@executioncontrolprotocol/cli 0.4.2 → 0.10.0

package/README.md

@@ -1,77 +1,97 @@
-# `@executioncontrolprotocol/cli`
+# @executioncontrolprotocol/cli
 
-**Execution Control Protocol (ECP)** specifies portable **Context** manifests for agent orchestration: structured inputs and outputs, tool boundaries, per-executor policies, and host-level enforcement via system config—so runs stay least-privilege and auditable.
+ECP command-line interface for running **workflows** (`@executioncontrolprotocol.workflow`) in configured
+**environments** (runtime + extensions + policies).
 
-**Learn more:** [executioncontrolprotocol.io](https://executioncontrolprotocol.io)
+This CLI is how you run ECP deterministically in a Node.js / TypeScript ecosystem:
 
-This package is the **command-line interface** for validating and running Contexts.
+- Compile workflow source modules (`.ts` / `.js`) to portable JSON manifests
+- Validate workflows against an environment’s registered capabilities
+- Describe/search environment capabilities for agent/UI discovery
+- Run workflows and print structured run results
+- Encode/decode workflows using format extensions (TOON, Fluent, JSON)
+
+For the architecture and monorepo package boundaries, start with
+[`AGENTS.md`](../../AGENTS.md) and [`ecp-overhaul.md`](../../ecp-overhaul.md).
 
 ## Install
 
-```bash
+From npm (when published):
+
+```sh
 npm install -g @executioncontrolprotocol/cli
 ```
 
+From this monorepo (recommended for development):
+
+```sh
+npm install
+npm run build
+cd packages/cli
+npm link
+```
+
 ## Usage
 
-```bash
-ecp --help
-ecp validate path/to/context.yaml
-ecp run path/to/context.yaml -i topic="Hello"
+All operational commands that need an environment accept:
+
+- `--env <path>`: a module that exports the environment builder (`default export`)
+
+### Run
+
+```sh
+ecp run examples/01-echo/workflow.ts --env examples/01-echo/environment.ts
 ```
 
-### System config (`ecp.config.yaml` / `~/.ecp/config.yaml`)
-
-**v0.5 layout:** use top-level **`security`** for allow-lists and defaults (mirrors `models`, `tools`, `loggers`, …). Wiring lives under **`models.providers`**, **`tools.servers`**, **`loggers.config`**, **`agents.endpoints`**, **`plugins.installs`**, **`secrets`**. Set **`version: "0.5"`**.
-
-```bash
-ecp config --help
-ecp config init                    # best-practices starter in current directory
-ecp config init --global          # ~/.ecp/config.yaml
-ecp config path                    # resolved file path (use --for-write for mutation target)
-ecp config get --format json
-ecp config security get
-ecp config plugins get             # plugins.installs + security.plugins summary
-ecp config models get
-ecp config tools get
-ecp config loggers get
-ecp config secrets yaml get
+Provide workflow input (JSON file):
+
+```sh
+ecp run workflow.json --env environment.ts --input input.json
 ```
 
-`ecp run` accepts `--logger` / `-l` (e.g. `file`) to enable logger **plugins** (`kind: logger`); defaults and allow-lists are under **`security.loggers`**, per-logger options under **`loggers.config`**.
+Dry run (validate + plan without invoking capabilities):
 
-YAML and JSON are supported; defaults are searched in order: `./ecp.config.yaml`, `./ecp.config.json`, then `~/.ecp/`.
+```sh
+ecp run workflow.ts --env environment.ts --dry-run
+```
 
-## Secrets and environment files
+### Validate
 
-ECP separates **where** a secret is loaded from using **provider ids** in `tools.servers.<name>.credentials.bindings[].source`:
+```sh
+ecp validate examples/01-echo/workflow.ts --env examples/01-echo/environment.ts
+```
 
-| Provider id   | Meaning                                                                                                                                                                                                      |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `process.env` | Read from the current process environment (`process.env[<key>]`).                                                                                                                                            |
-| `dot.env`     | Read from a `.env`-style file on disk (path from config or `--environment`).                                                                                                                                 |
-| `os.secrets`  | Read from the OS credential manager / keychain; stored under an `ecp://<key>` target (same as default `SecretRef.id`; provider is only in `source.provider`, e.g. `os.secrets.MY_KEY` as shorthand in docs). |
+### Compile (portable JSON)
 
-Bindings use **plain keys** (e.g. `GITHUB_PAT`, `server/fetch.token`) in `source.key`. Values are never stored in Context YAML—only references.
+```sh
+ecp compile examples/01-echo/workflow.ts -o dist/workflow.json
+```
 
-### `ecp config secrets`
+### Describe / search environment capabilities
 
-Use **`os.secrets`** for durable storage (e.g. `ecp config secrets add --provider os.secrets --key myapp/token --prompt`). The `ecp config` commands do **not** support `--environment`; they resolve `dot.env` only from `ecp.config.*` (`secrets.providers.dot.env.path`).
+```sh
+ecp describe --env examples/01-echo/environment.ts
+ecp search "echo" --env examples/01-echo/environment.ts
+```
 
-### `--environment` (runtime commands only)
+### Encode / decode formats
 
-On **`ecp run`**, **`ecp validate`**, **`ecp trace`**, **`ecp trace list`**, and **`ecp graph`**, you can pass:
+Encoding and decoding uses **format extensions** bound in your environment.
 
-```bash
-ecp run context.yaml --environment ./.env.local
+```sh
+ecp encode workflow.json --format toon --env environment.ts -o workflow.toon
+ecp encode workflow.json --format fluent --env environment.ts -o workflow.generated.ts
+ecp decode workflow.toon --format toon --env environment.ts -o workflow.json
 ```
 
-This sets the **file** used by the **`dot.env`** provider for that process. It **does not** merge variables into `process.env`; use `source.provider: process.env` only for variables already in the shell/CI environment, and `source.provider: dot.env` for file-backed values.
+Notes:
 
-If both `--environment` and `secrets.providers.dot.env.path` are set, **`--environment` wins** for that command. If the path does not exist, the CLI exits with an error.
+- Fluent **decode** is not supported. Use `ecp compile` for TypeScript/Fluent source → manifest.
+- JSON is the canonical manifest format; other formats are optional extensions.
 
-## Links
+## Related packages
 
-- **Docs**: [executioncontrolprotocol.io](https://executioncontrolprotocol.io)
-- **Repo**: `https://github.com/executioncontrolprotocol/executioncontrolprotocol`
-- **Issues**: `https://github.com/executioncontrolprotocol/executioncontrolprotocol/issues`
+- [`@executioncontrolprotocol/core`](../core/README.md): runtime-agnostic core + fluent API
+- [`@executioncontrolprotocol/node`](../runtimes/node/README.md): Node runtime host used by CLI examples
+- [`@executioncontrolprotocol/types`](../types/README.md): protocol types + generated JSON Schemas
+- [`@executioncontrolprotocol/mcp`](../mcp/): MCP server adapter exposing an environment to agents

package/bin/dev.js

@@ -1,8 +1,7 @@
-#!/usr/bin/env -S node --loader ts-node/esm --disable-warning=ExperimentalWarning
+#!/usr/bin/env node
 
-import {execute} from '@oclif/core'
+import { execute } from "@oclif/core"
 
-// Suppress Node deprecation warnings (e.g. punycode -> DEP0040) so CLI output stays clean.
-process.noDeprecation = true;
+process.noDeprecation = true
 
-await execute({development: true, dir: import.meta.url})
+await execute({ development: true, dir: import.meta.url })

package/bin/ecp.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+import { execute } from "@oclif/core"
+
+process.noDeprecation = true
+
+await execute({ dir: import.meta.url })

package/bin/run.cmd

@@ -1,3 +1,3 @@
 @echo off
 
-node "%~dp0\run" %*
+node "%~dp0\ecp.js" %*

package/bin/run.js

@@ -1,8 +1,4 @@
 #!/usr/bin/env node
 
-import {execute} from '@oclif/core'
-
-// Suppress Node deprecation warnings (e.g. punycode -> DEP0040) so CLI output stays clean.
-process.noDeprecation = true;
-
-await execute({dir: import.meta.url})
+/** @deprecated Use `ecp.js`; kept for tests and `run.cmd`. */
+import "./ecp.js"

package/dist/commands/compile.d.ts

@@ -0,0 +1,15 @@
+import { Command } from "@oclif/core";
+/** Compile a workflow source file to a portable JSON manifest. */
+export default class Compile extends Command {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static args: {
+        "workflow-path": import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=compile.d.ts.map

package/dist/commands/compile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../src/commands/compile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAA;AAKlD,kEAAkE;AAClE,MAAM,CAAC,OAAO,OAAO,OAAQ,SAAQ,OAAO;IAC1C,MAAM,CAAC,OAAO,SAA+B;IAE7C,MAAM,CAAC,WAAW,SACoF;IAEtG,MAAM,CAAC,QAAQ,WAGd;IAED,MAAM,CAAC,KAAK;;MAMX;IAED,MAAM,CAAC,IAAI;;MAKV;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAe3B"}

package/dist/commands/compile.js

@@ -0,0 +1,44 @@
+import { Args, Command, Flags } from "@oclif/core";
+import { compileWorkflowSource } from "@executioncontrolprotocol/core/compile";
+import { readFile, writeFile } from "node:fs/promises";
+import { runWithCommandError } from "../lib/command-helpers.js";
+/** Compile a workflow source file to a portable JSON manifest. */
+export default class Compile extends Command {
+    static summary = "Compile a workflow to JSON";
+    static description = "Bundle and evaluate a workflow module (.ts or .js), or load .json, and emit the workflow manifest.";
+    static examples = [
+        "<%= config.bin %> <%= command.id %> examples/01-echo/workflow.ts",
+        "<%= config.bin %> <%= command.id %> examples/01-echo/workflow.ts -o dist/workflow.json",
+    ];
+    static flags = {
+        ...Command.baseFlags,
+        output: Flags.string({
+            char: "o",
+            description: "Write manifest JSON to this file (stdout if omitted)",
+        }),
+    };
+    static args = {
+        "workflow-path": Args.string({
+            required: true,
+            description: "Workflow file (.ts, .js, or .json)",
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(Compile);
+        await runWithCommandError(this, async () => {
+            const input = args["workflow-path"];
+            const source = await readFile(input, "utf8");
+            const result = await compileWorkflowSource({ source, filename: input });
+            if (!result.ok) {
+                this.log(JSON.stringify(result, null, 2));
+                this.exit(1);
+            }
+            const json = JSON.stringify(result.manifest, null, 2);
+            if (flags.output)
+                await writeFile(flags.output, json, "utf8");
+            else
+                this.log(json);
+        });
+    }
+}
+//# sourceMappingURL=compile.js.map

package/dist/commands/compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/commands/compile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAA;AAC9E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAE/D,kEAAkE;AAClE,MAAM,CAAC,OAAO,OAAO,OAAQ,SAAQ,OAAO;IAC1C,MAAM,CAAC,OAAO,GAAG,4BAA4B,CAAA;IAE7C,MAAM,CAAC,WAAW,GAChB,oGAAoG,CAAA;IAEtG,MAAM,CAAC,QAAQ,GAAG;QAChB,kEAAkE;QAClE,wFAAwF;KACzF,CAAA;IAED,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,OAAO,CAAC,SAAS;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,sDAAsD;SACpE,CAAC;KACH,CAAA;IAED,MAAM,CAAC,IAAI,GAAG;QACZ,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;YAC3B,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,oCAAoC;SAClD,CAAC;KACH,CAAA;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACvE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YACrD,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;;gBACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC,CAAC,CAAA;IACJ,CAAC"}

package/dist/commands/config/secrets/add.d.ts

@@ -1,13 +1,14 @@
 import { Command } from "@oclif/core";
+/** Store an OS keychain secret. */
 export default class ConfigSecretsAdd extends Command {
     static summary: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        key: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
     static flags: {
-        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         value: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        prompt: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/config/secrets/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAgB7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,SAAoE;IAElF,MAAM,CAAC,KAAK;;;;;;;MAoBV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAuD3B"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAA;AAUlD,mCAAmC;AACnC,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,SAA+C;IAE7D,MAAM,CAAC,WAAW,SACsF;IAExG,MAAM,CAAC,QAAQ,WAGd;IAED,MAAM,CAAC,IAAI;;MAKV;IAED,MAAM,CAAC,KAAK;;MAKX;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B3B"}

package/dist/commands/config/secrets/add.js

@@ -1,84 +1,51 @@
-import { Command, Flags } from "@oclif/core";
+import { Args, Command, Flags } from "@oclif/core";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
-import { configScopeFlags } from "../../../lib/config-flags.js";
-import { OS_PROVIDER_ID } from "../../../lib/secret-provider-ids.js";
-import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
-import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
-import { canonicalSecretKeyForBinding, createDefaultSecretBroker, ECP_SECRET_REF_PROTOCOL_PREFIX, secretRefIdFromLogicalKey, } from "@executioncontrolprotocol/runtime";
+import { canonicalSecretKey, ECP_SECRET_REF_PROTOCOL_PREFIX, secretRefIdFromLogicalKey, } from "@executioncontrolprotocol/secrets";
+import { getCliSecretsStore } from "../../../lib/secrets/store.js";
+/** Store an OS keychain secret. */
 export default class ConfigSecretsAdd extends Command {
-    static summary = `Add or replace a secret in a provider (e.g. ${OS_PROVIDER_ID})`;
-    static flags = {
-        ...configScopeFlags,
-        provider: Flags.string({
-            char: "p",
-            description: `Provider id (e.g. ${OS_PROVIDER_ID})`,
-            required: true,
-        }),
-        key: Flags.string({
-            char: "k",
-            description: `Secret lookup key (e.g. GITHUB_API_KEY or server/fetch.token; ref id is ${ECP_SECRET_REF_PROTOCOL_PREFIX}<key>)`,
+    static summary = "Add or replace a secret in the OS keychain";
+    static description = "Prompts interactively for the secret value by default. Use --value for non-interactive inline input.";
+    static examples = [
+        "<%= config.bin %> <%= command.id %> server/fetch.token",
+        "<%= config.bin %> <%= command.id %> GITHUB_API_KEY --value ghp_xxx",
+    ];
+    static args = {
+        key: Args.string({
             required: true,
+            description: `Secret lookup key (ref id is ${ECP_SECRET_REF_PROTOCOL_PREFIX}<key>)`,
         }),
+    };
+    static flags = {
         value: Flags.string({
             char: "v",
-            description: "Secret value (avoid in shell history; prefer --prompt)",
-        }),
-        prompt: Flags.boolean({
-            description: "Read secret from stdin interactively (masked input not supported on all terminals)",
+            description: "Secret value inline (non-interactive; avoid in shell history)",
         }),
     };
     async run() {
-        const { flags } = await this.parse(ConfigSecretsAdd);
-        if (flags.value && flags.prompt) {
-            this.error("Use only one of --value or --prompt.", { exit: 1 });
-        }
-        if (!flags.value && !flags.prompt) {
-            this.error("Provide --value or --prompt.", { exit: 1 });
-        }
-        const cwd = process.cwd();
-        const { config } = loadConfigForDisplay({
-            global: flags.global,
-            cwd,
-            explicit: flags.config,
-        });
-        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
-        const { registry } = createDefaultSecretBroker({
-            policy: resolveSecretPolicyFromConfig(config),
-            dotenvPath,
-            cwd,
-        });
-        const provider = registry.get(flags.provider);
-        if (!provider) {
-            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
-        }
-        if (!provider.store) {
-            this.error(`Provider "${flags.provider}" does not support store (read-only).`, { exit: 1 });
-        }
-        const available = await provider.isAvailable();
+        const { args, flags } = await this.parse(ConfigSecretsAdd);
+        const store = getCliSecretsStore();
+        const available = await store.isAvailable();
         if (!available) {
-            this.error(`Provider "${flags.provider}" is not available on this system.`, { exit: 1 });
+            this.error("OS keychain is not available on this system.", { exit: 1 });
         }
-        let value = flags.value ?? "";
-        if (flags.prompt) {
+        let value = flags.value;
+        if (value === undefined) {
             const rl = createInterface({ input, output });
             try {
-                value = (await rl.question("Secret value: ")).trim();
+                value = (await rl.question("Paste secret value: ")).trim();
             }
             finally {
-                await rl.close();
+                rl.close();
+            }
+            if (!value) {
+                this.error("Secret value cannot be empty.", { exit: 1 });
             }
         }
-        if (!value) {
-            this.error("Empty secret.", { exit: 1 });
-        }
-        const ref = {
-            id: secretRefIdFromLogicalKey(flags.key),
-            provider: flags.provider,
-            key: canonicalSecretKeyForBinding(flags.key),
-        };
-        await provider.store({ ref, value });
-        this.log(`Stored secret for provider "${flags.provider}" key "${flags.key}".`);
+        const key = canonicalSecretKey(args.key);
+        await store.set(key, value);
+        this.log(`Stored secret "${key}" (${secretRefIdFromLogicalKey(key)}).`);
     }
 }
 //# sourceMappingURL=add.js.map

package/dist/commands/config/secrets/add.js.map

@@ -1 +1 @@
-{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAG3C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,GAAG,+CAA+C,cAAc,GAAG,CAAC;IAElF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,qBAAqB,cAAc,GAAG;YACnD,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EACT,2EAA2E,8BAA8B,QAAQ;YACnH,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,wDAAwD;SACtE,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,oFAAoF;SAClG,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,uCAAuC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,oCAAoC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAc;YACrB,EAAE,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAI,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAS;YACzB,GAAG,EAAE,4BAA4B,CAAC,KAAK,CAAC,GAAI,CAAC;SAC9C,CAAC;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACjF,CAAC"}
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,cAAc,CAAA;AAC/D,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,mCAAmC;AACnC,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,GAAG,4CAA4C,CAAA;IAE7D,MAAM,CAAC,WAAW,GAChB,sGAAsG,CAAA;IAExG,MAAM,CAAC,QAAQ,GAAG;QAChB,wDAAwD;QACxD,oEAAoE;KACrE,CAAA;IAED,MAAM,CAAC,IAAI,GAAG;QACZ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACf,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,gCAAgC,8BAA8B,QAAQ;SACpF,CAAC;KACH,CAAA;IAED,MAAM,CAAC,KAAK,GAAG;QACb,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,+DAA+D;SAC7E,CAAC;KACH,CAAA;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAE1D,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAA;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7C,IAAI,CAAC;gBACH,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5D,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAA;YACZ,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC"}

package/dist/commands/config/secrets/get.d.ts

@@ -1,12 +1,12 @@
 import { Command } from "@oclif/core";
+/** Read an OS keychain secret. */
 export default class ConfigSecretsGet extends Command {
     static summary: string;
+    static args: {
+        key: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
     static flags: {
-        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        show: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        reveal: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/config/secrets/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAY7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,SAAyC;IAEvD,MAAM,CAAC,KAAK;;;;;;MAeV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAwC3B"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAA;AAQlD,kCAAkC;AAClC,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,SAAwC;IAEtD,MAAM,CAAC,IAAI;;MAKV;IAED,MAAM,CAAC,KAAK;;MAIX;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoB3B"}

package/dist/commands/config/secrets/get.js

@@ -1,63 +1,38 @@
-import { Command, Flags } from "@oclif/core";
-import { configScopeFlags } from "../../../lib/config-flags.js";
-import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
-import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
-import { canonicalSecretKeyForBinding, createDefaultSecretBroker, ECP_SECRET_REF_PROTOCOL_PREFIX, secretRefIdFromLogicalKey, } from "@executioncontrolprotocol/runtime";
+import { Args, Command, Flags } from "@oclif/core";
+import { canonicalSecretKey, ECP_SECRET_REF_PROTOCOL_PREFIX, redactSecret, } from "@executioncontrolprotocol/secrets";
+import { getCliSecretsStore } from "../../../lib/secrets/store.js";
+/** Read an OS keychain secret. */
 export default class ConfigSecretsGet extends Command {
     static summary = "Read a secret (redacted by default)";
-    static flags = {
-        ...configScopeFlags,
-        provider: Flags.string({
-            char: "p",
-            description: "Provider id",
-            required: true,
-        }),
-        key: Flags.string({
-            char: "k",
-            description: `Lookup key (same form as add; ref id is ${ECP_SECRET_REF_PROTOCOL_PREFIX}<key>)`,
+    static args = {
+        key: Args.string({
             required: true,
+            description: `Lookup key (ref id is ${ECP_SECRET_REF_PROTOCOL_PREFIX}<key>)`,
         }),
-        show: Flags.boolean({
+    };
+    static flags = {
+        reveal: Flags.boolean({
             description: "Print full value (writes to stdout — avoid logs)",
         }),
     };
     async run() {
-        const { flags } = await this.parse(ConfigSecretsGet);
-        const cwd = process.cwd();
-        const { config } = loadConfigForDisplay({
-            global: flags.global,
-            cwd,
-            explicit: flags.config,
-        });
-        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
-        const { registry } = createDefaultSecretBroker({
-            policy: resolveSecretPolicyFromConfig(config),
-            dotenvPath,
-            cwd,
-        });
-        const provider = registry.get(flags.provider);
-        if (!provider) {
-            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
-        }
-        const available = await provider.isAvailable();
+        const { args, flags } = await this.parse(ConfigSecretsGet);
+        const store = getCliSecretsStore();
+        const available = await store.isAvailable();
         if (!available) {
-            this.error(`Provider "${flags.provider}" is not available.`, { exit: 1 });
+            this.error("OS keychain is not available on this system.", { exit: 1 });
         }
-        const ref = {
-            id: secretRefIdFromLogicalKey(flags.key),
-            provider: flags.provider,
-            key: canonicalSecretKeyForBinding(flags.key),
-        };
-        const result = await provider.load(ref);
-        if (!result) {
-            this.error(`No secret for key "${flags.key}".`, { exit: 1 });
+        const key = canonicalSecretKey(args.key);
+        const value = await store.get(key);
+        if (value == null) {
+            this.error(`No secret for key "${key}".`, { exit: 1 });
         }
-        if (flags.show) {
+        if (flags.reveal) {
             this.warn("Printing full secret to stdout — ensure this is not logged or captured.");
-            this.log(result.value);
+            this.log(value);
         }
         else {
-            this.log(result.redactedPreview);
+            this.log(redactSecret(value));
         }
     }
 }

package/dist/commands/config/secrets/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAG3C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,GAAG,qCAAqC,CAAC;IAEvD,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,aAAa;YAC1B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2CAA2C,8BAA8B,QAAQ;YAC9F,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,kDAAkD;SAChE,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,6BAA6B,CAAC,MAAM,CAAC;YAC7C,UAAU;YACV,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,GAAG,GAAc;YACrB,EAAE,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAI,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAS;YACzB,GAAG,EAAE,4BAA4B,CAAC,KAAK,CAAC,GAAI,CAAC;SAC9C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YACrF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;IACH,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/commands/config/secrets/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC9B,YAAY,GACb,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,kCAAkC;AAClC,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,MAAM,CAAC,OAAO,GAAG,qCAAqC,CAAA;IAEtD,MAAM,CAAC,IAAI,GAAG;QACZ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACf,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,yBAAyB,8BAA8B,QAAQ;SAC7E,CAAC;KACH,CAAA;IAED,MAAM,CAAC,KAAK,GAAG;QACb,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,kDAAkD;SAChE,CAAC;KACH,CAAA;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAA;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,sBAAsB,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;YACpF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC"}

package/dist/commands/config/secrets/list.d.ts

@@ -1,11 +1,7 @@
 import { Command } from "@oclif/core";
+/** List OS keychain secret keys. */
 export default class ConfigSecretsList extends Command {
     static summary: string;
-    static flags: {
-        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
     run(): Promise<void>;
 }
 //# sourceMappingURL=list.d.ts.map

package/dist/commands/config/secrets/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAO7C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,MAAM,CAAC,OAAO,SAAsD;IAEpE,MAAM,CAAC,KAAK;;;;MAOV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoC3B"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/secrets/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAGrC,oCAAoC;AACpC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,MAAM,CAAC,OAAO,SAAwC;IAEhD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB3B"}

package/dist/commands/config/secrets/list.js

@@ -1,51 +1,21 @@
-import { Command, Flags } from "@oclif/core";
-import { configScopeFlags } from "../../../lib/config-flags.js";
-import { OS_PROVIDER_ID } from "../../../lib/secret-provider-ids.js";
-import { resolveDotenvPathFromConfig, resolveSecretPolicyFromConfig } from "../../../lib/secrets-config.js";
-import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
-import { createDefaultSecretBroker } from "@executioncontrolprotocol/runtime";
+import { Command } from "@oclif/core";
+import { getCliSecretsStore } from "../../../lib/secrets/store.js";
+/** List OS keychain secret keys. */
 export default class ConfigSecretsList extends Command {
-    static summary = "List secret keys for a provider (when supported)";
-    static flags = {
-        ...configScopeFlags,
-        provider: Flags.string({
-            char: "p",
-            description: `Provider id (e.g. ${OS_PROVIDER_ID})`,
-            required: true,
-        }),
-    };
+    static summary = "List secret keys in the OS keychain";
     async run() {
-        const { flags } = await this.parse(ConfigSecretsList);
-        const cwd = process.cwd();
-        const { config } = loadConfigForDisplay({
-            global: flags.global,
-            cwd,
-            explicit: flags.config,
-        });
-        const dotenvPath = resolveDotenvPathFromConfig(cwd, config);
-        const { registry } = createDefaultSecretBroker({
-            policy: resolveSecretPolicyFromConfig(config),
-            dotenvPath,
-            cwd,
-        });
-        const provider = registry.get(flags.provider);
-        if (!provider) {
-            this.error(`Unknown provider "${flags.provider}".`, { exit: 1 });
-        }
-        if (!provider.list) {
-            this.error(`Provider "${flags.provider}" does not support list.`, { exit: 1 });
-        }
-        const available = await provider.isAvailable();
+        const store = getCliSecretsStore();
+        const available = await store.isAvailable();
         if (!available) {
-            this.error(`Provider "${flags.provider}" is not available.`, { exit: 1 });
+            this.error("OS keychain is not available on this system.", { exit: 1 });
         }
-        const refs = await provider.list();
-        if (refs.length === 0) {
+        const keys = await store.list();
+        if (keys.length === 0) {
             this.log("(no entries)");
             return;
         }
-        for (const r of refs) {
-            this.log(`  ${r.key}`);
+        for (const key of keys) {
+            this.log(`  ${key}`);
         }
     }
 }