@executioncontrolprotocol/cli 0.4.0 → 0.4.2

package/dist/commands/config/plugins/security/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/plugins/security/update.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/commands/config/plugins/security/update.js

@@ -0,0 +1,5 @@
+/**
+ * @deprecated Use `ecp config security plugins update` — same behavior (writes `security.plugins`).
+ */
+export { default } from "../../security/plugins/update.js";
+//# sourceMappingURL=update.js.map

package/dist/commands/config/plugins/security/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../../src/commands/config/plugins/security/update.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/commands/config/secrets/add.d.ts

@@ -0,0 +1,14 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsAdd extends Command {
+    static summary: string;
+    static flags: {
+        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        value: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        prompt: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=add.d.ts.map

package/dist/commands/config/secrets/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAgB7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,SAAoE;IAElF,MAAM,CAAC,KAAK;;;;;;;MAoBV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAuD3B"}

package/dist/commands/config/secrets/add.js

@@ -0,0 +1,84 @@
+import { Command, Flags } from "@oclif/core";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { OS_PROVIDER_ID } from "../../../lib/secret-provider-ids.js";
+import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
+import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
+import { canonicalSecretKeyForBinding, createDefaultSecretBroker, ECP_SECRET_REF_PROTOCOL_PREFIX, secretRefIdFromLogicalKey, } from "@executioncontrolprotocol/runtime";
+export default class ConfigSecretsAdd extends Command {
+    static summary = `Add or replace a secret in a provider (e.g. ${OS_PROVIDER_ID})`;
+    static flags = {
+        ...configScopeFlags,
+        provider: Flags.string({
+            char: "p",
+            description: `Provider id (e.g. ${OS_PROVIDER_ID})`,
+            required: true,
+        }),
+        key: Flags.string({
+            char: "k",
+            description: `Secret lookup key (e.g. GITHUB_API_KEY or server/fetch.token; ref id is ${ECP_SECRET_REF_PROTOCOL_PREFIX}<key>)`,
+            required: true,
+        }),
+        value: Flags.string({
+            char: "v",
+            description: "Secret value (avoid in shell history; prefer --prompt)",
+        }),
+        prompt: Flags.boolean({
+            description: "Read secret from stdin interactively (masked input not supported on all terminals)",
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsAdd);
+        if (flags.value && flags.prompt) {
+            this.error("Use only one of --value or --prompt.", { exit: 1 });
+        }
+        if (!flags.value && !flags.prompt) {
+            this.error("Provide --value or --prompt.", { exit: 1 });
+        }
+        const cwd = process.cwd();
+        const { config } = loadConfigForDisplay({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
+        const { registry } = createDefaultSecretBroker({
+            policy: resolveSecretPolicyFromConfig(config),
+            dotenvPath,
+            cwd,
+        });
+        const provider = registry.get(flags.provider);
+        if (!provider) {
+            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
+        }
+        if (!provider.store) {
+            this.error(`Provider "${flags.provider}" does not support store (read-only).`, { exit: 1 });
+        }
+        const available = await provider.isAvailable();
+        if (!available) {
+            this.error(`Provider "${flags.provider}" is not available on this system.`, { exit: 1 });
+        }
+        let value = flags.value ?? "";
+        if (flags.prompt) {
+            const rl = createInterface({ input, output });
+            try {
+                value = (await rl.question("Secret value: ")).trim();
+            }
+            finally {
+                await rl.close();
+            }
+        }
+        if (!value) {
+            this.error("Empty secret.", { exit: 1 });
+        }
+        const ref = {
+            id: secretRefIdFromLogicalKey(flags.key),
+            provider: flags.provider,
+            key: canonicalSecretKeyForBinding(flags.key),
+        };
+        await provider.store({ ref, value });
+        this.log(`Stored secret for provider "${flags.provider}" key "${flags.key}".`);
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/config/secrets/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAG3C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,GAAG,+CAA+C,cAAc,GAAG,CAAC;IAElF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,qBAAqB,cAAc,GAAG;YACnD,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EACT,2EAA2E,8BAA8B,QAAQ;YACnH,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,wDAAwD;SACtE,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,oFAAoF;SAClG,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,uCAAuC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,oCAAoC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAc;YACrB,EAAE,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAI,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAS;YACzB,GAAG,EAAE,4BAA4B,CAAC,KAAK,CAAC,GAAI,CAAC;SAC9C,CAAC;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACjF,CAAC"}

package/dist/commands/config/secrets/get.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsGet extends Command {
+    static summary: string;
+    static flags: {
+        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        show: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/config/secrets/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAY7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,SAAyC;IAEvD,MAAM,CAAC,KAAK;;;;;;MAeV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAwC3B"}

package/dist/commands/config/secrets/get.js

@@ -0,0 +1,64 @@
+import { Command, Flags } from "@oclif/core";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
+import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
+import { canonicalSecretKeyForBinding, createDefaultSecretBroker, ECP_SECRET_REF_PROTOCOL_PREFIX, secretRefIdFromLogicalKey, } from "@executioncontrolprotocol/runtime";
+export default class ConfigSecretsGet extends Command {
+    static summary = "Read a secret (redacted by default)";
+    static flags = {
+        ...configScopeFlags,
+        provider: Flags.string({
+            char: "p",
+            description: "Provider id",
+            required: true,
+        }),
+        key: Flags.string({
+            char: "k",
+            description: `Lookup key (same form as add; ref id is ${ECP_SECRET_REF_PROTOCOL_PREFIX}<key>)`,
+            required: true,
+        }),
+        show: Flags.boolean({
+            description: "Print full value (writes to stdout — avoid logs)",
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsGet);
+        const cwd = process.cwd();
+        const { config } = loadConfigForDisplay({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
+        const { registry } = createDefaultSecretBroker({
+            policy: resolveSecretPolicyFromConfig(config),
+            dotenvPath,
+            cwd,
+        });
+        const provider = registry.get(flags.provider);
+        if (!provider) {
+            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
+        }
+        const available = await provider.isAvailable();
+        if (!available) {
+            this.error(`Provider "${flags.provider}" is not available.`, { exit: 1 });
+        }
+        const ref = {
+            id: secretRefIdFromLogicalKey(flags.key),
+            provider: flags.provider,
+            key: canonicalSecretKeyForBinding(flags.key),
+        };
+        const result = await provider.load(ref);
+        if (!result) {
+            this.error(`No secret for key "${flags.key}".`, { exit: 1 });
+        }
+        if (flags.show) {
+            this.warn("Printing full secret to stdout — ensure this is not logged or captured.");
+            this.log(result.value);
+        }
+        else {
+            this.log(result.redactedPreview);
+        }
+    }
+}
+//# sourceMappingURL=get.js.map

package/dist/commands/config/secrets/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAG3C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,GAAG,qCAAqC,CAAC;IAEvD,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,aAAa;YAC1B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2CAA2C,8BAA8B,QAAQ;YAC9F,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,kDAAkD;SAChE,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,GAAG,GAAc;YACrB,EAAE,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAI,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAS;YACzB,GAAG,EAAE,4BAA4B,CAAC,KAAK,CAAC,GAAI,CAAC;SAC9C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YACrF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;IACH,CAAC"}

package/dist/commands/config/secrets/list.d.ts

@@ -0,0 +1,11 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsList extends Command {
+    static summary: string;
+    static flags: {
+        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/config/secrets/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAO7C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,MAAM,CAAC,OAAO,SAAsD;IAEpE,MAAM,CAAC,KAAK;;;;MAOV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoC3B"}

package/dist/commands/config/secrets/list.js

@@ -0,0 +1,52 @@
+import { Command, Flags } from "@oclif/core";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { OS_PROVIDER_ID } from "../../../lib/secret-provider-ids.js";
+import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
+import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
+import { createDefaultSecretBroker } from "@executioncontrolprotocol/runtime";
+export default class ConfigSecretsList extends Command {
+    static summary = "List secret keys for a provider (when supported)";
+    static flags = {
+        ...configScopeFlags,
+        provider: Flags.string({
+            char: "p",
+            description: `Provider id (e.g. ${OS_PROVIDER_ID})`,
+            required: true,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsList);
+        const cwd = process.cwd();
+        const { config } = loadConfigForDisplay({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
+        const { registry } = createDefaultSecretBroker({
+            policy: resolveSecretPolicyFromConfig(config),
+            dotenvPath,
+            cwd,
+        });
+        const provider = registry.get(flags.provider);
+        if (!provider) {
+            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
+        }
+        if (!provider.list) {
+            this.error(`Provider "${flags.provider}" does not support list.`, { exit: 1 });
+        }
+        const available = await provider.isAvailable();
+        if (!available) {
+            this.error(`Provider "${flags.provider}" is not available.`, { exit: 1 });
+        }
+        const refs = await provider.list();
+        if (refs.length === 0) {
+            this.log("(no entries)");
+            return;
+        }
+        for (const r of refs) {
+            this.log(`  ${r.key}`);
+        }
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/config/secrets/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,MAAM,CAAC,OAAO,GAAG,kDAAkD,CAAC;IAEpE,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,qBAAqB,cAAc,GAAG;YACnD,QAAQ,EAAE,IAAI;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC"}

package/dist/commands/config/secrets/providers/doctor.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsProvidersDoctor extends Command {
+    static summary: string;
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/config/secrets/providers/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/providers/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAMtC,MAAM,CAAC,OAAO,OAAO,4BAA6B,SAAQ,OAAO;IAC/D,MAAM,CAAC,OAAO,SAAgD;IAE9D,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B3B"}

package/dist/commands/config/secrets/providers/doctor.js

@@ -0,0 +1,40 @@
+import { Command } from "@oclif/core";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../../lib/secrets-config.js";
+import { loadConfigForDisplay } from "../../../../lib/system-config-cli.js";
+import { createDefaultSecretBroker } from "@executioncontrolprotocol/runtime";
+export default class ConfigSecretsProvidersDoctor extends Command {
+    static summary = "Run health checks for each secret provider";
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsProvidersDoctor);
+        const cwd = process.cwd();
+        const { config } = loadConfigForDisplay({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
+        const { registry } = createDefaultSecretBroker({
+            policy: resolveSecretPolicyFromConfig(config),
+            dotenvPath,
+            cwd,
+        });
+        let failed = false;
+        for (const { provider } of registry.list()) {
+            const h = await provider.healthCheck();
+            const line = `${provider.id}: ${h.ok ? "ok" : "FAIL"}${h.message ? ` — ${h.message}` : ""}`;
+            if (h.ok) {
+                this.log(line);
+            }
+            else {
+                this.warn(line);
+                failed = true;
+            }
+        }
+        if (failed) {
+            this.exit(1);
+        }
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/config/secrets/providers/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/providers/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,CAAC,OAAO,OAAO,4BAA6B,SAAQ,OAAO;IAC/D,MAAM,CAAC,OAAO,GAAG,4CAA4C,CAAC;IAE9D,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5F,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC"}

package/dist/commands/config/secrets/providers/list.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsProvidersList extends Command {
+    static summary: string;
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/config/secrets/providers/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/providers/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAMtC,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,OAAO;IAC7D,MAAM,CAAC,OAAO,SAAuD;IAErE,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAwB3B"}

package/dist/commands/config/secrets/providers/list.js

@@ -0,0 +1,31 @@
+import { Command } from "@oclif/core";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../../lib/secrets-config.js";
+import { loadConfigForDisplay } from "../../../../lib/system-config-cli.js";
+import { createDefaultSecretBroker } from "@executioncontrolprotocol/runtime";
+export default class ConfigSecretsProvidersList extends Command {
+    static summary = "List registered secret providers and availability";
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsProvidersList);
+        const cwd = process.cwd();
+        const { config } = loadConfigForDisplay({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
+        const { registry } = createDefaultSecretBroker({
+            policy: resolveSecretPolicyFromConfig(config),
+            dotenvPath,
+            cwd,
+        });
+        for (const { provider, source } of registry.list()) {
+            const ok = await provider.isAvailable();
+            const caps = provider.capabilities();
+            this.log(`${provider.id} (${source})  available=${ok}  secureAtRest=${caps.secureAtRest}  ` +
+                `list=${caps.supportsList}  delete=${caps.supportsDelete}`);
+        }
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/config/secrets/providers/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/providers/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,OAAO;IAC7D,MAAM,CAAC,OAAO,GAAG,mDAAmD,CAAC;IAErE,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CACN,GAAG,QAAQ,CAAC,EAAE,KAAK,MAAM,gBAAgB,EAAE,kBAAkB,IAAI,CAAC,YAAY,IAAI;gBAChF,QAAQ,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,cAAc,EAAE,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC"}

package/dist/commands/config/secrets/providers.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsProviders extends Command {
+    static summary: string;
+    run(): Promise<void>;
+}
+//# sourceMappingURL=providers.d.ts.map

package/dist/commands/config/secrets/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,OAAO;IACzD,MAAM,CAAC,OAAO,SAA8B;IAEtC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ3B"}

package/dist/commands/config/secrets/providers.js

@@ -0,0 +1,9 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsProviders extends Command {
+    static summary = "Inspect secret providers";
+    async run() {
+        await this.parse(ConfigSecretsProviders);
+        this.log(["Usage: ecp config secrets providers <subcommand>", "", "  list    Show providers and availability", "  doctor  Health check each provider", ""].join("\n"));
+    }
+}
+//# sourceMappingURL=providers.js.map

package/dist/commands/config/secrets/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,OAAO;IACzD,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC;IAE5C,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CACN,CAAC,kDAAkD,EAAE,EAAE,EAAE,2CAA2C,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC,IAAI,CACpJ,IAAI,CACL,CACF,CAAC;IACJ,CAAC"}

package/dist/commands/config/secrets/remove.d.ts

@@ -0,0 +1,12 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsRemove extends Command {
+    static summary: string;
+    static flags: {
+        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=remove.d.ts.map

package/dist/commands/config/secrets/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAW7C,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,OAAO;IACtD,MAAM,CAAC,OAAO,SAA4B;IAE1C,MAAM,CAAC,KAAK;;;;;MAYV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B3B"}

package/dist/commands/config/secrets/remove.js

@@ -0,0 +1,51 @@
+import { Command, Flags } from "@oclif/core";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
+import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
+import { canonicalSecretKeyForBinding, createDefaultSecretBroker, secretRefIdFromLogicalKey, } from "@executioncontrolprotocol/runtime";
+export default class ConfigSecretsRemove extends Command {
+    static summary = "Remove a stored secret";
+    static flags = {
+        ...configScopeFlags,
+        provider: Flags.string({
+            char: "p",
+            description: "Provider id",
+            required: true,
+        }),
+        key: Flags.string({
+            char: "k",
+            description: `Lookup key (same form as add)`,
+            required: true,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsRemove);
+        const cwd = process.cwd();
+        const { config } = loadConfigForDisplay({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
+        const { registry } = createDefaultSecretBroker({
+            policy: resolveSecretPolicyFromConfig(config),
+            dotenvPath,
+            cwd,
+        });
+        const provider = registry.get(flags.provider);
+        if (!provider) {
+            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
+        }
+        if (!provider.delete) {
+            this.error(`Provider "${flags.provider}" does not support remove.`, { exit: 1 });
+        }
+        const ref = {
+            id: secretRefIdFromLogicalKey(flags.key),
+            provider: flags.provider,
+            key: canonicalSecretKeyForBinding(flags.key),
+        };
+        await provider.delete(ref);
+        this.log(`Removed secret for provider "${flags.provider}" key "${flags.key}".`);
+    }
+}
+//# sourceMappingURL=remove.js.map

package/dist/commands/config/secrets/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAG3C,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,OAAO;IACtD,MAAM,CAAC,OAAO,GAAG,wBAAwB,CAAC;IAE1C,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,aAAa;YAC1B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,IAAI;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,GAAG,GAAc;YACrB,EAAE,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAI,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAS;YACzB,GAAG,EAAE,4BAA4B,CAAC,KAAK,CAAC,GAAI,CAAC;SAC9C,CAAC;QACF,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAClF,CAAC"}

package/dist/commands/config/secrets/yaml/get.d.ts

@@ -0,0 +1,11 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsYamlGet extends Command {
+    static summary: string;
+    static flags: {
+        format: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/config/secrets/yaml/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/yaml/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAY7C,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,OAAO;IACvD,MAAM,CAAC,OAAO,SAAgE;IAE9E,MAAM,CAAC,KAAK;;;;MAOV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoB3B"}

package/dist/commands/config/secrets/yaml/get.js

@@ -0,0 +1,35 @@
+import { Command, Flags } from "@oclif/core";
+import { getSecurityConfig, stringifySystemConfig, } from "@executioncontrolprotocol/runtime";
+import { formatConfigFileHeaderLine, runWithCommandError } from "../../../../lib/command-helpers.js";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { loadConfigForDisplay } from "../../../../lib/system-config-cli.js";
+export default class ConfigSecretsYamlGet extends Command {
+    static summary = "Print top-level secrets.* and security.secrets (YAML/JSON)";
+    static flags = {
+        ...configScopeFlags,
+        format: Flags.string({
+            description: "Serialization format",
+            options: ["yaml", "json"],
+            default: "yaml",
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigSecretsYamlGet);
+        const cwd = process.cwd();
+        await runWithCommandError(this, async () => {
+            const { path, exists, config } = loadConfigForDisplay({
+                global: flags.global,
+                cwd,
+                explicit: flags.config,
+            });
+            this.log(formatConfigFileHeaderLine(path, exists));
+            const slice = {
+                secrets: config.secrets,
+                security: { secrets: getSecurityConfig(config)?.secrets },
+            };
+            const fmt = flags.format;
+            this.log(stringifySystemConfig(slice, fmt).trim());
+        });
+    }
+}
+//# sourceMappingURL=get.js.map

package/dist/commands/config/secrets/yaml/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/yaml/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,OAAO;IACvD,MAAM,CAAC,OAAO,GAAG,4DAA4D,CAAC;IAE9E,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,sBAAsB;YACnC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU;YAClC,OAAO,EAAE,MAAM;SAChB,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1B,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;gBACpD,MAAM,EAAE,KAAK,CAAC,MAAiB;gBAC/B,GAAG;gBACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,KAAK,GAAoB;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE;aAC1D,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC"}

package/dist/commands/config/secrets/yaml/set-default-provider.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigSecretsYamlSetDefaultProvider extends Command {
+    static summary: string;
+    static args: {
+        provider: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=set-default-provider.d.ts.map

package/dist/commands/config/secrets/yaml/set-default-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-default-provider.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/yaml/set-default-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAK5C,MAAM,CAAC,OAAO,OAAO,mCAAoC,SAAQ,OAAO;IACtE,MAAM,CAAC,OAAO,SAAiC;IAE/C,MAAM,CAAC,IAAI;;MAET;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAe3B"}

package/dist/commands/config/secrets/yaml/set-default-provider.js

@@ -0,0 +1,24 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { persistConfig, readForMutation } from "../../../../lib/system-config-cli.js";
+export default class ConfigSecretsYamlSetDefaultProvider extends Command {
+    static summary = "Set secrets.defaultProvider";
+    static args = {
+        provider: Args.string({ required: true, description: "Provider id (e.g. os.secrets, dot.env)" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigSecretsYamlSetDefaultProvider);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        config.secrets ??= {};
+        config.secrets.defaultProvider = args.provider;
+        persistConfig(path, config);
+        this.log(`Set secrets.defaultProvider = ${args.provider} (${path})`);
+    }
+}
+//# sourceMappingURL=set-default-provider.js.map

package/dist/commands/config/secrets/yaml/set-default-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-default-provider.js","sourceRoot":"","sources":["../../../../../src/commands/config/secrets/yaml/set-default-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAEtF,MAAM,CAAC,OAAO,OAAO,mCAAoC,SAAQ,OAAO;IACtE,MAAM,CAAC,OAAO,GAAG,6BAA6B,CAAC;IAE/C,MAAM,CAAC,IAAI,GAAG;QACZ,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;KACjG,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAC;IACvE,CAAC"}