
@@ -3426,6 +4113,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
   const app = useApp();
   const { width, height } = useTerminalDimensions3();
   const [section, setSection] = useState4("Storage" /* Storage */);
+  const [focus, setFocus] = useState4("nav");
   const [rowIndex, setRowIndex] = useState4(0);
   const [dialog, setDialog] = useState4(null);
   const [error, setError] = useState4("");
@@ -3445,11 +4133,21 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
   useEffect4(() => {
     refreshStatus();
   }, [refreshStatus]);
+  const sealRecord = useRef5(null);
+  useEffect4(() => {
+    loadSealRecord(vaultPath).then((record) => {
+      sealRecord.current = record;
+    });
+  }, [vaultPath]);
   useEffect4(() => () => {
     passkeyAbort.current?.abort();
-    admin.current?.close();
+    const current = admin.current;
     admin.current = null;
-  }, []);
+    if (current) {
+      current.close();
+      saveSealRecord(vaultPath, current.sealRecord());
+    }
+  }, [vaultPath]);
   const writeFields = (next) => {
     fieldsRef.current = next;
     setFields(next);
@@ -3653,7 +4351,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
           return;
         }
         try {
-          admin.current = VaultService.authorize(vaultPath, { password: first, totp: status?.totp ? second : undefined });
+          admin.current = VaultService.authorize(vaultPath, { password: first, sealRecord: sealRecord.current, totp: status?.totp ? second : undefined });
         } catch (e) {
           setError(message(e));
           writeFields(["", ""]);
@@ -3795,6 +4493,12 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
     setSection(next);
     setRowIndex(0);
   };
+  const pickSection = (next) => {
+    close();
+    setSection(next);
+    setRowIndex(0);
+    setFocus("nav");
+  };
   const moveRow = (delta) => setRowIndex(Math.min(rows.length - 1, Math.max(0, current + delta)));
   useKeyboard4((key) => {
     if (!app.active || key.ctrl || key.meta)
@@ -3819,6 +4523,44 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
       }
       return;
     }
+    if (key.name === "q") {
+      onBack();
+      return;
+    }
+    if (key.name === "tab") {
+      key.preventDefault();
+      setFocus(focus === "nav" ? "rows" : "nav");
+      return;
+    }
+    if (focus === "nav") {
+      switch (key.name) {
+        case "up":
+        case "k":
+          switchSection(-1);
+          return;
+        case "down":
+        case "j":
+          switchSection(1);
+          return;
+        case "home":
+          pickSection(SECTIONS[0]);
+          return;
+        case "end":
+          pickSection(SECTIONS[SECTIONS.length - 1]);
+          return;
+        case "right":
+        case "l":
+        case "space":
+          setFocus("rows");
+          return;
+        case "escape":
+          onBack();
+          return;
+      }
+      if (isEnter(key))
+        setFocus("rows");
+      return;
+    }
     switch (key.name) {
       case "up":
       case "k":
@@ -3828,21 +4570,16 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
       case "j":
         moveRow(1);
         return;
-      case "left":
-      case "h":
-        switchSection(-1);
-        return;
-      case "right":
-      case "l":
-        switchSection(1);
+      case "home":
+        setRowIndex(0);
         return;
-      case "tab":
-        key.preventDefault();
-        switchSection(key.shift ? -1 : 1);
+      case "end":
+        setRowIndex(rows.length - 1);
         return;
+      case "left":
+      case "h":
       case "escape":
-      case "q":
-        onBack();
+        setFocus("nav");
         return;
       case "space":
         row?.run?.();
@@ -3852,14 +4589,10 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
       row?.run?.();
   });
   const commands = useMemo3(() => [
-    ...SECTIONS.map((s) => ({ id: `settings:${s}`, title: `Settings \u2014 ${s}`, group: "Settings", run: () => {
-      close();
-      setSection(s);
-      setRowIndex(0);
-    } })),
+    ...SECTIONS.map((s) => ({ id: `settings:${s}`, title: `Settings \u2014 ${s}`, group: "Settings", run: () => pickSection(s) })),
     { id: "settings:back", title: "Back to the vault", hint: "esc", group: "Settings", run: onBack }
   ], [onBack]);
-  const copyTarget = row?.copy ? { label: row.label, read: () => row.copy ?? null, secret: false } : null;
+  const copyTarget = focus === "rows" && row?.copy ? { label: row.label, read: () => row.copy ?? null, secret: false } : null;
   useScreenContext(commands, copyTarget);
   useEffect4(() => {
     if (dialog?.kind === "confirm")
@@ -3868,13 +4601,16 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
       setHints([["esc", "cancel"]]);
     else if (dialog)
       setHints([["enter", "save"], ...fieldCount(dialog, status) > 1 ? [["tab", "field"]] : [], ["esc", "cancel"]]);
+    else if (focus === "nav")
+      setHints([["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["esc", "back to vault"]]);
     else
-      setHints([["\u2191\u2193", "move"], ["\u2190\u2192/tab", "section"], ...row?.verb ? [["enter", row.verb]] : [], ...row?.copy && row.verb !== "copy" ? [["ctrl+c", "copy"]] : [], ["esc", "back"]]);
-  }, [dialog, status, row?.verb, row?.copy, setHints]);
+      setHints([["\u2191\u2193", "move"], ...row?.verb ? [["enter", row.verb]] : [], ...row?.copy && row.verb !== "copy" ? [["ctrl+c", "copy"]] : [], ["\u2190/esc", "sections"]]);
+  }, [dialog, status, focus, row?.verb, row?.copy, setHints]);
   const listHeight = Math.max(3, height - 12);
   const offset = Math.max(0, Math.min(current - Math.floor(listHeight / 2), rows.length - listHeight));
   const visible = rows.slice(offset, offset + listHeight);
   const inputsFocused = app.active && dialog !== null;
+  const rowsFocused = focus === "rows" || dialog !== null;
   const valueWidth = Math.max(12, width - 64);
   return /* @__PURE__ */ jsxs4("box", {
     flexDirection: "row",
@@ -3895,14 +4631,10 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
           height: 1,
           paddingX: 1,
           backgroundColor: s === section ? theme.selection : undefined,
-          onMouseDown: () => {
-            close();
-            setSection(s);
-            setRowIndex(0);
-          },
+          onMouseDown: () => pickSection(s),
           children: /* @__PURE__ */ jsx4("text", {
             children: s === section ? /* @__PURE__ */ jsxs4("strong", {
-              fg: theme.accent,
+              fg: rowsFocused ? theme.muted : theme.accent,
               children: [
                 "\u203A ",
                 s
@@ -3932,7 +4664,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
             children: admin.current ? "Authorized for this visit \u2014 changes apply right away." : "Changes ask for your master password once per visit."
           }) : null,
           visible.map((r, i) => {
-            const on = offset + i === current;
+            const on = rowsFocused && offset + i === current;
             return /* @__PURE__ */ jsxs4("box", {
               flexDirection: "row",
               height: 1,
@@ -3940,6 +4672,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
               onMouseDown: () => {
                 if (dialog)
                   return;
+                setFocus("rows");
                 if (on)
                   r.run?.();
                 else
@@ -3977,7 +4710,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
               ]
             }, r.id);
           }),
-          row?.help && !dialog ? /* @__PURE__ */ jsx4("text", {
+          focus === "rows" && row?.help && !dialog ? /* @__PURE__ */ jsx4("text", {
             marginTop: 1,
             fg: theme.dim,
             wrapMode: "word",
@@ -4242,10 +4975,11 @@ function UnlockScreen({ vaultPath, onUnlock, setHints, notice, passkeyRunner = r
   const passkeys = useMemo4(() => VaultService.listPasskeys(vaultPath), [vaultPath]);
   const passkeyAbort = useRef6(null);
   const stepBeforePasskey = useRef6("password");
+  const sealRecord = useRef6(null);
   const finish = useCallback2((creds) => {
     setStep("unlocking");
     try {
-      onUnlock(VaultService.unlock(vaultPath, creds));
+      onUnlock(VaultService.unlock(vaultPath, { ...creds, sealRecord: sealRecord.current }));
     } catch (e) {
       setError(e instanceof Error ? e.message : String(e));
       setPassword("");
@@ -4257,13 +4991,14 @@ function UnlockScreen({ vaultPath, onUnlock, setHints, notice, passkeyRunner = r
   useEffect5(() => {
     let cancelled = false;
     (async () => {
+      sealRecord.current = await loadSealRecord(vaultPath);
       const recoveryFile = process.env.AUTHO_RECOVERY_FILE;
       if (recoveryFile) {
         try {
           const token = readRecoveryToken(recoveryFile);
           if (token) {
             try {
-              const session = VaultService.unlock(vaultPath, { password: "", recovery: token });
+              const session = VaultService.unlock(vaultPath, { password: "", recovery: token, sealRecord: sealRecord.current });
               if (!cancelled)
                 onUnlock(session);
               return;
@@ -4580,7 +5315,9 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
   const wide = width >= WIDE_MIN_COLUMNS;
   const [entries, setEntries] = useState6([]);
   const [query, setQuery] = useState6("");
-  const [searchFocused, setSearchFocused] = useState6(false);
+  const [pane, setPane] = useState6("list");
+  const [actionIndex, setActionIndex] = useState6(0);
+  const searchFocused = pane === "search";
   const [selectedId, setSelectedId] = useState6(initialSelectedId ?? null);
   const [detailOpen, setDetailOpen] = useState6(false);
   const [revealed, setRevealed] = useState6(null);
@@ -4607,6 +5344,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     setRevealed((r) => r && r.id !== selected?.id ? null : r);
     setOtp((o) => o && o.id !== selected?.id ? null : o);
     setConfirmDelete(false);
+    setActionIndex(0);
   }, [selected?.id]);
   const now = useNow(1000, Boolean(revealed || otp));
   useEffect6(() => {
@@ -4622,9 +5360,9 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       return null;
     }
   }, [session, app]);
-  const generateOtp = useCallback3((entry) => {
+  const generateOtp = useCallback3((entry, options) => {
     try {
-      const result = session.generateOtp(entry.id);
+      const result = session.generateOtp(entry.id, options);
       const next = { id: entry.id, code: result.code, expiresAt: Date.parse(result.expiresAt) };
       setOtp(next);
       return next;
@@ -4635,7 +5373,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
   }, [session, app]);
   useEffect6(() => {
     if (otp && selected && otp.id === selected.id && now >= otp.expiresAt) {
-      generateOtp(selected);
+      generateOtp(selected, { audit: false });
     }
   }, [now, otp, selected, generateOtp]);
   const copyPrimary = useCallback3((entry) => {
@@ -4686,6 +5424,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       app.toast(`Deleted "${entry.name}"`);
       setConfirmDelete(false);
       setDetailOpen(false);
+      setPane("list");
       reload();
     } catch (e) {
       app.toast(e instanceof Error ? e.message : String(e), "error");
@@ -4707,6 +5446,32 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
   };
   const showDetail = wide || detailOpen;
   const listHeight = Math.max(3, height - 6);
+  const actions = selected ? [
+    selected.type === "otp" ? { id: "copy", hotkey: "o", label: "copy code", color: theme.success, run: () => copyPrimary(selected) } : { id: "copy", hotkey: "c", label: `copy ${valueName(selected.type).toLowerCase()}`, color: theme.success, run: () => copyPrimary(selected) },
+    ...selected.type !== "otp" ? [{ id: "reveal", hotkey: "s", label: revealed?.id === selected.id ? "hide" : "reveal", color: theme.revealed, run: () => toggleReveal(selected) }] : [],
+    ...selected.url && selected.type !== "otp" ? [{ id: "open", hotkey: "o", label: "open", color: theme.info, run: () => open(selected) }] : [],
+    { id: "edit", hotkey: "e", label: "edit", color: theme.accent, run: () => onEdit(selected.id) },
+    { id: "delete", hotkey: "d", label: "delete", color: theme.danger, run: () => setConfirmDelete(true) }
+  ] : [];
+  const currentAction = Math.min(actionIndex, Math.max(0, actions.length - 1));
+  const focusPane = (next) => {
+    if (next === "actions") {
+      if (!selected)
+        return;
+      setDetailOpen(true);
+      setActionIndex(0);
+    }
+    if (next !== "actions" && !wide)
+      setDetailOpen(false);
+    setPane(next);
+  };
+  const cyclePane = (delta) => {
+    let index = PANES.indexOf(pane);
+    do
+      index = (index + delta + PANES.length) % PANES.length;
+    while (PANES[index] === "actions" && !selected);
+    focusPane(PANES[index]);
+  };
   useKeyboard6((key) => {
     if (!app.active || key.ctrl || key.meta)
       return;
@@ -4718,13 +5483,18 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
         setConfirmDelete(false);
       return;
     }
+    if (key.name === "tab") {
+      key.preventDefault();
+      cyclePane(key.shift ? -1 : 1);
+      return;
+    }
     if (searchFocused) {
       if (key.name === "escape") {
         setQuery("");
-        setSearchFocused(false);
-      } else if (isEnter(key) || key.name === "down" || key.name === "tab") {
+        setPane("list");
+      } else if (isEnter(key) || key.name === "down") {
         key.preventDefault();
-        setSearchFocused(false);
+        setPane("list");
       }
       return;
     }
@@ -4754,7 +5524,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
         return;
       case "/":
         key.preventDefault();
-        setSearchFocused(true);
+        focusPane("search");
         return;
       case "n":
         onCreate();
@@ -4773,30 +5543,52 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
         app.toast("Reloaded", "info");
         return;
     }
-    if (!selected)
-      return;
-    if (isEnter(key)) {
-      if (!showDetail)
-        setDetailOpen(true);
-      else
-        copyPrimary(selected);
+    if (key.name === "escape") {
+      if (pane === "actions")
+        focusPane("list");
+      else if (revealed)
+        setRevealed(null);
+      else if (query)
+        setQuery("");
       return;
     }
-    switch (key.name) {
-      case "right":
-      case "l":
-        setDetailOpen(true);
+    if (!selected)
+      return;
+    if (pane === "actions") {
+      switch (key.name) {
+        case "left":
+        case "h":
+          if (currentAction === 0)
+            focusPane("list");
+          else
+            setActionIndex((i) => Math.max(0, Math.min(i, actions.length - 1) - 1));
+          return;
+        case "right":
+        case "l":
+          setActionIndex((i) => Math.min(actions.length - 1, i + 1));
+          return;
+        case "space":
+          actions[currentAction]?.run();
+          return;
+      }
+      if (isEnter(key)) {
+        actions[currentAction]?.run();
         return;
-      case "left":
-      case "h":
-      case "escape":
-        if (detailOpen && !wide)
-          setDetailOpen(false);
-        else if (revealed)
-          setRevealed(null);
-        else if (query)
-          setQuery("");
+      }
+    } else {
+      if (key.name === "right" || key.name === "l") {
+        focusPane("actions");
+        return;
+      }
+      if (isEnter(key)) {
+        if (showDetail)
+          copyPrimary(selected);
+        else
+          focusPane("actions");
         return;
+      }
+    }
+    switch (key.name) {
       case "c":
         copyPrimary(selected);
         return;
@@ -4828,7 +5620,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
   const commands = useMemo5(() => {
     const list = [
       { id: "new", title: "New secret", hint: "n", group: "Vault", run: onCreate },
-      { id: "search", title: "Search secrets", hint: "/", group: "Vault", run: () => setSearchFocused(true) },
+      { id: "search", title: "Search secrets", hint: "/", group: "Vault", run: () => setPane("search") },
       { id: "reload", title: "Reload list", hint: "r", group: "Vault", run: reload }
     ];
     if (selected) {
@@ -4848,6 +5640,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
           setQuery("");
           setSelectedId(entry.id);
           setDetailOpen(true);
+          setPane("actions");
         }
       });
     }
@@ -4864,12 +5657,14 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       hints = [["y", "delete"], ["n/esc", "cancel"]];
     else if (searchFocused)
       hints = [["type", "filter"], ["enter/\u2193", "results"], ["esc", "clear"]];
+    else if (pane === "actions")
+      hints = [["\u2190\u2192", "choose"], ["enter", "run"], ["\u2191\u2193", "secret"], ["esc", "back"]];
     else if (!showDetail)
-      hints = [["\u2191\u2193", "move"], ["enter", "open"], ["c", "copy"], ["u", "user"], ["/", "search"], ["n", "new"], ["ctrl+k", "commands"], [",", "settings"], ["q", "quit"]];
+      hints = [["\u2191\u2193", "move"], ["enter", "open"], ["c", "copy"], ["/", "search"], ["n", "new"], ["q", "quit"]];
     else
-      hints = [["enter/c", "copy"], ["u", "user"], ["s", "reveal"], ...selected?.type === "otp" ? [["o", "code"]] : [], ["e", "edit"], ["d", "delete"], ["/", "search"], ["ctrl+k", "commands"], wide ? ["q", "quit"] : ["esc", "back"]];
+      hints = [["\u2191\u2193", "move"], ["enter", "copy"], ["\u2192/tab", "actions"], ["/", "search"], ["n", "new"], ["q", "quit"]];
     setHints(hints);
-  }, [confirmDelete, searchFocused, showDetail, wide, selected?.type, setHints]);
+  }, [confirmDelete, searchFocused, pane, showDetail, setHints]);
   const listWidth = wide ? Math.max(32, Math.floor(width * 0.38)) : width;
   const offset = Math.max(0, Math.min(selectedIndex - Math.floor(listHeight / 2), filtered.length - listHeight));
   const visible = filtered.slice(offset, offset + listHeight);
@@ -4902,8 +5697,12 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
         backgroundColor: isSelected ? theme.selection : undefined,
         onMouseDown: () => {
           setSelectedId(entry.id);
-          if (!wide)
+          if (wide)
+            setPane("list");
+          else {
             setDetailOpen(true);
+            setPane("actions");
+          }
         },
         children: /* @__PURE__ */ jsxs6("text", {
           children: [
@@ -4936,11 +5735,8 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     otp: otp?.id === selected.id ? otp : null,
     now,
     confirmDelete,
-    onCopy: () => copyPrimary(selected),
-    onOtp: () => copyPrimary(selected),
-    onOpen: () => open(selected),
-    onEdit: () => onEdit(selected.id),
-    onDelete: () => setConfirmDelete(true)
+    actions,
+    focusedAction: pane === "actions" ? currentAction : null
   }) : /* @__PURE__ */ jsx6("box", {
     flexGrow: 1,
     border: true,
@@ -4987,9 +5783,12 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     ]
   });
 }
-function Detail({ entry, revealed, otp, now, confirmDelete, onCopy, onOtp, onOpen, onEdit, onDelete }) {
+function valueName(type) {
+  return type === "note" ? "Note" : type === "otp" ? "Secret key" : "Password";
+}
+function Detail({ entry, revealed, otp, now, confirmDelete, actions, focusedAction }) {
   const badge = typeBadge(entry.type);
-  const valueLabel = entry.type === "note" ? "Note" : entry.type === "otp" ? "Secret key" : "Password";
+  const valueLabel = valueName(entry.type);
   const revealSeconds = revealed ? Math.max(0, Math.ceil((revealed.until - now) / 1000)) : 0;
   const otpSeconds = otp ? Math.max(0, Math.ceil((otp.expiresAt - now) / 1000)) : 0;
   const otpBar = 10;
@@ -5119,51 +5918,28 @@ function Detail({ entry, revealed, otp, now, confirmDelete, onCopy, onOtp, onOpe
             })
           ]
         })
-      }) : /* @__PURE__ */ jsxs6("box", {
+      }) : /* @__PURE__ */ jsx6("box", {
         flexDirection: "row",
         gap: 1,
         flexWrap: "wrap",
-        children: [
-          entry.type === "otp" ? /* @__PURE__ */ jsx6(Button, {
-            hotkey: "o",
-            label: "copy code",
-            onPress: onOtp,
-            color: theme.success
-          }) : /* @__PURE__ */ jsx6(Button, {
-            hotkey: "c",
-            label: `copy ${valueLabel.toLowerCase()}`,
-            onPress: onCopy,
-            color: theme.success
-          }),
-          entry.url && entry.type !== "otp" ? /* @__PURE__ */ jsx6(Button, {
-            hotkey: "o",
-            label: "open",
-            onPress: onOpen,
-            color: theme.info
-          }) : null,
-          /* @__PURE__ */ jsx6(Button, {
-            hotkey: "e",
-            label: "edit",
-            onPress: onEdit,
-            color: theme.accent
-          }),
-          /* @__PURE__ */ jsx6(Button, {
-            hotkey: "d",
-            label: "delete",
-            onPress: onDelete,
-            color: theme.danger
-          })
-        ]
+        children: actions.map((action, i) => /* @__PURE__ */ jsx6(Button, {
+          hotkey: action.hotkey,
+          label: action.label,
+          onPress: action.run,
+          color: action.color,
+          focused: focusedAction === i
+        }, action.id))
       })
     ]
   });
 }
-var WIDE_MIN_COLUMNS = 96;
+var PANES, WIDE_MIN_COLUMNS = 96;
 var init_vault = __esm(() => {
   init_components();
   init_context();
   init_theme();
   init_util();
+  PANES = ["search", "list", "actions"];
 });
 
 // apps/cli/src/tui.tsx
@@ -5213,11 +5989,11 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
     const current = sessionRef.current;
     if (!current)
       return;
-    current.close();
+    closeSessionAndRecordSeal(vaultPath, current);
     setSession(null);
     setPaletteOpen(false);
     setRoute({ name: "unlock", notice });
-  }, []);
+  }, [vaultPath]);
   const quit = useCallback4(() => {
     if (quitting.current)
       return;
@@ -5322,6 +6098,9 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
     ] : [],
     { id: "quit", title: "Quit", hint: "ctrl+c \xD72", group: "App", run: quit }
   ];
+  const goVault = useCallback4(() => setRoute({ name: "vault" }), []);
+  const goSettings = useCallback4(() => setRoute({ name: "settings" }), []);
+  const globalHints = !session || route.name === "unlock" ? [] : route.name === "vault" ? [["ctrl+k", "commands"], [",", "settings"]] : [["ctrl+k", "commands"]];
   const title = route.name === "unlock" ? "Locked" : route.name === "form" ? route.editing ? "Edit secret" : "New secret" : route.name === "settings" ? "Settings" : "Vault";
   const vaultName = basename3(vaultPath);
   let screen;
@@ -5349,7 +6128,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
     screen = /* @__PURE__ */ jsx7(SettingsScreen, {
       vaultPath,
       setHints,
-      onBack: () => setRoute({ name: "vault" }),
+      onBack: goVault,
       passkeyRunner
     });
   } else {
@@ -5358,7 +6137,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
       initialSelectedId: route.focusId,
       onCreate: () => setRoute({ name: "form", editing: null }),
       onEdit,
-      onSettings: () => setRoute({ name: "settings" }),
+      onSettings: goSettings,
       setHints,
       revealMs
     }, route.focusId ?? "vault");
@@ -5400,6 +6179,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
         }),
         /* @__PURE__ */ jsx7(StatusBar, {
           hints,
+          pinned: globalHints,
           toast: toastState
         }),
         paletteOpen ? /* @__PURE__ */ jsx7(CommandPalette, {
@@ -5426,9 +6206,8 @@ async function runTui(vaultPath) {
   const sessionSink = { current: null };
   renderer.once("destroy", () => {
     clipboard.handOffPendingClear();
-    try {
-      sessionSink.current?.close();
-    } catch {}
+    if (sessionSink.current)
+      closeSessionAndRecordSeal(vault, sessionSink.current).catch(() => {});
     sessionSink.current = null;
   });
   createRoot(renderer).render(/* @__PURE__ */ jsx7(App, {
@@ -5443,6 +6222,7 @@ async function runTui(vaultPath) {
 }
 var init_tui = __esm(() => {
   init_src3();
+  init_os_secrets();
   init_clipboard();
   init_components();
   init_context();
@@ -5544,13 +6324,14 @@ async function readPasswordMasked(prompt = "Master password: ") {
 init_src();
 init_src2();
 init_src3();
+init_os_secrets();
 init_paths();
 init_paths();
-import { createHash as createHash2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash3, timingSafeEqual as timingSafeEqual4 } from "crypto";
 import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync } from "fs";
 var DAEMON_TOKEN_SERVICE = "autho.daemon";
 function daemonTokenName(statePath) {
-  return createHash2("sha256").update(statePath).digest("hex");
+  return createHash3("sha256").update(statePath).digest("hex");
 }
 async function storeDaemonToken(statePath, token) {
   const tokenName = daemonTokenName(statePath);
@@ -5641,20 +6422,11 @@ async function deleteDaemonState(statePath) {
     rmSync(statePath, { force: true });
   }
 }
-function openSessionFromRootKey(rootKey, vaultPath) {
-  return new VaultSession(new AuthoDatabase(vaultPath), rootKey);
-}
-function unlockVaultRootKey(vaultPath, password) {
-  const db = new AuthoDatabase(vaultPath);
-  try {
-    const config = db.getVaultConfig();
-    if (!config) {
-      throw new Error(`Vault is not initialized at ${vaultPath}`);
-    }
-    return unlockRootKey(password, config);
-  } finally {
-    db.close();
-  }
+async function openSessionFromRootKey(session) {
+  return new VaultSession(new AuthoDatabase(session.vaultPath), session.rootKey, {
+    sealBound: session.sealBound,
+    sealRecord: await loadSealRecord(session.vaultPath)
+  });
 }
 async function readJson(request) {
   return await request.json();
@@ -5698,7 +6470,7 @@ async function startDaemonServer(options) {
   };
   const auth = (request) => {
     const provided = getBearerToken(request);
-    if (!provided || provided.length !== token.length || !timingSafeEqual2(Buffer.from(provided), Buffer.from(token))) {
+    if (!provided || provided.length !== token.length || !timingSafeEqual4(Buffer.from(provided), Buffer.from(token))) {
       return unauthorized();
     }
     return null;
@@ -5748,13 +6520,18 @@ async function startDaemonServer(options) {
           if (ttlSeconds <= 0 || ttlSeconds > 86400) {
             return json({ error: "Unlock ttl must be between 1 and 86400 seconds" }, 400);
           }
-          const rootKey = unlockVaultRootKey(options.vaultPath, body.password);
+          const { rootKey, sealBound } = VaultService.unlockRootKey(options.vaultPath, {
+            password: body.password,
+            sealRecord: await loadSealRecord(options.vaultPath),
+            totp: body.totp
+          });
           const sessionId = randomId();
           const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
           sessions.set(sessionId, {
             expiresAt,
             id: sessionId,
             rootKey,
+            sealBound,
             vaultPath: options.vaultPath
           });
           return json({
@@ -5773,11 +6550,11 @@ async function startDaemonServer(options) {
           if (!session) {
             return json({ error: `Unknown daemon session: ${body.sessionId}` }, 404);
           }
-          const vaultSession = openSessionFromRootKey(session.rootKey, session.vaultPath);
+          const vaultSession = await openSessionFromRootKey(session);
           try {
             return json(vaultSession.renderEnv(body.mappings, body.leaseId));
           } finally {
-            vaultSession.close();
+            await closeSessionAndRecordSeal(session.vaultPath, vaultSession);
           }
         }
         if (request.method === "POST" && url.pathname === "/exec") {
@@ -5786,11 +6563,11 @@ async function startDaemonServer(options) {
           if (!session) {
             return json({ error: `Unknown daemon session: ${body.sessionId}` }, 404);
           }
-          const vaultSession = openSessionFromRootKey(session.rootKey, session.vaultPath);
+          const vaultSession = await openSessionFromRootKey(session);
           try {
             return json(vaultSession.runExec(body));
           } finally {
-            vaultSession.close();
+            await closeSessionAndRecordSeal(session.vaultPath, vaultSession);
           }
         }
         if (request.method === "POST" && url.pathname === "/shutdown") {
@@ -5861,6 +6638,7 @@ async function daemonUnlock(options) {
   }
   return daemonRequest(state, "/unlock", {
     password: options.password,
+    totp: options.totp,
     ttlSeconds: options.ttlSeconds
   });
 }
@@ -5989,6 +6767,14 @@ function output(value, jsonMode = false) {
   }
   console.log(value);
 }
+function printSealChanges(changes, diffTrusted) {
+  if (!diffTrusted && changes.length > 0) {
+    console.log("The stored row signatures were edited too, so the list below may be incomplete.");
+  }
+  for (const change of changes) {
+    console.log(`  ${change.change.padEnd(8)} ${change.table} ${change.rowId}`);
+  }
+}
 function absolutePath(path) {
   return resolve5(path);
 }
@@ -6046,7 +6832,7 @@ async function runPromptMode(vaultPath, initialPassword) {
   const prompt = await createPromptAdapter();
   try {
     const password = await askPassword(prompt, initialPassword);
-    const session = VaultService.unlock(vaultPath, password);
+    const session = VaultService.unlock(vaultPath, { password, sealRecord: await loadSealRecord(vaultPath) });
     try {
       const action = (await prompt.ask("Action [create/read/list/delete/otp/exit]: ")).toLowerCase();
       if (action === "exit" /* Exit */) {
@@ -6096,7 +6882,7 @@ async function runPromptMode(vaultPath, initialPassword) {
       }
       throw new Error(`Unknown prompt action: ${action}`);
     } finally {
-      session.close();
+      await closeSessionAndRecordSeal(vaultPath, session);
     }
   } finally {
     prompt.close();
@@ -6119,8 +6905,9 @@ async function passkeyCredentials(vaultPath) {
   return { password: "", passkey: { credentialId: result.credentialId, prfOutput: result.prfOutput } };
 }
 async function resolveUnlockCredentials(vaultPath, args, existingPassword) {
+  const sealRecord = await loadSealRecord(vaultPath);
   if (wantsPasskey(args)) {
-    return passkeyCredentials(vaultPath);
+    return { ...await passkeyCredentials(vaultPath), sealRecord };
   }
   let password = existingPassword ?? getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
   if (!password) {
@@ -6129,7 +6916,7 @@ async function resolveUnlockCredentials(vaultPath, args, existingPassword) {
   if (!password && process.stdin.isTTY) {
     password = await readPasswordMasked("Master password: ");
   }
-  const creds = { password: required(password, "--password") };
+  const creds = { password: required(password, "--password"), sealRecord };
   if (await hasPinSet(vaultPath)) {
     const pin = process.env.AUTHO_PIN ?? getString(args, "pin") ?? (process.stdin.isTTY ? await readPasswordMasked("PIN: ") : undefined);
     if (!pin)
@@ -6302,12 +7089,17 @@ function help() {
     "  import legacy --file <path> [--skip-existing] [--vault <path>] [--json]",
     "  secrets add --name <name> --type <password|note|otp> --value <value> [--username <v>] [--url <v>] [--description <v>] [--digits <v>] [--algorithm <v>] [--vault <path>]",
     "  secrets list [--vault <path>] [--json]",
-    "  secrets get --ref <name-or-id> [--vault <path>] [--json]",
-    "  secrets rm --ref <name-or-id> [--vault <path>] [--json]",
+    "  secrets get --ref <name-or-id> [--links] [--vault <path>] [--json]",
+    "  secrets rm --ref <name-or-id> [--with-linked] [--vault <path>] [--json]",
+    "  link <primary> <secret> [--vault <path>] [--json]      Show <secret> on <primary>'s page",
+    "  unlink <primary> <secret> [--vault <path>] [--json]",
     "  secrets edit --ref <name-or-id> [--new-name <v>] [--value <v>] [--username <v>] [--url <v>] [--description <v>] [--vault <path>] [--json]",
     "  otp code --ref <name-or-id> [--vault <path>] [--json]",
-    "  lease create --secret <ref> [--secret <ref>] [--ttl <seconds>] [--name <v>] [--vault <path>] [--json]",
+    "  lease create --secret <ref> [--secret <ref>] [--ttl <seconds>] [--name <v>] [--no-links] [--vault <path>] [--json]",
+    "  lease show --lease <id> [--vault <path>] [--json]",
     "  lease revoke --lease <id> [--vault <path>] [--json]",
+    "  vault verify [--vault <path>] [--json]",
+    "  vault reseal [--accept] [--vault <path>] [--json]",
     "  env render --map <ENV=ref> [--project-file <path>] [--lease <id>] [--vault <path>] [--json]",
     "  env sync --map <ENV=ref> [--project-file <path>] [--lease <id>] [--ttl <seconds>] [--output <path>] [--force] [--vault <path>] [--json]",
     "  exec --map <ENV=ref> [--project-file <path>] [--lease <id>] [--vault <path>] -- <cmd>",
@@ -6358,6 +7150,9 @@ function help() {
     "  Config keys: vaultDir, revealSeconds, clipboardClearSeconds, idleLockSeconds, passwordLength,",
     "    passwordSymbols, mouse, defaultLeaseTtl, daemonTtlSeconds, webPort (see `autho config show`).",
     "  lease create uses the defaultLeaseTtl setting when --ttl is omitted (0 = --ttl required).",
+    "  A lease on a secret also covers the secrets linked to it, read live (--no-links to opt out).",
+    "  env and exec inject an OTP secret's current code, never its seed.",
+    "  The vault is sealed: edits made outside autho stop env, exec and leases until `autho vault reseal`.",
     "  In the TUI, press , for Settings. `autho --version` prints the installed version.",
     "  The default vault path is ~/.autho/vault.db (override with config or AUTHO_HOME).",
     "  The default project file is <vaultDir>/project.json.",
@@ -6419,7 +7214,10 @@ async function main() {
       "audit" /* Audit */,
       "import" /* Import */,
       "recovery" /* Recovery */,
-      "unlock" /* Unlock */
+      "unlock" /* Unlock */,
+      "link" /* Link */,
+      "unlink" /* Unlink */,
+      "vault" /* Vault */
     ].includes(scope ?? "");
     const daemonNeedsPassword = scope === "daemon" /* Daemon */ && action === "unlock" /* Unlock */;
     if (needsPassword || daemonNeedsPassword) {
@@ -6595,9 +7393,13 @@ async function main() {
     return;
   }
   if (scope === "daemon" /* Daemon */ && action === "unlock" /* Unlock */) {
+    const creds = await resolveUnlockCredentials(vaultPath, args, password);
+    if (creds.passkey || creds.recovery)
+      throw new Error("daemon unlock needs the master password");
     output(await daemonUnlock({
-      password: required(password, "--password"),
+      password: creds.password,
       statePath,
+      totp: creds.totp,
       ttlSeconds: getString(args, "ttl") ? Number(getString(args, "ttl")) : numberPreference("daemonTtlSeconds")
     }), jsonMode);
     return;
@@ -6683,6 +7485,7 @@ async function main() {
       info = admin.addPasskey({ ...result, label, prfSalt });
     } finally {
       admin.close();
+      await saveSealRecord(vaultPath, admin.sealRecord());
     }
     if (jsonMode) {
       output({ added: true, id: info.id, label: info.label }, true);
@@ -6701,6 +7504,31 @@ async function main() {
   if (scope === "passkey" /* Passkey */) {
     throw new Error(`Unknown passkey action: ${action}. Use add, list or remove.`);
   }
+  if (scope === "vault" /* Vault */ && action === "reseal" /* Reseal */) {
+    const mode = getBoolean(args, "accept") ? "accept" : "quarantine";
+    const result = VaultService.reseal(vaultPath, await resolveUnlockCredentials(vaultPath, args, password), mode);
+    await saveSealRecord(vaultPath, result.sealRecord);
+    if (jsonMode) {
+      output(result, true);
+    } else if (result.wasIntact) {
+      console.log("The vault seal is intact; nothing to do.");
+    } else {
+      if (result.reason)
+        console.log(`Seal problem: ${result.reason}.`);
+      printSealChanges(result.changes, result.diffTrusted);
+      if (mode === "quarantine") {
+        console.log(`Revoked ${result.revokedLeases} active lease(s).`);
+        if (result.undone.length)
+          console.log(`Undid ${result.undone.length} change(s).`);
+        if (result.kept.length) {
+          console.log(`Couldn't undo ${result.kept.length} change(s); check these by hand:`);
+          printSealChanges(result.kept, true);
+        }
+      }
+      console.log(mode === "accept" ? "Vault re-sealed as it is now." : "Vault re-sealed.");
+    }
+    return;
+  }
   if (scope === "password" /* Password */ && action === "change" /* Change */) {
     const admin = VaultService.authorize(vaultPath, await resolveUnlockCredentials(vaultPath, args, password));
     try {
@@ -6723,6 +7551,7 @@ async function main() {
       }
     } finally {
       admin.close();
+      await saveSealRecord(vaultPath, admin.sealRecord());
     }
     return;
   }
@@ -6770,13 +7599,41 @@ async function main() {
       return;
     }
     if (scope === "secrets" /* Secrets */ && action === "get" /* Get */) {
-      const ref = getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id");
-      output(session.getSecret(required(ref, "--ref")), jsonMode);
+      const ref = required(getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id"), "--ref");
+      const secret = session.getSecret(ref);
+      output(getBoolean(args, "links") ? { ...secret, ...session.getLinks(secret.id) } : secret, jsonMode);
       return;
     }
     if (scope === "secrets" /* Secrets */ && action === "rm" /* Rm */) {
       const ref = getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id");
-      output(session.removeSecret(required(ref, "--ref")), jsonMode);
+      output(session.removeSecret(required(ref, "--ref"), { withLinked: getBoolean(args, "with-linked") }), jsonMode);
+      return;
+    }
+    if (scope === "link" /* Link */ || scope === "unlink" /* Unlink */) {
+      const primary = required(action ?? getString(args, "primary"), "<primary>");
+      const linked = required(subaction ?? getString(args, "secret"), "<secret>");
+      output(scope === "link" /* Link */ ? session.linkSecrets(primary, linked) : session.unlinkSecrets(primary, linked), jsonMode);
+      return;
+    }
+    if (scope === "vault" /* Vault */ && action === "verify" /* Verify */) {
+      const seal = session.verifySeal();
+      if (jsonMode) {
+        output(seal, true);
+      } else if (seal.state === "intact") {
+        console.log("Vault seal is intact.");
+      } else if (seal.state === "unsealed") {
+        console.log("Vault isn't sealed yet. Unlock it with the master password to seal it.");
+      } else {
+        console.log(`Vault was modified outside autho: ${seal.reason}.`);
+        printSealChanges(seal.changes, seal.diffTrusted);
+        console.log("Run `autho vault reseal` to undo the changes and revoke leases, or `autho vault reseal --accept` if you made the change.");
+      }
+      if (seal.state === "tampered")
+        process.exitCode = 2;
+      return;
+    }
+    if (scope === "lease" /* Lease */ && action === "show" /* Show */) {
+      output(session.showLease(required(getString(args, "lease"), "--lease")), jsonMode);
       return;
     }
     if (scope === "secrets" /* Secrets */ && action === "edit" /* Edit */) {
@@ -6804,6 +7661,7 @@ async function main() {
     if (scope === "lease" /* Lease */ && action === "create" /* Create */) {
       output(session.createLease({
         name: getString(args, "name") ?? "session",
+        noLinks: getBoolean(args, "no-links"),
         secretRefs: getStrings(args, "secret"),
         ttlSeconds: leaseTtl(args)
       }), jsonMode);
@@ -6868,7 +7726,7 @@ async function main() {
     }
     throw new Error(`Unknown command: ${[scope, action, subaction].filter(Boolean).join(" ")}`);
   } finally {
-    session.close();
+    await closeSessionAndRecordSeal(vaultPath, session);
   }
 }
 main().catch((error) => {