Use and host Vaultwarden (Bitwarden-compatible) password vaults. Use a vault: read credentials with the pinned bw 2025.4.0 CLI and vault-fetch.sh, with a local `.credentials` fallback. Host a vault for people: run the official Vaultwarden server for the owner, as a shared-tent CLAW service (digest-verified install without Docker, a socket bridge within the service limits) or on their dedicated VM behind Caddy.

Authenticate AI-agent claws to an HTTP API via their own Nostr keypair (NIP-98 kind-27235 + TOFU): verify notes, adversarial tests, signer included

Generate TOTP (2FA) codes from a base32 secret - pure Node, no dependencies. Pass the secret as an arg or via a local .credentials (gitignored)