The npm wrapper (npx phantom-secrets init) actively refuses to install on Windows today. The Rust release pipeline already produces a Windows binary (phantom-x86_64-pc-windows-msvc.zip), but the npm layer cannot fetch or extract it.

Three blockers in the wrapper

1. npm/package.json:42-45 — "os": ["darwin", "linux"] causes npm install to fail with EBADPLATFORM on Windows.
2. npm/bin/cli.js:17-33 — getPlatformTarget() has no Windows branch; Windows users hit Unsupported platform: win32-* and exit 1.
3. npm/bin/cli.js:79-80 — extraction uses tar xzf (Unix only) + chmod +x (Unix only). Windows release is a .zip, not .tar.gz.

Fix (~15-20 lines of JS)

• Add "win32" to the os array in package.json
• Add Windows branch to getPlatformTarget() returning x86_64-pc-windows-msvc
• Download .zip instead of .tar.gz on Windows; extract via PowerShell Expand-Archive or a small Node zip library
• Skip chmod +x on Windows (no-op)
• .exe suffix is already handled at cli.js:37-38

Why this was missed originally

The audit focused on the Rust workspace. The npm distribution layer wasn't in scope. Surfaced when asking "is there a Windows install yet."

Severity

Release blocker — without this, Windows users can't run npx phantom-secrets init even after the Rust crates support Windows. Must land before cutting a release that advertises Windows support.

Tracker: #1