@seekrit/cli 0.45.0 → 0.47.0

package/dist/index.js

@@ -1936,6 +1936,7 @@ const AUDIT_ACTIONS = [
 	"secret.rotated",
 	"secret.rotation_failed",
 	"token.created",
+	"token.updated",
 	"token.revoked",
 	"token.deleted",
 	"honey_token.created",
@@ -2108,6 +2109,8 @@ z.object({
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
 z.object({ required: z.boolean() });
 z.object({
 	email: emailSchema,
@@ -2478,7 +2481,8 @@ const SYNC_PROVIDER_KINDS = [
 	"bunnyshell",
 	"github-actions",
 	"gcp-secret-manager",
-	"langgraph-platform"
+	"langgraph-platform",
+	"azure-key-vault"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -2819,6 +2823,54 @@ const langgraphPlatformConnectionConfigSchema = z.object({
 	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
 	path: ["baseUrl"]
 });
+/**
+* The Azure clouds a vault can live in.
+*
+* Unlike AWS, where the China partition can be read off the region string
+* (`cn-…`), nothing about a tenant id or a vault name says which cloud it
+* belongs to — and two hosts have to agree with the answer: the Entra authority
+* that issues the token and the DNS suffix the vault answers on. Getting either
+* wrong is a failure inside an alarm with nobody watching, so it is stated.
+*/
+const AZURE_CLOUDS = [
+	"public",
+	"usgov",
+	"china"
+];
+/**
+* A Microsoft Entra directory (tenant) or application (client) id.
+*
+* Both are GUIDs. Entra accepts a verified domain name in place of a tenant id
+* in the token URL, but not a client id, and taking only the GUID for both
+* keeps one rule — a tenant's GUID is on the same admin-center page as the
+* client id it pairs with, so nothing is harder to find.
+*/
+const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
+/**
+* Azure account scope: which directory to authenticate against, as which app.
+*
+* The split follows AWS's, and for the same reason. A service principal's
+* **client secret** is the credential and is wrapped to the connection's key;
+* the tenant and client ids are *identifiers* — they appear in the token
+* request URL, in sign-in logs, and on the app registration blade. Keeping them
+* here lets the dashboard say which principal a connection authenticates as,
+* which is the first thing worth knowing when a connection starts failing after
+* a secret expires.
+*
+* Client secrets are the only credential kind here: a certificate or federated
+* credential would need a private key or a trust relationship the sync engine
+* has nowhere to keep, and Entra caps a client secret at 24 months, which is a
+* rotation the connection's `lastError` will make loud.
+*/
+const azureKeyVaultConnectionConfigSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Entra directory (tenant) ID. */
+	tenantId: azureGuidSchema,
+	/** Application (client) ID of the service principal seekrit signs in as. */
+	clientId: azureGuidSchema,
+	/** Which Azure cloud the tenant and its vaults live in. */
+	cloud: z.enum(AZURE_CLOUDS).default("public")
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2836,7 +2888,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
 	gcpSecretManagerConnectionConfigSchema,
-	langgraphPlatformConnectionConfigSchema
+	langgraphPlatformConnectionConfigSchema,
+	azureKeyVaultConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -3568,6 +3621,65 @@ const langgraphPlatformDestinationSchema = z.object({
 	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
 	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
 });
+/**
+* A Key Vault's name — the leftmost label of its DNS name, so the vault
+* `acme-prod` answers at `acme-prod.vault.azure.net`.
+*
+* Azure's own rule, stated here because the failure it prevents is confusing:
+* 3–24 characters, alphanumerics and hyphens, starting with a letter, ending
+* with a letter or digit, and no run of two hyphens. A name that breaks it
+* cannot exist, so a typo is a DNS failure rather than a 404 — an error that
+* says nothing about what was wrong.
+*
+* The *base URL* is not taken instead. It would let a connection be pointed at
+* any host, and the whole address seekrit needs is this label plus the cloud
+* already named on the connection.
+*/
+const azureVaultNameSchema = z.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
+/**
+* What to do with a name Key Vault cannot store.
+*
+* Key Vault secret names are `^[0-9a-zA-Z-]+$` — **no underscores** — and
+* `DATABASE_URL` is what a secret is actually called nearly everywhere. So this
+* is not an edge case to fail on: it is the common case, and a connector that
+* rejected it would push nothing at all.
+*
+* - `dash` — `_` becomes `-`, so `DATABASE_URL` is stored as `DATABASE-URL`.
+*   The default, and what every other tool bridging this gap does. The rename
+*   is visible: the dashboard and the run ledger both show it.
+* - `reject` — fail each such name instead, for an operator who would rather
+*   name every secret explicitly with the binding's `rename` than have seekrit
+*   choose. Nothing is renamed silently under either setting; this one just
+*   refuses rather than translating.
+*
+* Translating can make two seekrit names collide (`A_B` and `A-B` both give
+* `A-B`). That is caught per run and fails *both* names rather than letting
+* whichever sorts last win — the same rule, and the same reasoning, as
+* {@link mapSecretNames}.
+*/
+const AZURE_KEY_VAULT_NAME_MODES = ["dash", "reject"];
+/**
+* Which vault a binding writes to, and under what names.
+*
+* There is no layout choice as Secrets Manager has: the reason a `json-bundle`
+* exists there is billing — AWS charges per secret per month — and Key Vault
+* charges per *operation*, so fifty names cost the same stored fifty ways. One
+* secret per name is simply correct here.
+*/
+const azureKeyVaultDestinationSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Vault name, e.g. `acme-prod` for `acme-prod.vault.azure.net`. */
+	vault: azureVaultNameSchema,
+	/**
+	* Prepended to every secret name, e.g. `storefront-`. Key Vault has no
+	* hierarchy — its names are flat, and `/` is not among the characters it
+	* accepts — so unlike Parameter Store's `path` this is a naming convention
+	* and nothing more. Worth setting in a vault that holds anything else.
+	*/
+	prefix: z.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
+	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
+	nameMode: z.enum(AZURE_KEY_VAULT_NAME_MODES).default("dash")
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -3585,7 +3697,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
 	gcpSecretManagerDestinationSchema,
-	langgraphPlatformDestinationSchema
+	langgraphPlatformDestinationSchema,
+	azureKeyVaultDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -4873,7 +4986,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.45.0";
+var version = "0.47.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -5025,6 +5138,10 @@ var SeekritClient = class {
 	getEnv(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/** Rename an environment (display name only — the slug is immutable). */
+	updateEnv(orgId, envId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/envs/${envId}`, input);
+	}
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
@@ -5178,6 +5295,10 @@ var SeekritClient = class {
 	createToken(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
 	}
+	/** Rename a token. Role, environment binding, and expiry are immutable. */
+	updateToken(orgId, tokenId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/tokens/${tokenId}`, input);
+	}
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
@@ -10065,570 +10186,259 @@ function registerOrgCommands(program) {
 	});
 }
 //#endregion
-//#region src/pg.ts
+//#region src/proxy-presets.ts
+/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
+function placeholder(secret) {
+	return `{{seekrit:${secret}}}`;
+}
 /**
-* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
-*
-* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
-* machine and sends only the verifier; the plaintext password never reaches the
-* API or gets stored. Registering a target wraps the admin connection string to
-* the broker's public key locally, so the control plane only ever stores
-* ciphertext.
+* The catalogue. Ordered as `seekrit proxy presets` prints it: the three model
+* APIs an agent almost certainly calls, then the aggregators, then the generic
+* escape hatches.
 */
-/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$2(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
+const PROXY_PRESETS = [
+	{
+		id: "openai",
+		label: "OpenAI API (api.openai.com)",
+		host: "api.openai.com",
+		prefix: "/openai",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}]
+	},
+	{
+		id: "anthropic",
+		label: "Anthropic API (api.anthropic.com)",
+		host: "api.anthropic.com",
+		prefix: "/anthropic",
+		secret: "ANTHROPIC_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "ANTHROPIC_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}] : [{
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}]
+	},
+	{
+		id: "gemini",
+		label: "Gemini API (generativelanguage.googleapis.com)",
+		host: "generativelanguage.googleapis.com",
+		prefix: "/gemini",
+		secret: "GEMINI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1beta/**", "/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GOOGLE_GEMINI_BASE_URL",
+			value: "{{base}}",
+			note: "gemini-cli reads GEMINI_BASE_URL instead — set both if you run either."
+		}, {
+			name: "GEMINI_API_KEY",
+			value: placeholder("GEMINI_API_KEY")
+		}] : [{
+			name: "GEMINI_API_KEY",
+			value: placeholder("GEMINI_API_KEY")
+		}],
+		note: "Gemini authenticates with an x-goog-api-key header; a ?key= query string is substituted too, but prefer the header."
+	},
+	{
+		id: "openrouter",
+		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
+		host: "openrouter.ai",
+		prefix: "/openrouter",
+		secret: "OPENROUTER_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/api/v1/**"],
+		baseUrlSuffix: "/api/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}] : [{
+			name: "OPENROUTER_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}]
+	},
+	{
+		id: "github",
+		label: "GitHub REST + GraphQL API (api.github.com)",
+		host: "api.github.com",
+		prefix: "/github",
+		secret: "GITHUB_TOKEN",
+		methods: [],
+		paths: [],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GITHUB_API_URL",
+			value: "{{base}}"
+		}, {
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}] : [{
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}],
+		note: "`gh` resolves api.github.com from GH_HOST, not a base URL — prefer forward mode for it."
+	},
+	{
+		id: "openai-compatible",
+		label: "Any OpenAI-compatible gateway — LiteLLM, vLLM, Ollama, Together, self-hosted",
+		host: "",
+		prefix: "/gateway",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		requiresBaseUrl: true,
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}],
+		note: "Needs --base-url (e.g. --base-url https://litellm.internal:4000)."
+	}
+];
+function findPreset(id) {
+	return PROXY_PRESETS.find((p) => p.id === id);
 }
-/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
-function generateRoleName(prefix = "tmp") {
-	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-	let out = "";
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	for (const b of bytes) out += alphabet[b % 36];
-	return `${prefix}_${out}`;
+function presetIds() {
+	return PROXY_PRESETS.map((p) => p.id);
 }
-function registerPgCommands(program) {
-	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
-	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const executor = options.executor === "remote" ? "remote" : "in_do";
-		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
-		if (![
-			"readonly",
-			"readwrite",
-			"custom"
-		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
-		const accessLevel = options.access;
-		const adminSecret = resolveLeaseAdminSecret({
-			executor,
-			hmacKey: options.hmacKey,
-			adminUrl: options.adminUrl,
-			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
-		});
-		const config = {
-			provider: "postgres",
-			executor,
-			accessLevel,
-			connection: {
-				host: options.host,
-				port: Number.parseInt(options.port, 10),
-				database: options.database
-			},
-			...accessLevel === "custom" ? {
-				...options.createStatement.length ? { createStatements: options.createStatement } : {},
-				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
-			} : { schema: options.schema },
-			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
-		};
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
-		});
-		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
-		const bootstrap = postgresGroupBootstrapSql(config);
-		if (bootstrap) {
-			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
-			console.log(bootstrap);
-		}
-	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "postgres") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+/**
+* Apply `--base-url` / `--secret` / `--prefix` overrides to a preset.
+*
+* Returns a new preset rather than mutating the catalogue entry: the same
+* process can generate two configs in one run (a test does), and a preset that
+* remembered the last `--base-url` would be a genuinely confusing bug.
+*/
+function specialize(preset, overrides) {
+	let host = preset.host;
+	let paths = preset.paths;
+	let baseUrlSuffix = preset.baseUrlSuffix;
+	if (overrides.baseUrl) {
+		const url = new URL(overrides.baseUrl);
+		host = url.hostname.toLowerCase();
+		const upstreamPath = url.pathname.replace(/\/+$/, "");
+		if (upstreamPath) {
+			paths = [];
+			baseUrlSuffix = `${upstreamPath}${preset.baseUrlSuffix}`;
 		}
-	});
-	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
-		const bootstrap = postgresGroupBootstrapSql(cfg);
-		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
-		console.log(bootstrap);
-	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`removed ${targetId}`);
-	});
-	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
-		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
-		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds$2(options.ttl);
-		const { password, verifier } = await generatePostgresCredential();
-		const { connection } = await ctx.client.mintLease(org.id, {
-			provider: "postgres",
-			targetId: target.id,
-			roleName,
-			verifier,
-			ttlSeconds
-		});
-		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
-		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
-		if (options.json) console.log(JSON.stringify({
-			...connection,
-			password,
-			url
-		}, null, 2));
-		else console.log(url);
-	});
-	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
-	});
-	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId}`);
-	});
+	}
+	const secret = overrides.secret ?? preset.secret;
+	const specialized = {
+		...preset,
+		host,
+		paths,
+		baseUrlSuffix,
+		secret,
+		prefix: overrides.prefix ?? preset.prefix
+	};
+	if (preset.allow && secret !== preset.secret) specialized.allow = preset.allow.map((name) => name === preset.secret ? secret : name);
+	if (secret !== preset.secret) specialized.env = (mode) => preset.env(mode).map((hint) => ({
+		...hint,
+		value: hint.value.replace(/\{\{seekrit:[A-Za-z0-9_]+\}\}/, placeholder(secret))
+	}));
+	return specialized;
 }
-/** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
-	acc.push(value);
-	return acc;
+/** The secret names a preset's rule permits. Default-deny: empty means none. */
+function presetAllow(preset) {
+	if (preset.allow) return preset.allow;
+	return preset.secret ? [preset.secret] : [];
 }
 //#endregion
-//#region src/proxy-binary.ts
-/**
-* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
-*
-* The proxy is the strongest answer seekrit has for an untrusted workload — the
-* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
-* thing here to *try*, because trying it meant `cargo` and a TOML file. This
-* module removes the first half: it resolves a prebuilt, checksum-verified
-* binary for the host platform and execs it, so `npx @seekrit/proxy` and
-* `seekrit proxy run` behave like the proxy was already installed.
-*
-* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
-* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
-* entrypoint over it, and the two must not drift.
-*
-* Three properties worth stating, since this downloads and executes code:
-*
-* - **The checksum is verified before anything is executed**, against a
-*   `.sha256` fetched from the same release. That is integrity, not provenance —
-*   it proves the bytes match what the release published, which is exactly the
-*   guarantee `install.sh` gives and no more.
-* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
-*   short-circuits entirely, and a cached download for the same version+target is
-*   reused, so this is a one-time cost per version.
-* - **Version is pinned, not floating.** A default of `latest` would make two
-*   machines run different proxies from the same command; the pinned constant is
-*   what this CLI was built against, overridable when you want otherwise.
-*/
-/**
-* The proxy version this CLI was built against.
-*
-* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
-* release-please-config.json), so the pin follows the crate without anyone
-* remembering to move it.
-*/
-const PROXY_VERSION = "0.10.0";
-const BIN = "seekrit-proxy";
+//#region src/proxy-config.ts
 /**
-* Host → Rust target triple.
-*
-* Linux always resolves to **musl**: that build is statically linked, so one
-* artifact covers glibc, musl, alpine, and distroless, and there is no libc
-* detection to get wrong on a machine where `ldd` says something unexpected.
+* A deliberately small TOML writer: basic strings and arrays of them, which is
+* every value in this config. Full TOML is not needed and a general emitter
+* would be one more thing that can disagree with the parser on an edge case.
 */
-function detectTarget(os = platform(), cpu = arch()) {
-	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
-	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	switch (os) {
-		case "linux": return {
-			target: `${machine}-unknown-linux-musl`,
-			exe: ""
-		};
-		case "darwin": return {
-			target: `${machine}-apple-darwin`,
-			exe: ""
-		};
-		case "win32":
-			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
-			return {
-				target: "x86_64-pc-windows-msvc",
-				exe: ".exe"
-			};
-		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	}
-}
-/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
-function versionPrefix(version) {
-	if (version === "latest") return "latest";
-	return version.startsWith("v") ? version : `v${version}`;
-}
-function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
-}
-function resolveBaseUrl(explicit) {
-	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
-}
-/** Where a resolved binary is kept, keyed so versions and targets never collide. */
-function proxyBinaryPath(version, target, exe) {
-	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+function tomlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, (c) => {
+		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	})}"`;
 }
-async function fetchBytes(url) {
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
-	return new Uint8Array(await res.arrayBuffer());
+function tomlArray(values) {
+	return `[${values.map(tomlString).join(", ")}]`;
 }
 /**
-* Ensure a `seekrit-proxy` binary exists locally and return its path.
+* Claim `preferred` if nothing else has it, else derive one from `host`.
 *
-* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
-* version+target, then a fresh download. A binary already on `PATH` is
-* deliberately *not* used — silently running a different version than the one
-* this CLI pins is the kind of surprise that costs an afternoon.
+* Two rules can name the same preset-known host (a narrow rule above a broad
+* one is the documented pattern), and two routes cannot share a prefix — so the
+* second one needs a distinct, still-recognisable name rather than an error.
 */
-async function resolveProxyBinary(options = {}) {
-	const override = process.env.SEEKRIT_PROXY_BIN;
-	if (override) {
-		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
-		return override;
+function claimPrefix(preferred, host, taken) {
+	if (preferred && !taken.has(preferred)) {
+		taken.add(preferred);
+		return preferred;
 	}
-	const version = resolveVersion(options.version);
-	const { target, exe } = detectTarget();
-	const dest = proxyBinaryPath(version, target, exe);
-	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
-	const baseUrl = resolveBaseUrl(options.baseUrl);
-	const prefix = versionPrefix(version);
-	const name = `${BIN}-${target}${exe}`;
-	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
-	const sumUrl = `${binUrl}.sha256`;
-	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
-	let bytes;
-	let expected;
-	try {
-		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
+	return prefixForHost(host, taken);
+}
+/** Slug for a route prefix, derived from a hostname. */
+function prefixForHost(host, taken) {
+	const labels = host.split(".").filter(Boolean);
+	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
+	const base = (labels[0] ?? "upstream").replace(/[^a-z0-9-]/gi, "").toLowerCase() || "upstream";
+	let prefix = `/${base}`;
+	let n = 2;
+	while (taken.has(prefix)) prefix = `/${base}-${n++}`;
+	taken.add(prefix);
+	return prefix;
+}
+const HEADER = `# seekrit-proxy configuration — generated by \`seekrit proxy init\`.
+#
+# The proxy resolves the secrets its service token grants (SEEKRIT_TOKEN in the
+# environment, never in this file), then swaps {{seekrit:NAME}} placeholders in
+# outbound requests for the decrypted values before forwarding upstream.
+#
+# Safe to commit: it contains hostnames, secret *names*, and thumbprints — no
+# secret values and no credential. Review it before you rely on it; the
+# allowlist below is a security boundary, and a generator does not know your
+# threat model.`;
+/** Render the plan as the text of a `seekrit-proxy.toml`. */
+function renderProxyConfig(plan) {
+	const out = [HEADER];
+	const server = Boolean(plan.policy);
+	if (plan.notes.length > 0) {
+		out.push("#");
+		for (const note of plan.notes) out.push(`# ${note}`);
 	}
-	const actual = createHash("sha256").update(bytes).digest("hex");
-	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
-	const dir = dirname(dest);
-	mkdirSync(dir, { recursive: true });
-	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
-	try {
-		writeFileSync(staging, bytes, { mode: 493 });
-		renameSync(staging, dest);
-	} catch (err) {
-		rmSync(staging, { force: true });
-		throw err;
-	}
-	chmodSync(dest, 493);
-	return dest;
-}
-/**
-* Run the proxy, forwarding stdio, signals, and its exit status.
-*
-* The proxy is a long-lived foreground process, so this wrapper has to be
-* transparent: Node cannot exec-replace itself, and without relaying signals
-* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
-* the proxy running, holding decrypted secrets, with the shell prompt back.
-*/
-async function runProxyBinary(argv, options = {}) {
-	const bin = await resolveProxyBinary(options);
-	const child = spawn(bin, argv, {
-		stdio: "inherit",
-		env: {
-			...process.env,
-			...options.env
-		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		child.kill(signal);
-	};
-	for (const signal of signals) process.on(signal, forward);
-	return new Promise((resolve, reject) => {
-		child.on("error", (err) => {
-			for (const s of signals) process.off(s, forward);
-			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
-		});
-		child.on("exit", (code, signal) => {
-			for (const s of signals) process.off(s, forward);
-			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
-		});
-	});
-}
-/** Signal name → number, for the 128+n exit convention. */
-function signalNumber(signal) {
-	return {
-		SIGHUP: 1,
-		SIGINT: 2,
-		SIGQUIT: 3,
-		SIGKILL: 9,
-		SIGTERM: 15
-	}[signal] ?? 0;
-}
-//#endregion
-//#region src/proxy-presets.ts
-/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
-function placeholder(secret) {
-	return `{{seekrit:${secret}}}`;
-}
-/**
-* The catalogue. Ordered as `seekrit proxy presets` prints it: the two model
-* APIs an agent almost certainly calls, then the aggregators, then the generic
-* escape hatches.
-*/
-const PROXY_PRESETS = [
-	{
-		id: "openai",
-		label: "OpenAI API (api.openai.com)",
-		host: "api.openai.com",
-		prefix: "/openai",
-		secret: "OPENAI_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/v1/**"],
-		baseUrlSuffix: "/v1",
-		env: (mode) => mode === "reverse" ? [{
-			name: "OPENAI_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}] : [{
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}]
-	},
-	{
-		id: "anthropic",
-		label: "Anthropic API (api.anthropic.com)",
-		host: "api.anthropic.com",
-		prefix: "/anthropic",
-		secret: "ANTHROPIC_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/v1/**"],
-		baseUrlSuffix: "",
-		env: (mode) => mode === "reverse" ? [{
-			name: "ANTHROPIC_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "ANTHROPIC_API_KEY",
-			value: placeholder("ANTHROPIC_API_KEY")
-		}] : [{
-			name: "ANTHROPIC_API_KEY",
-			value: placeholder("ANTHROPIC_API_KEY")
-		}]
-	},
-	{
-		id: "openrouter",
-		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
-		host: "openrouter.ai",
-		prefix: "/openrouter",
-		secret: "OPENROUTER_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/api/v1/**"],
-		baseUrlSuffix: "/api/v1",
-		env: (mode) => mode === "reverse" ? [{
-			name: "OPENAI_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENROUTER_API_KEY")
-		}] : [{
-			name: "OPENROUTER_API_KEY",
-			value: placeholder("OPENROUTER_API_KEY")
-		}]
-	},
-	{
-		id: "github",
-		label: "GitHub REST + GraphQL API (api.github.com)",
-		host: "api.github.com",
-		prefix: "/github",
-		secret: "GITHUB_TOKEN",
-		methods: [],
-		paths: [],
-		baseUrlSuffix: "",
-		env: (mode) => mode === "reverse" ? [{
-			name: "GITHUB_API_URL",
-			value: "{{base}}"
-		}, {
-			name: "GITHUB_TOKEN",
-			value: placeholder("GITHUB_TOKEN")
-		}] : [{
-			name: "GITHUB_TOKEN",
-			value: placeholder("GITHUB_TOKEN")
-		}],
-		note: "`gh` resolves api.github.com from GH_HOST, not a base URL — prefer forward mode for it."
-	},
-	{
-		id: "openai-compatible",
-		label: "Any OpenAI-compatible gateway — LiteLLM, vLLM, Ollama, Together, self-hosted",
-		host: "",
-		prefix: "/gateway",
-		secret: "OPENAI_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/v1/**"],
-		baseUrlSuffix: "/v1",
-		requiresBaseUrl: true,
-		env: (mode) => mode === "reverse" ? [{
-			name: "OPENAI_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}] : [{
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}],
-		note: "Needs --base-url (e.g. --base-url https://litellm.internal:4000)."
-	}
-];
-function findPreset(id) {
-	return PROXY_PRESETS.find((p) => p.id === id);
-}
-function presetIds() {
-	return PROXY_PRESETS.map((p) => p.id);
-}
-/**
-* Apply `--base-url` / `--secret` / `--prefix` overrides to a preset.
-*
-* Returns a new preset rather than mutating the catalogue entry: the same
-* process can generate two configs in one run (a test does), and a preset that
-* remembered the last `--base-url` would be a genuinely confusing bug.
-*/
-function specialize(preset, overrides) {
-	let host = preset.host;
-	let paths = preset.paths;
-	let baseUrlSuffix = preset.baseUrlSuffix;
-	if (overrides.baseUrl) {
-		const url = new URL(overrides.baseUrl);
-		host = url.hostname.toLowerCase();
-		const upstreamPath = url.pathname.replace(/\/+$/, "");
-		if (upstreamPath) {
-			paths = [];
-			baseUrlSuffix = `${upstreamPath}${preset.baseUrlSuffix}`;
-		}
-	}
-	const secret = overrides.secret ?? preset.secret;
-	const specialized = {
-		...preset,
-		host,
-		paths,
-		baseUrlSuffix,
-		secret,
-		prefix: overrides.prefix ?? preset.prefix
-	};
-	if (preset.allow && secret !== preset.secret) specialized.allow = preset.allow.map((name) => name === preset.secret ? secret : name);
-	if (secret !== preset.secret) specialized.env = (mode) => preset.env(mode).map((hint) => ({
-		...hint,
-		value: hint.value.replace(/\{\{seekrit:[A-Za-z0-9_]+\}\}/, placeholder(secret))
-	}));
-	return specialized;
-}
-/** The secret names a preset's rule permits. Default-deny: empty means none. */
-function presetAllow(preset) {
-	if (preset.allow) return preset.allow;
-	return preset.secret ? [preset.secret] : [];
-}
-//#endregion
-//#region src/proxy-config.ts
-/**
-* A deliberately small TOML writer: basic strings and arrays of them, which is
-* every value in this config. Full TOML is not needed and a general emitter
-* would be one more thing that can disagree with the parser on an edge case.
-*/
-function tomlString(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, (c) => {
-		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
-	})}"`;
-}
-function tomlArray(values) {
-	return `[${values.map(tomlString).join(", ")}]`;
-}
-/**
-* Claim `preferred` if nothing else has it, else derive one from `host`.
-*
-* Two rules can name the same preset-known host (a narrow rule above a broad
-* one is the documented pattern), and two routes cannot share a prefix — so the
-* second one needs a distinct, still-recognisable name rather than an error.
-*/
-function claimPrefix(preferred, host, taken) {
-	if (preferred && !taken.has(preferred)) {
-		taken.add(preferred);
-		return preferred;
-	}
-	return prefixForHost(host, taken);
-}
-/** Slug for a route prefix, derived from a hostname. */
-function prefixForHost(host, taken) {
-	const labels = host.split(".").filter(Boolean);
-	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
-	const base = (labels[0] ?? "upstream").replace(/[^a-z0-9-]/gi, "").toLowerCase() || "upstream";
-	let prefix = `/${base}`;
-	let n = 2;
-	while (taken.has(prefix)) prefix = `/${base}-${n++}`;
-	taken.add(prefix);
-	return prefix;
-}
-const HEADER = `# seekrit-proxy configuration — generated by \`seekrit proxy init\`.
-#
-# The proxy resolves the secrets its service token grants (SEEKRIT_TOKEN in the
-# environment, never in this file), then swaps {{seekrit:NAME}} placeholders in
-# outbound requests for the decrypted values before forwarding upstream.
-#
-# Safe to commit: it contains hostnames, secret *names*, and thumbprints — no
-# secret values and no credential. Review it before you rely on it; the
-# allowlist below is a security boundary, and a generator does not know your
-# threat model.`;
-/** Render the plan as the text of a `seekrit-proxy.toml`. */
-function renderProxyConfig(plan) {
-	const out = [HEADER];
-	const server = Boolean(plan.policy);
-	if (plan.notes.length > 0) {
-		out.push("#");
-		for (const note of plan.notes) out.push(`# ${note}`);
-	}
-	out.push("");
-	const reverse = plan.mode === "reverse" || plan.mode === "both";
-	const forward = plan.mode === "forward" || plan.mode === "both";
-	if (reverse) {
-		out.push(`listen = ${tomlString(plan.listen)}`);
-		out.push("");
-	} else {
-		out.push("# Forward-proxy only: the reverse plane still binds this address and");
-		out.push("# serves nothing, since no [[route]] is declared below.");
-		out.push(`listen = ${tomlString(plan.listen)}`);
-		out.push("");
+	out.push("");
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	if (reverse) {
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
+	} else {
+		out.push("# Forward-proxy only: the reverse plane still binds this address and");
+		out.push("# serves nothing, since no [[route]] is declared below.");
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
 	}
 	if (reverse) for (const route of plan.routes) {
 		out.push("[[route]]");
@@ -10791,203 +10601,725 @@ function planFromPresets(presets, options) {
 			label: preset.label,
 			baseUrl
 		});
-		for (const hint of preset.env(hintMode)) envHints.push({
-			...hint,
-			value: hint.value.replace("{{base}}", baseUrl)
+		for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+		if (preset.note) notes.push(`${preset.id}: ${preset.note}`);
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/**
+* Build a server-policy plan from an agent's published rules.
+*
+* The rules are used for **routing only** — one `[[route]]` per distinct host,
+* so the workload has a base URL to point at — and never copied into the file as
+* authorization. That is the whole trade of server mode: adding an upstream
+* becomes a dashboard change, and a rule this file also stated would be a
+* startup error rather than a belt-and-braces duplicate.
+*/
+function planFromPolicy(args, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	const seen = /* @__PURE__ */ new Set();
+	for (const rule of args.rules) {
+		if (!rule.host || seen.has(rule.host)) continue;
+		seen.add(rule.host);
+		const preset = PRESET_BY_HOST.get(rule.host);
+		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
+		routes.push({
+			prefix,
+			upstream: `https://${rule.host}`,
+			host: rule.host,
+			allow: [],
+			methods: [],
+			paths: [],
+			baseUrl
+		});
+		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		policy: {
+			agent: args.agent,
+			agents: args.agents,
+			refreshInterval: args.refreshInterval,
+			signers: args.signers
+		},
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/** Host → preset, for naming routes generated from published policy. */
+const PRESET_BY_HOST = /* @__PURE__ */ new Map();
+for (const id of [
+	"openai",
+	"anthropic",
+	"openrouter",
+	"github"
+]) {
+	const preset = findPreset(id);
+	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+}
+/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
+function yamlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+const COMPOSE_DEFAULTS = {
+	service: "seekrit-proxy",
+	workload: "agent",
+	publish: false
+};
+/**
+* A `docker compose` sidecar snippet for a generated config.
+*
+* The container case differs from the local one in exactly the ways that break a
+* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
+* reachable from a sibling container, the workload dials it by *service name*
+* rather than loopback, and in forward mode the CA has to live on a shared
+* volume or the workload trusts a certificate the proxy no longer has.
+*/
+function renderComposeSnippet(plan, options) {
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	const [, listenPort = "8080"] = splitHostPort(plan.listen);
+	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
+	const host = options.service;
+	const out = [
+		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
+		"#",
+		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
+		"# Keeping them in separate containers is what makes that boundary real: the",
+		"# service token is in the proxy's environment, where the workload cannot read it.",
+		"services:",
+		`  ${host}:`,
+		`    image: ${options.image}`
+	];
+	const command = [];
+	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
+	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
+	if (forward) {
+		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
+		out.push("    # config too — there is no flag for the forward plane's address.");
+	}
+	out.push("    environment:");
+	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
+	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
+	out.push("    volumes:");
+	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
+	if (forward) {
+		out.push("      # The interception CA must survive restarts, or the certificate the");
+		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
+		out.push("      - seekrit-proxy-ca:/ca");
+	}
+	if (options.publish) {
+		out.push("    ports:");
+		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
+		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
+	} else {
+		out.push("    # No `ports`: reachable on the compose network only, which is what you");
+		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
+	}
+	out.push("    restart: unless-stopped");
+	out.push("");
+	out.push(`  ${options.workload}:`);
+	out.push("    # ← your workload. It never holds a real credential.");
+	out.push("    image: your-agent:latest");
+	out.push("    depends_on:");
+	out.push(`      - ${host}`);
+	out.push("    environment:");
+	if (forward) {
+		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
+		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+	}
+	for (const hint of plan.envHints) {
+		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
+		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
+		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	}
+	out.push("");
+	if (forward) {
+		out.push("volumes:");
+		out.push("  seekrit-proxy-ca:");
+		out.push("");
+	}
+	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
+	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
+	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+//#endregion
+//#region src/paperclip.ts
+/**
+* `seekrit paperclip` — wire seekrit into a [Paperclip](https://docs.paperclip.ing)
+* agent.
+*
+* Paperclip is a control plane: it decides which agent runs, and its *adapter*
+* launches the runtime that does the work. Two consequences shape this command.
+*
+* First, **MCP config is per-runtime, not per-Paperclip-agent.** There is no
+* field in Paperclip's database that means "give this agent the seekrit tools" —
+* the adapter's runtime (Claude Code, Codex, Gemini CLI, OpenCode) reads its own
+* MCP config from the working directory Paperclip points it at. So attaching the
+* seekrit servers means writing a `.mcp.json` *there*, which is what this does.
+*
+* Second, **a seekrit secret cannot be a Paperclip `secret_ref`.** Paperclip's
+* provider list is closed (`local_encrypted`, `aws_secrets_manager`,
+* `gcp_secret_manager`, `vault`), so there is nothing to select. Values reach a
+* run through `seekrit run` / the `run_command` tool, or — better, for a run
+* whose output you cannot predict — through the egress proxy, where the adapter
+* env holds `{{seekrit:NAME}}` placeholders and never a key. The env block this
+* command prints is that second shape, ready to paste into the agent's
+* Configuration tab.
+*
+* The proxy's own config file stays with `seekrit proxy init`. That command
+* already owns the reviewable-security-artifact warnings, and a second
+* generator behind a different name is how the two drift apart.
+*/
+/** Claude Code and friends read this name from the runtime's working directory. */
+const MCP_FILE = ".mcp.json";
+/**
+* The two seekrit MCP servers, in the shape a *runtime's* `.mcp.json` wants.
+*
+* These are the same two servers `agent-plugin/mcp.json` declares, and a test
+* pins them to that file so a rename cannot land in one place only. The one
+* field that is deliberately **not** copied is the remote transport's spelling:
+* the Agent Plugins manifest says `streamable-http`, while Claude Code's own
+* `.mcp.json` says `http`. Writing the manifest's spelling into a runtime config
+* produces a server the runtime silently declines to load, which reads as "the
+* hosted server is down".
+*/
+const PAPERCLIP_MCP_SERVERS = {
+	seekrit: {
+		type: "stdio",
+		command: "npx",
+		args: ["-y", "@seekrit/mcp"]
+	},
+	"seekrit-cloud": {
+		type: "http",
+		url: "https://mcp.seekrit.dev/mcp"
+	}
+};
+/**
+* Merge the seekrit servers into an existing `.mcp.json` without disturbing it.
+*
+* An agent's working directory is usually a real repository, so this file may
+* already carry servers someone else depends on — replacing it wholesale is a
+* silent regression in whatever they were doing. Unknown top-level keys are
+* preserved for the same reason: runtimes keep growing new ones.
+*
+* A `seekrit` entry that already exists and *differs* is left alone unless
+* forced. Someone pinning a version or adding an `env` did it on purpose.
+*/
+function mergeMcpServers(existing, force) {
+	const servers = { ...existing.mcpServers ?? {} };
+	const added = [];
+	const kept = [];
+	for (const [name, entry] of Object.entries(PAPERCLIP_MCP_SERVERS)) {
+		const current = servers[name];
+		if (current && !force) {
+			if (JSON.stringify(current) === JSON.stringify(entry)) continue;
+			kept.push(name);
+			continue;
+		}
+		servers[name] = entry;
+		added.push(name);
+	}
+	return {
+		merged: {
+			...existing,
+			mcpServers: servers
+		},
+		added,
+		kept
+	};
+}
+function readMcpFile(path) {
+	if (!existsSync(path)) return {};
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) fail(`${path} is not a JSON object — fix or move it before writing MCP servers there`);
+		return parsed;
+	} catch (err) {
+		if (err instanceof SyntaxError) fail(`${path} is not valid JSON (${err.message}) — fix or move it first`);
+		throw err;
+	}
+}
+/**
+* The env a Paperclip agent needs, given the upstreams it calls.
+*
+* Every value here is a plain string: a placeholder is not a secret, so none of
+* it needs a `secret_ref` and none of it trips
+* `PAPERCLIP_SECRETS_STRICT_MODE` — which is exactly why this is the path to
+* recommend. The env is derived from the same preset catalogue and the same
+* plan builder `seekrit proxy init` uses, so what gets pasted into Paperclip and
+* what the proxy enforces cannot disagree.
+*
+* One hint has to be rewritten on the way through. The shared generator writes
+* the CA path as `$PWD/seekrit-proxy-ca.pem`, which is correct for the `export`
+* lines it normally produces — a shell expands it. **Paperclip's env map is not a
+* shell.** Pasted verbatim it becomes a literal `$PWD/…`, the runtime cannot find
+* the CA, and every HTTPS call fails with a certificate error that looks like a
+* proxy bug. So it is replaced with a marker that cannot be mistaken for a
+* working value.
+*/
+const ABSOLUTE_PATH_MARKER = "<absolute path to>";
+function adapterEnv(presets, options) {
+	if (presets.length === 0) return [];
+	return planFromPresets(presets, {
+		...PLAN_DEFAULTS,
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen
+	}).envHints.map((hint) => {
+		if (!hint.value.includes("$PWD/")) return { ...hint };
+		return {
+			...hint,
+			value: hint.value.replace("$PWD/", `${ABSOLUTE_PATH_MARKER} `),
+			note: `${hint.note ? `${hint.note} ` : ""}Paperclip does not expand shell variables — paste the real path the proxy wrote this to.`
+		};
+	});
+}
+function registerPaperclipCommands(program) {
+	program.command("paperclip").description("wire seekrit into a Paperclip agent (`seekrit paperclip --help`)").command("init").description("attach the seekrit MCP servers to a Paperclip agent's working directory").option("-d, --dir <path>", "the agent's working directory", ".").option("--preset <id...>", `upstreams the agent calls, for the printed adapter env (${presetIds().join(", ")})`).option("--mode <mode>", "proxy mode the printed env assumes: forward or reverse", "forward").option("--listen <addr>", "reverse-mode proxy address", PLAN_DEFAULTS.listen).option("--forward-listen <addr>", "forward-mode proxy address", PLAN_DEFAULTS.forwardListen).option("--no-mcp", "print the adapter env only, without writing .mcp.json").option("--force", "overwrite a seekrit entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.mode !== "forward" && options.mode !== "reverse") fail(`--mode must be forward or reverse (got "${options.mode}")`);
+		const presets = [];
+		for (const id of options.preset ?? []) {
+			const preset = findPreset(id);
+			if (!preset) fail(`unknown preset "${id}" — try one of: ${presetIds().join(", ")}`);
+			if (preset.requiresBaseUrl) fail(`preset "${id}" needs a base URL, which this command does not take —\n  generate its env with: seekrit proxy init --preset ${id} --base-url https://…`);
+			presets.push(preset);
+		}
+		const dir = resolve(options.dir);
+		const mcpPath = join(dir, MCP_FILE);
+		let added = [];
+		let kept = [];
+		if (options.mcp) {
+			if (!existsSync(dir)) fail(`no such directory: ${options.dir}\n  Pass --dir with the agent's working directory (its Configuration tab shows it).`);
+			const result = mergeMcpServers(readMcpFile(mcpPath), Boolean(options.force));
+			added = result.added;
+			kept = result.kept;
+			writeFileSync(mcpPath, `${JSON.stringify(result.merged, null, 2)}\n`, { mode: 420 });
+		}
+		const env = adapterEnv(presets, {
+			mode: options.mode,
+			listen: options.listen,
+			forwardListen: options.forwardListen
+		});
+		emit(options, {
+			mcpFile: options.mcp ? mcpPath : null,
+			added,
+			kept,
+			env
+		}, () => {
+			if (options.mcp) {
+				process.stderr.write(added.length > 0 ? `Wrote ${mcpPath} (${added.join(", ")})\n` : `${mcpPath} already had both seekrit servers\n`);
+				for (const name of kept) process.stderr.write(`seekrit: left the existing "${name}" entry alone — pass --force to replace it\n`);
+			}
+			if (env.length > 0) {
+				process.stderr.write("\nAdapter environment variables (Agent → Configuration → Environment variables).\nEvery value is a plain string — a placeholder is not a secret, so none of\nthese needs a Paperclip secret_ref:\n\n");
+				printTable(env, [col("VARIABLE", (h) => h.name), col("VALUE", (h) => h.value)], "no env for these presets");
+				const notes = env.filter((h) => h.note);
+				if (notes.length > 0) {
+					process.stderr.write("\n");
+					for (const hint of notes) process.stderr.write(`  ${hint.name}: ${hint.note}\n`);
+				}
+				const presetFlags = presets.map((p) => `--preset ${p.id}`).join(" ");
+				process.stderr.write(`\nThose values only resolve behind a running proxy. Write its config with:\n  seekrit proxy init --mode ${options.mode} ${presetFlags}\n`);
+			} else process.stderr.write("\nNo --preset given, so no adapter env was printed. Pass the upstreams this\nagent calls to get the placeholder env for them, e.g.\n  seekrit paperclip init --preset anthropic --preset openai\n");
+			process.stderr.write("\nAlso worth doing once per company:\n  npx paperclipai plugin install @seekrit/paperclip-plugin   # tools, skills, panel\n  Skills page → https://github.com/seekritdev/agent-plugin   # skills alone\n");
 		});
-		if (preset.note) notes.push(`${preset.id}: ${preset.note}`);
-	}
-	if (hintMode === "forward") envHints.unshift({
-		name: "HTTPS_PROXY",
-		value: `http://${options.forwardListen}`
-	}, {
-		name: "NODE_EXTRA_CA_CERTS",
-		value: `$PWD/${options.caCert}`,
-		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
 	});
-	return {
-		mode: options.mode,
-		listen: options.listen,
-		forwardListen: options.forwardListen,
-		routes,
-		unmatched: options.unmatched,
-		caCert: options.caCert,
-		caKey: options.caKey,
-		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
-		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
-		...options.control ? { control: options.control } : {},
-		...options.tasks ? { tasks: options.tasks } : {},
-		...options.activity ? { activity: options.activity } : {},
-		envHints,
-		notes
-	};
 }
+//#endregion
+//#region src/pg.ts
 /**
-* Build a server-policy plan from an agent's published rules.
+* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
 *
-* The rules are used for **routing only** — one `[[route]]` per distinct host,
-* so the workload has a base URL to point at — and never copied into the file as
-* authorization. That is the whole trade of server mode: adding an upstream
-* becomes a dashboard change, and a rule this file also stated would be a
-* startup error rather than a belt-and-braces duplicate.
+* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
+* machine and sends only the verifier; the plaintext password never reaches the
+* API or gets stored. Registering a target wraps the admin connection string to
+* the broker's public key locally, so the control plane only ever stores
+* ciphertext.
 */
-function planFromPolicy(args, options) {
-	const taken = /* @__PURE__ */ new Set();
-	const routes = [];
-	const envHints = [];
-	const notes = [];
-	const hintMode = options.mode === "forward" ? "forward" : "reverse";
-	const seen = /* @__PURE__ */ new Set();
-	for (const rule of args.rules) {
-		if (!rule.host || seen.has(rule.host)) continue;
-		seen.add(rule.host);
-		const preset = PRESET_BY_HOST.get(rule.host);
-		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
-		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
-		routes.push({
-			prefix,
-			upstream: `https://${rule.host}`,
-			host: rule.host,
-			allow: [],
-			methods: [],
-			paths: [],
-			baseUrl
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$2(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
+function generateRoleName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerPgCommands(program) {
+	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
+	const target = pg.command("target").description("manage provisioning targets");
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
 		});
-		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
-			...hint,
-			value: hint.value.replace("{{base}}", baseUrl)
+		const config = {
+			provider: "postgres",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : { schema: options.schema },
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+		const bootstrap = postgresGroupBootstrapSql(config);
+		if (bootstrap) {
+			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
+			console.log(bootstrap);
+		}
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "postgres") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
+		const bootstrap = postgresGroupBootstrapSql(cfg);
+		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
+		console.log(bootstrap);
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
+		const roleName = options.role ?? generateRoleName();
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const { password, verifier } = await generatePostgresCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "postgres",
+			targetId: target.id,
+			roleName,
+			verifier,
+			ttlSeconds
 		});
+		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+	});
+	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
+//#region src/proxy-binary.ts
+/**
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
+*
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
+*/
+/**
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
+*/
+const PROXY_VERSION = "0.10.0";
+const BIN = "seekrit-proxy";
+/**
+* Host → Rust target triple.
+*
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
+*/
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
 	}
-	if (hintMode === "forward") envHints.unshift({
-		name: "HTTPS_PROXY",
-		value: `http://${options.forwardListen}`
-	}, {
-		name: "NODE_EXTRA_CA_CERTS",
-		value: `$PWD/${options.caCert}`,
-		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
-	});
-	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
-	return {
-		mode: options.mode,
-		listen: options.listen,
-		forwardListen: options.forwardListen,
-		routes,
-		policy: {
-			agent: args.agent,
-			agents: args.agents,
-			refreshInterval: args.refreshInterval,
-			signers: args.signers
-		},
-		unmatched: options.unmatched,
-		caCert: options.caCert,
-		caKey: options.caKey,
-		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
-		...options.control ? { control: options.control } : {},
-		...options.tasks ? { tasks: options.tasks } : {},
-		...options.activity ? { activity: options.activity } : {},
-		envHints,
-		notes
-	};
 }
-/** Host → preset, for naming routes generated from published policy. */
-const PRESET_BY_HOST = /* @__PURE__ */ new Map();
-for (const id of [
-	"openai",
-	"anthropic",
-	"openrouter",
-	"github"
-]) {
-	const preset = findPreset(id);
-	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
 }
-/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
-function yamlString(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
+}
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
 }
-const COMPOSE_DEFAULTS = {
-	service: "seekrit-proxy",
-	workload: "agent",
-	publish: false
-};
 /**
-* A `docker compose` sidecar snippet for a generated config.
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
 *
-* The container case differs from the local one in exactly the ways that break a
-* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
-* reachable from a sibling container, the workload dials it by *service name*
-* rather than loopback, and in forward mode the CA has to live on a shared
-* volume or the workload trusts a certificate the proxy no longer has.
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
 */
-function renderComposeSnippet(plan, options) {
-	const reverse = plan.mode === "reverse" || plan.mode === "both";
-	const forward = plan.mode === "forward" || plan.mode === "both";
-	const [, listenPort = "8080"] = splitHostPort(plan.listen);
-	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
-	const host = options.service;
-	const out = [
-		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
-		"#",
-		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
-		"# Keeping them in separate containers is what makes that boundary real: the",
-		"# service token is in the proxy's environment, where the workload cannot read it.",
-		"services:",
-		`  ${host}:`,
-		`    image: ${options.image}`
-	];
-	const command = [];
-	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
-	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
-	if (forward) {
-		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
-		out.push("    # config too — there is no flag for the forward plane's address.");
-	}
-	out.push("    environment:");
-	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
-	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
-	out.push("    volumes:");
-	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
-	if (forward) {
-		out.push("      # The interception CA must survive restarts, or the certificate the");
-		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
-		out.push("      - seekrit-proxy-ca:/ca");
-	}
-	if (options.publish) {
-		out.push("    ports:");
-		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
-		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
-	} else {
-		out.push("    # No `ports`: reachable on the compose network only, which is what you");
-		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
-	}
-	out.push("    restart: unless-stopped");
-	out.push("");
-	out.push(`  ${options.workload}:`);
-	out.push("    # ← your workload. It never holds a real credential.");
-	out.push("    image: your-agent:latest");
-	out.push("    depends_on:");
-	out.push(`      - ${host}`);
-	out.push("    environment:");
-	if (forward) {
-		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
-		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
-		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
-		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
 	}
-	for (const hint of plan.envHints) {
-		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
-		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
-		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
 	}
-	out.push("");
-	if (forward) {
-		out.push("volumes:");
-		out.push("  seekrit-proxy-ca:");
-		out.push("");
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
 	}
-	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
-	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
-	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
-	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+	chmodSync(dest, 493);
+	return dest;
+}
+/**
+* Run the proxy, forwarding stdio, signals, and its exit status.
+*
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
+*/
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
+}
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
 }
 //#endregion
 //#region src/proxy.ts
@@ -12049,8 +12381,21 @@ function credentialNoun(provider) {
 	if (provider.startsWith("aws-")) return "secret access key";
 	if (provider === "gcp-secret-manager") return "service-account key JSON";
 	if (provider === "langgraph-platform") return "LangSmith API key";
+	if (provider === "azure-key-vault") return "client secret";
 	return "API token";
 }
+/**
+* Entra takes a verified domain name in place of a tenant id, but never in
+* place of a client id — so both are held to the GUID, which keeps one rule
+* and costs nothing: the admin center shows a tenant's GUID on the same page
+* as the application id it pairs with.
+*/
+function assertAzureGuid(value, flag, what) {
+	if (!value) fail(`${flag} is required for azure-key-vault (${what})`);
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} "${id}" is not a GUID — the Entra admin center shows it under ${what}`);
+	return id;
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -12116,6 +12461,15 @@ function buildConfig(provider, options) {
 				...options.langgraphTenant ? { tenantId: options.langgraphTenant.trim() } : {}
 			};
 		}
+		case "azure-key-vault": {
+			const cloud = assertMembers(list(options.azureCloud, "public"), AZURE_CLOUDS, "--azure-cloud")[0];
+			return {
+				provider: "azure-key-vault",
+				tenantId: assertAzureGuid(options.azureTenantId, "--azure-tenant-id", "Directory (tenant) ID"),
+				clientId: assertAzureGuid(options.azureClientId, "--azure-client-id", "Application (client) ID"),
+				cloud: cloud ?? "public"
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -12318,6 +12672,17 @@ function buildDestination(provider, options) {
 			provider: "langgraph-platform",
 			deploymentId: assertLanggraphDeploymentId(options.langgraphDeployment)
 		};
+		case "azure-key-vault": {
+			if (!options.vault) fail("--vault is required for azure-key-vault — the vault name, e.g. acme-prod");
+			const prefix = options.path?.trim();
+			const nameMode = assertMembers(list(options.nameMode, "dash"), AZURE_KEY_VAULT_NAME_MODES, "--name-mode")[0];
+			return {
+				provider: "azure-key-vault",
+				vault: options.vault.trim(),
+				...prefix ? { prefix } : {},
+				nameMode: nameMode ?? "dash"
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -12339,6 +12704,7 @@ function describeDestination(destination) {
 		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
 		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
 		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
+		case "azure-key-vault": return `${destination.vault}${destination.prefix ? ` (${destination.prefix}*)` : ""}`;
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -12354,7 +12720,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -12378,7 +12744,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--azure-tenant-id <id>", "azure-key-vault: Entra Directory (tenant) ID, a GUID").option("--azure-client-id <id>", "azure-key-vault: Application (client) ID of the service principal, a GUID (its client secret is read from stdin)").option("--azure-cloud <cloud>", `azure-key-vault: ${AZURE_CLOUDS.join(" | ")}`, "public").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -13247,6 +13613,7 @@ registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
+registerPaperclipCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);