@heyditto/cli 2.5.1 → 2.6.0

package/README.md

@@ -406,9 +406,10 @@ heyditto endpoints set <endpoint> --model … --system-prompt … --spend-limit
                                    --record on|off --memory-depth <n>
 heyditto endpoints delete <endpoint> [--yes]
 heyditto endpoints keys <endpoint>         list keys
-heyditto endpoints keys create <endpoint> --gh-secret <NAME> [--repo owner/repo] [--env <env>] [--org <org>]
+heyditto endpoints keys create <endpoint> --store <destination> --secret <NAME> [scoping flags]
                                    [--name <label>] [--expires <1h…never>] [--budget <tokens>]
                                    [--spend-period <p>] [--yes]
+heyditto endpoints keys stores              which destinations this machine can write to
 heyditto endpoints keys revoke <endpoint> <keyId> [--yes]
 ```
 
@@ -416,30 +417,57 @@ Endpoints spend your Ditto credits, so deleting one, revoking a key or raising a
 spend limit asks you to type the slug back; pass `--yes` in scripts. `--output
 json` is available everywhere and includes the gateway base URL.
 
-#### Put a key in GitHub Actions
-
-`keys create --gh-secret` mints a long-lived key on an endpoint and stores it as
-a GitHub Actions secret through the [`gh` CLI](https://cli.github.com) — **the
-key is never shown**. The plaintext goes to `gh secret set` over stdin, so it
-does not appear in argv, `ps`, shell history, logs or the CLI's own output, and
-the CLI does not keep a copy. If `gh` fails to store it, the freshly minted key
-is revoked again.
+#### Put a key straight into a secret manager
+
+`keys create` mints a long-lived key on an endpoint and stores it in a secret
+manager by delegating to that platform's own CLI — **the key is never shown**.
+The plaintext goes to the platform CLI over stdin (or through `/dev/stdin`, for
+the CLIs that read a file instead), so it does not appear in argv, `ps`, shell
+history, logs or the CLI's own output, and nothing is kept locally. If the
+platform CLI fails, the freshly minted key is revoked again.
+
+| Destination | Shorthand | Scoping flags | CLI it delegates to |
+| --- | --- | --- | --- |
+| GitHub Actions | `--gh-secret NAME` | `--repo` `--env` `--org` | `gh secret set` |
+| GitLab CI/CD | `--gitlab-var NAME` | `--project` `--org` `--env` | `glab variable set --masked` |
+| AWS Secrets Manager | `--aws-secret NAME` | `--region` | `aws secretsmanager create-secret` (then `put-secret-value`) |
+| Google Secret Manager | `--gcp-secret NAME` | `--project` | `gcloud secrets create` (then `versions add`) |
+| Azure Key Vault | `--az-secret NAME` | `--key-vault` (required) | `az keyvault secret set --file` |
+| 1Password | `--op-item TITLE` | `--op-vault` | `op item create` (JSON template on stdin) |
+| HashiCorp Vault | `--vault-secret PATH` | `--mount` `--field` | `vault kv patch` (then `kv put`) |
+| Doppler | `--doppler-secret NAME` | `--project` `--doppler-config` | `doppler secrets set` |
+| Cloudflare Workers | `--cf-secret NAME` | `--worker` | `wrangler secret put` |
+| Vercel | `--vercel-env NAME` | `--vercel-target` | `vercel env add --sensitive` |
+| Kubernetes | `--k8s-secret NAME` | `--namespace` `--k8s-key` | `kubectl patch secret` (then `apply`) |
+| Fly.io | `--fly-secret NAME` | `--app` | `fly secrets import` |
+
+Every shorthand is sugar for `--store <id> --secret <NAME>`; use whichever
+reads better. `heyditto endpoints keys stores` lists the destinations with the
+CLI each one needs and whether it is installed here (`--output json` for
+scripts).
 
 ```bash
 cd my-repo
 heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY               # repo from the current directory (like gh)
 heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --repo acme/app --budget 5000000
-heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --repo acme/app --env production --yes
 heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --org acme --expires 6mo --output json
-```
-
-Requirements: `gh` on `PATH` and signed in (`gh auth status`) — both are checked
-before anything is minted. Without a terminal the command needs `--yes`;
-interactively it shows what it will do and asks you to type the secret name.
-Defaults: key name `gh:<owner>/<repo>:<NAME>`, expiry `1y`; `--budget` caps the
-key's spend (`--spend-period` defaults to `monthly`). The output shows the key's
-last four characters, expiry, budget, where the secret was set, and a workflow
-snippet:
+heyditto endpoints keys create my-endpoint --store aws --secret DITTO_KEY --region us-east-1
+heyditto endpoints keys create my-endpoint --gcp-secret ditto-key --project my-gcp-project
+heyditto endpoints keys create my-endpoint --az-secret ditto-key --key-vault my-vault
+heyditto endpoints keys create my-endpoint --op-item "Ditto inference" --op-vault Engineering
+heyditto endpoints keys create my-endpoint --vault-secret ditto/inference --mount secret --field token
+heyditto endpoints keys create my-endpoint --k8s-secret ditto-inference --namespace prod
+```
+
+Requirements: the platform CLI on `PATH` and signed in — both are checked
+*before* anything is minted, so a missing CLI costs you nothing. Without a
+terminal the command needs `--yes`; interactively it shows what it will do and
+asks you to type the secret name back. Defaults: expiry `1y`, key label
+`<store>:<target>:<NAME>` (GitHub keeps its original `gh:<owner>/<repo>:<NAME>`);
+`--budget` caps the key's spend (`--spend-period` defaults to `monthly`). A
+scoping flag that belongs to another destination is an error rather than being
+ignored. The output shows the key's last four characters, expiry, budget, where
+it was stored, and how to consume it — for GitHub Actions:
 
 ```yaml
 env:
@@ -537,7 +565,11 @@ the thread URL the backend returns for its linked app (falling back to the
 production app link on older backends). `pull --resume` always resumes the
 harness inside the restored tree (add `--dry-run` to see the launch plan), so
 the next prompt lands in the restored transcript even when the original
-directory still exists on the same machine. Worktrees compressed with `zstd`
+directory still exists on the same machine. Restored Claude transcripts are
+filed under Claude Code's own project slug for the destination path (every
+non-alphanumeric character becomes `-`), so `claude --resume` finds them in
+paths with underscores or dots such as `/opt/workspace_base/capsule`. macOS
+AppleDouble `._*` files and `.DS_Store` never enter the worktree archive. Worktrees compressed with `zstd`
 are decompressed by Node itself when the `zstd` binary is missing; on a Node
 without zstd support the pull fails with a message naming the binary to install.
 

package/dist/commands.d.ts

@@ -52,10 +52,36 @@ export declare function cmdEndpointKeysRevoke(ref: string, keyId: string, option
 }): Promise<void>;
 interface KeysCreateOptions {
     output?: string;
+    /** Canonical destination selector; every store also has a shorthand flag. */
+    store?: string;
+    secret?: string;
     ghSecret?: string;
+    gitlabVar?: string;
+    awsSecret?: string;
+    gcpSecret?: string;
+    azSecret?: string;
+    opItem?: string;
+    vaultSecret?: string;
+    dopplerSecret?: string;
+    cfSecret?: string;
+    vercelEnv?: string;
+    k8sSecret?: string;
+    flySecret?: string;
     repo?: string;
     env?: string;
     org?: string;
+    region?: string;
+    project?: string;
+    keyVault?: string;
+    opVault?: string;
+    mount?: string;
+    field?: string;
+    dopplerConfig?: string;
+    worker?: string;
+    vercelTarget?: string;
+    namespace?: string;
+    k8sKey?: string;
+    app?: string;
     name?: string;
     expires?: string;
     budget?: string;
@@ -63,11 +89,16 @@ interface KeysCreateOptions {
     yes?: boolean;
 }
 /**
- * Mints a key on an endpoint and hands the plaintext straight to `gh secret
- * set` over stdin. The key is never printed, logged or stored locally; on a
- * failed `gh` call it is revoked again so nothing usable is left behind.
+ * Mints a key on an endpoint and hands the plaintext straight to the platform
+ * CLI over stdin (`gh secret set`, `gcloud secrets create --data-file=-`, …).
+ * The key is never printed, logged or stored locally; when the platform CLI
+ * fails it is revoked again so nothing usable is left behind.
  */
 export declare function cmdEndpointKeysCreate(ref: string, options: KeysCreateOptions): Promise<void>;
+/** Lists every destination and whether this machine can delegate to it. */
+export declare function cmdEndpointKeyStores(options: {
+    output?: string;
+}): Promise<void>;
 /** Registers the `endpoints` group; bare `heyditto endpoints [flags]` still lists. */
 export declare function registerEndpointCommands(program: Command, addExamples: (c: Command, ex: string) => Command, outputOption: () => Option): void;
 interface SessionsOptions {

package/dist/commands.js

@@ -7,12 +7,20 @@ import { createEndpoint, createKey, deleteEndpoint, findEndpoint, getEndpoint, i
 import { openInBrowser } from "./browser.js";
 import { endpointURL } from "./config.js";
 import { activationLink, formatActivation } from "./endpoint-format.js";
-import { describeTarget, preflightGh, resolveRepoFromCwd, setGitHubSecret, validateRepo, validateSecretName, } from "./gh-secret.js";
+import { STORE_IDS, VERCEL_TARGETS, deliver, probeStores, selectStore, } from "./secret-stores/index.js";
 import { SESSION_ENV, SESSION_ID_HEADER, endSession, readSessionHistory, resolveActiveSession, startSession, useSession, } from "./mcp-session.js";
 import { readStoredAuth, updateStoredAuth } from "./store.js";
 function pad(s, n) {
     return s.length >= n ? s : s + " ".repeat(n - s.length);
 }
+/** Left-aligned columns sized to their widest cell; the last column is not padded. */
+function printTable(header, rows) {
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+    const line = (r) => r.map((c, i) => (i === r.length - 1 ? c : pad(c, widths[i]))).join("  ");
+    process.stdout.write(`${line(header)}\n`);
+    for (const r of rows)
+        process.stdout.write(`${line(r)}\n`);
+}
 function spendColumn(e) {
     const used = (e.spentTokens ?? 0).toLocaleString();
     if (e.spendLimitTokens == null || e.spendLimitTokens < 0)
@@ -305,11 +313,7 @@ export async function cmdEndpointKeys(ref, options) {
         k.lastUsedAt ? `used ${k.lastUsedAt.slice(0, 16).replace("T", " ")}` : "",
     ]);
     const header = ["ID", "KEY", "NAME", "STATE", "LAST USED"];
-    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
-    const line = (r) => r.map((c, i) => (i === r.length - 1 ? c : pad(c, widths[i]))).join("  ");
-    process.stdout.write(`${line(header)}\n`);
-    for (const r of rows)
-        process.stdout.write(`${line(r)}\n`);
+    printTable(header, rows);
 }
 export async function cmdEndpointKeysRevoke(ref, keyId, options) {
     const { endpoint } = await getEndpoint(ref);
@@ -321,6 +325,23 @@ export async function cmdEndpointKeysRevoke(ref, keyId, options) {
     }
     process.stdout.write(`Revoked key ${keyId} on ${endpoint.slug}.\n`);
 }
+/** Shorthand flag values keyed by the store they select. */
+function shorthandsOf(options) {
+    return {
+        github: options.ghSecret,
+        gitlab: options.gitlabVar,
+        aws: options.awsSecret,
+        gcloud: options.gcpSecret,
+        azure: options.azSecret,
+        "1password": options.opItem,
+        vault: options.vaultSecret,
+        doppler: options.dopplerSecret,
+        cloudflare: options.cfSecret,
+        vercel: options.vercelEnv,
+        kubernetes: options.k8sSecret,
+        fly: options.flySecret,
+    };
+}
 function parseKeyBudget(raw) {
     if (raw === undefined)
         return undefined;
@@ -335,53 +356,38 @@ function parseKeyExpiry(raw) {
         return value;
     throw new Error(`--expires must be one of: ${KEY_EXPIRIES.join(", ")}`);
 }
-/** Resolves where the secret goes from --repo / --env / --org (repo falls back to the cwd, like gh). */
-function resolveSecretTarget(options) {
-    const org = options.org?.trim();
-    const env = options.env?.trim();
-    if (org) {
-        if (options.repo || env)
-            throw new Error("--org cannot be combined with --repo or --env (organization secrets are not scoped to one repository)");
-        if (!/^[A-Za-z0-9_.-]+$/.test(org))
-            throw new Error(`--org must be an organization login, got "${options.org}"`);
-        return { kind: "org", org };
-    }
-    const repo = options.repo ? validateRepo(options.repo) : resolveRepoFromCwd();
-    if (env)
-        return { kind: "env", repo, env };
-    return { kind: "repo", repo };
-}
 /**
- * Mints a key on an endpoint and hands the plaintext straight to `gh secret
- * set` over stdin. The key is never printed, logged or stored locally; on a
- * failed `gh` call it is revoked again so nothing usable is left behind.
+ * Mints a key on an endpoint and hands the plaintext straight to the platform
+ * CLI over stdin (`gh secret set`, `gcloud secrets create --data-file=-`, …).
+ * The key is never printed, logged or stored locally; when the platform CLI
+ * fails it is revoked again so nothing usable is left behind.
  */
 export async function cmdEndpointKeysCreate(ref, options) {
-    if (!options.ghSecret)
-        throw new Error("--gh-secret <NAME> is required: this command only mints keys straight into a GitHub Actions secret");
-    const secretName = validateSecretName(options.ghSecret);
+    const { store, name: secretName } = selectStore({ ...options, shorthands: shorthandsOf(options) });
     const budget = parseKeyBudget(options.budget);
     const expiresIn = parseKeyExpiry(options.expires);
     if (options.spendPeriod !== undefined && budget === undefined)
         throw new Error("--spend-period only applies together with --budget");
     const spendPeriod = budget !== undefined ? (options.spendPeriod ?? "monthly") : undefined;
-    // Everything that can fail cheaply happens before any write: gh present and
-    // signed in, target repo known, endpoint exists, operator confirmed.
-    preflightGh();
-    const target = resolveSecretTarget(options);
+    // Everything that can fail cheaply happens before any write: the platform
+    // CLI is present and signed in, its target is known, the endpoint exists,
+    // and the operator confirmed.
+    store.preflight();
+    const target = store.resolveTarget(options);
     const { endpoint, catalog } = await getEndpoint(ref);
-    const keyName = options.name?.trim() || (target.kind === "org" ? `gh-secret:${secretName}` : `gh:${target.repo}:${secretName}`);
-    const plan = `Will mint key "${keyName}" on ${endpoint.slug} (expires ${expiresIn}${budget !== undefined ? `, budget ${budget.toLocaleString()} tokens ${spendPeriod}` : ""}) and set secret ${secretName} on ${describeTarget(target)}.`;
-    await confirmTyped({ action: `mint a key on ${endpoint.slug} and set secret ${secretName}`, expected: secretName, label: "the secret name", yes: options.yes, preview: plan });
+    const keyName = options.name?.trim() || defaultKeyName(store, target, secretName);
+    const plan = `Will mint key "${keyName}" on ${endpoint.slug} (expires ${expiresIn}${budget !== undefined ? `, budget ${budget.toLocaleString()} tokens ${spendPeriod}` : ""}) and store ${secretName} in ${target.describe}.`;
+    await confirmTyped({ action: `mint a key on ${endpoint.slug} and store ${secretName} in ${store.label}`, expected: secretName, label: `the ${store.nameLabel.toLowerCase()}`, yes: options.yes, preview: plan });
     const minted = await createKey(endpoint.id, {
         name: keyName,
         expiresIn,
         ...(budget !== undefined ? { spendLimitTokens: budget, spendPeriod } : {}),
     });
-    // Split the plaintext off immediately; only `plaintext` may reach gh's stdin.
+    // Split the plaintext off immediately; only `plaintext` may reach the
+    // platform CLI's stdin.
     const { key: plaintext, ...key } = minted;
     try {
-        setGitHubSecret(secretName, target, plaintext ?? "");
+        deliver(store, secretName, store.deliveries(secretName, target), plaintext ?? "");
     }
     catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
@@ -396,7 +402,7 @@ export async function cmdEndpointKeysCreate(ref, options) {
     }
     const anthropicBaseUrl = apiRootOf(catalog.baseUrl);
     const openaiBaseUrl = catalog.baseUrl;
-    const snippet = `\${{ secrets.${secretName} }}`;
+    const gateway = { anthropicBaseUrl, openaiBaseUrl };
     if (isJSON(options)) {
         process.stdout.write(`${JSON.stringify({
             endpoint: { id: endpoint.id, slug: endpoint.slug },
@@ -409,24 +415,57 @@ export async function cmdEndpointKeysCreate(ref, options) {
                 spendLimitTokens: key.spendLimitTokens ?? budget ?? null,
                 spendPeriod: key.spendPeriod ?? spendPeriod ?? null,
             },
-            secret: { name: secretName, ...target, snippet },
+            store: store.id,
+            secret: {
+                name: secretName,
+                ...target.fields,
+                describe: target.describe,
+                ...(store.snippet ? { snippet: store.snippet(secretName, target) } : {}),
+            },
             gateway: { baseUrl: catalog.baseUrl, anthropicBaseUrl, openaiBaseUrl },
         }, null, 2)}\n`);
         return;
     }
     process.stdout.write([
         `Minted key …${key.keyHint} (${key.name ?? keyName}) on ${endpoint.slug}: expires ${expiresIn}${budget !== undefined ? `, budget ${budget.toLocaleString()} tokens ${spendPeriod}` : ", no spend cap"}.`,
-        `Stored it as GitHub Actions secret ${secretName} on ${describeTarget(target)}. The key was not printed and is not kept locally.`,
+        `Stored ${secretName} in ${target.describe} via ${store.bin}. The key was not printed and is not kept locally.`,
         "",
-        "Use it in a workflow step:",
-        "  env:",
-        `    ANTHROPIC_AUTH_TOKEN: ${snippet}`,
-        `    ANTHROPIC_BASE_URL: ${anthropicBaseUrl}`,
-        `  # OpenAI-compatible clients: OPENAI_API_KEY: ${snippet} with OPENAI_BASE_URL: ${openaiBaseUrl}`,
+        ...store.usage(secretName, target, gateway),
         "",
         `Revoke later with: heyditto endpoints keys revoke ${endpoint.slug} ${key.id}`,
     ].join("\n") + "\n");
 }
+/** Key label in the Ditto app: which store, which target, which name. */
+function defaultKeyName(store, target, secretName) {
+    if (store.keyName)
+        return store.keyName(secretName, target);
+    const scope = Object.entries(target.fields)
+        .filter(([key, value]) => key !== "kind" && value)
+        .map(([, value]) => value)
+        .join("/");
+    return `${store.id}:${scope ? `${scope}:` : ""}${secretName}`;
+}
+/** Lists every destination and whether this machine can delegate to it. */
+export async function cmdEndpointKeyStores(options) {
+    const probes = probeStores();
+    if (isJSON(options)) {
+        process.stdout.write(`${JSON.stringify(probes, null, 2)}\n`);
+        return;
+    }
+    const header = ["STORE", "DESTINATION", "CLI", "STATUS", "FLAGS"];
+    const rows = probes.map((p) => [
+        p.id,
+        p.label,
+        p.resolvedBin,
+        p.installed ? "installed" : "not installed",
+        [`${p.shorthand} <${p.nameLabel}>`, ...p.flags].join(" "),
+    ]);
+    printTable(header, rows);
+    const missing = probes.filter((p) => !p.installed);
+    if (missing.length > 0) {
+        process.stdout.write(`\nNot installed: ${missing.map((p) => p.bin).join(", ")}. Install the one you need, or store the key by hand from the console.\n`);
+    }
+}
 /** Registers the `endpoints` group; bare `heyditto endpoints [flags]` still lists. */
 export function registerEndpointCommands(program, addExamples, outputOption) {
     const endpoints = program
@@ -437,7 +476,7 @@ export function registerEndpointCommands(program, addExamples, outputOption) {
         .addHelpText("after", `
 Endpoint controls spend your Ditto credits, so delete, key revocation and
 spend-limit increases ask you to type the slug back (or pass --yes).
-'keys create --gh-secret' mints a key straight into a GitHub Actions secret
+'keys create' mints a key straight into a secret manager via its own CLI
 through the gh CLI; the plaintext never reaches your terminal.`);
     addExamples(endpoints
         .command("list", { isDefault: true })
@@ -513,13 +552,38 @@ through the gh CLI; the plaintext never reaches your terminal.`);
         .action(cmdEndpointKeys);
     addExamples(keys
         .command("create")
-        .description("mint a key and store it straight into a GitHub Actions secret via gh (the key is never printed)")
+        .description("mint a key and store it straight into a secret manager through its own CLI (the key is never printed)")
         .argument("<endpoint>", "endpoint slug or id")
-        .requiredOption("--gh-secret <NAME>", "Actions secret name to set with the gh CLI")
-        .option("--repo <owner/repo>", "repository for the secret (default: the repo of the current directory, as gh resolves it)")
-        .option("--env <environment>", "set a deployment-environment secret on the repo instead of a repository secret")
-        .option("--org <org>", "set an organization secret instead (cannot be combined with --repo/--env)")
-        .option("--name <label>", "key name shown in the Ditto app (default: gh:<owner>/<repo>:<NAME>)")
+        .addOption(new Option("--store <destination>", "where the key goes").choices([...STORE_IDS]))
+        .option("--secret <NAME>", "name of the secret, variable, item or path to store (with --store)")
+        .option("--gh-secret <NAME>", "shorthand for --store github --secret NAME")
+        .option("--gitlab-var <NAME>", "shorthand for --store gitlab --secret NAME")
+        .option("--aws-secret <NAME>", "shorthand for --store aws --secret NAME")
+        .option("--gcp-secret <NAME>", "shorthand for --store gcloud --secret NAME")
+        .option("--az-secret <NAME>", "shorthand for --store azure --secret NAME")
+        .option("--op-item <TITLE>", "shorthand for --store 1password --secret TITLE")
+        .option("--vault-secret <PATH>", "shorthand for --store vault --secret PATH")
+        .option("--doppler-secret <NAME>", "shorthand for --store doppler --secret NAME")
+        .option("--cf-secret <NAME>", "shorthand for --store cloudflare --secret NAME")
+        .option("--vercel-env <NAME>", "shorthand for --store vercel --secret NAME")
+        .option("--k8s-secret <NAME>", "shorthand for --store kubernetes --secret NAME")
+        .option("--fly-secret <NAME>", "shorthand for --store fly --secret NAME")
+        .option("--repo <owner/repo>", "github: repository for the secret (default: the repo of the current directory)")
+        .option("--env <environment>", "github: deployment environment; gitlab: variable environment scope")
+        .option("--org <org>", "github: organization secret; gitlab: group variable (cannot be combined with --repo/--env)")
+        .option("--region <region>", "aws: region for the secret (default: the configured region)")
+        .option("--project <project>", "gitlab, gcloud, doppler: project (default: the CLI's configured project)")
+        .option("--key-vault <name>", "azure: Key Vault the secret goes into (required)")
+        .option("--op-vault <name>", "1password: vault for the item (default: Private)")
+        .option("--mount <mount>", "vault: kv mount (default: secret)")
+        .option("--field <field>", "vault: field at the path (default: token)")
+        .option("--doppler-config <config>", "doppler: config within the project, e.g. prod")
+        .option("--worker <name>", "cloudflare: Worker name (default: the local wrangler config)")
+        .addOption(new Option("--vercel-target <target>", "vercel: environment").choices([...VERCEL_TARGETS]))
+        .option("--namespace <namespace>", "kubernetes: namespace (default: default)")
+        .option("--k8s-key <key>", "kubernetes: key within the secret (default: key)")
+        .option("--app <app>", "fly: app name (default: the local fly.toml)")
+        .option("--name <label>", "key name shown in the Ditto app (default: <store>:<target>:<NAME>)")
         .addOption(new Option("--expires <duration>", "server-side key expiry").choices([...KEY_EXPIRIES]).default("1y"))
         .option("--budget <tokens>", "spend cap for the key, in Ditto tokens")
         .addOption(new Option("--spend-period <period>", "window the key's spend cap resets on (with --budget; default monthly)").choices(["daily", "weekly", "monthly", "yearly", "never"]))
@@ -527,8 +591,19 @@ through the gh CLI; the plaintext never reaches your terminal.`);
         .addOption(outputOption())
         .action(cmdEndpointKeysCreate), `  heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY                  # repo of the current directory
   heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --repo acme/app --budget 5000000
-  heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --repo acme/app --env production --yes
-  heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --org acme --expires 6mo --output json`);
+  heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --org acme --expires 6mo --output json
+  heyditto endpoints keys create my-endpoint --store aws --secret DITTO_KEY --region us-east-1
+  heyditto endpoints keys create my-endpoint --gcp-secret DITTO_KEY --project my-gcp-project
+  heyditto endpoints keys create my-endpoint --az-secret DITTO_KEY --key-vault my-vault
+  heyditto endpoints keys create my-endpoint --op-item "Ditto inference" --op-vault Engineering
+  heyditto endpoints keys create my-endpoint --vault-secret ditto/inference --mount secret --field token
+  heyditto endpoints keys create my-endpoint --gitlab-var DITTO_KEY --project acme/app
+  heyditto endpoints keys create my-endpoint --k8s-secret ditto-inference --namespace prod`);
+    keys
+        .command("stores")
+        .description("list the secret managers keys can be minted into, and whether their CLI is installed here")
+        .addOption(outputOption())
+        .action(cmdEndpointKeyStores);
     keys
         .command("revoke")
         .description("revoke one key")
@@ -765,10 +840,6 @@ export async function cmdAgents(options) {
         connectionsColumn(a),
     ]);
     const header = ["ID", "KIND", "NAME", "THREADS", "LAST ACTIVITY", "CONNECTIONS"];
-    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
-    const line = (r) => r.map((c, i) => (i === r.length - 1 ? c : pad(c, widths[i]))).join("  ");
-    process.stdout.write(`${line(header)}\n`);
-    for (const r of rows)
-        process.stdout.write(`${line(r)}\n`);
+    printTable(header, rows);
 }
 //# sourceMappingURL=commands.js.map