reqenc-edge

v5.1.2

Published

16 days ago

Enterprise 22-layer dual-pack end-to-end request encryption SDK for zero-trust microservices and edge proxies.

Downloads

1,158

reqenc-edge 🛡️

Zero-Trust 22-Layer Dual-Pack Request Encryption Client & Edge CLI for Microservices, APIs, and Cloudflare Proxies.

reqenc-edge is the official client SDK and Command-Line Interface (CLI) for the REQENC Zero-Trust Security Platform. It transforms standard HTTP traffic into 22-Layer Dual-Pack Quantum-Hardened Encrypted Envelopes sealed with 2048-bit RSA-OAEP, ECDH P-384 ephemeral key exchange, AES-256-GCM, and AES-256-CTR before bytes touch the wire.

Even if an adversary intercepts your packets via Wi-Fi sniffing, compromised routers, cloud middleboxes, or corporate TLS termination proxies (e.g. Burp Suite, Charles Proxy, Fiddler), they only see opaque ciphertext. The URL path, query params, HTTP method, headers, and payload remain completely concealed until decrypted in RAM inside your Cloudflare Anycast edge boundary.

📑 Table of Contents

⚡ Installation

Global CLI Installation

Install globally to manage enclaves, configure routed endpoints, and test encrypted requests directly from your terminal:

npm install -g reqenc-edge

(You can also execute commands without installing using npx reqenc-edge <command>)

Application SDK Installation

Install in your backend, frontend, or serverless project:

npm install reqenc-edge
# or
pnpm add reqenc-edge
# or
yarn add reqenc-edge
# or
bun add reqenc-edge

💻 Global CLI Usage

The reqenc CLI gives you complete control over your Zero-Trust encryption infrastructure.

1. Authentication & Device Login

reqenc login

The CLI launches your default web browser to your Reqenc Console (https://reqenc.cwit.site/cli-auth).
If you are already logged in to the web console, it automatically approves the terminal device session.
If not logged in, simply sign in or create an account, and your terminal instantly connects.
An ephemeral session token is negotiated and stored securely at ~/.reqenc/config.json.
All your cloud project enclaves and endpoints automatically synchronize to your terminal.

2. Inspecting Account Identity (`whoami`)

Check your current authenticated user, active session ID, hostname, and synchronized enclaves:

reqenc whoami

Output:

✔ Authenticated
  Account:    [email protected]
  Device:     MacBook-Pro.local (darwin)
  Session ID: rqe_sess_7a9f182c4e0b
  Enclaves:   3 active

3. Automatic Environment Setup (`reqenc env` / `reqenc init`)

Instantly generate and inject complete .env credentials into your local application directory:

# Print .env variables to terminal:
reqenc env

# Auto-write / update .env directly into your current project folder:
reqenc env --write

# Zero-config shortcut (alias for reqenc env -w):
reqenc init

# Select specific enclave if you have multiple:
reqenc env "Payment Gateway" --write

# Specify custom output filename:
reqenc env --out .env.local

This writes framework-ready environment variables compatible with:

Node.js / Express / Fastify / Cloudflare: REQENC_API_KEY, REQENC_PROXY_URL, REQENC_PUBLIC_KEY
Vite / React / Vue: VITE_REQENC_API_KEY, VITE_REQENC_PROXY_URL, VITE_REQENC_PUBLIC_KEY
Next.js: NEXT_PUBLIC_REQENC_API_KEY, NEXT_PUBLIC_REQENC_PROXY_URL, NEXT_PUBLIC_REQENC_PUBLIC_KEY

4. Managing Project Enclaves (`project`)

List All Enclaves

reqenc project list
# or shortcut:
reqenc list

Displays all local and cloud-synced enclaves, including their 2048-bit public keys, destination origin URLs, and configured microservice endpoints.

Inspect Complete Enclave Information (`info`)

Inspect comprehensive cryptographic specifications, live API keys, key fingerprints, destination origins, and microservice routes:

# Inspect active enclave (auto-selected when you have 1 enclave):
reqenc info

# Inspect by name:
reqenc info "Payment Gateway"

# Inspect by enclave ID:
reqenc info "proj_qtjkox0e63zn"

# Display full 2048-bit RSA-OAEP Public Key PEM:
reqenc info "Payment Gateway" --key

Sample Output:

ENCLAVE DETAILS: [Payment Gateway]

IDENTITY & METADATA:
  Enclave Name:       Payment Gateway
  Enclave ID:         proj_qtjkox0e63zn
  Status:             ● ACTIVE · 22-Layer Verified
  Created:            Sep 13, 2026, 12:12 PM (2h ago)
  Total Requests:     1,420 dispatches

SECURITY SPECIFICATION:
  Protocol Level:     22-Layer Dual-Pack Autonomous Cryptography
  Security Mode:      STRICT_22LAYER_DUALPACK
  Key Exchange:       2048-Bit RSA-OAEP (SHA-256 MGF1) + ECDH Curve P-384
  Dual Ciphers:       AES-256-GCM (Authenticated AEAD) + AES-256-CTR
  Integrity Seals:     HMAC-SHA256 (HKDF) + HMAC-SHA384 Signatures
  Replay Defenses:    128-Bit CSPRNG Nonce + Monotonic Chrono-Seal + Bloom Cache
  Edge Enforcement:   RAM-only unsealing at 300+ Anycast PoPs

KEYS & CREDENTIALS:
  Live API Key:       rqe_live_8f3d19e4a02c
  Key Fingerprint:    SHA256:7CA4F1A48E0D224C898B164F
  Public Key:         2048-bit RSA (Pass --key to view full PEM)

ORIGIN & ROUTING:
  Default Origin URL: https://api.mycorp.com
  Routed Endpoints:   2 configured
    1. Auth API [ENABLED] (Prefix: /auth -> https://auth.mycorp.com)
    2. Billing API [ENABLED] (Prefix: /billing -> https://billing.mycorp.com)

QUICK INTEGRATION (.env):
  REQENC_API_KEY="rqe_live_8f3d19e4a02c"
  REQENC_PROXY_URL="https://reqenc.cwit.site"

DISPATCH TEST REQUEST:
  reqenc exec -- "Payment Gateway" -- /api/v1/charge

Create a New Enclave

# Basic enclave creation:
reqenc project create "Payment Gateway"
reqenc create "Payment Gateway"   # (Shortcut)

# Enclave with custom origin destination URL:
reqenc project create "Stripe Proxy" --url https://api.stripe.com

Update / Modify an Enclave

Modify the name or backend origin URL of an existing enclave using either its name or ID:

# Update origin destination URL:
reqenc project update "Payment Gateway" --url https://api.v2.mycorp.com

# Rename enclave:
reqenc project update "Payment Gateway" --name "Production Checkout"

# Update both simultaneously:
reqenc project update "proj_94b81c" --name "EU Payment Shield" --url https://eu.api.corp.com

Delete an Enclave

Permanently remove an enclave from both local terminal configuration and your cloud dashboard:

# Delete by name:
reqenc project delete "Payment Gateway"

# Delete by ID:
reqenc project delete "proj_94b81c"

4. Managing Multi-API Routed Endpoints (`endpoint`)

Enclaves can route encrypted requests across multiple upstream microservice backends based on route prefixes.

List Configured Endpoints

reqenc endpoint list "Payment Gateway"

Output:

ROUTED ENDPOINTS FOR [Payment Gateway] (2):
  Default Origin URL: https://api.mycorp.com

  1. Auth Service  [ENABLED]
     Endpoint ID:  ep_a1b2c3
     Path Prefix:  /auth
     Target URL:   https://auth.mycorp.internal

  2. Billing Service  [ENABLED]
     Endpoint ID:  ep_d4e5f6
     Path Prefix:  /v1/charge
     Target URL:   https://billing.mycorp.internal

Add a Routed Endpoint

Add a dedicated upstream target with path prefix matching:

reqenc endpoint add "Payment Gateway" --name "Auth API" --url https://auth.corp.com --prefix /auth
reqenc endpoint add "Payment Gateway" --name "Tax Service" --url https://tax.corp.com --prefix /tax

Toggle Endpoint State (Enable / Disable)

Temporarily disable an upstream route without deleting its configuration:

reqenc endpoint toggle "Payment Gateway" "Auth API"
# or by ID:
reqenc endpoint toggle "Payment Gateway" "ep_a1b2c3"

Delete a Routed Endpoint

Permanently remove an endpoint route from an enclave:

reqenc endpoint delete "Payment Gateway" "Auth API"
# or by ID:
reqenc endpoint delete "Payment Gateway" "ep_a1b2c3"

5. Edge Traffic Testing & Simulation (`exec`)

Test 22-layer encrypted dispatch through edge Anycast nodes directly from terminal:

# Syntax: reqenc exec -- <project> -- <path>
reqenc exec -- "Payment Gateway" -- /api/v1/charge
reqenc exec -- "Stripe Proxy" -- /v1/tokens

CLI Execution Trace:

⚡ Encrypting 22-layer dual-pack payload for [Payment Gateway] -> /api/v1/charge
✔ Session key wrapped via RSA-OAEP 2048
✔ Dual-Pack 2: AES-256-CTR + ECDH P-384 + Polymorphic Scramble sealed
✔ Anti-replay nonce cache verified (Canary: b8e35cf91280fa71)
  Target Origin: https://api.mycorp.com
  API Key:       rqe_live_49f82a10...

✔ Routed over Anycast Edge PoPs in 11ms (HTTP 200 OK)
Payload sealed and forwarded without intermediate exposure.

6. Real-Time Forensic Audit Logs (`logs`)

Stream live forensic decryption and edge-routing events from 300+ global Cloudflare PoPs:

reqenc logs --follow "Payment Gateway"

Live Output:

📡 Streaming live edge logs for enclave [Payment Gateway]... (Press Ctrl+C to stop)

[2026-09-13T07:45:01.120Z] ENCLAVE: Payment Gateway | POP: SIN | RSA-OAEP verified | Pack 2 valid | 200 OK (8ms)
[2026-09-13T07:45:04.620Z] ENCLAVE: Payment Gateway | POP: FRA | AES-GCM tag valid | Replay nonce ok | 200 OK (11ms)
[2026-09-13T07:45:08.120Z] ENCLAVE: Payment Gateway | POP: IAD | 22 layers decrypted | Origin forwarded | 200 OK (13ms)

7. Revoking Sessions & Remote Lockdown (`logout`)

Local Terminal Logout

Log out and clear stored session credentials from your device:

reqenc logout

Remote Console Revocation (Zero-Trust Enforcement)

If a developer laptop is lost, compromised, or offboarded, you can revoke access in real time:

Navigate to the REQENC Web Console (https://reqenc.cwit.site/#dashboard).
Open the CLI Sessions tab.
Click Terminate Session on the target device.
Immediate Lockdown: The very next time reqenc executes in that terminal, the CLI checks the cloud edge state, invalidates all local credentials, and blocks execution:

✖ ACCESS DENIED: CLI Session Terminated / Revoked
  Session [rqe_sess_7a9f182c4e0b] was revoked from the Reqenc Console.
  Local terminal credentials have been invalidated for security.

To reconnect your terminal, run:
  reqenc login

If a user is not logged in or their session was revoked, all functional commands (project, endpoint, exec, logs, whoami) are immediately blocked.

8. Command Help & Diagnostics (`help`)

To view the complete categorized list of commands, flags, and usage examples:

reqenc help
# or
reqenc --help

🚀 SDK Quickstart (TypeScript / JavaScript)

Environment Variables

Add your enclave credentials to your .env or .env.local file:

# Found in your REQENC Console (https://reqenc.cwit.site/#dashboard)
REQENC_API_KEY="rqe_live_your_api_key_here"
REQENC_PROXY_URL="https://reqenc.cwit.site"

# Your Project's 2048-bit Public Key (PEM format)
REQENC_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----"

Note for Frontend Frameworks:
In Vite, prefix variables with VITE_ (VITE_REQENC_API_KEY, VITE_REQENC_PUBLIC_KEY, VITE_REQENC_PROXY_URL).
In Next.js, prefix client-side variables with NEXT_PUBLIC_ (NEXT_PUBLIC_REQENC_API_KEY, NEXT_PUBLIC_REQENC_PUBLIC_KEY).

Drop-in Fetch Replacement (`reqenc.fetch`)

The reqenc.fetch() method is a direct drop-in replacement for native window.fetch or Node.js fetch. It automatically encapsulates the HTTP method, destination path, custom headers, and body into a 22-layer dual-pack envelope:

import { reqenc } from 'reqenc-edge';

async function processSecurePayment() {
  const response = await reqenc.fetch('/api/v1/payments/charge', {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer sk_live_sensitive_token',
      'X-Customer-Region': 'eu-west-1',
    },
    body: {
      accountId: 'acc_corp_9942',
      amountCents: 15000,
      currency: 'USD',
    },
  });

  const data = await response.json();
  console.log('Encrypted edge response:', data);
}

Programmatic Client Configuration

If passing credentials programmatically or during runtime initialization instead of reading from environment variables:

import { reqenc } from 'reqenc-edge';

reqenc.init({
  apiKey: 'rqe_live_your_api_key',
  publicKey: '-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----',
  proxyUrl: 'https://reqenc.cwit.site', // Defaults to https://reqenc.cwit.site
  version: '4', // Enforces 22-Layer Dual-Pack
});

const res = await reqenc.fetch('/api/v1/customers');
const customers = await res.json();

🌐 How to Implement REQENC in Your Website or App

1. Frontend Browser Implementation (React, Vite, Next.js Client)

By encrypting payloads directly in the user's browser, sensitive credentials, passwords, and payment information are protected before they reach the physical Wi-Fi or cellular network:

React + Vite Component Example

import React, { useState } from 'react';
import { reqenc } from 'reqenc-edge';

// Initialize once at app startup or inside component
reqenc.init({
  apiKey: import.meta.env.VITE_REQENC_API_KEY,
  publicKey: import.meta.env.VITE_REQENC_PUBLIC_KEY,
  proxyUrl: 'https://reqenc.cwit.site',
});

export function LoginForm() {
  const [email, setEmail] = useState('');
  const [password, setPassword] = useState('');
  const [loading, setLoading] = useState(false);
  const [message, setMessage] = useState('');

  const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault();
    setLoading(true);

    try {
      // Passwords and tokens are sealed in 22 layers in the user's browser RAM!
      const res = await reqenc.fetch('/api/v1/auth/login', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: { email, password },
      });

      const data = await res.json();
      if (res.ok) {
        setMessage(`Authenticated as ${data.user.name}`);
      } else {
        setMessage(`Error: ${data.message}`);
      }
    } catch (err: any) {
      setMessage(`Network error: ${err.message}`);
    } finally {
      setLoading(false);
    }
  };

  return (
    <form onSubmit={handleSubmit} className="auth-card">
      <h2>Zero-Trust Encrypted Sign In</h2>
      <input
        type="email"
        placeholder="Enter email"
        value={email}
        onChange={e => setEmail(e.target.value)}
        required
      />
      <input
        type="password"
        placeholder="Enter password"
        value={password}
        onChange={e => setPassword(e.target.value)}
        required
      />
      <button type="submit" disabled={loading}>
        {loading ? 'Sealing in 22 Layers...' : 'Sign In Securely'}
      </button>
      {message && <p>{message}</p>}
    </form>
  );
}

Vanilla HTML & JavaScript (Via ESM)

<!DOCTYPE html>
<html>
<head>
  <title>Zero-Trust Form</title>
</head>
<body>
  <button id="send-btn">Send Sensitive Data</button>

  <script type="module">
    import { reqenc } from 'https://esm.sh/reqenc-edge';

    reqenc.init({
      apiKey: 'rqe_live_your_api_key',
      publicKey: '-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----',
      proxyUrl: 'https://reqenc.cwit.site',
    });

    document.getElementById('send-btn').addEventListener('click', async () => {
      const res = await reqenc.fetch('/api/v1/telemetry', {
        method: 'POST',
        body: { sensitiveMetric: 9942, userToken: 'secret_abc' },
      });
      const data = await res.json();
      console.log('Server response:', data);
    });
  </script>
</body>
</html>

2. Next.js Integration (App Router & Server Actions)

In Next.js App Router, call reqenc.fetch() directly inside Server Actions or Route Handlers:

// app/actions/billing.ts
'use server';

import { reqenc } from 'reqenc-edge';

export async function processInvoice(invoiceId: string, amount: number) {
  // Automatically reads REQENC_API_KEY & REQENC_PUBLIC_KEY from process.env
  const res = await reqenc.fetch(`/api/billing/invoices/${invoiceId}/pay`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Audit-Trigger': 'server-action',
    },
    body: { amount, paidAt: new Date().toISOString() },
  });

  if (!res.ok) {
    throw new Error(`Invoice settlement failed with status ${res.status}`);
  }

  return await res.json();
}

3. Express.js Microservice Gateway

Forward sensitive client requests through an Express.js API gateway to upstream services:

import express from 'express';
import { reqenc } from 'reqenc-edge';

const app = express();
app.use(express.json());

app.post('/api/checkout', async (req, res) => {
  try {
    const upstream = await reqenc.fetch('/api/v1/checkout', {
      method: 'POST',
      headers: { 'Authorization': req.headers.authorization || '' },
      body: req.body,
    });
    const data = await upstream.json();
    res.status(upstream.status).json(data);
  } catch (err: any) {
    res.status(502).json({ error: 'Zero-trust edge dispatch failed', message: err.message });
  }
});

app.listen(3000, () => console.log('Zero-Trust Gateway active on port 3000'));

4. How Your Upstream Origin Backend Receives Requests

Your backend requires ZERO decryption libraries or cryptographic changes.

The client browser/server sends the 22-layer sealed envelope to https://reqenc.cwit.site/api/proxy.
Cloudflare Anycast edge nodes verify the 22 layers in hardware RAM.
The edge reconstructs the clean HTTP request and forwards it over private TLS directly to your origin server (e.g. https://api.mycorp.com/api/v1/checkout).

The edge Worker injects verified provenance headers:

x-reqenc-verified: true
x-reqenc-enclave-id: proj_qtjkox0e63zn
x-reqenc-request-id: req_7ca4f1a48e0d
x-reqenc-timestamp: 1726218720000

Your server responds normally. The edge Worker encrypts the response body before returning it to the client.

5. Multi-Tenant Microservices (`ReqencClient`)

Instantiate isolated clients with different keypairs for multi-tenant architectures:

import { ReqencClient } from 'reqenc-edge';

const tenantA = new ReqencClient({
  apiKey: process.env.TENANT_A_KEY,
  publicKey: process.env.TENANT_A_PUBKEY,
  proxyUrl: 'https://reqenc.cwit.site',
});

const tenantB = new ReqencClient({
  apiKey: process.env.TENANT_B_KEY,
  publicKey: process.env.TENANT_B_PUBKEY,
  proxyUrl: 'https://reqenc.cwit.site',
});

await tenantA.fetch('/api/resource');
await tenantB.fetch('/api/resource');

🔒 The 22 Autonomous Security Layers

Every packet sent through reqenc is wrapped in 22 distinct cryptographic layers split into a dual-pack envelope:

| Layer | Security Mechanism | Cryptographic Primitive | Protection Objective | |:---:|---|---|---| | L01 | Ephemeral Session Key | CSPRNG 256-Bit Key | Fresh symmetric cipher key generated per HTTP request | | L02 | Asymmetric Key-Wrapping | 2048-Bit RSA-OAEP (SHA-256 MGF1) | Guarantees only edge enclave private key can unwrap session key | | L03 | Cryptographic Nonce Vector | 128-Bit CSPRNG Nonce | Ensures every ciphertext block is globally unique | | L04 | Microsecond Chrono-Seal | Monotonic Edge Timestamp | Replay prevention: packets older than drift window dropped | | L05 | AEAD Integrity Tag | AES-256-GCM Tag (128-bit) | Tamper detection: any bit flip causes instant rejection | | L06 | Request Trace UUID | UUID v4 Enclave Identifier | Global request tracking and deduplication across edge PoPs | | L07 | Hardware Identity Lock | Public Key Fingerprint Binding | Prevents public key substitution or man-in-the-middle forging | | L08 | Payload Compression | Deflate / Zlib Stream | Strips plaintext entropy markers and reduces packet size | | L09 | HKDF Key Separation | RFC 5869 Salted Key Derivation | Mathematically separates signing keys from encryption keys | | L10 | Protected Header Envelope | Ciphertext-Sealed Headers | Authorization & custom tokens never travel in plaintext | | L11 | HTTP Method Masking | Uniform POST Enveloping | Mask GET, PUT, DELETE into uniform opaque POST requests | | L12 | Route Path Concealment | Inner URI Encapsulation | Conceals API paths from URL-based firewalls and snoopers | | L13 | Entropy Size Padding | PKCS#7 32–256 Byte Buckets | Defeats traffic analysis by normalizing payload length | | L14 | Protocol Version Lock | Strict Major/Minor Enforcement | Prevents cryptographic downgrade attacks | | L15 | Double-Hash Integrity Chain | SHA-256(SHA-256(Packet)) | Immune to length-extension and collision vulnerabilities | | L16 | ECDH Key Agreement | Curve P-384 Ephemeral Secret | Forward secrecy: compromised keys cannot decrypt past sessions | | L17 | Dual-Cipher Cascade | AES-256-CTR Layer 2 Stream | Two independent cipher families defend against zero-day cipher breaks | | L18 | HMAC-SHA384 Auth | Salted 384-Bit Signature | Secondary cryptographic authentication layer | | L19 | Polymorphic Nonce Scramble | Dynamic Byte Substitution | Nonce patterns dynamically scrambled to prevent side-channel analysis | | L20 | Inner Response Key Derivation | Derived Response Secret | Prevents return traffic interception by sealing response symmetrically | | L21 | Global Anycast Routing | Cloudflare 300+ Edge Nodes | Packet decryption strictly localized in RAM nearest to consumer | | L22 | Zero-Trust Memory Erasure | RAM Overwrite on Lifecycle End | Buffer wiping prevents residual memory harvesting on servers |

🛡️ Zero-Trust Session & Revocation Lifecycle

REQENC enforces an uncompromised Zero-Trust posture for all terminal devices:

┌──────────────┐         1. reqenc login         ┌──────────────────────┐
│  Developer   │ ──────────────────────────────> │    REQENC Console    │
│   Terminal   │ <────────────────────────────── │ (Browser Dashboard)  │
└──────────────┘       2. Device Token Handshake └──────────────────────┘
       │                                                    │
       │ 3. Every CLI command verifies                      │
       │    active session status                           │
       ▼                                                    │ 4. Click "Terminate"
┌────────────────────────────────────────┐                  │    in Web Dashboard
│  Firestore + Cloudflare Edge Workers   │ <────────────────┘
│     Session Revocation Authority       │
└────────────────────────────────────────┘
       │
       │ 5. Session marked 'terminated'
       ▼
┌──────────────┐
│  Developer   │ ──> [BLOCKED: ✖ ACCESS DENIED: CLI Session Revoked]
│   Terminal   │     Credentials purged from ~/.reqenc/config.json
└──────────────┘

📖 Complete CLI Command Reference

| Command | Subcommand / Flags | Description | |---|---|---| | reqenc login | — | Authenticate terminal using 1-click browser dashboard | | reqenc whoami | — | Display logged-in account, device info, and active session | | reqenc logout | — | Clear credentials and terminate session | | reqenc project list | — | List all project enclaves and sync from cloud | | reqenc info | [name\|id] [--key] | Display complete enclave details, credentials, and routes | | reqenc project create | <name> [--url <origin>] | Provision a new 22-Layer enclave | | reqenc project update | <name\|id> [--name <n>] [--url <u>] | Modify enclave name or origin destination URL | | reqenc project delete | <name\|id> | Permanently remove enclave from local config and cloud | | reqenc endpoint list | <project> | List all microservice routed endpoints for an enclave | | reqenc endpoint add | <project> --name <n> --url <u> --prefix <p> | Add an upstream microservice route to an enclave | | reqenc endpoint toggle| <project> <endpoint-id\|name> | Enable or disable a routed endpoint route | | reqenc endpoint delete| <project> <endpoint-id\|name> | Remove a routed endpoint from an enclave | | reqenc exec | -- <project> -- <path> | Dispatch a simulated 22-layer encrypted test request | | reqenc logs | --follow <project> | Stream real-time forensic audit logs from Anycast edge | | reqenc status | — | Inspect global 300+ Anycast edge network health | | reqenc version | -v, --version | Output installed package and protocol version | | reqenc help | --help, -h | Display structured CLI help manual and flag usage |