src/
├── main.rs ─ CLI, entrypoint, schema bootstrap
├── server.rs ─ HTTPS + mTLS server, all endpoints
├── client.rs ─ HTTP client, rustls config, session file
├── auth.rs ─ request authentication, permission checks, audit, MFA
├── credstore.rs ─ encrypted-at-rest credential profiles
├── persistence.rs ─ master-key provider, DEK, CA + server cert load/init/rekey
├── tls.rs ─ CA + certificate issuance
├── blackbook_core.rs ─ key hierarchy, AES-GCM envelopes, KDFs
├── crypto_ops.rs ─ crypto toolkit primitives + byte formats (shared)
├── keys_api.rs ─ managed-key endpoints (encrypt/sign/HMAC/tokens)
├── crypto_cli.rs ─ `bbk key` / `bbk crypto` commands
├── mcp.rs ─ MCP server for AI agents
├── net_ratelimit.rs ─ per-client rate limiter (anti-DoS)
├── audit_archive.rs ─ encrypted, verifiable audit-log archives
├── presentation.rs ─ fingerprint rendering (display only)
├── webui.rs (+webui/) ─ local browser console that re-invokes the CLI
└── tunnel_*.rs ─ end-to-end-encrypted client-to-client tunnels