Move docs/ package mirror into document-navigator plugin

Relocate the ~6k-file docs tree from the repo root into
plugins/document-navigator/docs/ so the plugin is self-contained and
portable. docs/superpowers/ (specs and plans) stays at the repo root.

Moved via cp+rm rather than git mv because directory rename() fails with
EPERM on this WSL /mnt DrvFs mount; git rename-detection pairs the
identical-content files at commit time.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/create-root-keys-chain.md

@@ -0,0 +1,57 @@
+# `bin/create-root-keys-chain`
+
+## Purpose
+
+Commander entry point for the `create-root-keys-chain` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("create-root-keys-chain", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+create-root-keys-chain --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | create-root-keys-chain [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`create-root-keys-chain --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/create-root-keys.md

@@ -0,0 +1,57 @@
+# `bin/create-root-keys`
+
+## Purpose
+
+Commander entry point for the `create-root-keys` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("create-root-keys", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+create-root-keys --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | create-root-keys [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`create-root-keys --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/create-server-keys-chain.md

@@ -0,0 +1,57 @@
+# `bin/create-server-keys-chain`
+
+## Purpose
+
+Commander entry point for the `create-server-keys-chain` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("create-server-keys-chain", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+create-server-keys-chain --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | create-server-keys-chain [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`create-server-keys-chain --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/create-server-keys.md

@@ -0,0 +1,57 @@
+# `bin/create-server-keys`
+
+## Purpose
+
+Commander entry point for the `create-server-keys` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("create-server-keys", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+create-server-keys --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | create-server-keys [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`create-server-keys --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/get-file-stats.md

@@ -0,0 +1,57 @@
+# `bin/get-file-stats`
+
+## Purpose
+
+Commander entry point for the `get-file-stats` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("get-file-stats", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+get-file-stats --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | get-file-stats [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`get-file-stats --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/index.md

@@ -0,0 +1,57 @@
+# `bin/index`
+
+## Purpose
+
+Commander entry point for the `index` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("index", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+index --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | index [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`index --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/license.md

@@ -0,0 +1,57 @@
+# `bin/license`
+
+## Purpose
+
+Commander entry point for the `license` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("license", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+license --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | license [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`license --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/prepare-file.md

@@ -0,0 +1,57 @@
+# `bin/prepare-file`
+
+## Purpose
+
+Commander entry point for the `prepare-file` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("prepare-file", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+prepare-file --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | prepare-file [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`prepare-file --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/roll-server-keys-chain.md

@@ -0,0 +1,57 @@
+# `bin/roll-server-keys-chain`
+
+## Purpose
+
+Commander entry point for the `roll-server-keys-chain` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("roll-server-keys-chain", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+roll-server-keys-chain --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | roll-server-keys-chain [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`roll-server-keys-chain --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/roll-server-keys.md

@@ -0,0 +1,57 @@
+# `bin/roll-server-keys`
+
+## Purpose
+
+Commander entry point for the `roll-server-keys` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("roll-server-keys", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+roll-server-keys --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | roll-server-keys [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`roll-server-keys --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/serve-file.md

@@ -0,0 +1,57 @@
+# `bin/serve-file`
+
+## Purpose
+
+Commander entry point for the `serve-file` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("serve-file", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+serve-file --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | serve-file [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`serve-file --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/validate-file.md

@@ -0,0 +1,57 @@
+# `bin/validate-file`
+
+## Purpose
+
+Commander entry point for the `validate-file` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("validate-file", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+validate-file --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | validate-file [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`validate-file --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/validate-packet.md

@@ -0,0 +1,57 @@
+# `bin/validate-packet`
+
+## Purpose
+
+Commander entry point for the `validate-packet` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("validate-packet", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+validate-packet --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | validate-packet [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`validate-packet --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/verify-key-chain.md

@@ -0,0 +1,57 @@
+# `bin/verify-key-chain`
+
+## Purpose
+
+Commander entry point for the `verify-key-chain` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("verify-key-chain", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+verify-key-chain --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | verify-key-chain [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`verify-key-chain --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/view-chain-public.md

@@ -0,0 +1,57 @@
+# `bin/view-chain-public`
+
+## Purpose
+
+Commander entry point for the `view-chain-public` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("view-chain-public", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+view-chain-public --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | view-chain-public [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`view-chain-public --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/view-keys.md

@@ -0,0 +1,57 @@
+# `bin/view-keys`
+
+## Purpose
+
+Commander entry point for the `view-keys` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("view-keys", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+view-keys --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | view-keys [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`view-keys --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/view-public-key-file.md

@@ -0,0 +1,57 @@
+# `bin/view-public-key-file`
+
+## Purpose
+
+Commander entry point for the `view-public-key-file` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("view-public-key-file", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+view-public-key-file --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | view-public-key-file [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`view-public-key-file --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.

plugins/document-navigator/docs/security-stack/security/server-keys/src/bin/view-vault.md

@@ -0,0 +1,57 @@
+# `bin/view-vault`
+
+## Purpose
+
+Commander entry point for the `view-vault` operator command. Parses CLI
+flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
+and dispatches to the matching function in
+`@suaveplan/server-keys/commands/`. The body runs inside
+`runFunction("view-vault", ...)` so OTel emission, structured stderr
+banners, and `exit(1)` on failure are all handled by the shared
+wrapper instead of being re-implemented per bin.
+
+This file is a thin wrapper — operator-facing behaviour lives in the
+`commands/` module the bin imports. The bin's only responsibilities
+are flag parsing, password prompting, and exit-code threading; the
+spec compliance, error handling, and OTel emission all come from the
+shared wrapper layer.
+
+## Features
+
+- `commander` flag parsing with `-h/--help` for every sub-command.
+- Password prompts via `@inquirer/prompts` (echo-disabled).
+- OTel command-total + duration histogram per invocation.
+- Structured `SERVER_KEYS_*` error banners on failure.
+- `process.exit(1)` on any thrown failure, after the banner.
+
+## Usage: Basic
+
+```bash
+view-vault --help
+```
+
+## Usage: Advanced
+
+Run the bin from a shell with a non-TTY `stdin` (e.g. via process
+substitution) to script multiple operations:
+
+```bash
+echo "mypassword" | view-vault [flags...]
+```
+
+When invoked under a `SIGINT`-trapping shell, the bin honours the
+shared `AbortController` plumbed through `runFunction`.
+
+## API Reference
+
+This bin exposes its surface via `commander` flags only. Run
+`view-vault --help` for the authoritative list. The library-level surface
+the bin wraps is documented under the matching `commands/` module.
+
+## Implementation Notes
+
+The bin imports its target command lazily where possible to keep `bun
+link` cold-start time short. Every prompt accepts `{ inputStream,
+outputStream, signal }` via `PromptOptions` so tests can drive the
+bin without a real TTY; in production the defaults resolve to
+`process.stdin` / `process.stdout`.