chore: auto-commit uncommitted changes

Makefile

@@ -13,15 +13,17 @@ export GOEXPERIMENT
 
 APP_DIR     := app
 WEB_DIR     := website
+CLI_DIR     := cli
 APP_BIN     := $(APP_DIR)/vault1984
 WEB_BIN     := $(WEB_DIR)/vault1984-web
+CLI_BIN     := $(CLI_DIR)/vault1984
 APP_ENTRY   := ./cmd/vault1984
 WEB_ENTRY   := .
 
 LDFLAGS     := -s -w
 GOFLAGS     := -trimpath
 
-.PHONY: all app website test clean deploy deploy-app deploy-web \
+.PHONY: all app website cli test clean deploy deploy-app deploy-web \
         restart restart-app restart-web stop stop-app stop-web status verify-fips
 
 # --- build ---
@@ -36,6 +38,11 @@ website:
 	cd $(WEB_DIR) && go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o vault1984-web $(WEB_ENTRY)
 	@echo "built $(WEB_BIN) (FIPS)"
 
+cli:
+	$(MAKE) -C $(CLI_DIR)
+	@strip $(CLI_BIN) 2>/dev/null || true
+	@echo "built $(CLI_BIN) ($$(wc -c < $(CLI_BIN)) bytes, stripped)"
+
 # --- test ---
 
 test:
@@ -107,3 +114,4 @@ logs-web:
 
 clean:
 	rm -f $(APP_BIN) $(WEB_BIN)
+	$(MAKE) -C $(CLI_DIR) clean

cli/Makefile

@@ -0,0 +1,120 @@
+# vault1984 CLI — Makefile
+# Pure C, BearSSL + QuickJS + cJSON, target <1MB stripped
+#
+# Usage:
+#   make          — build for host
+#   make clean    — remove build artifacts
+#   make strip    — strip the binary
+#   make size     — show binary size
+
+CC       ?= cc
+CFLAGS   := -std=c11 -Wall -Wextra -Os -DNDEBUG
+CFLAGS_GNU := -std=gnu11 -Wall -Os -DNDEBUG
+LDFLAGS  :=
+STRIP    ?= strip
+
+# Platform detection
+UNAME_S := $(shell uname -s 2>/dev/null || echo Windows)
+ifeq ($(UNAME_S),Linux)
+  LDFLAGS += -lm -lpthread
+endif
+ifeq ($(UNAME_S),Darwin)
+  LDFLAGS += -lm
+endif
+ifeq ($(UNAME_S),FreeBSD)
+  LDFLAGS += -lm -lpthread
+endif
+
+# Directories
+SRC_DIR     := src
+BUILD_DIR   := build
+VENDOR_DIR  := vendor
+BEARSSL_DIR := $(VENDOR_DIR)/bearssl
+QUICKJS_DIR := $(VENDOR_DIR)/quickjs
+CJSON_DIR   := $(VENDOR_DIR)/cjson
+CRYPTO_DIR  := ../crypto
+
+# Output binary
+BIN := vault1984
+
+# --- Source files ---
+
+# CLI sources
+CLI_SRC := $(SRC_DIR)/main.c \
+           $(SRC_DIR)/http.c \
+           $(SRC_DIR)/keystore.c \
+           $(SRC_DIR)/jsbridge.c \
+           $(SRC_DIR)/util.c
+
+# cJSON (single file)
+CJSON_SRC := $(CJSON_DIR)/cJSON.c
+
+# QuickJS core sources (no qjs.c/qjsc.c — those are standalone executables)
+QUICKJS_SRC := $(QUICKJS_DIR)/quickjs.c \
+               $(QUICKJS_DIR)/cutils.c \
+               $(QUICKJS_DIR)/dtoa.c \
+               $(QUICKJS_DIR)/libregexp.c \
+               $(QUICKJS_DIR)/libunicode.c \
+               $(QUICKJS_DIR)/quickjs-libc.c
+
+# BearSSL — compile all .c files in src/ subdirectories
+BEARSSL_SRC := $(shell find $(BEARSSL_DIR)/src -name '*.c')
+
+# All sources
+ALL_SRC := $(CLI_SRC) $(CJSON_SRC) $(QUICKJS_SRC) $(BEARSSL_SRC)
+
+# Object files (in build/)
+ALL_OBJ := $(patsubst %.c,$(BUILD_DIR)/%.o,$(ALL_SRC))
+
+# Include paths
+INCLUDES := -I$(BEARSSL_DIR)/inc \
+            -I$(QUICKJS_DIR) \
+            -I$(CJSON_DIR) \
+            -I$(SRC_DIR)
+
+# QuickJS needs these defines
+QJS_DEFS := -DCONFIG_VERSION=\"2025-04-26\" \
+            -D_GNU_SOURCE \
+            -DCONFIG_BIGNUM
+
+# --- Rules ---
+
+.PHONY: all clean strip size
+
+all: $(BIN)
+
+$(BIN): $(ALL_OBJ)
+	$(CC) -o $@ $^ $(LDFLAGS)
+	@echo "built: $(BIN) ($(shell wc -c < $@ 2>/dev/null || echo '?') bytes)"
+
+# CLI sources (need QuickJS + BearSSL headers)
+$(BUILD_DIR)/$(SRC_DIR)/%.o: $(SRC_DIR)/%.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) $(INCLUDES) -Wno-unused-parameter -c $< -o $@
+
+# cJSON
+$(BUILD_DIR)/$(CJSON_DIR)/%.o: $(CJSON_DIR)/%.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -I$(CJSON_DIR) -c $< -o $@
+
+# QuickJS
+$(BUILD_DIR)/$(QUICKJS_DIR)/%.o: $(QUICKJS_DIR)/%.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS_GNU) $(QJS_DEFS) -I$(QUICKJS_DIR) -Wno-sign-compare -Wno-unused-parameter -Wno-implicit-fallthrough -c $< -o $@
+
+# BearSSL
+$(BUILD_DIR)/$(BEARSSL_DIR)/%.o: $(BEARSSL_DIR)/%.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -I$(BEARSSL_DIR)/inc -I$(BEARSSL_DIR)/src -c $< -o $@
+
+clean:
+	rm -rf $(BUILD_DIR) $(BIN)
+
+strip: $(BIN)
+	$(STRIP) $(BIN)
+	@echo "stripped: $(BIN) ($(shell wc -c < $(BIN)) bytes)"
+
+size: $(BIN)
+	@ls -la $(BIN)
+	@echo "---"
+	@size $(BIN) 2>/dev/null || true