@flowscripter/dynamic-cli-framework 3.0.2 → 4.0.0

package/dist/src/service/plugin/DefaultPluginService.js

@@ -1,7 +1,26 @@
+import { NpmPluginManager, NpmjsPluginRepository, NpmPluginRepository, } from "@flowscripter/dynamic-plugin-framework";
 export default class DefaultPluginService {
+    #defaultRemoteConfig;
+    #defaultLocalConfig;
     #pluginManager;
-    constructor(pluginManager) {
-        this.#pluginManager = pluginManager;
+    constructor(remoteConfig, localConfig) {
+        this.#defaultRemoteConfig = remoteConfig;
+        this.#defaultLocalConfig = localConfig;
+        this.#pluginManager = new NpmPluginManager([new NpmjsPluginRepository(remoteConfig)], new NpmPluginRepository(localConfig));
+    }
+    get pluginManager() {
+        return this.#pluginManager;
+    }
+    async applyKeyValueOverrides(keyValueService) {
+        let remotesConfig = [this.#defaultRemoteConfig];
+        if (await keyValueService.has("remotes-config")) {
+            remotesConfig = (await keyValueService.get("remotes-config"));
+        }
+        let localConfig = this.#defaultLocalConfig;
+        if (await keyValueService.has("local-config")) {
+            localConfig = (await keyValueService.get("local-config"));
+        }
+        this.#pluginManager = new NpmPluginManager(remotesConfig.map((config) => new NpmjsPluginRepository(config)), new NpmPluginRepository(localConfig));
     }
     search(query) {
         return this.#pluginManager.search(query);

package/dist/src/service/plugin/PluginServiceProvider.d.ts

@@ -0,0 +1,17 @@
+import type { ServiceInfo, ServiceProvider } from "@flowscripter/dynamic-cli-framework-api";
+import type { Context } from "@flowscripter/dynamic-cli-framework-api";
+import type { CLIConfig } from "@flowscripter/dynamic-cli-framework-api";
+import type { NpmjsPluginRepositoryConfig, NpmPluginRepositoryConfig } from "@flowscripter/dynamic-plugin-framework";
+import { type SpawnInterfaceAdapterOptions } from "./SpawnInterfaceAdapter.ts";
+import { type FetchInterfaceAdapterOptions } from "./FetchInterfaceAdapter.ts";
+import DefaultCommandRegistry from "../../runtime/registry/DefaultCommandRegistry.ts";
+import DefaultServiceProviderRegistry from "../../runtime/registry/DefaultServiceProviderRegistry.ts";
+export default class PluginServiceProvider implements ServiceProvider {
+    #private;
+    readonly serviceId = "PLUGIN_SERVICE";
+    readonly servicePriority: number;
+    constructor(servicePriority: number, remoteConfig: NpmjsPluginRepositoryConfig, localConfig: NpmPluginRepositoryConfig, commandRegistry: DefaultCommandRegistry, serviceProviderRegistry: DefaultServiceProviderRegistry, spawnInterfaceAdapterOptions?: SpawnInterfaceAdapterOptions, fetchInterfaceAdapterOptions?: FetchInterfaceAdapterOptions);
+    getServiceInfo(cliConfig: CLIConfig): Promise<ServiceInfo>;
+    initService(context: Context): Promise<void>;
+}
+//# sourceMappingURL=PluginServiceProvider.d.ts.map

package/dist/src/service/plugin/PluginServiceProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginServiceProvider.d.ts","sourceRoot":"","sources":["../../../../src/service/plugin/PluginServiceProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWzE,OAAO,KAAK,EAEV,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,wCAAwC,CAAC;AAIhD,OAA8B,EAC5B,KAAK,4BAA4B,EAClC,MAAM,4BAA4B,CAAC;AACpC,OAA8B,EAC5B,KAAK,4BAA4B,EAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,sBAAsB,MAAM,kDAAkD,CAAC;AACtF,OAAO,8BAA8B,MAAM,0DAA0D,CAAC;AAMtG,MAAM,CAAC,OAAO,OAAO,qBAAsB,YAAW,eAAe;;IACnE,QAAQ,CAAC,SAAS,oBAAqB;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;gBAW/B,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,2BAA2B,EACzC,WAAW,EAAE,yBAAyB,EACtC,eAAe,EAAE,sBAAsB,EACvC,uBAAuB,EAAE,8BAA8B,EACvD,4BAA4B,GAAE,4BAAiC,EAC/D,4BAA4B,GAAE,4BAAiC;IAW3D,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAS1D,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAmEnD"}

package/dist/src/service/plugin/PluginServiceProvider.js

@@ -0,0 +1,95 @@
+import { PRINTER_SERVICE_ID, SPAWN_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
+import { FETCH_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
+import { KEY_VALUE_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
+import { DYNAMIC_CLI_FRAMEWORK_COMMAND_FACTORY_EXTENSION_POINT } from "@flowscripter/dynamic-cli-framework-api";
+import { DYNAMIC_CLI_FRAMEWORK_SERVICE_PROVIDER_FACTORY_EXTENSION_POINT } from "@flowscripter/dynamic-cli-framework-api";
+import { PLUGIN_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
+import DefaultPluginService from "./DefaultPluginService.js";
+import { PluginGroupCommand } from "./command/PluginGroupCommand.js";
+import SpawnInterfaceAdapter, {} from "./SpawnInterfaceAdapter.js";
+import FetchInterfaceAdapter, {} from "./FetchInterfaceAdapter.js";
+import DefaultCommandRegistry from "../../runtime/registry/DefaultCommandRegistry.js";
+import DefaultServiceProviderRegistry from "../../runtime/registry/DefaultServiceProviderRegistry.js";
+import getLogger from "../../util/logger.js";
+const logger = getLogger("PluginServiceProvider");
+export default class PluginServiceProvider {
+    serviceId = PLUGIN_SERVICE_ID;
+    servicePriority;
+    #remoteConfig;
+    #localConfig;
+    #commandRegistry;
+    #serviceProviderRegistry;
+    #spawnInterfaceAdapterOptions;
+    #fetchInterfaceAdapterOptions;
+    #pluginService;
+    #cliConfig;
+    constructor(servicePriority, remoteConfig, localConfig, commandRegistry, serviceProviderRegistry, spawnInterfaceAdapterOptions = {}, fetchInterfaceAdapterOptions = {}) {
+        this.servicePriority = servicePriority;
+        this.#remoteConfig = remoteConfig;
+        this.#localConfig = localConfig;
+        this.#commandRegistry = commandRegistry;
+        this.#serviceProviderRegistry = serviceProviderRegistry;
+        this.#spawnInterfaceAdapterOptions = spawnInterfaceAdapterOptions;
+        this.#fetchInterfaceAdapterOptions = fetchInterfaceAdapterOptions;
+    }
+    async getServiceInfo(cliConfig) {
+        this.#cliConfig = cliConfig;
+        this.#pluginService = new DefaultPluginService(this.#remoteConfig, this.#localConfig);
+        return {
+            service: this.#pluginService,
+            commands: [new PluginGroupCommand()],
+        };
+    }
+    async initService(context) {
+        const pluginService = this.#pluginService;
+        if (context.doesServiceExist(KEY_VALUE_SERVICE_ID)) {
+            const keyValueService = context.getServiceById(KEY_VALUE_SERVICE_ID);
+            await pluginService.applyKeyValueOverrides(keyValueService);
+        }
+        const pluginManager = pluginService.pluginManager;
+        if (!context.doesServiceExist(SPAWN_SERVICE_ID)) {
+            logger.debug("SpawnService not available, plugin manager will spawn processes directly");
+        }
+        else if (!("setSpawn" in pluginManager)) {
+            logger.debug("Plugin manager does not support SpawnCapable, skipping spawn injection");
+        }
+        else {
+            const spawnService = context.getServiceById(SPAWN_SERVICE_ID);
+            const printerService = context.getServiceById(PRINTER_SERVICE_ID);
+            const adapter = new SpawnInterfaceAdapter(spawnService, printerService, this.#spawnInterfaceAdapterOptions);
+            pluginManager.setSpawn(adapter);
+        }
+        if (!context.doesServiceExist(FETCH_SERVICE_ID)) {
+            logger.debug("FetchService not available, plugin manager will fetch directly");
+        }
+        else if (!("setFetch" in pluginManager)) {
+            logger.debug("Plugin manager does not support FetchCapable, skipping fetch injection");
+        }
+        else {
+            const fetchService = context.getServiceById(FETCH_SERVICE_ID);
+            const adapter = new FetchInterfaceAdapter(fetchService, this.#fetchInterfaceAdapterOptions);
+            pluginManager.setFetch(adapter);
+        }
+        await pluginManager.registerExtensions(DYNAMIC_CLI_FRAMEWORK_COMMAND_FACTORY_EXTENSION_POINT);
+        await pluginManager.registerExtensions(DYNAMIC_CLI_FRAMEWORK_SERVICE_PROVIDER_FACTORY_EXTENSION_POINT);
+        const commandFactoryExtensions = await pluginManager.getRegisteredExtensions(DYNAMIC_CLI_FRAMEWORK_COMMAND_FACTORY_EXTENSION_POINT);
+        for (const ext of commandFactoryExtensions) {
+            const factory = (await pluginManager.instantiate(ext.extensionHandle));
+            for (const command of factory.getCommands()) {
+                this.#commandRegistry.addCommand(command);
+            }
+        }
+        const spFactoryExtensions = await pluginManager.getRegisteredExtensions(DYNAMIC_CLI_FRAMEWORK_SERVICE_PROVIDER_FACTORY_EXTENSION_POINT);
+        for (const ext of spFactoryExtensions) {
+            const factory = (await pluginManager.instantiate(ext.extensionHandle));
+            for (const sp of factory.getServiceProviders()) {
+                const info = await sp.getServiceInfo(this.#cliConfig);
+                if (info.service) {
+                    context.addServiceInstance(sp.serviceId, info.service);
+                }
+                info.commands.forEach((cmd) => this.#commandRegistry.addCommand(cmd, sp.serviceId));
+                this.#serviceProviderRegistry.addServiceProvider(sp);
+            }
+        }
+    }
+}

package/dist/src/service/upgrade/UpgradeServiceProvider.js

@@ -52,8 +52,8 @@ export default class UpgradeServiceProvider {
             return;
         }
         const keyValueService = context.getServiceById(KEY_VALUE_SERVICE_ID);
-        if (await keyValueService.hasKey("upgrade-status")) {
-            const status = await keyValueService.getKey("upgrade-status");
+        if (await keyValueService.has("upgrade-status")) {
+            const status = await keyValueService.get("upgrade-status");
             if (status === "declined") {
                 logger.debug(() => "Auto-upgrade previously declined, skipping");
                 return;
@@ -97,10 +97,10 @@ export default class UpgradeServiceProvider {
             return;
         }
         if (enableResult.value !== true) {
-            await keyValueService.setKey("upgrade-status", "declined");
+            await keyValueService.set("upgrade-status", "declined");
             return;
         }
-        await keyValueService.setKey("upgrade-status", "enabled");
+        await keyValueService.set("upgrade-status", "enabled");
         await this.#checkAndUpgrade(context, upgradeService, cliConfig);
     }
     async #checkAndUpgrade(context, upgradeService, cliConfig) {

package/index.ts

@@ -187,12 +187,11 @@ export type { ServiceProviderFactory } from "@flowscripter/dynamic-cli-framework
 export { DYNAMIC_CLI_FRAMEWORK_SERVICE_PROVIDER_FACTORY_EXTENSION_POINT } from "@flowscripter/dynamic-cli-framework-api";
 export { PLUGIN_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
 export type { PluginService } from "@flowscripter/dynamic-cli-framework-api";
-export { default as DefaultPluginServiceProvider } from "./src/service/plugin/DefaultPluginServiceProvider.ts";
+export { default as PluginServiceProvider } from "./src/service/plugin/PluginServiceProvider.ts";
 
 // Core CLI
 export { default as BaseCLI } from "./src/cli/BaseCLI.ts";
 export { default as DefaultRuntimeCLI } from "./src/cli/DefaultRuntimeCLI.ts";
-export { default as DynamicPluginRuntimeCLI } from "./src/cli/DynamicPluginRuntimeCLI.ts";
 
 // Terminal API
 export type { default as Terminal } from "./src/terminal/Terminal.ts";
@@ -202,8 +201,4 @@ export { SpecialKey } from "./src/terminal/KeyReader.ts";
 export { default as TtyKeyReader } from "./src/terminal/TtyKeyReader.ts";
 
 // Convenience functions
-export {
-  launchDynamicPluginMultiCommandCLI,
-  launchMultiCommandCLI,
-  launchSingleCommandCLI,
-} from "./src/launcher.ts";
+export { launchMultiCommandCLI, launchSingleCommandCLI } from "./src/launcher.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowscripter/dynamic-cli-framework",
-  "version": "3.0.2",
+  "version": "4.0.0",
   "description": "A framework for developing CLI applications which supports dynamic discovery and installation of new commands",
   "keywords": [
     "bun",
@@ -48,8 +48,8 @@
     "build": "tsc -p tsconfig.build.json"
   },
   "dependencies": {
-    "@flowscripter/dynamic-cli-framework-api": "^1.4.1",
-    "@flowscripter/dynamic-plugin-framework": "1.12.0",
+    "@flowscripter/dynamic-cli-framework-api": "^1.5.0",
+    "@flowscripter/dynamic-plugin-framework": "2.0.0",
     "emphasize": "^7.0.0",
     "fastest-levenshtein": "^1.0.16",
     "figlet": "^1.11.0",

package/src/cli/BaseCLI.ts

@@ -54,6 +54,7 @@ import ImagePrinterServiceProvider from "../service/imagePrinter/ImagePrinterSer
 import SpawnServiceProvider from "../service/spawn/SpawnServiceProvider.ts";
 import FetchServiceProvider from "../service/fetch/FetchServiceProvider.ts";
 import UpgradeServiceProvider from "../service/upgrade/UpgradeServiceProvider.ts";
+import PluginServiceProvider from "../service/plugin/PluginServiceProvider.ts";
 const logger = getLogger("BaseCLI");
 
 /**
@@ -76,6 +77,7 @@ const logger = getLogger("BaseCLI");
  * * {@link FetchServiceProvider}
  * * {@link CompletionServiceProvider}
  * * {@link UpgradeServiceProvider}
+ * * {@link PluginServiceProvider}
  *
  * `keyReader` is optional. If omitted, or if the stderr {@link Terminal} is not a TTY, prompting is
  * unavailable: {@link PrompterServiceProvider} (and {@link ArgumentPrompterServiceProvider}, if
@@ -141,6 +143,9 @@ export default class BaseCLI implements CLI {
       fetchServiceEnabled: false,
       upgradeServiceEnabled: false,
       upgradeLocationsConfig: { supportedPlatforms: [] },
+      pluginServiceEnabled: false,
+      pluginServiceRemoteConfig: { name: "", registryUrl: "", packageJsonNamespace: "" },
+      pluginServiceLocalConfig: { nodeModulesPath: "", packageJsonNamespace: "" },
       validateAllCommands: false,
       promptingEnabled: true,
       ...options,
@@ -292,6 +297,18 @@ export default class BaseCLI implements CLI {
       this.addServiceProvider(new UpgradeServiceProvider(6, this.#options.upgradeLocationsConfig));
     }
 
+    if (this.#options.pluginServiceEnabled) {
+      this.addServiceProvider(
+        new PluginServiceProvider(
+          50,
+          this.#options.pluginServiceRemoteConfig,
+          this.#options.pluginServiceLocalConfig,
+          this.#commandRegistry,
+          this.#serviceProviderRegistry,
+        ),
+      );
+    }
+
     const configurationServiceProvider = new ConfigurationServiceProvider(
       90,
       this.#options.envVarsSupportEnabled,

package/src/cli/BaseCLIFeatureOptions.ts

@@ -1,4 +1,8 @@
 import type { UpgradeLocationsConfig } from "../service/upgrade/UpgradeLocationsConfig.ts";
+import type {
+  NpmjsPluginRepositoryConfig,
+  NpmPluginRepositoryConfig,
+} from "@flowscripter/dynamic-plugin-framework";
 
 export default interface BaseCLIFeatureOptions {
   readonly configFileSupportEnabled?: boolean;
@@ -12,6 +16,9 @@ export default interface BaseCLIFeatureOptions {
   readonly fetchServiceEnabled?: boolean;
   readonly upgradeServiceEnabled?: boolean;
   readonly upgradeLocationsConfig?: UpgradeLocationsConfig;
+  readonly pluginServiceEnabled?: boolean;
+  readonly pluginServiceRemoteConfig?: NpmjsPluginRepositoryConfig;
+  readonly pluginServiceLocalConfig?: NpmPluginRepositoryConfig;
   readonly validateAllCommands?: boolean;
   readonly promptingEnabled?: boolean;
 }

package/src/launcher.ts

@@ -9,8 +9,6 @@ import type {
 } from "@flowscripter/dynamic-cli-framework-api";
 import type BaseCLIFeatureOptions from "./cli/BaseCLIFeatureOptions.ts";
 import DefaultRuntimeCLI from "./cli/DefaultRuntimeCLI.ts";
-import DynamicPluginRuntimeCLI from "./cli/DynamicPluginRuntimeCLI.ts";
-import type { MarketplacePluginManager } from "@flowscripter/dynamic-plugin-framework";
 
 export async function launchSingleCommandCLI(
   command: SubCommand,
@@ -75,36 +73,3 @@ export async function launchMultiCommandCLI(
 
   return await cli.run();
 }
-
-export async function launchDynamicPluginMultiCommandCLI(
-  pluginManager: MarketplacePluginManager,
-  commands: ReadonlyArray<Command>,
-  description?: string,
-  name?: string,
-  version?: string,
-  serviceProviders?: ReadonlyArray<ServiceProvider>,
-  options?: BaseCLIFeatureOptions,
-): Promise<RunResult> {
-  if (!name) {
-    name = path.basename(process.execPath);
-  }
-  const cliConfig: CLIConfig = {
-    description,
-    name,
-    version: version || "N/A",
-  };
-
-  const mergedOptions: BaseCLIFeatureOptions = {
-    ...options,
-    validateAllCommands:
-      (options?.validateAllCommands ?? false) ||
-      process.env.DYNAMIC_CLI_FRAMEWORK_VALIDATE_ALL !== undefined,
-  };
-  const cli = new DynamicPluginRuntimeCLI(cliConfig, pluginManager, mergedOptions);
-
-  commands.forEach((command) => cli.addCommand(command));
-
-  serviceProviders?.forEach((service) => cli.addServiceProvider(service));
-
-  return await cli.run();
-}

package/src/service/completion/CompletionServiceProvider.ts

@@ -61,8 +61,8 @@ export default class CompletionServiceProvider implements ServiceProvider {
     }
 
     const keyValueService = context.getServiceById(KEY_VALUE_SERVICE_ID) as KeyValueService;
-    if (await keyValueService.hasKey("completion-status")) {
-      const status = await keyValueService.getKey("completion-status");
+    if (await keyValueService.has("completion-status")) {
+      const status = await keyValueService.get("completion-status");
       if (status === "installed" || status === "declined") {
         logger.debug(() => `Completion status is '${status}', skipping auto-prompt`);
         return;
@@ -99,7 +99,7 @@ export default class CompletionServiceProvider implements ServiceProvider {
     }
 
     if (enableResult.value !== true) {
-      await keyValueService.setKey("completion-status", "declined");
+      await keyValueService.set("completion-status", "declined");
       return;
     }
 
@@ -131,7 +131,7 @@ export default class CompletionServiceProvider implements ServiceProvider {
 
     try {
       await this.#installCompletion(context, shellType);
-      await keyValueService.setKey("completion-status", "installed");
+      await keyValueService.set("completion-status", "installed");
     } catch (error) {
       if (context.doesServiceExist(PRINTER_SERVICE_ID)) {
         const printerService = context.getServiceById(PRINTER_SERVICE_ID) as PrinterService;

package/src/service/configuration/ConfigurationServiceProvider.ts

@@ -7,6 +7,7 @@ import ConfigCommand from "./command/ConfigCommand.ts";
 import type {
   SingleValueType,
   Values,
+  ValueNode,
   PopulatedValues,
   PopulatedValueType,
 } from "@flowscripter/dynamic-cli-framework-api";
@@ -19,6 +20,7 @@ import {
 } from "@flowscripter/dynamic-cli-framework-api";
 import DefaultKeyValueService from "./DefaultKeyValueService.ts";
 import DefaultSecretService from "./DefaultSecretService.ts";
+import resolveSecrets from "./resolveSecrets.ts";
 import type { Command } from "@flowscripter/dynamic-cli-framework-api";
 import argumentValueMerge from "../../runtime/values/argumentValueMerge.ts";
 import {
@@ -129,13 +131,21 @@ const logger = getLogger("ConfigurationServiceProvider");
  *
  * The second and third level of properties is used to scope the key-values to specific command names
  * (via {@link Command.name} values) and specific service IDs (via {@link ServiceProvider.serviceId} values).
- * Both keys and values are string based.
+ * Keys are strings, but values are arbitrary JSON (see {@link ValueNode}) - not limited to strings -
+ * and may be deep objects or arrays.
  *
- * Values may be stored as OS-native secrets via {@link KeyValueService.setKey} with `isSecret=true`.
- * When a value is stored as a secret, a sentinel value of the format `__SECRET__:<bun_secret_name>`
- * is stored in the config file instead of the actual value. The actual value is stored in the OS
- * credential store via Bun.secrets. The sentinel prefix `__SECRET__:` is reserved and must not be
- * used for regular key-value data.
+ * Any node within a value passed to {@link KeyValueService.set} can be wrapped in {@link Secret} -
+ * at any depth - to have that node, and only that node, stored as an OS-native secret. When a node
+ * is wrapped in {@link Secret}, its value (of any shape) is JSON-serialized and stored as a single
+ * OS-native secret via Bun.secrets, with a sentinel value of the format `__SECRET__:<bun_secret_name>`
+ * substituted in its place in the structure that gets stored in the config file. Everything else in
+ * the value is stored as plain (unencrypted) config data. The sentinel prefix `__SECRET__:` is
+ * reserved and must not be used for regular key-value data.
+ *
+ * Independently of how a value was written, {@link KeyValueService.get} recursively resolves any
+ * string leaf - at any depth within the retrieved value - which starts with the sentinel prefix,
+ * via the OS secret store. This means a secret reference may also be hand-embedded (nested
+ * arbitrarily deep) directly within a plain, non-secret value in the config file.
  *
  * Secret support requires `secretServiceEnabled=true` in the constructor (which also requires
  * `configEnabled=true`).
@@ -150,7 +160,10 @@ const logger = getLogger("ConfigurationServiceProvider");
  *        "commands": {
  *            "command1": {
  *               "foo1": "bar1",
- *               "foo2": "__SECRET__:command_command1_foo2"
+ *               "foo2": "__SECRET__:command_command1_foo2",
+ *               "foo3": {
+ *                   "nested": ["a", "__SECRET__:command_command1_foo3_nested"]
+ *               }
  *            },
  *            "command2": {
  *                "foo1": "bar3"
@@ -184,11 +197,11 @@ export default class ConfigurationServiceProvider implements ServiceProvider {
 
   // the configuration data to be used by the CLI runner implementation
   // when updating command scoped access to key-value data via the key-value service.
-  #commandKeyValueData = new Map<string, Map<string, string>>();
+  #commandKeyValueData = new Map<string, Map<string, ValueNode>>();
 
   // the configuration data to be used by the CLI runner implementation
   // when updating service scoped access to key-value data via the key-value service.
-  #serviceKeyValueData = new Map<string, Map<string, string>>();
+  #serviceKeyValueData = new Map<string, Map<string, ValueNode>>();
 
   // the optional service providing scope limited key-value data to commands and other services
   #defaultKeyValueService: DefaultKeyValueService | undefined;
@@ -301,40 +314,23 @@ export default class ConfigurationServiceProvider implements ServiceProvider {
     }
 
     if (result !== undefined && this.#defaultSecretService) {
-      result = await this.#resolveSecrets(result);
+      result = await resolveSecrets<PopulatedValues | PopulatedValueType>(
+        result,
+        async (bunSecretName) => {
+          const secretValue = await this.#defaultSecretService!.getSecret(bunSecretName);
+          if (secretValue === null) {
+            throw new Error(
+              `Secret not found in OS secret store for sentinel: '${SECRET_SENTINEL_PREFIX}${bunSecretName}'`,
+            );
+          }
+          return secretValue;
+        },
+      );
     }
 
     return result;
   }
 
-  async #resolveSecrets(
-    value: PopulatedValues | PopulatedValueType,
-  ): Promise<PopulatedValues | PopulatedValueType> {
-    if (typeof value === "string" && value.startsWith(SECRET_SENTINEL_PREFIX)) {
-      const bunSecretName = value.slice(SECRET_SENTINEL_PREFIX.length);
-      const secretValue = await this.#defaultSecretService!.getSecret(bunSecretName);
-      if (secretValue === null) {
-        throw new Error(`Secret not found in OS secret store for sentinel: '${value}'`);
-      }
-      return secretValue;
-    }
-    if (typeof value === "object" && value !== null) {
-      if (Array.isArray(value)) {
-        const resolved = [];
-        for (const item of value) {
-          resolved.push(await this.#resolveSecrets(item));
-        }
-        return resolved as unknown as PopulatedValues;
-      }
-      const resolved: Record<string, unknown> = {};
-      for (const [key, val] of Object.entries(value)) {
-        resolved[key] = await this.#resolveSecrets(val as PopulatedValueType);
-      }
-      return resolved as unknown as PopulatedValues;
-    }
-    return value;
-  }
-
   /**
    * Indicate that the contained {@link DefaultKeyValueService} should be set to have a scope of the provided
    * command name.
@@ -542,8 +538,8 @@ export default class ConfigurationServiceProvider implements ServiceProvider {
     const config: {
       defaults?: Record<string, Values | SingleValueType>;
       "key-values"?: {
-        commands?: Record<string, Record<string, string>>;
-        services?: Record<string, Record<string, string>>;
+        commands?: Record<string, Record<string, ValueNode>>;
+        services?: Record<string, Record<string, ValueNode>>;
       };
     } = {};
 

package/src/service/configuration/DefaultKeyValueService.ts

@@ -1,9 +1,14 @@
-import type { KeyValueService } from "@flowscripter/dynamic-cli-framework-api";
-import { SECRET_SENTINEL_PREFIX } from "@flowscripter/dynamic-cli-framework-api";
+import type {
+  ValueNode,
+  KeyValueService,
+  SettableValueNode,
+} from "@flowscripter/dynamic-cli-framework-api";
+import { Secret, SECRET_SENTINEL_PREFIX } from "@flowscripter/dynamic-cli-framework-api";
 import type DefaultSecretService from "./DefaultSecretService.ts";
+import resolveSecrets from "./resolveSecrets.ts";
 
 export default class DefaultKeyValueService implements KeyValueService {
-  #keyValueData: Map<string, string> | undefined;
+  #keyValueData: Map<string, ValueNode> | undefined;
   #dirty = false;
   readonly #secretService: DefaultSecretService | undefined;
 
@@ -11,7 +16,7 @@ export default class DefaultKeyValueService implements KeyValueService {
     this.#secretService = secretService;
   }
 
-  public setKeyValueData(keyValueData: Map<string, string>) {
+  public setKeyValueData(keyValueData: Map<string, ValueNode>) {
     if (this.#keyValueData) {
       throw new Error("Attempt to overwrite key-value data, it should be cleared first");
     }
@@ -28,7 +33,7 @@ export default class DefaultKeyValueService implements KeyValueService {
     return this.#dirty;
   }
 
-  public async getKey(key: string): Promise<string> {
+  public async get<T extends ValueNode = ValueNode>(key: string): Promise<T> {
     if (this.#keyValueData === undefined) {
       throw new Error("Attempt to access undefined key-value data");
     }
@@ -37,56 +42,105 @@ export default class DefaultKeyValueService implements KeyValueService {
       throw new Error("Attempt to access unknown key");
     }
 
-    if (value.startsWith(SECRET_SENTINEL_PREFIX)) {
+    const resolveSecret = async (bunSecretName: string): Promise<unknown> => {
       if (!this.#secretService) {
         throw new Error("Secret sentinel found but no secret service is available");
       }
-      const bunSecretName = value.slice(SECRET_SENTINEL_PREFIX.length);
       const secretValue = await this.#secretService.getSecret(bunSecretName);
       if (secretValue === null) {
         throw new Error(`Secret not found in OS secret store for key: '${key}'`);
       }
-      return secretValue;
-    }
+      try {
+        return JSON.parse(secretValue);
+      } catch {
+        return secretValue;
+      }
+    };
 
-    return value;
+    return resolveSecrets(value, resolveSecret) as Promise<T>;
   }
 
-  public hasKey(key: string): Promise<boolean> {
+  public has(key: string): Promise<boolean> {
     if (this.#keyValueData === undefined) {
       return Promise.reject(new Error("Attempt to access undefined key-value data"));
     }
     return Promise.resolve(this.#keyValueData.has(key));
   }
 
-  public async setKey(key: string, value: string, isSecret = false): Promise<void> {
+  public async set(key: string, value: SettableValueNode): Promise<void> {
     if (this.#keyValueData === undefined) {
       throw new Error("Attempt to access undefined key-value data");
     }
-    if (isSecret) {
+    this.#keyValueData.set(key, await this.#storeSecrets(key, value, []));
+    this.#dirty = true;
+  }
+
+  async #storeSecrets(
+    key: string,
+    value: SettableValueNode,
+    path: Array<string>,
+  ): Promise<ValueNode> {
+    if (value instanceof Secret) {
       if (!this.#secretService) {
         throw new Error("Attempt to set a secret but no secret service is available");
       }
-      const bunSecretName = await this.#secretService.setSecret(key, value);
-      this.#keyValueData.set(key, SECRET_SENTINEL_PREFIX + bunSecretName);
-    } else {
-      this.#keyValueData.set(key, value);
+      const secretName = [key, ...path].join("_");
+      const bunSecretName = await this.#secretService.setSecret(
+        secretName,
+        JSON.stringify(value.value),
+      );
+      return SECRET_SENTINEL_PREFIX + bunSecretName;
     }
-    this.#dirty = true;
+    if (Array.isArray(value)) {
+      const result: Array<ValueNode> = [];
+      for (let i = 0; i < value.length; i += 1) {
+        result.push(await this.#storeSecrets(key, value[i]!, [...path, String(i)]));
+      }
+      return result as ValueNode;
+    }
+    if (typeof value === "object" && value !== null) {
+      const result: Record<string, ValueNode> = {};
+      for (const [propertyName, propertyValue] of Object.entries(value)) {
+        result[propertyName] = await this.#storeSecrets(key, propertyValue, [
+          ...path,
+          propertyName,
+        ]);
+      }
+      return result as ValueNode;
+    }
+    return value;
   }
 
-  public async deleteKey(key: string): Promise<void> {
+  public async delete(key: string): Promise<void> {
     if (this.#keyValueData === undefined) {
       throw new Error("Attempt to access undefined key-value data");
     }
     const value = this.#keyValueData.get(key);
-    if (value !== undefined && value.startsWith(SECRET_SENTINEL_PREFIX)) {
+    if (value !== undefined) {
+      await this.#deleteSecrets(value);
+    }
+    this.#keyValueData.delete(key);
+    this.#dirty = true;
+  }
+
+  async #deleteSecrets(value: ValueNode): Promise<void> {
+    if (typeof value === "string" && value.startsWith(SECRET_SENTINEL_PREFIX)) {
       if (this.#secretService) {
         const bunSecretName = value.slice(SECRET_SENTINEL_PREFIX.length);
         await this.#secretService.deleteSecret(bunSecretName);
       }
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        await this.#deleteSecrets(item);
+      }
+      return;
+    }
+    if (typeof value === "object" && value !== null) {
+      for (const propertyValue of Object.values(value)) {
+        await this.#deleteSecrets(propertyValue as ValueNode);
+      }
     }
-    this.#keyValueData.delete(key);
-    this.#dirty = true;
   }
 }