@seekrit/cli 2.2.0 → 2.3.0

package/dist/index.js

@@ -25,11 +25,15 @@ const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/
 */
 const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
 const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
+/** A TCP port. 0 is refused: it never matches a connection, so a rule naming it is a mistake. */
+const policyPortSchema = z.number().int().min(1).max(65535);
 const agentPolicyRuleSchema = z.object({
 	host: policyHostSchema,
 	methods: z.array(policyMethodSchema).max(16).default([]),
 	paths: z.array(policyPathSchema).max(64).default([]),
 	allow: z.array(policySecretNameSchema).max(64).default([]),
+	https_ports: z.array(policyPortSchema).max(32).optional(),
+	http_ports: z.array(policyPortSchema).max(32).optional(),
 	label: z.string().trim().max(120).optional()
 });
 z.object({ 
@@ -48,11 +52,65 @@ z.object({
 });
 z.object({
 	host: policyHostSchema,
+	/** How the agent reaches the host. Omit for a destination the operator fixed. */
+	transport: z.object({
+		scheme: z.enum(["https", "http"]),
+		port: policyPortSchema
+	}).optional(),
 	method: policyMethodSchema,
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
 /**
+* The ports a rule covers, with the default applied.
+*
+* **Absent does not mean any here**, unlike methods and paths. A bare hostname
+* reads as `https://host`, so a rule naming no ports covers HTTPS on 443 and
+* nothing else: another port on the same name is another service (often an
+* admin one), and cleartext puts the substituted credential on the wire. The
+* default applies only when *neither* list says anything — `http_ports: [8080]`
+* alone means exactly that, not that plus 443.
+*/
+function policyRulePorts(rule) {
+	const norm = (ports) => [...new Set(ports ?? [])].sort((a, b) => a - b);
+	const https = norm(rule.https_ports);
+	const http = norm(rule.http_ports);
+	if (https.length === 0 && http.length === 0) return {
+		https: [443],
+		http: []
+	};
+	return {
+		https,
+		http
+	};
+}
+/** True when a rule covers HTTPS on 443 and nothing else — all v1 can say. */
+function isDefaultPolicyPorts(rule) {
+	const { https, http } = policyRulePorts(rule);
+	return http.length === 0 && https.length === 1 && https[0] === 443;
+}
+/**
+* `https:443,8443 http:5000`, or `null` for the default — for the editor's
+* collapsed rows, the publish diff, and the CLI, which only mention ports when
+* a rule says something about them.
+*/
+function describePolicyPorts(rule) {
+	if (isDefaultPolicyPorts(rule)) return null;
+	const { https, http } = policyRulePorts(rule);
+	const parts = [];
+	if (https.length > 0) parts.push(`https:${https.join(",")}`);
+	if (http.length > 0) parts.push(`http:${http.join(",")}`);
+	return parts.join(" ");
+}
+/**
+* The bundle version to publish these rules as: v1 unless a rule needs ports v1
+* cannot express. Keeping the old version wherever it suffices is what lets a
+* fleet upgrade its proxies after the dashboard rather than in lockstep.
+*/
+function policyBundleVersionFor(rules) {
+	return rules.every(isDefaultPolicyPorts) ? 1 : 2;
+}
+/**
 * Serialize a bundle to the exact bytes that get signed and transported.
 *
 * Explicit field order rather than a generic sorted-key walk: the field list is
@@ -61,6 +119,10 @@ z.object({
 * arrays are kept, since their emptiness is meaningful (any/any/none).
 */
 function canonicalizeAgentPolicy(bundle) {
+	if (bundle.v < 2) {
+		const index = bundle.rules.findIndex((rule) => !isDefaultPolicyPorts(rule));
+		if (index !== -1) throw new AgentPolicyError(`rule ${index + 1} names ports, which need a v2 bundle (see policyBundleVersionFor)`);
+	}
 	const rules = bundle.rules.map((rule) => {
 		const out = {
 			host: rule.host.trim().toLowerCase(),
@@ -68,6 +130,11 @@ function canonicalizeAgentPolicy(bundle) {
 			paths: rule.paths.map((p) => p.trim()),
 			allow: [...rule.allow].sort()
 		};
+		if (bundle.v >= 2) {
+			const ports = policyRulePorts(rule);
+			out.https_ports = ports.https;
+			out.http_ports = ports.http;
+		}
 		if (rule.label?.trim()) out.label = rule.label.trim();
 		return out;
 	});
@@ -158,8 +225,13 @@ function parseAgentPolicyUnverified(envelope) {
 	} catch (e) {
 		throw new AgentPolicyError(`policy bundle body is unreadable: ${e.message}`);
 	}
-	if (body?.v !== 1) throw new AgentPolicyError(`unsupported policy bundle version ${String(body?.v)}`);
+	if (typeof body?.v !== "number" || body.v < 1 || body.v > 2) throw new AgentPolicyError(`unsupported policy bundle version ${String(body?.v)}`);
 	if (!Array.isArray(body.rules) || !body.signer?.jwk) throw new AgentPolicyError("policy bundle is missing rules or signer");
+	body.rules.forEach((rule, i) => {
+		const carriesPorts = rule.https_ports !== void 0 || rule.http_ports !== void 0;
+		if (body.v < 2 && carriesPorts) throw new AgentPolicyError(`policy bundle v${body.v} rule ${i + 1} carries https_ports/http_ports, which need a v2 bundle`);
+		for (const port of [...rule.https_ports ?? [], ...rule.http_ports ?? []]) if (!policyPortSchema.safeParse(port).success) throw new AgentPolicyError(`policy bundle rule ${i + 1} names an invalid port ${port}`);
+	});
 	return body;
 }
 /**
@@ -209,6 +281,11 @@ function ruleCoversPath(rule, path) {
 	if (rule.paths.length === 0) return true;
 	return rule.paths.some((p) => matchPolicyPath(p, path));
 }
+function ruleReaches(rule, transport) {
+	if (!transport) return true;
+	const ports = policyRulePorts(rule);
+	return (transport.scheme === "https" ? ports.https : ports.http).includes(transport.port);
+}
 /**
 * Decide a request against an ordered rule set, first match wins — the same
 * evaluation `RuleSet::decide` performs in the proxy, including which rule
@@ -218,11 +295,14 @@ function ruleCoversPath(rule, path) {
 function evaluatePolicy(rules, query) {
 	const host = query.host.trim().toLowerCase();
 	let hostMatched = false;
+	let portMatched = false;
 	let pathMatchedIndex = null;
 	for (let i = 0; i < rules.length; i++) {
 		const rule = rules[i];
 		if (rule.host.trim().toLowerCase() !== host) continue;
 		hostMatched = true;
+		if (!ruleReaches(rule, query.transport)) continue;
+		portMatched = true;
 		const pathsOk = ruleCoversPath(rule, query.path);
 		if (pathsOk && ruleCoversMethod(rule, query.method)) {
 			if (query.secret !== void 0 && !rule.allow.includes(query.secret)) return {
@@ -240,8 +320,12 @@ function evaluatePolicy(rules, query) {
 		decision: "method_not_allowed",
 		ruleIndex: pathMatchedIndex
 	};
+	if (!hostMatched) return {
+		decision: "no_rule",
+		ruleIndex: null
+	};
 	return {
-		decision: hostMatched ? "path_not_allowed" : "no_rule",
+		decision: portMatched ? "path_not_allowed" : "port_not_allowed",
 		ruleIndex: null
 	};
 }
@@ -251,6 +335,7 @@ function describePolicyVerdict(verdict, rules) {
 	switch (verdict.decision) {
 		case "allow": return `permitted by rule ${(verdict.ruleIndex ?? 0) + 1}${rule?.label ? ` (${rule.label})` : ""}`;
 		case "no_rule": return "no rule covers this host";
+		case "port_not_allowed": return "this host has rules, but none cover this scheme and port";
 		case "method_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} covers this path but not this method`;
 		case "path_not_allowed": return "this host has rules, but none cover this path";
 		case "secret_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} permits the request but not this secret`;
@@ -291,6 +376,7 @@ function normalizeRule(rule) {
 		methods: rule.methods.map((m) => m.toUpperCase()).sort(),
 		paths: [...rule.paths],
 		allow: [...rule.allow].sort(),
+		ports: policyRulePorts(rule),
 		label: rule.label?.trim() || void 0
 	};
 }
@@ -319,6 +405,7 @@ const activityEntrySchema = z.object({
 	decision: z.enum([
 		"allow",
 		"no_rule",
+		"port_not_allowed",
 		"method_not_allowed",
 		"path_not_allowed",
 		"secret_not_allowed",
@@ -354,8 +441,7 @@ z.object({
 	*/
 	entries: z.array(activityEntrySchema).min(1).max(500)
 });
-//#endregion
-//#region ../../packages/core/src/agent-review.ts
+// ../../packages/core/src/agent-review.ts
 function emptyStats() {
 	return {
 		allows: 0,
@@ -565,8 +651,7 @@ z.object({
 z.object({ 
 /** The presented token. In the body, never a URL — it is a credential. */
 token: z.string().trim().min(8).max(512) });
-//#endregion
-//#region ../../packages/core/src/archive.ts
+// ../../packages/core/src/archive.ts
 /**
 * The **break-glass archive** format: one signed JSON file holding everything
 * seekrit stores for an org, in the form seekrit stores it — ciphertext stays
@@ -951,8 +1036,7 @@ const ENTITLEMENT_KEYS = Object.keys({
 		metric: "monthly_resolves"
 	}
 });
-//#endregion
-//#region ../../packages/core/src/plans.ts
+// ../../packages/core/src/plans.ts
 const PLAN_FAMILIES = {
 	free: {
 		id: "free",
@@ -986,8 +1070,7 @@ const PLAN_FAMILIES = {
 const PLAN_FAMILY_IDS = Object.keys(PLAN_FAMILIES);
 /** Plan families a plan picker should render. Excludes families marked `hidden`. */
 const VISIBLE_PLAN_FAMILY_IDS = PLAN_FAMILY_IDS.filter((family) => !PLAN_FAMILIES[family].hidden);
-//#endregion
-//#region ../../packages/core/src/billing.ts
+// ../../packages/core/src/billing.ts
 /**
 * Lifecycle states a subscription can be in. Mirrors the biller's own states
 * (Stripe) but is provider-neutral so a different biller could map onto it.
@@ -999,8 +1082,7 @@ const SUBSCRIPTION_STATUSES = [
 	"canceled",
 	"paused"
 ];
-//#endregion
-//#region ../../packages/core/src/branches.ts
+// ../../packages/core/src/branches.ts
 /**
 * Branch (ephemeral) environments — a per-PR/preview overlay on an existing
 * application environment.
@@ -1044,8 +1126,7 @@ function parseBranchTtl(input) {
 	if (multiplier === void 0) return null;
 	return value * multiplier;
 }
-//#endregion
-//#region ../../packages/core/src/change-requests.ts
+// ../../packages/core/src/change-requests.ts
 const CHANGE_REQUEST_STATUSES = [
 	"open",
 	"applied",
@@ -1061,8 +1142,7 @@ function describeChange(kind, name, restoreFrom) {
 		case "restore": return `restore ${name} to v${restoreFrom ?? "?"}`;
 	}
 }
-//#endregion
-//#region ../../packages/core/src/connect.ts
+// ../../packages/core/src/connect.ts
 /** Workload authentication is separate from secret-decryption principals. */
 const workloadPublicKeySchema = z.object({
 	kty: z.literal("EC"),
@@ -1196,8 +1276,7 @@ z.object({
 	body: z.string().max(65536).optional()
 }).strict().refine((v) => !["GET", "HEAD"].includes(v.method) || v.body === void 0, "GET and HEAD cannot carry a body");
 z.object({ audience: audienceSchema }).strict();
-//#endregion
-//#region ../../packages/core/src/dotenv.ts
+// ../../packages/core/src/dotenv.ts
 /**
 * `.env` parsing and serialization — the canonical definition of what a `.env`
 * file means to seekrit. `apps/run/src/dotenv.rs` is a faithful port of the
@@ -1320,8 +1399,7 @@ function skipSpace(content, from, end) {
 	while (i < end && (content[i] === " " || content[i] === "	")) i++;
 	return i;
 }
-//#endregion
-//#region ../../packages/core/src/ids.ts
+// ../../packages/core/src/ids.ts
 const ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 /**
 * Generate a prefixed, URL-safe random ID, e.g. `org_h9K2x…`.
@@ -1338,8 +1416,7 @@ function randomId(prefix, length = 24) {
 	}
 	return `${prefix}_${out}`;
 }
-//#endregion
-//#region ../../packages/core/src/interpolate.ts
+// ../../packages/core/src/interpolate.ts
 /**
 * Secret references: `${OTHER_SECRET}` inside a secret value.
 *
@@ -1484,8 +1561,7 @@ function interpolateSecrets(values) {
 		unresolved: [...unresolved].sort()
 	};
 }
-//#endregion
-//#region ../../packages/core/src/json-value.ts
+// ../../packages/core/src/json-value.ts
 /**
 * Whether a value is worth *offering* a JSON view for: an object or array.
 *
@@ -1939,8 +2015,7 @@ z.discriminatedUnion("provider", [
 	mintGcpLeaseSchema,
 	mintMongoLeaseSchema
 ]);
-//#endregion
-//#region ../../packages/core/src/providers/aws.ts
+// ../../packages/core/src/providers/aws.ts
 /**
 * The one-time IAM setup an admin performs so seekrit can assume the target
 * role. Analogue of `sshHostSetupInstructions` / `postgresGroupBootstrapSql` —
@@ -1967,8 +2042,7 @@ function awsTrustPolicyInstructions(config) {
 		`# on ${config.roleArn}. seekrit only ever calls AssumeRole on this role.`
 	].join("\n");
 }
-//#endregion
-//#region ../../packages/core/src/providers/gcp.ts
+// ../../packages/core/src/providers/gcp.ts
 /**
 * The one-time IAM setup an admin performs so seekrit can impersonate the target
 * service account. Analogue of `awsTrustPolicyInstructions` — printed for the
@@ -1990,8 +2064,7 @@ function gcpSetupInstructions(config) {
 		"gcloud services enable iamcredentials.googleapis.com"
 	].join("\n");
 }
-//#endregion
-//#region ../../packages/core/src/providers/mongodb.ts
+// ../../packages/core/src/providers/mongodb.ts
 /**
 * The one-time setup an admin performs so seekrit can provision users: create a
 * dedicated provisioning user with `userAdmin` on the target database (or
@@ -2016,8 +2089,7 @@ function mongoAdminSetupInstructions(config) {
 		`//   --uri "mongodb://seekrit_provisioner:<pwd>@${config.connection.host}:${config.connection.port}/?authSource=${authSource}"`
 	].join("\n");
 }
-//#endregion
-//#region ../../packages/core/src/providers/postgres.ts
+// ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
 * read-only / read-write target's leased credentials inherit. Idempotent (safe
@@ -2048,8 +2120,7 @@ function postgresGroupBootstrapSql(config) {
 	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
 	return lines.join("\n");
 }
-//#endregion
-//#region ../../packages/core/src/providers/ssh.ts
+// ../../packages/core/src/providers/ssh.ts
 /**
 * The one-time host setup an admin runs so a target's certificates are accepted.
 * Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
@@ -2069,8 +2140,7 @@ function sshHostSetupInstructions(config) {
 		"sudo systemctl reload sshd"
 	].join("\n");
 }
-//#endregion
-//#region ../../packages/core/src/types.ts
+// ../../packages/core/src/types.ts
 const AUDIT_ACTIONS = [
 	"workload.created",
 	"workload.updated",
@@ -2301,8 +2371,7 @@ const NOTIFICATION_TYPE_META = {
 		defaultEnabled: true
 	}
 };
-//#endregion
-//#region ../../packages/core/src/schemas.ts
+// ../../packages/core/src/schemas.ts
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
 const nameSchema = z.string().trim().min(1).max(128);
@@ -2724,8 +2793,7 @@ z.object({
 	*/
 	status: settableRotationStatusSchema.optional()
 }).refine((v) => v.intervalSeconds !== void 0 || v.config !== void 0 || v.status !== void 0, "provide at least one of intervalSeconds, config, or status");
-//#endregion
-//#region ../../packages/core/src/sync.ts
+// ../../packages/core/src/sync.ts
 /**
 * Third-party sync: seekrit as source of truth, pushing an environment's
 * resolved secrets out to a platform that holds its own copy (Vercel project
@@ -4209,8 +4277,7 @@ z.object({
 	mode: z.enum(["auto", "manual"]).optional(),
 	enabled: z.boolean().optional()
 });
-//#endregion
-//#region ../../packages/core/src/vault.ts
+// ../../packages/core/src/vault.ts
 /** One encrypted credential within a connection. */
 const VAULT_SLOTS = [
 	"oauth2",
@@ -4494,8 +4561,7 @@ z.object({
 	userRef: vaultUserRefSchema,
 	leaseId: leaseIdSchema
 });
-//#endregion
-//#region ../../packages/crypto/src/encoding.ts
+// ../../packages/crypto/src/encoding.ts
 const CHUNK = 32768;
 /** Base64url (no padding) — portable across browsers, Workers, and Node. */
 function toBase64Url(bytes) {
@@ -4526,8 +4592,7 @@ function utf8Encode(text) {
 function utf8Decode(bytes) {
 	return new TextDecoder().decode(bytes);
 }
-//#endregion
-//#region ../../packages/crypto/src/errors.ts
+// ../../packages/crypto/src/errors.ts
 var SeekritCryptoError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -4547,8 +4612,7 @@ function splitBlob(blob, prefix, segments) {
 	if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
 	return parts.slice(1);
 }
-//#endregion
-//#region ../../packages/crypto/src/aes.ts
+// ../../packages/crypto/src/aes.ts
 const SECRET_PREFIX = "sc1";
 const IV_LENGTH$1 = 12;
 /** Generate a fresh 256-bit data encryption key for an environment. */
@@ -4593,8 +4657,7 @@ async function decryptSecret(dek, blob, aad) {
 function secretAad(environmentId, secretName) {
 	return `${environmentId}/${secretName}`;
 }
-//#endregion
-//#region ../../packages/crypto/src/keys.ts
+// ../../packages/crypto/src/keys.ts
 async function generateKeyPair() {
 	const pair = await crypto.subtle.generateKey({
 		name: "ECDH",
@@ -4627,8 +4690,7 @@ async function importPrivateKeyPkcs8(pkcs8) {
 		namedCurve: "P-256"
 	}, true, ["deriveBits"]);
 }
-//#endregion
-//#region ../../packages/crypto/src/wrap.ts
+// ../../packages/crypto/src/wrap.ts
 /**
 * ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
 * the recipient's public key; the shared secret is run through HKDF-SHA256 to
@@ -4696,8 +4758,7 @@ async function unwrapDek(wrapped, privateKey) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
 	}
 }
-//#endregion
-//#region ../../packages/crypto/src/aws.ts
+// ../../packages/crypto/src/aws.ts
 /** Generate the ephemeral P-256 keypair a client uses to receive one AWS lease. */
 async function generateAwsRecipientKeyPair() {
 	return generateKeyPair();
@@ -4724,8 +4785,7 @@ async function unwrapAwsCredential(wrapped, privateKeyJwk) {
 		region: c.region
 	};
 }
-//#endregion
-//#region ../../packages/crypto/src/gcp.ts
+// ../../packages/crypto/src/gcp.ts
 /** Generate the ephemeral P-256 keypair a client uses to receive one GCP lease. */
 async function generateGcpRecipientKeyPair() {
 	return generateKeyPair();
@@ -4751,8 +4811,7 @@ async function unwrapGcpCredential(wrapped, privateKeyJwk) {
 		scopes: c.scopes
 	};
 }
-//#endregion
-//#region ../../packages/crypto/src/kms.ts
+// ../../packages/crypto/src/kms.ts
 /**
 * Client-side KMS envelope encryption. A managed `encrypt` key is a 256-bit
 * AES-GCM key whose material reaches the client only as a `wd1.` grant (wrapped
@@ -4882,8 +4941,7 @@ async function decryptDataKey(material, wrapped) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "data key unwrap failed: wrong key or tampered blob");
 	}
 }
-//#endregion
-//#region ../../packages/crypto/src/random.ts
+// ../../packages/crypto/src/random.ts
 const ALPHABETS = {
 	alphanumeric: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
 	hex: "0123456789abcdef",
@@ -4919,8 +4977,7 @@ function generateSecretValue(length, alphabet = "alphanumeric") {
 	}
 	return out;
 }
-//#endregion
-//#region ../../packages/crypto/src/mongodb.ts
+// ../../packages/crypto/src/mongodb.ts
 /** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
 async function generateMongoRecipientKeyPair() {
 	return generateKeyPair();
@@ -4954,8 +5011,7 @@ async function unwrapMongoCredential(wrapped, privateKeyJwk) {
 function mongoConnectionUri(cred) {
 	return `mongodb://${encodeURIComponent(cred.username)}:${encodeURIComponent(cred.password)}@${cred.host}:${cred.port}/${cred.database}?authSource=${cred.authSource}`;
 }
-//#endregion
-//#region ../../packages/crypto/src/mysql.ts
+// ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
 * authentication string, for minting *temporary MySQL login credentials*
@@ -5011,8 +5067,7 @@ async function generateMysqlCredential(options = {}) {
 		verifier: await mysqlNativePasswordVerifier(password)
 	};
 }
-//#endregion
-//#region ../../packages/crypto/src/passphrase.ts
+// ../../packages/crypto/src/passphrase.ts
 /**
 * User private keys are stored server-side encrypted under a key derived from
 * the user's passphrase, so any browser or CLI session can fetch and unlock
@@ -5071,8 +5126,7 @@ async function decryptPrivateKey(passphrase, blob) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
 	}
 }
-//#endregion
-//#region ../../packages/crypto/src/policy-key.ts
+// ../../packages/crypto/src/policy-key.ts
 /**
 * Signing with a principal's **existing** keypair, for agent access policy.
 *
@@ -5141,8 +5195,7 @@ function policySignerJwk(publicKeyJwk) {
 		y: jwk.y
 	};
 }
-//#endregion
-//#region ../../packages/crypto/src/shamir.ts
+// ../../packages/crypto/src/shamir.ts
 /**
 * Shamir's Secret Sharing over GF(2^8) — the same field AES uses, with the
 * reduction polynomial x^8 + x^4 + x^3 + x + 1 (0x11b). Splits a byte string
@@ -5271,8 +5324,7 @@ function combineSecret(shares) {
 	}
 	return secret;
 }
-//#endregion
-//#region ../../packages/crypto/src/recovery.ts
+// ../../packages/crypto/src/recovery.ts
 /** Generate a fresh org recovery keypair (P-256, same as any principal). */
 function generateRecoveryKey() {
 	return generateKeyPair();
@@ -5326,8 +5378,7 @@ async function combineRecoveryShares(shareBytes) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "recovery reconstruction failed: wrong, insufficient, or mismatched shares");
 	}
 }
-//#endregion
-//#region ../../packages/crypto/src/redis.ts
+// ../../packages/crypto/src/redis.ts
 /**
 * Client-side construction of a Redis (6+) ACL password verifier, for minting
 * *temporary Redis login credentials* without the password plaintext ever
@@ -5428,8 +5479,7 @@ async function generatePostgresCredential(options = {}) {
 		iterations
 	};
 }
-//#endregion
-//#region ../../packages/crypto/src/sign.ts
+// ../../packages/crypto/src/sign.ts
 /**
 * Managed signing keys for the client-side KMS — ECDSA over P-256 (the curve
 * already used for principal keypairs; universal in WebCrypto). A `sign` key's
@@ -5491,8 +5541,7 @@ function signatureKeyRef(signature) {
 		version
 	};
 }
-//#endregion
-//#region ../../packages/crypto/src/ssh.ts
+// ../../packages/crypto/src/ssh.ts
 /**
 * Client-side SSH certificate authority for minting *temporary SSH access*
 * without any private key ever reaching seekrit's control plane.
@@ -5623,8 +5672,7 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 	const b64 = toBase64(new SshWriter().bytes(utf8Encode("openssh-key-v1")).byte(0).string("none").string("none").string(/* @__PURE__ */ new Uint8Array(0)).uint32(1).string(ed25519PublicKeyBlob(pub)).string(concat(privSection, pad)).build());
 	return `-----BEGIN OPENSSH PRIVATE KEY-----\n${b64.match(/.{1,70}/g)?.join("\n") ?? b64}\n-----END OPENSSH PRIVATE KEY-----\n`;
 }
-//#endregion
-//#region ../../packages/crypto/src/token.ts
+// ../../packages/crypto/src/token.ts
 /**
 * Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
 * principals. One local bundle holds independent authentication and decryption
@@ -5734,11 +5782,9 @@ async function createAgentTaskToken() {
 		tokenHash: await hashToken(token)
 	};
 }
-//#endregion
-//#region package.json
-var version = "2.2.0";
-//#endregion
-//#region ../../packages/api-client/src/index.ts
+// package.json
+var version = "2.3.0";
+// ../../packages/api-client/src/index.ts
 /**
 * The proposer's note travels as a header, not a body field: an unprotected
 * environment ignores it, so the same call works either way and no caller has
@@ -6735,8 +6781,7 @@ function writeProjectConfig(config, dir = process.cwd()) {
 	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
 	return path;
 }
-//#endregion
-//#region src/io.ts
+// src/io.ts
 let failThrows = false;
 /**
 * In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
@@ -6861,8 +6906,7 @@ async function readStdin() {
 	for await (const chunk of process.stdin) chunks.push(chunk);
 	return Buffer.concat(chunks).toString("utf8");
 }
-//#endregion
-//#region src/context.ts
+// src/context.ts
 /** Sent as `x-seekrit-client` so the API attributes usage to the CLI (analytics). */
 const CLI_CLIENT = `cli/${version}`;
 /**
@@ -7002,8 +7046,7 @@ async function getDek(ctx, orgId, envId) {
 	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
 	return unwrapDek(wrappedDek, privateKey);
 }
-//#endregion
-//#region src/output.ts
+// src/output.ts
 /** Shorthand for a column whose header is fixed and value is one field. */
 function col(header, value) {
 	return {
@@ -7065,8 +7108,7 @@ function section(title) {
 	console.log("");
 	console.log(title);
 }
-//#endregion
-//#region src/target.ts
+// src/target.ts
 /** Resolve the target org from a flag, the committed config, or a lone org. */
 async function resolveOrg(ctx, orgSlug) {
 	const wanted = orgSlug ?? findProjectConfig()?.org;
@@ -7222,8 +7264,7 @@ async function resolveGroup(ctx, opts) {
 		slug: group.slug
 	};
 }
-//#endregion
-//#region src/access.ts
+// src/access.ts
 /**
 * Human-readable labels for the principals holding a key grant. `grant list`
 * would otherwise be a column of opaque ids, which is exactly the question
@@ -7316,8 +7357,7 @@ function registerAccessCommands(program) {
 		console.error(`revoked ${options.user ?? options.token}'s access to ${label}`);
 	});
 }
-//#endregion
-//#region src/account.ts
+// src/account.ts
 function sessionStatus(session) {
 	if (session.revokedAt) return "revoked";
 	if (session.expiresAt && Date.parse(session.expiresAt) < Date.now()) return "expired";
@@ -7367,8 +7407,7 @@ function registerAccountCommands(program) {
 		console.error(`${type} emails ${state}`);
 	});
 }
-//#endregion
-//#region src/agents.ts
+// src/agents.ts
 /**
 * Agent access governance from the CLI.
 *
@@ -7500,6 +7539,14 @@ function describeList(values) {
 function describeSecrets(values) {
 	return values.length === 0 ? "none" : values.join(" ");
 }
+/**
+* The third convention, and the one most likely to be misread: **no ports means
+* HTTPS on 443**, not any port. A blank or `any` here would say the opposite of
+* what the proxy enforces, so the default is spelled out.
+*/
+function describePorts(rule) {
+	return describePolicyPorts(rule) ?? "https:443";
+}
 function printRules(rules) {
 	printTable(rules.map((rule, i) => ({
 		n: i + 1,
@@ -7507,6 +7554,7 @@ function printRules(rules) {
 	})), [
 		col("#", (r) => r.n),
 		col("host", (r) => r.rule.host),
+		col("ports", (r) => describePorts(r.rule)),
 		col("methods", (r) => describeList(r.rule.methods)),
 		col("paths", (r) => describeList(r.rule.paths)),
 		col("secrets", (r) => describeSecrets(r.rule.allow)),
@@ -7515,8 +7563,9 @@ function printRules(rules) {
 }
 /** One rule as a single line, for the publish diff. */
 function ruleLine(rule) {
+	const ports = describePolicyPorts(rule);
 	const parts = [
-		rule.host,
+		ports ? `${rule.host} [${ports}]` : rule.host,
 		describeList(rule.methods),
 		describeList(rule.paths),
 		`secrets=${describeSecrets(rule.allow)}`
@@ -7843,7 +7892,11 @@ function registerAgentCommands(program) {
 			console.error("widening proposals are never applied: an agent must not earn permissions by retrying");
 		}
 	});
-	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--scheme <scheme>", "https or http, as the agent dials it (forward proxy)", "https").option("--port <n>", "port the agent dials (forward proxy; default 443 for https, 80 for http)").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const scheme = options.scheme.toLowerCase();
+		if (scheme !== "https" && scheme !== "http") fail("--scheme must be https or http");
+		const port = options.port === void 0 ? scheme === "https" ? 443 : 80 : Number(options.port);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) fail("--port must be 1-65535");
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const agent = await resolveAgent(ctx, org.id, ref);
@@ -7853,6 +7906,10 @@ function registerAgentCommands(program) {
 		if (!published) fail(`${agent.slug} has no published policy — every request is denied`);
 		const verdict = evaluatePolicy(published.rules, {
 			host: options.host,
+			transport: {
+				scheme,
+				port
+			},
 			method: options.method,
 			path: options.path,
 			...options.secret === void 0 ? {} : { secret: options.secret }
@@ -7863,7 +7920,7 @@ function registerAgentCommands(program) {
 			verdict,
 			reason
 		}, () => {
-			const target = `${options.method.toUpperCase()} ${options.host}${options.path}`;
+			const target = `${options.method.toUpperCase()} ${scheme}://${options.host}:${port}${options.path}`;
 			console.log(`${verdict.decision === "allow" ? "allow" : "DENY"}  ${target}${options.secret ? ` [${options.secret}]` : ""}`);
 			console.log(`  v${published.version}: ${reason}`);
 		});
@@ -7943,7 +8000,7 @@ function registerPolicyCommands(policy) {
 		const { signingKey, jwk } = await getPolicySigner(ctx);
 		const issuedAt = Math.floor(Date.now() / 1e3);
 		const bundle = await signAgentPolicy(signingKey, jwk, {
-			v: 1,
+			v: policyBundleVersionFor(rules),
 			org: org.id,
 			agent: agent.id,
 			agent_slug: agent.slug,
@@ -8356,8 +8413,7 @@ function printExplain(provenance, refs = {}) {
 	}
 	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
 }
-//#endregion
-//#region src/env-diff.ts
+// src/env-diff.ts
 /**
 * The comparison itself, kept pure so it can be tested without a network or a
 * key. Rows come back sorted by name: a diff people read top-to-bottom should
@@ -8474,8 +8530,7 @@ function registerEnvDiff(env) {
 		});
 	});
 }
-//#endregion
-//#region src/group-sync-grants.ts
+// src/group-sync-grants.ts
 /** Wrap a newly composed group layer for connections already syncing the app env or its branches. */
 async function syncGrantsForGroupLink(ctx, orgId, envId, envSlug, groupId) {
 	const [{ groups }, { bindings }, { branches }] = await Promise.all([
@@ -8500,8 +8555,7 @@ async function syncGrantsForGroupLink(ctx, orgId, envId, envSlug, groupId) {
 		};
 	}));
 }
-//#endregion
-//#region src/kms.ts
+// src/kms.ts
 /** Collect a repeatable option into a list. */
 function collect$9(value, acc = []) {
 	acc.push(value);
@@ -8790,8 +8844,7 @@ function registerKmsCommands(program) {
 		}
 	});
 }
-//#endregion
-//#region src/recovery.ts
+// src/recovery.ts
 /** Collect a repeatable option into a list. */
 function collect$8(value, acc = []) {
 	acc.push(value);
@@ -8990,8 +9043,7 @@ function registerRecoveryCommands(program) {
 		console.error(`recovery request ${requestId} canceled`);
 	});
 }
-//#endregion
-//#region src/apps.ts
+// src/apps.ts
 /**
 * Applications and their environments — the structure everything else hangs
 * off. Creating an environment is the one command here that does crypto: the
@@ -9193,8 +9245,7 @@ function registerAppCommands(program) {
 		console.error(`removed ${group.slug} from ${target.appSlug}/${target.envSlug}`);
 	});
 }
-//#endregion
-//#region src/decryptor.ts
+// src/decryptor.ts
 /**
 * The standalone offline decryptor: one self-contained HTML file, written out by
 * `seekrit archive decryptor`, that opens a break-glass archive in any browser
@@ -10026,8 +10077,7 @@ const OFFLINE_DECRYPTOR_HTML = `<!doctype html>
 </body>
 </html>
 `;
-//#endregion
-//#region src/format.ts
+// src/format.ts
 function shellQuote(value) {
 	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
@@ -10039,8 +10089,7 @@ function formatSecrets(values, format) {
 		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
 	}
 }
-//#endregion
-//#region src/archive.ts
+// src/archive.ts
 /**
 * Break-glass archives (docs/break-glass-export.md).
 *
@@ -10370,8 +10419,7 @@ function registerArchiveCommands(program) {
 		console.error("open it in any browser — it declares a Content-Security-Policy of `default-src 'none'`, so it cannot reach the network.");
 	});
 }
-//#endregion
-//#region src/audit.ts
+// src/audit.ts
 /** The API's per-page ceiling (`auditQuerySchema.limit`). */
 const MAX_PAGE = 200;
 function parseLimit(raw) {
@@ -10425,8 +10473,7 @@ function registerAuditCommands(program) {
 		});
 	});
 }
-//#endregion
-//#region src/aws.ts
+// src/aws.ts
 /**
 * `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
 * dynamic secrets, the tier-2 sibling of `seekrit pg`).
@@ -10568,8 +10615,7 @@ function registerAwsCommands(program) {
 		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
 	});
 }
-//#endregion
-//#region src/billing.ts
+// src/billing.ts
 /** `included: null` means unlimited; an unavailable meter is unknown, not zero. */
 function usageLine(usage) {
 	if (!usage.available) return "unknown";
@@ -10644,8 +10690,7 @@ function registerBillingCommands(program) {
 		console.error(`${ref.slug} moved to the Free plan`);
 	});
 }
-//#endregion
-//#region src/branches.ts
+// src/branches.ts
 /**
 * Resolve `--from` to the environment being branched.
 *
@@ -10742,8 +10787,7 @@ function registerBranchCommands(program) {
 		console.error(`deleted branch ${app.slug}#${target.slug}`);
 	});
 }
-//#endregion
-//#region src/changes.ts
+// src/changes.ts
 /**
 * Change requests: the review queue in front of protected environments, and the
 * protection settings that create it.
@@ -11271,8 +11315,7 @@ async function resolveEnvironment(ctx, scope) {
 	});
 	return values;
 }
-//#endregion
-//#region src/doctor.ts
+// src/doctor.ts
 /** Every `SEEKRIT_*` variable the CLI reads, for the set-but-blank check. */
 const READ_VARS = [
 	"SEEKRIT_TOKEN",
@@ -11692,8 +11735,7 @@ function registerDoctorCommand(program) {
 		if (checks.some((c) => c.status === "fail")) process.exitCode = 1;
 	});
 }
-//#endregion
-//#region src/gcp.ts
+// src/gcp.ts
 /**
 * `seekrit gcp` — temporary GCP credentials via IAM Credentials
 * `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
@@ -11835,8 +11877,7 @@ function registerGcpCommands(program) {
 		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
 	});
 }
-//#endregion
-//#region src/groups.ts
+// src/groups.ts
 /**
 * Shared groups: reusable secret bags composed into application environments
 * by matching slug (`seekrit env groups add`). A group holds one environment
@@ -11943,8 +11984,7 @@ function registerGroupCommands(program) {
 		console.error(`created ${groupRef.slug}@${created.environment.slug} (${created.environment.id})`);
 	});
 }
-//#endregion
-//#region src/hermes.ts
+// src/hermes.ts
 /**
 * `seekrit hermes` — wire seekrit into [Hermes Agent](https://hermes-agent.nousresearch.com)
 * as a **secret source**.
@@ -12161,8 +12201,7 @@ function registerHermesCommands(program) {
 		emit(options, { reference: ref }, () => console.log(ref));
 	});
 }
-//#endregion
-//#region src/honey.ts
+// src/honey.ts
 /**
 * Honey tokens — decoy credentials that unlock nothing and alert when used.
 *
@@ -12207,8 +12246,7 @@ function registerHoneyTokenCommands(program) {
 		console.error(`${honeyTokenId} deleted`);
 	});
 }
-//#endregion
-//#region src/m2m.ts
+// src/m2m.ts
 /**
 * Resolve M2M client credentials from (in order) the process environment, a
 * `.env` overlay (for `seekrit run`), then saved config. Both halves must come
@@ -12445,8 +12483,7 @@ function registerInitCommand(program) {
 		await runInit(options);
 	});
 }
-//#endregion
-//#region src/logsink.ts
+// src/logsink.ts
 /** Collect repeated `--header Name: value` flags into a map. */
 function collectHeader(value, acc = {}) {
 	const sep = value.indexOf(":");
@@ -12513,8 +12550,7 @@ function registerLogSinkCommands(program) {
 		console.error("log sink removed");
 	});
 }
-//#endregion
-//#region src/mongodb.ts
+// src/mongodb.ts
 /**
 * `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
 * secrets), the tier-2 sibling of `seekrit aws`.
@@ -12648,8 +12684,7 @@ function registerMongoCommands(program) {
 		console.error(`revoked ${leaseId} (the MongoDB user has been dropped)`);
 	});
 }
-//#endregion
-//#region src/provisioner.ts
+// src/provisioner.ts
 /**
 * `seekrit provisioner` — helpers for the self-hosted **remote executor**
 * (`seekrit-provisioner`), the daemon that runs a target's provisioning SQL
@@ -12691,8 +12726,7 @@ function resolveLeaseAdminSecret(opts) {
 	if (!adminUrl) fail(`provide the admin connection string via --admin-url or ${opts.adminUrlEnv}`);
 	return adminUrl;
 }
-//#endregion
-//#region src/mysql.ts
+// src/mysql.ts
 /**
 * `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
 * secrets).
@@ -12832,8 +12866,7 @@ function collect$5(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/proxy-binary.ts
+// src/proxy-binary.ts
 /**
 * Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
 *
@@ -12868,7 +12901,7 @@ function collect$5(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.13.0";
+const PROXY_VERSION = "0.15.0";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -12904,7 +12937,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.13.0";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.15.0";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -13014,8 +13047,7 @@ function signalNumber(signal) {
 		SIGTERM: 15
 	}[signal] ?? 0;
 }
-//#endregion
-//#region src/nomad.ts
+// src/nomad.ts
 /**
 * `seekrit nomad` — wire seekrit into [HashiCorp Nomad](https://developer.hashicorp.com/nomad)
 * as a **secret provider plugin**.
@@ -13399,8 +13431,7 @@ function registerNomadCommands(program) {
 function indent(text) {
 	return text.split("\n").map((line) => line.length > 0 ? `     ${line}` : line).join("\n");
 }
-//#endregion
-//#region src/orgs.ts
+// src/orgs.ts
 /**
 * Counts for `org show`. Each list is admin-gated to a different degree, so a
 * member who can't read one still gets the rest: a failed call reports as
@@ -13557,8 +13588,7 @@ function registerOrgCommands(program) {
 		});
 	});
 }
-//#endregion
-//#region src/proxy-presets.ts
+// src/proxy-presets.ts
 /** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
 function placeholder(secret) {
 	return `{{seekrit:${secret}}}`;
@@ -13742,8 +13772,31 @@ function presetAllow(preset) {
 	if (preset.allow) return preset.allow;
 	return preset.secret ? [preset.secret] : [];
 }
-//#endregion
-//#region src/proxy-config.ts
+// src/proxy-config.ts
+/**
+* Generate a `seekrit-proxy.toml` — the other half of "adoptable without Rust".
+*
+* `npx @seekrit/proxy` removes the toolchain; this removes the config file. The
+* proxy's TOML is not large, but it is the kind of file where every field has to
+* be right at once before anything works: a bare hostname in one place and a
+* base URL in another, a path glob matched against the *upstream-facing* path,
+* a trust anchor that must not come from us, and two modes whose blocks look
+* similar and mean different things. Generating it turns first-run from an
+* exercise in reading reference docs into a command.
+*
+* Two things this module is careful about:
+*
+* - **It writes the config the proxy actually accepts.** In server-policy mode
+*   `allow`/`methods`/`paths` on a route are *rejected*, not ignored, and the
+*   forward proxy's hosts come from the bundle — so the server-mode emitter
+*   leaves all four out rather than emitting a file that fails at startup. The
+*   golden fixtures in `apps/proxy/testdata/generated-configs/` are parsed by a
+*   Rust test, so this cannot drift from the parser.
+* - **It never pretends a fetched thumbprint is a local trust anchor.** The
+*   `signers` list is the one field that must not come from the API. What is
+*   emitted is annotated with where it came from, and the generated file says
+*   so, in the file, next to the value.
+*/
 /**
 * A deliberately small TOML writer: basic strings and arrays of them, which is
 * every value in this config. Full TOML is not needed and a general emitter
@@ -13964,6 +14017,22 @@ function splitHostPort(addr) {
 	if (idx === -1) return [addr, "8080"];
 	return [addr.slice(0, idx), addr.slice(idx + 1)];
 }
+/**
+* Where a policy rule's service actually is, as a reverse-proxy upstream.
+*
+* A rule names its ports (HTTPS on 443 unless it says otherwise), so a route
+* generated from it has to dial one of them — `https://host` for a rule that
+* only covers `http_ports: [5000]` would route to a service the rule never
+* mentioned. The route is routing, not authorization: the reverse plane never
+* refuses on ports, because this URL is the operator's to edit.
+*/
+function upstreamForRule(rule) {
+	const { https, http } = policyRulePorts(rule);
+	if (https.includes(443)) return `https://${rule.host}`;
+	if (https.length > 0) return `https://${rule.host}:${https[0]}`;
+	const port = http[0];
+	return port === 80 ? `http://${rule.host}` : `http://${rule.host}:${port}`;
+}
 /** Build a file-policy plan from presets and/or ad-hoc `host=SECRET` rules. */
 function planFromPresets(presets, options) {
 	const taken = /* @__PURE__ */ new Set();
@@ -14039,7 +14108,7 @@ function planFromPolicy(args, options) {
 		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
 		routes.push({
 			prefix,
-			upstream: `https://${rule.host}`,
+			upstream: upstreamForRule(rule),
 			host: rule.host,
 			allow: [],
 			methods: [],
@@ -14182,8 +14251,7 @@ function renderComposeSnippet(plan, options) {
 	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
 	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
 }
-//#endregion
-//#region src/paperclip.ts
+// src/paperclip.ts
 /**
 * `seekrit paperclip` — wire seekrit into a [Paperclip](https://docs.paperclip.ing)
 * agent.
@@ -14371,8 +14439,7 @@ function registerPaperclipCommands(program) {
 		});
 	});
 }
-//#endregion
-//#region src/pg.ts
+// src/pg.ts
 /**
 * `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
 *
@@ -14524,8 +14591,7 @@ function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/proxy.ts
+// src/proxy.ts
 /**
 * `seekrit proxy` — get `seekrit-proxy` running without a Rust toolchain or a
 * hand-written TOML file.
@@ -14854,10 +14920,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.13.0")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.15.0")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.13.0";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.15.0";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -14916,13 +14982,12 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.13.0`,
+			image: options.image ?? `seekritdev/proxy:0.15.0`,
 			publish: Boolean(options.publish)
 		}));
 	});
 }
-//#endregion
-//#region src/redis.ts
+// src/redis.ts
 /**
 * `seekrit redis` — temporary Redis (6+) credentials (Vault-style dynamic
 * secrets).
@@ -15062,8 +15127,7 @@ function collect$2(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/rotation.ts
+// src/rotation.ts
 /**
 * `seekrit rotation` — managed, scheduled rotation of a stored secret's value.
 *
@@ -15230,8 +15294,7 @@ function registerRotationCommands(program) {
 		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
 	});
 }
-//#endregion
-//#region src/run-command.ts
+// src/run-command.ts
 /** Keep signal handlers installed from provisioning through asynchronous cleanup. */
 async function runCommand(cmd, args, prepare, cleanup) {
 	let child;
@@ -15401,8 +15464,7 @@ async function reapStragglers(pids, signal) {
 		process.kill(pid, "SIGKILL");
 	} catch {}
 }
-//#endregion
-//#region src/run-leases.ts
+// src/run-leases.ts
 /** Validate all flags before contacting the API or creating any database roles. */
 function parseRunLeaseOptions(bindings = [], ttl) {
 	if (!bindings.length) {
@@ -15527,8 +15589,7 @@ var RunLeases = class {
 		return ok;
 	}
 };
-//#endregion
-//#region src/ssh.ts
+// src/ssh.ts
 /**
 * `seekrit ssh` — temporary SSH access via short-lived certificates (Vault-style
 * dynamic secrets, the SSH sibling of `seekrit pg`).
@@ -15670,8 +15731,7 @@ function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/sync.ts
+// src/sync.ts
 /** Split a `--flag a,b` list into trimmed, non-empty members. */
 function list(raw, fallback) {
 	return (raw ?? fallback).split(",").map((item) => item.trim()).filter(Boolean);
@@ -16417,8 +16477,7 @@ function registerSyncCommands(program) {
 		], "no sync runs yet"));
 	});
 }
-//#endregion
-//#region src/web-login.ts
+// src/web-login.ts
 /**
 * `seekrit login` — sign in through the browser.
 *
@@ -16593,8 +16652,7 @@ async function runLogout() {
 	});
 	if (config.clientId) console.error("(machine client credentials are kept — remove them with `seekrit login`)");
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 /** Collect repeated `--with group=env` flags into a map. */
 function collectKv(value, acc = {}) {
 	const eq = value.indexOf("=");
@@ -17045,7 +17103,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-Dgj-7S9y.js");
+	const { runMcpServer } = await import("./mcp-Clul2n4l.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);
@@ -17059,5 +17117,4 @@ const argv = process.argv.map((arg) => arg === "-v" ? "--version" : arg);
 program.parseAsync(argv).catch((err) => {
 	fail(describeError(err));
 });
-//#endregion
 export { signatureKeyRef as A, generateDek as B, version as C, importSigningKey as D, generateSigningKeyMaterial as E, generateEncryptKeyMaterial as F, parseBranchTtl as H, kmsBlobKeyRef as I, kmsDecrypt as L, generatePostgresCredential as M, generateMysqlCredential as N, importVerifyingKey as O, generateDataKey as P, kmsEncrypt as R, writeProjectConfig as S, parseServiceToken as T, toBase64 as V, getDek as _, kmsResolveRecipient as a, tryBuildContext as b, fetchDecryptedSecrets as c, resolveApp as d, resolveAppEnv as f, resolveOrg as g, resolveGroup as h, kmsResolveKey as i, verifyMessage as j, signMessage as k, fetchDecryptedVersion as l, resolveEnvTarget as m, kmsCallerIdentity as n, syncGrantsForGroupLink as o, resolveBranch as p, kmsRecoverMaterial as r, encryptAndSetSecret as s, ensureM2mAdminToken as t, materializeEnv as u, isTokenAuth as v, createServiceToken as w, setFailThrows as x, principalPublicKeyJwk as y, wrapDek as z };

package/dist/{mcp-Dgj-7S9y.js → mcp-Clul2n4l.js}

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { spawn } from "node:child_process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-//#region src/mcp.ts
+// src/mcp.ts
 /** Lowercase-alphanumeric string for a fresh Postgres role name. */
 function randomLower(length) {
 	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -1023,5 +1023,4 @@ async function runMcpServer(options = {}) {
 	});
 	await server.connect(new StdioServerTransport());
 }
-//#endregion
 export { runMcpServer };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [
@@ -38,17 +38,17 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "commander": "^15.0.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",
-    "tsdown": "^0.23.1",
+    "tsdown": "^0.23.3",
     "vitest": "^5.0.5",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",