@seekrit/cli 0.42.0 → 0.43.0

package/dist/index.js

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
-import { homedir, hostname, tmpdir, userInfo } from "node:os";
-import { dirname, join, parse } from "node:path";
+import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
+import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
-//#region ../../packages/core/src/agent-policy.ts
 /** A bare hostname: no scheme, no port, no path, no wildcard. */
 const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
 const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
@@ -45,6 +44,44 @@ z.object({
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
+/** A structurally invalid, unverifiable, or expired bundle. */
+var AgentPolicyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AgentPolicyError";
+	}
+};
+/**
+* Read a bundle **without** verifying its signature — for display only.
+*
+* Named to be hard to misuse: anything that acts on policy must go through
+* {@link verifyAgentPolicy} (or the Rust verifier). The dashboard uses this to
+* render version history it fetched from the API, where the trust question is
+* already settled differently: the API is the one showing you the list.
+*/
+function parseAgentPolicyUnverified(envelope) {
+	const parts = envelope.trim().split(".");
+	if (parts.length !== 3 || parts[0] !== "ap1") throw new AgentPolicyError(`not a policy bundle (expected a ap1. envelope)`);
+	let body;
+	try {
+		body = JSON.parse(utf8Decode$1(fromBase64url(parts[1])));
+	} catch (e) {
+		throw new AgentPolicyError(`policy bundle body is unreadable: ${e.message}`);
+	}
+	if (body?.v !== 1) throw new AgentPolicyError(`unsupported policy bundle version ${String(body?.v)}`);
+	if (!Array.isArray(body.rules) || !body.signer?.jwk) throw new AgentPolicyError("policy bundle is missing rules or signer");
+	return body;
+}
+function utf8Decode$1(bytes) {
+	return new TextDecoder().decode(bytes);
+}
+function fromBase64url(text) {
+	const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+	const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+	const out = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+	return out;
+}
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1709,7 +1746,8 @@ const SYNC_PROVIDER_KINDS = [
 	"netlify",
 	"bunnyshell",
 	"github-actions",
-	"gcp-secret-manager"
+	"gcp-secret-manager",
+	"langgraph-platform"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1990,6 +2028,66 @@ const gcpSecretManagerConnectionConfigSchema = z.object({
 	/** Project ID (`acme-prod`) or project number. */
 	projectId: gcpProjectSchema
 });
+/**
+* The four hosts LangChain runs the deployment control plane on. A LangSmith
+* account lives in exactly one of them, and an API key minted in one is not
+* accepted by another — so this is the "which account" half of a LangGraph
+* Platform connection, the way Cloudflare's account id is.
+*
+* `us` is the default because it is what `https://smith.langchain.com` signs
+* into; the other three are chosen at signup and never change afterwards.
+*/
+const LANGGRAPH_PLATFORM_REGIONS = [
+	"us",
+	"eu",
+	"apac",
+	"aws-us"
+];
+/**
+* LangSmith workspace/tenant scope for LangGraph Platform.
+*
+* The API key is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's token is.
+*
+* Two optional fields, for two different situations, and setting both is
+* rejected rather than silently resolved:
+*
+*  - `region` picks one of {@link LANGGRAPH_PLATFORM_HOSTS}. Omitted means
+*    `us`, which is where an account created at `smith.langchain.com` lives.
+*  - `baseUrl` points the connection at a **self-hosted** LangSmith install,
+*    whose control plane is served from the customer's own host under
+*    `/api-host` rather than from `*.api.host.langchain.com`.
+*
+* `tenantId` is the workspace a key was minted in. A workspace-scoped key names
+* its own tenant and does not need it; an organization-scoped key reaches
+* several workspaces and gets a bare 403 without it, which is the same trap
+* Vercel's `teamId` sets — so it is passed through as `X-Tenant-Id` whenever
+* it is present.
+*/
+const langgraphPlatformConnectionConfigSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Control-plane region. Omit for `us`. Mutually exclusive with `baseUrl`. */
+	region: z.enum(LANGGRAPH_PLATFORM_REGIONS).optional(),
+	/**
+	* Self-hosted LangSmith control-plane root, e.g.
+	* `https://langsmith.acme.com/api-host`. Omit for LangChain's own hosts.
+	* Must be `https:` — this URL carries the API key.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the self-hosted control-plane root, e.g. https://langsmith.acme.com/api-host").optional(),
+	/** LangSmith workspace (tenant) UUID, sent as `X-Tenant-Id`. */
+	tenantId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangSmith workspace UUID").optional()
+}).refine((c) => !(c.baseUrl !== void 0 && c.region !== void 0), {
+	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
+	path: ["baseUrl"]
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2006,7 +2104,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	netlifyConnectionConfigSchema,
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
-	gcpSecretManagerConnectionConfigSchema
+	gcpSecretManagerConnectionConfigSchema,
+	langgraphPlatformConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -2717,6 +2816,27 @@ const gcpSecretManagerDestinationSchema = z.object({
 	message: "a customer-managed key covers one location — use automatic replication, or a single location",
 	path: ["kmsKeyName"]
 });
+/**
+* One LangGraph Platform (Agent Server) **deployment**, addressed by its id.
+*
+* A deployment is the whole unit here: its secrets are a property of the
+* deployment, delivered to the agent container as environment variables, and
+* there is nothing finer to point at — no per-revision or per-graph scope, and
+* no equivalent of Vercel's `production`/`preview` split. A deployment that
+* needs different values is a different deployment, so it is a different
+* binding.
+*
+* Validated as a UUID because `PATCH /v2/deployments/{deployment_id}` declares
+* the path parameter as one: a name or a URL slug in the slot fails validation
+* at the control plane hours later inside an alarm, with nobody watching. It is
+* the `id` from `GET /v2/deployments`, and the UUID in the deployment's
+* dashboard URL.
+*/
+const langgraphPlatformDestinationSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
+	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2733,7 +2853,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	netlifyDestinationSchema,
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
-	gcpSecretManagerDestinationSchema
+	gcpSecretManagerDestinationSchema,
+	langgraphPlatformDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3939,7 +4060,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.42.0";
+var version = "0.43.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4299,6 +4420,23 @@ var SeekritClient = class {
 	getMyPolicySigner(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
 	}
+	/**
+	* The bundle a proxy would see — `GET /v1/agents/:ref/policy`, the same route
+	* `seekrit-proxy` polls, resolved by agent id or slug.
+	*
+	* Not org-scoped, because the caller is not: a proxy holds a service token that
+	* knows an agent slug and nothing about org ids. Reachable with any service
+	* token bound to the agent's org (or a user session), which is what lets
+	* `seekrit proxy init` generate a config on the machine that holds the proxy's
+	* own token rather than requiring an admin credential there.
+	*
+	* The `bundle` is signed and opaque to the API. Anything that *acts* on it must
+	* verify the signature against locally pinned signers; decoding it for display
+	* or to name a route is not acting on it.
+	*/
+	getAgentPolicyBundle(agentRef) {
+		return this.request("GET", `/v1/agents/${encodeURIComponent(agentRef)}/policy`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -7360,6 +7498,1024 @@ function collect$2(value, acc) {
 	return acc;
 }
 //#endregion
+//#region src/proxy-binary.ts
+/**
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
+*
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
+*/
+/**
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
+*/
+const PROXY_VERSION = "0.8.0";
+const BIN = "seekrit-proxy";
+/**
+* Host → Rust target triple.
+*
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
+*/
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	}
+}
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
+}
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.8.0";
+}
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+/**
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
+*
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
+*/
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
+	}
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
+	}
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
+	}
+	chmodSync(dest, 493);
+	return dest;
+}
+/**
+* Run the proxy, forwarding stdio, signals, and its exit status.
+*
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
+*/
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
+}
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
+}
+//#endregion
+//#region src/proxy-presets.ts
+/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
+function placeholder(secret) {
+	return `{{seekrit:${secret}}}`;
+}
+/**
+* The catalogue. Ordered as `seekrit proxy presets` prints it: the two model
+* APIs an agent almost certainly calls, then the aggregators, then the generic
+* escape hatches.
+*/
+const PROXY_PRESETS = [
+	{
+		id: "openai",
+		label: "OpenAI API (api.openai.com)",
+		host: "api.openai.com",
+		prefix: "/openai",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}]
+	},
+	{
+		id: "anthropic",
+		label: "Anthropic API (api.anthropic.com)",
+		host: "api.anthropic.com",
+		prefix: "/anthropic",
+		secret: "ANTHROPIC_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "ANTHROPIC_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}] : [{
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}]
+	},
+	{
+		id: "openrouter",
+		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
+		host: "openrouter.ai",
+		prefix: "/openrouter",
+		secret: "OPENROUTER_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/api/v1/**"],
+		baseUrlSuffix: "/api/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}] : [{
+			name: "OPENROUTER_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}]
+	},
+	{
+		id: "github",
+		label: "GitHub REST + GraphQL API (api.github.com)",
+		host: "api.github.com",
+		prefix: "/github",
+		secret: "GITHUB_TOKEN",
+		methods: [],
+		paths: [],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GITHUB_API_URL",
+			value: "{{base}}"
+		}, {
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}] : [{
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}],
+		note: "`gh` resolves api.github.com from GH_HOST, not a base URL — prefer forward mode for it."
+	},
+	{
+		id: "openai-compatible",
+		label: "Any OpenAI-compatible gateway — LiteLLM, vLLM, Ollama, Together, self-hosted",
+		host: "",
+		prefix: "/gateway",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		requiresBaseUrl: true,
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}],
+		note: "Needs --base-url (e.g. --base-url https://litellm.internal:4000)."
+	}
+];
+function findPreset(id) {
+	return PROXY_PRESETS.find((p) => p.id === id);
+}
+function presetIds() {
+	return PROXY_PRESETS.map((p) => p.id);
+}
+/**
+* Apply `--base-url` / `--secret` / `--prefix` overrides to a preset.
+*
+* Returns a new preset rather than mutating the catalogue entry: the same
+* process can generate two configs in one run (a test does), and a preset that
+* remembered the last `--base-url` would be a genuinely confusing bug.
+*/
+function specialize(preset, overrides) {
+	let host = preset.host;
+	let paths = preset.paths;
+	let baseUrlSuffix = preset.baseUrlSuffix;
+	if (overrides.baseUrl) {
+		const url = new URL(overrides.baseUrl);
+		host = url.hostname.toLowerCase();
+		const upstreamPath = url.pathname.replace(/\/+$/, "");
+		if (upstreamPath) {
+			paths = [];
+			baseUrlSuffix = `${upstreamPath}${preset.baseUrlSuffix}`;
+		}
+	}
+	const secret = overrides.secret ?? preset.secret;
+	const specialized = {
+		...preset,
+		host,
+		paths,
+		baseUrlSuffix,
+		secret,
+		prefix: overrides.prefix ?? preset.prefix
+	};
+	if (preset.allow && secret !== preset.secret) specialized.allow = preset.allow.map((name) => name === preset.secret ? secret : name);
+	if (secret !== preset.secret) specialized.env = (mode) => preset.env(mode).map((hint) => ({
+		...hint,
+		value: hint.value.replace(/\{\{seekrit:[A-Za-z0-9_]+\}\}/, placeholder(secret))
+	}));
+	return specialized;
+}
+/** The secret names a preset's rule permits. Default-deny: empty means none. */
+function presetAllow(preset) {
+	if (preset.allow) return preset.allow;
+	return preset.secret ? [preset.secret] : [];
+}
+//#endregion
+//#region src/proxy-config.ts
+/**
+* A deliberately small TOML writer: basic strings and arrays of them, which is
+* every value in this config. Full TOML is not needed and a general emitter
+* would be one more thing that can disagree with the parser on an edge case.
+*/
+function tomlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, (c) => {
+		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	})}"`;
+}
+function tomlArray(values) {
+	return `[${values.map(tomlString).join(", ")}]`;
+}
+/**
+* Claim `preferred` if nothing else has it, else derive one from `host`.
+*
+* Two rules can name the same preset-known host (a narrow rule above a broad
+* one is the documented pattern), and two routes cannot share a prefix — so the
+* second one needs a distinct, still-recognisable name rather than an error.
+*/
+function claimPrefix(preferred, host, taken) {
+	if (preferred && !taken.has(preferred)) {
+		taken.add(preferred);
+		return preferred;
+	}
+	return prefixForHost(host, taken);
+}
+/** Slug for a route prefix, derived from a hostname. */
+function prefixForHost(host, taken) {
+	const labels = host.split(".").filter(Boolean);
+	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
+	const base = (labels[0] ?? "upstream").replace(/[^a-z0-9-]/gi, "").toLowerCase() || "upstream";
+	let prefix = `/${base}`;
+	let n = 2;
+	while (taken.has(prefix)) prefix = `/${base}-${n++}`;
+	taken.add(prefix);
+	return prefix;
+}
+const HEADER = `# seekrit-proxy configuration — generated by \`seekrit proxy init\`.
+#
+# The proxy resolves the secrets its service token grants (SEEKRIT_TOKEN in the
+# environment, never in this file), then swaps {{seekrit:NAME}} placeholders in
+# outbound requests for the decrypted values before forwarding upstream.
+#
+# Safe to commit: it contains hostnames, secret *names*, and thumbprints — no
+# secret values and no credential. Review it before you rely on it; the
+# allowlist below is a security boundary, and a generator does not know your
+# threat model.`;
+/** Render the plan as the text of a `seekrit-proxy.toml`. */
+function renderProxyConfig(plan) {
+	const out = [HEADER];
+	const server = Boolean(plan.policy);
+	if (plan.notes.length > 0) {
+		out.push("#");
+		for (const note of plan.notes) out.push(`# ${note}`);
+	}
+	out.push("");
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	if (reverse) {
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
+	} else {
+		out.push("# Forward-proxy only: the reverse plane still binds this address and");
+		out.push("# serves nothing, since no [[route]] is declared below.");
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
+	}
+	if (reverse) for (const route of plan.routes) {
+		out.push("[[route]]");
+		out.push(`prefix = ${tomlString(route.prefix)}`);
+		out.push(`upstream = ${tomlString(route.upstream)}`);
+		if (server) out.push("# allow/methods/paths come from published policy in server mode.");
+		else {
+			if (route.allow.length > 0) out.push(`allow = ${tomlArray(route.allow)}`);
+			else out.push("# No `allow`: this route permits the operation but carries no credential.");
+			if (route.methods.length > 0) out.push(`methods = ${tomlArray(route.methods)}`);
+			if (route.paths.length > 0) out.push(`paths = ${tomlArray(route.paths)}`);
+			if (route.label) out.push(`label = ${tomlString(route.label)}`);
+		}
+		out.push("");
+	}
+	if (forward) {
+		out.push("[forward]");
+		out.push(`listen = ${tomlString(plan.forwardListen)}`);
+		out.push(`unmatched_host_policy = ${tomlString(plan.unmatched)}`);
+		out.push(`ca_cert = ${tomlString(plan.caCert)}`);
+		out.push(`ca_key = ${tomlString(plan.caKey)}`);
+		out.push("");
+		if (server) {
+			out.push("# Intercepted hosts come from published policy in server mode, so there are");
+			out.push("# no [[forward.host]] blocks here — adding an upstream is a dashboard change.");
+			out.push("");
+		} else for (const route of plan.routes) {
+			out.push("[[forward.host]]");
+			out.push(`match = ${tomlString(route.host)}`);
+			if (route.allow.length > 0) out.push(`allow = ${tomlArray(route.allow)}`);
+			else out.push("# No `allow`: reachable, but no credential travels toward it.");
+			if (route.methods.length > 0) out.push(`methods = ${tomlArray(route.methods)}`);
+			if (route.paths.length > 0) out.push(`paths = ${tomlArray(route.paths)}`);
+			if (route.label) out.push(`label = ${tomlString(route.label)}`);
+			out.push("");
+		}
+	}
+	if (plan.policy) {
+		out.push("# ---------------------------------------------------------------------------");
+		out.push("# Rules come from agent access policy in the dashboard. The bundle is signed");
+		out.push("# in a publishing admin's browser, and this proxy refuses any bundle not");
+		out.push("# signed by a key whose thumbprint is pinned below. So seekrit can withhold");
+		out.push("# your policy (the proxy then fails closed) but cannot widen it.");
+		out.push("# ---------------------------------------------------------------------------");
+		out.push("[policy]");
+		out.push("source = \"server\"");
+		out.push(`agent = ${tomlString(plan.policy.agent)}`);
+		if (plan.policy.agents.length > 1) out.push(`agents = ${tomlArray(plan.policy.agents)}`);
+		out.push(`refresh_interval = ${tomlString(plan.policy.refreshInterval)}`);
+		out.push("");
+		out.push("# THE TRUST ANCHOR — the one value that must not come from the API. Confirm");
+		out.push("# each thumbprint against the dashboard's trust-anchor panel before relying");
+		out.push("# on this file, and pin a second admin's key too: one pinned signer means one");
+		out.push("# lost passphrase leaves nobody able to publish.");
+		for (const signer of plan.policy.signers) out.push(signer.provenance === "own" ? `#   ${signer.thumbprint} — your own signing key (derived locally).` : `#   ${signer.thumbprint} — read from the policy the API served. VERIFY THIS.`);
+		if (plan.policy.signers.length === 0) {
+			out.push("#   (none found — paste the thumbprint from the dashboard.)");
+			out.push("# signers = [\"<thumbprint>\"]");
+			out.push("signers = []   # ← the proxy refuses to start until this is filled in.");
+		} else out.push(`signers = ${tomlArray(plan.policy.signers.map((s) => s.thumbprint))}`);
+		out.push("");
+	} else if (plan.secretsRefresh) {
+		out.push("# Re-resolve on an interval, so a secret added later reaches a running proxy.");
+		out.push("# No new grant is involved: a new secret in an environment this proxy already");
+		out.push("# has a key grant for decrypts with the key it already holds.");
+		out.push("[secrets]");
+		out.push(`refresh_interval = ${tomlString(plan.secretsRefresh)}`);
+		out.push("");
+	}
+	if (plan.cache) {
+		out.push("# Start on the last (encrypted) resolve response if the API is unreachable.");
+		out.push("# A *refused* resolve still fails closed, and decrypting a cached entry still");
+		out.push("# needs this proxy's service token.");
+		out.push("[cache]");
+		out.push("enabled = true");
+		out.push(`max_age = ${tomlString(plan.cache.maxAge)}`);
+		out.push("");
+	}
+	if (plan.control) {
+		out.push("# One proxy fronting several agents: the orchestrator mints a ticket per");
+		out.push("# agent. Requires SEEKRIT_PROXY_CONTROL_TOKEN in the environment, and that");
+		out.push("# token must not be readable by the agents.");
+		out.push("[control]");
+		out.push(`listen = ${tomlString(plan.control.listen)}`);
+		out.push(`ttl = ${tomlString(plan.control.ttl)}`);
+		out.push(`max_ttl = ${tomlString(plan.control.maxTtl)}`);
+		out.push("");
+	}
+	if (plan.envHints.length > 0) {
+		out.push("# ---------------------------------------------------------------------------");
+		out.push("# Point the workload at the proxy (these go in its environment, not here):");
+		out.push("#");
+		for (const hint of plan.envHints) {
+			out.push(`#   export ${hint.name}='${hint.value}'`);
+			if (hint.note) out.push(`#     ${hint.note}`);
+		}
+		out.push("# ---------------------------------------------------------------------------");
+	}
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+const PLAN_DEFAULTS = {
+	mode: "reverse",
+	listen: "127.0.0.1:8080",
+	forwardListen: "127.0.0.1:8081",
+	unmatched: "tunnel",
+	caCert: "seekrit-proxy-ca.pem",
+	caKey: "seekrit-proxy-ca-key.pem"
+};
+/** The base URL a workload points an SDK at, for a route in reverse mode. */
+function baseUrlFor(listen, prefix, suffix) {
+	const [hostPart = "127.0.0.1", port = "8080"] = splitHostPort(listen);
+	return `http://${hostPart === "0.0.0.0" || hostPart === "[::]" ? "127.0.0.1" : hostPart}:${port}${prefix}${suffix}`;
+}
+/** Split `host:port`, tolerating a bracketed IPv6 literal. */
+function splitHostPort(addr) {
+	const bracketed = /^\[(.+)\]:(\d+)$/.exec(addr);
+	if (bracketed) return [`[${bracketed[1]}]`, bracketed[2]];
+	const idx = addr.lastIndexOf(":");
+	if (idx === -1) return [addr, "8080"];
+	return [addr.slice(0, idx), addr.slice(idx + 1)];
+}
+/** Build a file-policy plan from presets and/or ad-hoc `host=SECRET` rules. */
+function planFromPresets(presets, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	for (const preset of presets) {
+		const prefix = claimPrefix(preset.prefix, preset.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset.baseUrlSuffix);
+		routes.push({
+			prefix,
+			upstream: `https://${preset.host}`,
+			host: preset.host,
+			allow: presetAllow(preset),
+			methods: preset.methods,
+			paths: preset.paths,
+			label: preset.label,
+			baseUrl
+		});
+		for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+		if (preset.note) notes.push(`${preset.id}: ${preset.note}`);
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
+		...options.control ? { control: options.control } : {},
+		envHints,
+		notes
+	};
+}
+/**
+* Build a server-policy plan from an agent's published rules.
+*
+* The rules are used for **routing only** — one `[[route]]` per distinct host,
+* so the workload has a base URL to point at — and never copied into the file as
+* authorization. That is the whole trade of server mode: adding an upstream
+* becomes a dashboard change, and a rule this file also stated would be a
+* startup error rather than a belt-and-braces duplicate.
+*/
+function planFromPolicy(args, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	const seen = /* @__PURE__ */ new Set();
+	for (const rule of args.rules) {
+		if (!rule.host || seen.has(rule.host)) continue;
+		seen.add(rule.host);
+		const preset = PRESET_BY_HOST.get(rule.host);
+		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
+		routes.push({
+			prefix,
+			upstream: `https://${rule.host}`,
+			host: rule.host,
+			allow: [],
+			methods: [],
+			paths: [],
+			baseUrl
+		});
+		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		policy: {
+			agent: args.agent,
+			agents: args.agents,
+			refreshInterval: args.refreshInterval,
+			signers: args.signers
+		},
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.control ? { control: options.control } : {},
+		envHints,
+		notes
+	};
+}
+/** Host → preset, for naming routes generated from published policy. */
+const PRESET_BY_HOST = /* @__PURE__ */ new Map();
+for (const id of [
+	"openai",
+	"anthropic",
+	"openrouter",
+	"github"
+]) {
+	const preset = findPreset(id);
+	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+}
+/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
+function yamlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+const COMPOSE_DEFAULTS = {
+	service: "seekrit-proxy",
+	workload: "agent",
+	publish: false
+};
+/**
+* A `docker compose` sidecar snippet for a generated config.
+*
+* The container case differs from the local one in exactly the ways that break a
+* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
+* reachable from a sibling container, the workload dials it by *service name*
+* rather than loopback, and in forward mode the CA has to live on a shared
+* volume or the workload trusts a certificate the proxy no longer has.
+*/
+function renderComposeSnippet(plan, options) {
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	const [, listenPort = "8080"] = splitHostPort(plan.listen);
+	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
+	const host = options.service;
+	const out = [
+		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
+		"#",
+		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
+		"# Keeping them in separate containers is what makes that boundary real: the",
+		"# service token is in the proxy's environment, where the workload cannot read it.",
+		"services:",
+		`  ${host}:`,
+		`    image: ${options.image}`
+	];
+	const command = [];
+	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
+	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
+	if (forward) {
+		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
+		out.push("    # config too — there is no flag for the forward plane's address.");
+	}
+	out.push("    environment:");
+	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
+	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
+	out.push("    volumes:");
+	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
+	if (forward) {
+		out.push("      # The interception CA must survive restarts, or the certificate the");
+		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
+		out.push("      - seekrit-proxy-ca:/ca");
+	}
+	if (options.publish) {
+		out.push("    ports:");
+		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
+		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
+	} else {
+		out.push("    # No `ports`: reachable on the compose network only, which is what you");
+		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
+	}
+	out.push("    restart: unless-stopped");
+	out.push("");
+	out.push(`  ${options.workload}:`);
+	out.push("    # ← your workload. It never holds a real credential.");
+	out.push("    image: your-agent:latest");
+	out.push("    depends_on:");
+	out.push(`      - ${host}`);
+	out.push("    environment:");
+	if (forward) {
+		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
+		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+	}
+	for (const hint of plan.envHints) {
+		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
+		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
+		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	}
+	out.push("");
+	if (forward) {
+		out.push("volumes:");
+		out.push("  seekrit-proxy-ca:");
+		out.push("");
+	}
+	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
+	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
+	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+//#endregion
+//#region src/proxy.ts
+/**
+* `seekrit proxy` — get `seekrit-proxy` running without a Rust toolchain or a
+* hand-written TOML file.
+*
+* The proxy is the only thing here that keeps a decrypted secret out of an
+* untrusted workload's memory entirely, and it was also the least likely to be
+* tried: `cargo build` and a config file, before you learn anything. These
+* subcommands close that gap from both ends —
+*
+*   seekrit proxy run --preset openai        # nothing installed, nothing written
+*   seekrit proxy init --agent nova          # a reviewable file from live policy
+*
+* — and none of them changes what the proxy does. The generated config is the
+* same config; the fetched binary is the released binary, checksum-verified.
+*/
+const DEFAULT_CONFIG = "seekrit-proxy.toml";
+/**
+* The exact grammar `seekrit_cache::parse_duration` accepts: a positive integer,
+* optionally suffixed `s`/`m`/`h`/`d` (bare means seconds). Notably **not** `ms`
+* — `--refresh 500ms` is the typo this catches, and catching it here saves a
+* binary download before the proxy's own startup error.
+*/
+const DURATION = /^[1-9]\d*[smhd]?$/;
+function duration(value, flag) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	if (!DURATION.test(trimmed)) fail(`${flag} must be a duration like 30s, 10m, 24h, or 7d (got "${value}")`);
+	return trimmed;
+}
+function planOptions(options) {
+	const mode = options.mode ?? PLAN_DEFAULTS.mode;
+	if (mode !== "reverse" && mode !== "forward" && mode !== "both") fail(`--mode must be reverse, forward, or both (got "${mode}")`);
+	const unmatched = options.unmatched ?? PLAN_DEFAULTS.unmatched;
+	if (unmatched !== "tunnel" && unmatched !== "deny") fail(`--unmatched must be tunnel or deny (got "${unmatched}")`);
+	const listen = options.listen ?? PLAN_DEFAULTS.listen;
+	const forwardListen = options.forwardListen ?? PLAN_DEFAULTS.forwardListen;
+	if (mode === "both" && listen === forwardListen) fail(`--listen and --forward-listen cannot both be ${listen} — the two planes need separate ports`);
+	if (options.control && (options.control === listen || options.control === forwardListen)) fail(`--control cannot share an address with a data plane (${options.control})`);
+	const refresh = duration(options.refresh, "--refresh");
+	return {
+		mode,
+		listen,
+		forwardListen,
+		unmatched,
+		caCert: options.caCert ?? PLAN_DEFAULTS.caCert,
+		caKey: options.caKey ?? PLAN_DEFAULTS.caKey,
+		...options.cache || options.cacheMaxAge ? { cacheMaxAge: duration(options.cacheMaxAge, "--cache-max-age") ?? "24h" } : {},
+		...refresh ? { secretsRefresh: refresh } : {},
+		...options.control ? { control: {
+			listen: options.control,
+			ttl: "1h",
+			maxTtl: "12h"
+		} } : {}
+	};
+}
+/**
+* Turn `--host api.foo.com=FOO_KEY,BAR_KEY` into a preset-shaped rule.
+*
+* The `=SECRET` half is optional on purpose: a rule with no `allow` permits an
+* operation without letting a credential travel with it, which is a real thing
+* to want and impossible to express if the flag demanded a secret name.
+*/
+function presetFromHostSpec(spec, index) {
+	const [hostPart = "", secretPart] = spec.split("=", 2);
+	const host = hostPart.trim().toLowerCase();
+	if (!host) fail(`--host needs a hostname (got "${spec}")`);
+	if (/^[a-z][a-z0-9+.-]*:\/\//.test(host) || host.includes("/")) fail(`--host takes a bare hostname, not a URL (got "${host}")`);
+	if (host.includes(":")) fail(`--host takes a hostname without a port (got "${host}")`);
+	const secrets = (secretPart ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+	for (const name of secrets) if (!/^[A-Za-z0-9_]+$/.test(name)) fail(`"${name}" is not a valid secret name (letters, digits, and _ only)`);
+	const labels = host.split(".").filter(Boolean);
+	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
+	return {
+		id: host,
+		label: host,
+		host,
+		prefix: `/${(labels[0] ?? `upstream${index}`).replace(/[^a-z0-9-]/g, "") || `upstream${index}`}`,
+		secret: secrets[0] ?? "",
+		allow: secrets,
+		methods: [],
+		paths: [],
+		baseUrlSuffix: "",
+		env: () => secrets[0] ? [{
+			name: secrets[0],
+			value: `{{seekrit:${secrets[0]}}}`
+		}] : [],
+		...secrets.length > 1 ? { note: `also allows ${secrets.slice(1).join(", ")} — pass each as a placeholder.` } : {}
+	};
+}
+/** Collect the presets/hosts a `--preset`/`--host`-driven invocation names. */
+function gatherPresets(options) {
+	const chosen = [];
+	for (const id of options.preset ?? []) {
+		const preset = findPreset(id);
+		if (!preset) fail(`unknown preset "${id}" — try one of: ${presetIds().join(", ")}`);
+		if (preset.requiresBaseUrl && !options.baseUrl) fail(`preset "${id}" needs --base-url (e.g. --base-url https://litellm.internal:4000)`);
+		chosen.push(specialize(preset, {
+			...options.baseUrl ? { baseUrl: options.baseUrl } : {},
+			...options.secret ? { secret: options.secret } : {},
+			...options.prefix ? { prefix: options.prefix } : {}
+		}));
+	}
+	(options.host ?? []).forEach((spec, i) => {
+		chosen.push(presetFromHostSpec(spec, i));
+	});
+	return chosen;
+}
+/**
+* Read an agent's published policy through the route the proxy itself polls.
+*
+* Deliberately the proxy-facing route rather than the org-scoped admin one: the
+* machine that runs `seekrit proxy init` is usually the machine that holds the
+* *proxy's* token, not an admin's, and a config generated from the same bytes the
+* proxy will fetch cannot disagree with what the proxy then does.
+*/
+async function fetchPolicy(ctx, agentRef, orgSlug) {
+	let served;
+	try {
+		served = await ctx.client.getAgentPolicyBundle(agentRef);
+	} catch (err) {
+		fail(`could not read policy for agent "${agentRef}": ${err instanceof Error ? err.message : String(err)}\n  Publish a policy for it in the dashboard first (Agents → the identity → Publish),
+  or generate a file-policy config instead with --preset / --host.`);
+	}
+	let rules = [];
+	try {
+		rules = parseAgentPolicyUnverified(served.bundle).rules;
+	} catch (err) {
+		fail(`the API served a policy bundle this CLI cannot decode: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const signers = [];
+	try {
+		const org = await resolveOrg(ctx, orgSlug);
+		const { signer } = await ctx.client.getMyPolicySigner(org.id);
+		if (signer) signers.push({
+			thumbprint: signer.thumbprint,
+			provenance: "own"
+		});
+	} catch {}
+	if (!signers.some((s) => s.thumbprint === served.signerThumbprint)) signers.push({
+		thumbprint: served.signerThumbprint,
+		provenance: "published"
+	});
+	return {
+		slug: served.agent.slug,
+		rules,
+		signers,
+		version: served.version
+	};
+}
+/** Build the plan a `--agent` / `--preset` invocation describes. */
+async function buildPlan(options) {
+	const plan = planOptions(options);
+	if (options.agent) {
+		if ((options.preset ?? []).length > 0 || (options.host ?? []).length > 0) fail("--agent takes the rules from published policy, so --preset/--host cannot also apply.\n  Server-policy mode rejects local rules rather than silently ignoring them.");
+		const policy = await fetchPolicy(buildContext(), options.agent, options.org);
+		const agents = options.agents?.length ? options.agents : [policy.slug];
+		process.stderr.write(`seekrit: agent ${policy.slug} — policy v${policy.version}, ${policy.rules.length} rule(s)\n`);
+		return planFromPolicy({
+			agent: policy.slug,
+			agents,
+			rules: policy.rules,
+			signers: policy.signers,
+			refreshInterval: plan.secretsRefresh ?? "10s"
+		}, plan);
+	}
+	const presets = gatherPresets(options);
+	if (presets.length === 0) fail("nothing to configure — pass --preset <name> (see `seekrit proxy presets`), --host <host>[=SECRET],\n  or --agent <slug> to take the rules from published policy.");
+	return planFromPresets(presets, plan);
+}
+/** Add the generation flags to a command, so `init` and `run` stay in step. */
+function withGenerateOptions(cmd) {
+	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets");
+}
+function registerProxyCommands(program) {
+	const proxy = program.command("proxy").description("run and configure the agent egress proxy (`seekrit proxy --help`)");
+	proxy.command("presets").description("list the ready-made upstream presets").option("--json", "machine-readable output").action((options) => {
+		emit(options, { presets: PROXY_PRESETS }, () => {
+			printTable(PROXY_PRESETS, [
+				col("PRESET", (p) => p.id),
+				col("HOST", (p) => p.host || "(--base-url)"),
+				col("SECRET", (p) => p.secret),
+				col("PREFIX", (p) => p.prefix),
+				col("DESCRIPTION", (p) => p.label)
+			], "no presets");
+			process.stderr.write("\nUse one with: seekrit proxy run --preset openai\nAnything not listed here works too: --host api.example.com=EXAMPLE_API_KEY\n");
+		});
+	});
+	withGenerateOptions(proxy.command("init").description("write a seekrit-proxy.toml from presets or published policy")).option("-o, --out <path>", "where to write it", DEFAULT_CONFIG).option("--print", "write to stdout instead of a file").option("--force", "overwrite an existing file").action(async (options) => {
+		const plan = await buildPlan(options);
+		const text = renderProxyConfig(plan);
+		if (options.print) {
+			process.stdout.write(text);
+			return;
+		}
+		const out = resolve(options.out);
+		if (existsSync(out) && !options.force) fail(`${options.out} already exists — pass --force to overwrite, or --print to review it`);
+		writeFileSync(out, text, { mode: 420 });
+		process.stderr.write(`Wrote ${options.out}\n`);
+		process.stderr.write(`
+Next:
+  export SEEKRIT_TOKEN=skt_…            # a service token with a key grant
+  seekrit proxy run --config ${options.out}\n`);
+		if (plan.policy) process.stderr.write("\nBefore you rely on this: confirm each pinned thumbprint against the dashboard's\ntrust-anchor panel. `signers` is the one field that must not come from the API.\n");
+	});
+	withGenerateOptions(proxy.command("run").description("fetch the proxy binary if needed and run it")).option("-c, --config <path>", "config file to use", DEFAULT_CONFIG).option("--proxy-version <version>", `binary version (default: ${PROXY_VERSION})`).option("--print-config", "print the config that would be used, then exit").action(async (options) => {
+		const generating = Boolean(options.agent) || (options.preset ?? []).length > 0 || (options.host ?? []).length > 0;
+		let configPath = resolve(options.config);
+		let ephemeralDir;
+		if (generating) {
+			const text = renderProxyConfig(await buildPlan(options));
+			if (options.printConfig) {
+				process.stdout.write(text);
+				return;
+			}
+			ephemeralDir = mkdtempSync(join(tmpdir(), "seekrit-proxy-"));
+			configPath = join(ephemeralDir, DEFAULT_CONFIG);
+			writeFileSync(configPath, text, { mode: 384 });
+			process.stderr.write("seekrit: running with a generated config (nothing written to the project — use `seekrit proxy init` to keep it)\n");
+		} else if (options.printConfig) fail("--print-config needs generation flags (--preset/--host/--agent)");
+		else if (!existsSync(configPath)) fail(`no ${options.config} here, and no --preset/--host/--agent to generate one.\n  Try: seekrit proxy run --preset openai
+   or: seekrit proxy init --preset openai   (to write a reviewable file first)`);
+		if (!process.env.SEEKRIT_TOKEN) process.stderr.write("seekrit: SEEKRIT_TOKEN is not set — the proxy needs a service token with a key\n  grant for the environment it serves, and will refuse to start without one.\n");
+		try {
+			process.exitCode = await runProxyBinary(["--config", configPath], { ...options.proxyVersion ? { version: options.proxyVersion } : {} });
+		} finally {
+			if (ephemeralDir) rmSync(ephemeralDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	});
+	proxy.command("install").description("download the proxy binary and print its path").option("--proxy-version <version>", `version to fetch (default: ${PROXY_VERSION})`).option("--force", "re-download even if it is already cached").action(async (options) => {
+		const path = await resolveProxyBinary({
+			...options.proxyVersion ? { version: options.proxyVersion } : {},
+			...options.force ? { force: true } : {}
+		});
+		console.log(path);
+		const { target } = detectTarget();
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.8.0")} (${target})\n`);
+	});
+	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.8.0";
+		const override = process.env.SEEKRIT_PROXY_BIN;
+		const { target, exe } = detectTarget();
+		const path = override ?? proxyBinaryPath(version, target, exe);
+		const info = {
+			path,
+			version,
+			target,
+			source: override ? "SEEKRIT_PROXY_BIN" : existsSync(path) ? "cache" : "not-yet-downloaded",
+			baseUrl: process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev"
+		};
+		emit(options, info, () => {
+			console.log(info.path);
+			process.stderr.write(`${info.version} · ${info.target} · ${info.source}\n`);
+		});
+	});
+	withGenerateOptions(proxy.command("compose").description("print a docker compose sidecar snippet for a generated config")).option("--service <name>", "compose service name for the proxy", COMPOSE_DEFAULTS.service).option("--workload <name>", "compose service name for your workload", COMPOSE_DEFAULTS.workload).option("--image <ref>", "image to pin (default: seekritdev/proxy:<version>)").option("--publish", "also publish the proxy's ports to the host").action(async (options) => {
+		const plan = await buildPlan(options);
+		process.stdout.write(renderComposeSnippet(plan, {
+			service: options.service,
+			workload: options.workload,
+			image: options.image ?? `seekritdev/proxy:0.8.0`,
+			publish: Boolean(options.publish)
+		}));
+	});
+}
+//#endregion
 //#region src/redis.ts
 /**
 * `seekrit redis` — temporary Redis (6+) credentials (Vault-style dynamic
@@ -8023,6 +9179,17 @@ function assertRailwayId(value, flag) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} should be a Railway UUID, not "${id}"`);
 	return id;
 }
+/**
+* A LangGraph Platform deployment id is a UUID — the one in its dashboard URL.
+* The deployment *name* in the slot is the common slip, and it fails at the
+* control plane rather than here.
+*/
+function assertLanggraphDeploymentId(value) {
+	if (!value) fail("--langgraph-deployment is required for langgraph-platform (a UUID)");
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`--langgraph-deployment should be the deployment UUID from its dashboard URL, not "${id}"`);
+	return id;
+}
 /** Reject a single value outside a known set, naming the choices. */
 function assertMember(value, allowed, flag, fallback) {
 	if (value === void 0) return fallback;
@@ -8147,6 +9314,7 @@ function assertRepoIds(raw) {
 function credentialNoun(provider) {
 	if (provider.startsWith("aws-")) return "secret access key";
 	if (provider === "gcp-secret-manager") return "service-account key JSON";
+	if (provider === "langgraph-platform") return "LangSmith API key";
 	return "API token";
 }
 /** Account-scope config for a connection (never the credential itself). */
@@ -8203,6 +9371,17 @@ function buildConfig(provider, options) {
 				provider: "gcp-secret-manager",
 				projectId: options.projectId
 			};
+		case "langgraph-platform": {
+			const region = options.langgraphRegion?.trim();
+			if (region && options.baseUrl) fail("pass --langgraph-region for a LangChain-hosted account or --base-url for a self-hosted one, not both");
+			if (region && !LANGGRAPH_PLATFORM_REGIONS.includes(region)) fail(`unknown --langgraph-region ${region} — one of: ${LANGGRAPH_PLATFORM_REGIONS.join(", ")}`);
+			return {
+				provider: "langgraph-platform",
+				...region ? { region } : {},
+				...options.baseUrl ? { baseUrl: options.baseUrl } : {},
+				...options.langgraphTenant ? { tenantId: options.langgraphTenant.trim() } : {}
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -8401,6 +9580,10 @@ function buildDestination(provider, options) {
 				...options.gcpPruneVersions ? { pruneVersions: true } : {}
 			};
 		}
+		case "langgraph-platform": return {
+			provider: "langgraph-platform",
+			deploymentId: assertLanggraphDeploymentId(options.langgraphDeployment)
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -8421,6 +9604,7 @@ function describeDestination(destination) {
 		case "netlify": return `${destination.siteId} (${destination.contexts.map((context) => context === "branch" ? `branch @${destination.branch}` : context).join(", ")})`;
 		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
 		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
+		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -8436,7 +9620,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -8460,7 +9644,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com)").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -9327,6 +10511,7 @@ registerPgCommands(program);
 registerMysqlCommands(program);
 registerRedisCommands(program);
 registerProvisionerCommands(program);
+registerProxyCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);