apcore-cli 0.9.1 → 0.10.0

package/dist/bin/apcore-cli.js

@@ -288,7 +288,7 @@ var init_sandbox = __esm({
        */
       async execute(moduleId, inputData, executor) {
         if (!this.enabled) {
-          return executor.execute(moduleId, inputData);
+          return executor.call(moduleId, inputData);
         }
         return this._sandboxedExecute(moduleId, inputData);
       }
@@ -583,9 +583,17 @@ function mapType(propName, propSchema) {
     array: "string"
   };
   if (!schemaType) {
+    warn(`No type specified for property '${propName}', defaulting to string.`);
     return "string";
   }
-  return typeMap[schemaType] ?? "string";
+  const mapped = typeMap[schemaType];
+  if (mapped === void 0) {
+    warn(
+      `Unknown schema type '${schemaType}' for property '${propName}', defaulting to string.`
+    );
+    return "string";
+  }
+  return mapped;
 }
 function extractHelp(propSchema, maxLength = 1e3) {
   let text = propSchema["x-llm-description"];
@@ -766,7 +774,7 @@ async function checkApproval(moduleDef, autoApprove, timeout) {
   if (!requiresApproval) {
     return;
   }
-  const moduleId = moduleDef.id;
+  const moduleId = moduleDef.moduleId;
   if (autoApprove) {
     return;
   }
@@ -790,7 +798,7 @@ async function checkApproval(moduleDef, autoApprove, timeout) {
 }
 async function promptWithTimeout(moduleDef, timeout) {
   timeout = Math.max(1, Math.min(timeout, 3600));
-  const moduleId = moduleDef.id;
+  const moduleId = moduleDef.moduleId;
   const annotations = moduleDef.annotations;
   const message = (annotations ? getAnnotation(annotations, "approval_message") : void 0) ?? `Module '${moduleId}' requires approval to execute.`;
   process.stderr.write(message + "\n");
@@ -870,7 +878,7 @@ var init_approval = __esm({
         const message = extra.approval_message ?? `Module '${moduleId}' requires approval to execute.`;
         process.stderr.write(message + "\n");
         try {
-          await promptWithTimeout({ id: moduleId }, this.timeout);
+          await promptWithTimeout({ moduleId }, this.timeout);
           return { status: "approved", approved_by: "tty_user" };
         } catch {
           return { status: "rejected", reason: "User rejected or timed out" };
@@ -890,7 +898,7 @@ function descriptorToScanned(m) {
   const metadata = m.metadata ?? {};
   const display = metadata["display"] ?? null;
   return {
-    moduleId: m.id,
+    moduleId: m.moduleId,
     description: m.description ?? "",
     inputSchema: m.inputSchema ?? {},
     outputSchema: m.outputSchema ?? {},
@@ -946,13 +954,13 @@ async function formatModuleList(modules, format, filterTags, showDeps = false, e
     if (showDeps) headers.push("Deps");
     if (exposureFilter) headers.push("Exposure");
     const rows = modules.map((m) => {
-      const base = [m.id, truncate(m.description, 80), (m.tags ?? []).join(", ")];
+      const base = [m.moduleId, truncate(m.description, 80), (m.tags ?? []).join(", ")];
       if (showDeps) {
         const deps = m.dependencies;
         base.push(String(Array.isArray(deps) ? deps.length : 0));
       }
       if (exposureFilter) {
-        base.push(exposureFilter.isExposed(m.id ?? "") ? "\u2713" : "\u2014");
+        base.push(exposureFilter.isExposed(m.moduleId ?? "") ? "\u2713" : "\u2014");
       }
       return base;
     });
@@ -960,7 +968,7 @@ async function formatModuleList(modules, format, filterTags, showDeps = false, e
   } else if (format === "json") {
     const result = modules.map((m) => {
       const entry = {
-        id: m.id,
+        id: m.moduleId,
         description: m.description,
         tags: m.tags ?? []
       };
@@ -969,7 +977,7 @@ async function formatModuleList(modules, format, filterTags, showDeps = false, e
         entry.dependency_count = Array.isArray(deps) ? deps.length : 0;
       }
       if (exposureFilter) {
-        entry.exposed = exposureFilter.isExposed(m.id ?? "");
+        entry.exposed = exposureFilter.isExposed(m.moduleId ?? "");
       }
       return entry;
     });
@@ -1001,7 +1009,7 @@ function annotationsToDict(annotations) {
 async function formatModuleDetail(moduleDef, format) {
   if (format === "table") {
     process.stdout.write(`
-Module: ${moduleDef.id}
+Module: ${moduleDef.moduleId}
 `);
     process.stdout.write(`
 Description:
@@ -1049,7 +1057,7 @@ Tags: ${tags.join(", ")}
     }
   } else if (format === "json") {
     const result = {
-      id: moduleDef.id,
+      id: moduleDef.moduleId,
       description: moduleDef.description
     };
     if (moduleDef.inputSchema) result.input_schema = moduleDef.inputSchema;
@@ -1409,7 +1417,7 @@ function getDisplay(descriptor) {
   if (display && typeof display === "object" && !Array.isArray(display)) {
     return display;
   }
-  const overlay = lookupBindingDisplay(descriptor.id);
+  const overlay = lookupBindingDisplay(descriptor.moduleId);
   return overlay ?? {};
 }
 var init_display_helpers = __esm({
@@ -1427,9 +1435,9 @@ import yaml2 from "js-yaml";
 function registerConfigNamespace() {
   try {
     const nodeRequire = createRequire(import.meta.url);
-    const { Config } = nodeRequire("apcore-js");
-    if (typeof Config?.registerNamespace === "function") {
-      Config.registerNamespace({
+    const { Config: Config2 } = nodeRequire("apcore-js");
+    if (typeof Config2?.registerNamespace === "function") {
+      Config2.registerNamespace({
         name: "apcore-cli",
         envPrefix: "APCORE_CLI",
         defaults: NAMESPACE_DEFAULTS
@@ -1943,1672 +1951,1694 @@ var init_shell = __esm({
   }
 });
 
-// src/security/audit.ts
-var audit_exports = {};
-__export(audit_exports, {
-  AuditLogger: () => AuditLogger,
-  canonicalizeForHash: () => canonicalizeForHash,
-  getAuditLogger: () => getAuditLogger,
-  setAuditLogger: () => setAuditLogger
-});
-import * as crypto from "crypto";
-import * as fs3 from "fs";
-import * as os from "os";
-import * as path3 from "path";
-function setAuditLogger(auditLogger) {
-  _auditLogger = auditLogger;
-}
-function getAuditLogger() {
-  return _auditLogger;
+// src/exposure.ts
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function canonicalizeForHash(value) {
-  if (value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map(canonicalizeForHash);
-  const src = value;
-  const sorted = {};
-  for (const key of Object.keys(src).sort()) {
-    sorted[key] = canonicalizeForHash(src[key]);
-  }
-  return sorted;
+function compilePattern(pattern) {
+  const sentinel = "\0GLOB\0";
+  const escaped = pattern.replaceAll("**", sentinel);
+  const parts = escaped.split("*");
+  const regexParts = parts.map((p) => {
+    const restored = p.replaceAll(sentinel, "**");
+    return escapeRegex(restored);
+  });
+  let regex = regexParts.join("[^.]*");
+  regex = regex.replaceAll("\\*\\*", ".+");
+  return new RegExp(`^${regex}$`);
 }
-var _auditLogger, AuditLogger;
-var init_audit = __esm({
-  "src/security/audit.ts"() {
+var ExposureFilter;
+var init_exposure = __esm({
+  "src/exposure.ts"() {
     "use strict";
     init_esm_shims();
     init_logger();
-    _auditLogger = null;
-    AuditLogger = class _AuditLogger {
-      static DEFAULT_PATH = path3.join(
-        os.homedir(),
-        ".apcore-cli",
-        "audit.jsonl"
-      );
-      logPath;
-      writeFailureWarned = false;
-      constructor(path6) {
-        this.logPath = path6 ?? _AuditLogger.DEFAULT_PATH;
-        this.ensureDirectory();
-      }
-      ensureDirectory() {
-        const dir = path3.dirname(this.logPath);
-        try {
-          fs3.mkdirSync(dir, { recursive: true });
-          try {
-            fs3.chmodSync(dir, 448);
-          } catch {
-          }
-        } catch {
+    ExposureFilter = class _ExposureFilter {
+      static VALID_MODES = ["all", "include", "exclude", "none"];
+      _mode;
+      _compiledInclude;
+      _compiledExclude;
+      constructor(mode = "all", include, exclude) {
+        if (!_ExposureFilter.VALID_MODES.includes(mode)) {
+          process.stderr.write(
+            `Warning: Unknown ExposureFilter mode '${mode}' \u2014 defaulting to 'none'. Valid modes: ${_ExposureFilter.VALID_MODES.join(", ")}.
+`
+          );
+          mode = "none";
         }
+        this._mode = mode;
+        const dedup = (arr) => [...new Set(arr)];
+        this._compiledInclude = dedup(include ?? []).map(compilePattern);
+        this._compiledExclude = dedup(exclude ?? []).map(compilePattern);
       }
-      logExecution(moduleId, inputData, status, exitCode, durationMs) {
-        const entry = {
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          user: this.getUser(),
-          module_id: moduleId,
-          input_hash: this.hashInput(inputData),
-          status,
-          exit_code: exitCode,
-          duration_ms: durationMs
-        };
-        try {
-          fs3.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
-          try {
-            fs3.chmodSync(this.logPath, 384);
-          } catch {
-          }
-        } catch (err) {
-          if (!this.writeFailureWarned) {
-            this.writeFailureWarned = true;
-            warn(`Could not write audit log: ${err}`);
-          }
+      /** Return true if the module should be exposed as a CLI command. */
+      isExposed(moduleId) {
+        if (this._mode === "all") return true;
+        if (this._mode === "include") {
+          return this._compiledInclude.some((rx) => rx.test(moduleId));
+        }
+        if (this._mode === "exclude") {
+          return !this._compiledExclude.some((rx) => rx.test(moduleId));
         }
+        return false;
       }
-      hashInput(inputData) {
-        const salt = crypto.randomBytes(16);
-        const payload = JSON.stringify(canonicalizeForHash(inputData));
-        return crypto.createHash("sha256").update(Buffer.concat([salt, Buffer.from(payload, "utf-8")])).digest("hex");
+      /** Partition moduleIds into [exposed, hidden] lists. */
+      filterModules(moduleIds) {
+        const exposed = [];
+        const hidden = [];
+        for (const mid of moduleIds) {
+          (this.isExposed(mid) ? exposed : hidden).push(mid);
+        }
+        return [exposed, hidden];
       }
-      getUser() {
-        try {
-          return os.userInfo().username;
-        } catch {
-          return process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
+      /**
+       * Create an ExposureFilter from a parsed config dict.
+       *
+       * Expected: `{ expose: { mode: "include", include: ["admin.*"] } }`
+       */
+      static fromConfig(config) {
+        const expose = config.expose ?? {};
+        if (typeof expose !== "object" || expose === null || Array.isArray(expose)) {
+          warn("Invalid 'expose' config (expected dict), using mode: all.");
+          return new _ExposureFilter();
+        }
+        const exposeObj = expose;
+        const mode = exposeObj.mode ?? "all";
+        if (!["all", "include", "exclude"].includes(mode)) {
+          throw new Error(
+            `Invalid expose mode: '${mode}'. Must be one of: all, include, exclude.`
+          );
+        }
+        let include = exposeObj.include ?? [];
+        if (!Array.isArray(include)) {
+          warn("Invalid 'expose.include' (expected list), ignoring.");
+          include = [];
+        }
+        let exclude = exposeObj.exclude ?? [];
+        if (!Array.isArray(exclude)) {
+          warn("Invalid 'expose.exclude' (expected list), ignoring.");
+          exclude = [];
         }
+        const filterList = (arr, label) => {
+          const result = [];
+          for (const p of arr) {
+            if (!p) {
+              warn(`Empty pattern in expose.${label}, skipping.`);
+            } else {
+              result.push(String(p));
+            }
+          }
+          return result;
+        };
+        return new _ExposureFilter(
+          mode,
+          filterList(include, "include"),
+          filterList(exclude, "exclude")
+        );
       }
     };
   }
 });
 
-// src/system-usage.ts
-import * as fs4 from "fs";
-import * as os2 from "os";
-import * as path4 from "path";
-function computeSummary(options = {}) {
-  const auditPath = options.auditPath ?? DEFAULT_AUDIT_PATH;
-  const period = options.period ?? "24h";
-  const cutoff = (options.now ?? /* @__PURE__ */ new Date()).getTime() - PERIOD_TO_MS[period];
-  if (!fs4.existsSync(auditPath)) {
-    return /* @__PURE__ */ new Map();
-  }
-  let raw;
-  try {
-    raw = fs4.readFileSync(auditPath, "utf-8");
-  } catch {
-    return /* @__PURE__ */ new Map();
-  }
-  const counts = /* @__PURE__ */ new Map();
-  const errors = /* @__PURE__ */ new Map();
-  const latencySum = /* @__PURE__ */ new Map();
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    let entry;
-    try {
-      entry = JSON.parse(trimmed);
-    } catch {
-      continue;
-    }
-    const ts = typeof entry.timestamp === "string" ? Date.parse(entry.timestamp) : NaN;
-    if (Number.isNaN(ts) || ts < cutoff) continue;
-    const moduleId = typeof entry.module_id === "string" ? entry.module_id : null;
-    if (!moduleId) continue;
-    counts.set(moduleId, (counts.get(moduleId) ?? 0) + 1);
-    if (entry.status === "error") {
-      errors.set(moduleId, (errors.get(moduleId) ?? 0) + 1);
-    }
-    const duration = entry.duration_ms;
-    if (typeof duration === "number") {
-      latencySum.set(moduleId, (latencySum.get(moduleId) ?? 0) + duration);
-    }
-  }
-  const out = /* @__PURE__ */ new Map();
-  for (const [id, calls] of counts) {
-    out.set(id, {
-      module_id: id,
-      calls,
-      errors: errors.get(id) ?? 0,
-      latency_ms: calls > 0 ? (latencySum.get(id) ?? 0) / calls : 0
-    });
-  }
-  return out;
+// src/builtin-group.ts
+function setReservedGroupNames(names) {
+  _effectiveReservedNames = names;
 }
-function sortModulesByUsage(modules, field, options = {}) {
-  const reverse = options.reverse ?? true;
-  const summary = computeSummary({
-    auditPath: options.auditPath,
-    period: options.period
-  });
-  if (summary.size === 0) {
-    modules.sort((a, b) => (a.id ?? a.module_id ?? "").localeCompare(b.id ?? b.module_id ?? ""));
-    if (reverse) modules.reverse();
-    return { used: false };
+function _validateBuiltinGroupName(name) {
+  if (!name || !_NAME_REGEX.test(name)) {
+    throw new ApcliGroupError(
+      `builtinGroupName ${JSON.stringify(name)} must match /^[a-z][a-z0-9_-]*$/ (non-empty, lowercase, alphanumeric + '_' / '-', leading letter).`
+    );
   }
-  const key = (m) => {
-    const id = m.id ?? m.module_id ?? "";
-    const s = summary.get(id);
-    if (!s) return 0;
-    return field === "latency" ? s.latency_ms : field === "calls" ? s.calls : s.errors;
-  };
-  modules.sort((a, b) => {
-    const diff = key(a) - key(b);
-    if (diff !== 0) return reverse ? -diff : diff;
-    return (a.id ?? a.module_id ?? "").localeCompare(b.id ?? b.module_id ?? "");
-  });
-  return { used: true };
 }
-var PERIOD_TO_MS, DEFAULT_AUDIT_PATH;
-var init_system_usage = __esm({
-  "src/system-usage.ts"() {
-    "use strict";
-    init_esm_shims();
-    PERIOD_TO_MS = {
-      "1h": 60 * 60 * 1e3,
-      "24h": 24 * 60 * 60 * 1e3,
-      "7d": 7 * 24 * 60 * 60 * 1e3,
-      "30d": 30 * 24 * 60 * 60 * 1e3
-    };
-    DEFAULT_AUDIT_PATH = path4.join(
-      os2.homedir(),
-      ".apcore-cli",
-      "audit.jsonl"
-    );
-  }
-});
-
-// src/security/config-encryptor.ts
-import * as crypto2 from "crypto";
-import * as os3 from "os";
-async function getKeytar() {
-  if (keytarModule) return keytarModule;
-  try {
-    keytarModule = await import("keytar");
-    return keytarModule;
-  } catch {
-    return null;
-  }
-}
-var PBKDF2_ITERATIONS, V1_STATIC_SALT, keytarModule, ConfigEncryptor;
-var init_config_encryptor = __esm({
-  "src/security/config-encryptor.ts"() {
+var ApcliGroupError, DEFAULT_BUILTIN_GROUP_NAME, RESERVED_GROUP_NAMES, _effectiveReservedNames, _NAME_REGEX, VALID_USER_MODES, APCLI_SUBCOMMAND_NAMES, ApcliGroup;
+var init_builtin_group = __esm({
+  "src/builtin-group.ts"() {
     "use strict";
     init_esm_shims();
     init_errors();
     init_logger();
-    PBKDF2_ITERATIONS = 6e5;
-    V1_STATIC_SALT = Buffer.from("apcore-cli-config-v1");
-    keytarModule = null;
-    ConfigEncryptor = class _ConfigEncryptor {
-      static SERVICE_NAME = "apcore-cli";
-      // One-shot flag so the "obfuscation only" warning fires exactly once
-      // per process instead of once per encrypt/decrypt call.
-      static weakFallbackWarned = false;
+    ApcliGroupError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ApcliGroupError";
+      }
+    };
+    DEFAULT_BUILTIN_GROUP_NAME = "apcli";
+    RESERVED_GROUP_NAMES = /* @__PURE__ */ new Set([DEFAULT_BUILTIN_GROUP_NAME]);
+    _effectiveReservedNames = RESERVED_GROUP_NAMES;
+    _NAME_REGEX = /^[a-z][a-z0-9_-]*$/;
+    VALID_USER_MODES = /* @__PURE__ */ new Set([
+      "all",
+      "none",
+      "include",
+      "exclude"
+    ]);
+    APCLI_SUBCOMMAND_NAMES = /* @__PURE__ */ new Set([
+      "list",
+      "describe",
+      "exec",
+      "validate",
+      "init",
+      "health",
+      "usage",
+      "enable",
+      "disable",
+      "reload",
+      "config",
+      "completion",
+      "describe-pipeline"
+    ]);
+    ApcliGroup = class _ApcliGroup {
+      _mode;
+      _include;
+      _exclude;
+      _disableEnv;
+      _registryInjected;
+      _fromCliConfig;
+      _name;
+      constructor(init) {
+        this._mode = init.mode;
+        this._include = init.include;
+        this._exclude = init.exclude;
+        this._disableEnv = init.disableEnv;
+        this._registryInjected = init.registryInjected;
+        this._fromCliConfig = init.fromCliConfig;
+        this._name = init.name;
+      }
       /**
-       * Encrypt and store a configuration value.
+       * Resolved name for the built-in command group (default `"apcli"`).
+       * Overridable via createCli's `builtinGroupName` option for downstream
+       * branded CLIs that want a custom namespace. Cross-SDK parity with
+       * Python `ApcliGroup.name` (2026-05-08).
+       */
+      get name() {
+        return this._name;
+      }
+      /**
+       * Tier 1 constructor — config came from `createCli({ apcli })`.
        *
-       * Cross-SDK contract (D10-003, 2026-04-26): when the OS keyring is
-       * detected as available but `setPassword` then throws (locked keyring,
-       * transient backend failure, permission revoked, etc.), the error is
-       * propagated wrapped in a `ConfigDecryptionError`. Previously TS
-       * caught the exception and silently fell through to AES file encryption
-       * — a quiet downgrade that surprised users who expected a hard failure.
-       * Python lets the keyring exception propagate raw; Rust returns
-       * `ConfigDecryptionError::KeyringError`. The fall-through to AES is
-       * still reached when `getKeytar()` returns `null` (keyring
-       * genuinely unavailable on this platform / install).
+       * A non-auto mode from this tier wins over env var and yaml.
        */
-      async store(key, value) {
-        const keytar = await getKeytar();
-        if (keytar) {
-          try {
-            await keytar.setPassword(_ConfigEncryptor.SERVICE_NAME, key, value);
-            return `keyring:${key}`;
-          } catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            throw new ConfigDecryptionError(
-              `Failed to store '${key}' in OS keyring: ${detail}. Unset APCORE_CLI_CONFIG_PASSPHRASE-aware backends or unlock the keyring before retrying.`
-            );
-          }
-        }
-        warn("OS keyring unavailable. Using file-based encryption.");
-        const ciphertext = this.aesEncrypt(value);
-        return `enc:v2:${ciphertext.toString("base64")}`;
+      static fromCliConfig(config, opts) {
+        return _ApcliGroup._build(
+          config,
+          opts,
+          /*fromCliConfig*/
+          true
+        );
       }
       /**
-       * Retrieve and decrypt a configuration value.
+       * Tier 3 constructor — config came from `apcore.yaml`.
+       *
+       * Env var (Tier 2) may override the yaml-supplied mode.
        */
-      async retrieve(configValue, key) {
-        if (configValue.startsWith("keyring:")) {
-          const keytar = await getKeytar();
-          if (!keytar) {
-            throw new ConfigDecryptionError(
-              `Keyring module not available to retrieve '${key}'.`
-            );
-          }
-          try {
-            const refKey = configValue.slice("keyring:".length);
-            const result = await keytar.getPassword(
-              _ConfigEncryptor.SERVICE_NAME,
-              refKey
-            );
-            if (result === null || result === void 0) {
-              throw new ConfigDecryptionError(
-                `Keyring entry not found for '${refKey}'.`
-              );
-            }
-            return result;
-          } catch (err) {
-            if (err instanceof ConfigDecryptionError) throw err;
-            throw new ConfigDecryptionError(
-              `Failed to retrieve from keyring: ${err}`
-            );
-          }
+      static fromYaml(config, opts) {
+        if (config !== null && config !== void 0 && typeof config !== "boolean" && (typeof config !== "object" || Array.isArray(config))) {
+          const got = Array.isArray(config) ? "array" : typeof config;
+          warn(
+            `apcore.yaml apcli has unexpected type ${got}; using auto-detect.`
+          );
+          return _ApcliGroup._build(
+            void 0,
+            opts,
+            /*fromCliConfig*/
+            false
+          );
         }
-        if (configValue.startsWith("enc:v2:")) {
-          const data = Buffer.from(configValue.slice("enc:v2:".length), "base64");
-          try {
-            return this.aesDecrypt(data);
-          } catch {
-            throw new ConfigDecryptionError(
-              `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`
-            );
-          }
+        return _ApcliGroup._build(
+          config,
+          opts,
+          /*fromCliConfig*/
+          false
+        );
+      }
+      /**
+       * Non-panicking Tier 3 factory (A-001 parity with Rust's `try_from_yaml`).
+       * Returns `[instance, null]` on success or `[null, errorMessage]` on invalid input.
+       * Use this in programmatic contexts where throwing/exiting is unwanted.
+       */
+      static tryFromYaml(config, opts) {
+        if (config !== null && config !== void 0 && typeof config !== "boolean" && (typeof config !== "object" || Array.isArray(config))) {
+          const got = Array.isArray(config) ? "array" : typeof config;
+          return [
+            null,
+            `apcore.yaml 'apcli:' must be a bool, object, or null; got ${got}`
+          ];
         }
-        if (configValue.startsWith("enc:")) {
-          const data = Buffer.from(configValue.slice("enc:".length), "base64");
-          try {
-            return this.aesDecryptV1(data);
-          } catch {
-            throw new ConfigDecryptionError(
-              `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`
-            );
+        if (config !== null && config !== void 0 && typeof config === "object" && !Array.isArray(config)) {
+          const mode = config["mode"];
+          if (mode !== void 0 && mode !== null) {
+            const validModes = ["all", "none", "include", "exclude"];
+            if (typeof mode !== "string" || !validModes.includes(mode)) {
+              return [null, `Invalid apcli mode: '${mode}'. Must be one of: all, none, include, exclude.`];
+            }
           }
         }
-        return configValue;
+        return [_ApcliGroup.fromYaml(config, opts), null];
       }
-      // Derive an AES-256 key with a provided salt (v2 format).
-      //
-      // Order of preference:
-      //   1. APCORE_CLI_CONFIG_PASSPHRASE env var — a real secret supplied by
-      //      the user; produces a key an attacker with filesystem read cannot
-      //      reconstruct without also knowing the passphrase.
-      //   2. hostname + username — obfuscation-only derivation for backward
-      //      compatibility. Emits a loud stderr warning on first use so
-      //      operators know the stored value is NOT protected against a
-      //      filesystem-read attacker.
-      deriveKey(salt) {
-        const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
-        if (passphrase && passphrase.length > 0) {
-          return crypto2.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, 32, "sha256");
+      // -------------------------------------------------------------------------
+      // Internal builder — shared by both factories
+      // -------------------------------------------------------------------------
+      static _build(config, opts, fromCliConfig) {
+        const name = opts.name ?? DEFAULT_BUILTIN_GROUP_NAME;
+        _validateBuiltinGroupName(name);
+        if (config === true) {
+          return new _ApcliGroup({
+            mode: "all",
+            include: [],
+            exclude: [],
+            disableEnv: false,
+            registryInjected: opts.registryInjected,
+            fromCliConfig,
+            name
+          });
         }
-        if (!_ConfigEncryptor.weakFallbackWarned) {
-          warn(
-            "APCORE_CLI_CONFIG_PASSPHRASE is not set. The `enc:v2:` fallback uses a key derived from hostname+username (non-secret inputs) and is OBFUSCATION ONLY \u2014 an attacker with filesystem read access can reconstruct the key. Set APCORE_CLI_CONFIG_PASSPHRASE or ensure the OS keyring is available for real encryption."
+        if (config === false) {
+          return new _ApcliGroup({
+            mode: "none",
+            include: [],
+            exclude: [],
+            disableEnv: false,
+            registryInjected: opts.registryInjected,
+            fromCliConfig,
+            name
+          });
+        }
+        if (config === void 0 || config === null) {
+          return new _ApcliGroup({
+            mode: "auto",
+            include: [],
+            exclude: [],
+            disableEnv: false,
+            registryInjected: opts.registryInjected,
+            fromCliConfig,
+            name
+          });
+        }
+        if (typeof config !== "object" || Array.isArray(config)) {
+          process.stderr.write(
+            `Error: apcli config must be a boolean or object; got ${Array.isArray(config) ? "array" : typeof config}.
+`
           );
-          _ConfigEncryptor.weakFallbackWarned = true;
+          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
         }
-        const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
-        const material = `${hostname2}:${username}`;
-        return crypto2.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, "sha256");
-      }
-      aesEncrypt(plaintext) {
-        const salt = crypto2.randomBytes(16);
-        const key = this.deriveKey(salt);
-        const nonce = crypto2.randomBytes(12);
-        const cipher = crypto2.createCipheriv("aes-256-gcm", key, nonce);
-        const ct = Buffer.concat([
-          cipher.update(plaintext, "utf-8"),
-          cipher.final()
-        ]);
-        const tag = cipher.getAuthTag();
-        return Buffer.concat([salt, nonce, tag, ct]);
-      }
-      aesDecrypt(data) {
-        const salt = data.subarray(0, 16);
-        const nonce = data.subarray(16, 28);
-        const tag = data.subarray(28, 44);
-        const ct = data.subarray(44);
-        const key = this.deriveKey(salt);
-        const decipher = crypto2.createDecipheriv("aes-256-gcm", key, nonce);
-        decipher.setAuthTag(tag);
-        return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf-8");
-      }
-      /** Decrypt legacy v1-format values: nonce(12)+tag(16)+ct, static salt. */
-      aesDecryptV1(data) {
-        const nonce = data.subarray(0, 12);
-        const tag = data.subarray(12, 28);
-        const ct = data.subarray(28);
-        const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
-        const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
-        const materials = passphrase ? [passphrase, `${hostname2}:${username}`] : [`${hostname2}:${username}`];
-        for (const material of materials) {
-          for (const iterations of [6e5, 1e5]) {
-            try {
-              const key = crypto2.pbkdf2Sync(material, V1_STATIC_SALT, iterations, 32, "sha256");
-              const decipher = crypto2.createDecipheriv("aes-256-gcm", key, nonce);
-              decipher.setAuthTag(tag);
-              return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf-8");
-            } catch {
-            }
+        const cfg = config;
+        let mode;
+        if (cfg.mode === void 0 || cfg.mode === null) {
+          mode = "auto";
+        } else if (typeof cfg.mode !== "string") {
+          process.stderr.write(
+            `Error: apcli.mode must be a string; got ${typeof cfg.mode}. Expected one of all|none|include|exclude.
+`
+          );
+          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
+        } else if (!VALID_USER_MODES.has(cfg.mode)) {
+          process.stderr.write(
+            `Error: apcli.mode '${cfg.mode}' is invalid. Expected one of all|none|include|exclude.
+`
+          );
+          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
+        } else {
+          mode = cfg.mode;
+        }
+        const include = _ApcliGroup._normalizeList(cfg.include, "include");
+        const exclude = _ApcliGroup._normalizeList(cfg.exclude, "exclude");
+        const rawDisableEnv = cfg.disableEnv !== void 0 ? cfg.disableEnv : cfg["disable_env"];
+        let disableEnv = false;
+        if (rawDisableEnv !== void 0) {
+          if (typeof rawDisableEnv === "boolean") {
+            disableEnv = rawDisableEnv;
+          } else {
+            warn(
+              `apcli.disable_env must be boolean; got ${typeof rawDisableEnv}. Treating as false.`
+            );
           }
         }
-        throw new Error("v1 decryption failed with all material+iteration combinations");
-      }
-    };
-  }
-});
-
-// src/security/auth.ts
-var AuthProvider;
-var init_auth = __esm({
-  "src/security/auth.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_errors();
-    init_config_encryptor();
-    AuthProvider = class {
-      config;
-      _encryptor;
-      constructor(config, encryptor) {
-        this.config = config;
-        this._encryptor = encryptor;
+        return new _ApcliGroup({
+          mode,
+          include,
+          exclude,
+          disableEnv,
+          registryInjected: opts.registryInjected,
+          fromCliConfig,
+          name
+        });
       }
       /**
-       * Resolve the active ConfigEncryptor instance.
+       * Normalize an include/exclude list. Non-array → warn and return [].
        *
-       * D11-005 (2026-05-12): three-tier fallback chain matching Python's
-       * `_get_encryptor` (auth.py:33): explicit constructor arg > peer attribute
-       * `config.encryptor` (set by embedders injecting forced-AES test fixtures
-       * or shared instances) > fresh `new ConfigEncryptor()`. Previously TS
-       * skipped the peer-attribute tier, silently giving embedders a different
-       * encryptor than the one they wired on the config.
-       */
-      getEncryptor() {
-        if (this._encryptor) return this._encryptor;
-        const fromConfig = this.config.encryptor;
-        if (fromConfig) return fromConfig;
-        return new ConfigEncryptor();
-      }
-      /**
-       * Retrieve the API key from the configured sources.
-       * Handles keyring: and enc: prefixes via ConfigEncryptor.
+       * Unknown but well-formed entries emit a WARNING (spec §7 error table,
+       * T-APCLI-25) but are retained in the returned list for forward-compat —
+       * if apcore-cli later adds a subcommand named `foo`, existing configs
+       * continue to work without a config change. At runtime, unknown names
+       * simply never match any registered subcommand.
        */
-      async getApiKey() {
-        const result = this.config.resolve(
-          "auth.api_key",
-          "--api-key",
-          "APCORE_AUTH_API_KEY"
-        );
-        if (result === null || result === void 0) {
-          return null;
+      static _normalizeList(raw, label) {
+        if (raw === void 0 || raw === null) return [];
+        if (!Array.isArray(raw)) {
+          warn(`apcli.${label} must be a list; got ${typeof raw}. Ignoring.`);
+          return [];
         }
-        const strResult = String(result);
-        if (strResult.startsWith("keyring:") || strResult.startsWith("enc:")) {
-          try {
-            return await this.getEncryptor().retrieve(strResult, "auth.api_key");
-          } catch (err) {
-            if (err instanceof ConfigDecryptionError) {
-              throw new AuthenticationError(
-                "Failed to decrypt stored API key. Re-store with 'apcli config set auth.api_key'."
+        const out = [];
+        for (const entry of raw) {
+          if (typeof entry === "string" && entry.length > 0) {
+            if (!APCLI_SUBCOMMAND_NAMES.has(entry)) {
+              warn(
+                `Unknown apcli subcommand '${entry}' in ${label} list \u2014 ignoring.`
               );
             }
-            throw err;
+            out.push(entry);
+          } else {
+            warn(`apcli.${label} contains non-string entry; skipping.`);
           }
         }
-        return strResult;
+        return out;
       }
+      // -------------------------------------------------------------------------
+      // Public API
+      // -------------------------------------------------------------------------
       /**
-       * Add authentication headers to an outgoing request.
+       * Resolve effective visibility mode after applying tier precedence.
        *
-       * Cross-SDK contract (D10-002, 2026-04-26): the input `headers` object
-       * is mutated **in place** and the same reference is returned. Callers
-       * that share the headers reference (the documented pattern in
-       * apcore-cli/docs/features/security.md §AuthProvider) can read
-       * `headers.Authorization` after the call without re-binding the
-       * return value. Python and Rust both mutate-and-return; TS previously
-       * spread into a new object, which silently broke shared-reference
-       * callers.
+       * Returns one of `"all" | "none" | "include" | "exclude"` — never `"auto"`.
+       *
+       * Tier order (spec §4.4):
+       *   1. CliConfig non-auto wins outright.
+       *   2. `APCORE_CLI_APCLI` env var (unless sealed by disableEnv).
+       *   3. yaml non-auto.
+       *   4. Auto-detect from registryInjected.
        */
-      async authenticateRequest(headers) {
-        const key = await this.getApiKey();
-        if (!key) {
-          throw new AuthenticationError(
-            "Remote registry requires authentication. Set --api-key, APCORE_AUTH_API_KEY, or auth.api_key in config."
-          );
+      resolveVisibility() {
+        if (this._fromCliConfig && this._mode !== "auto") {
+          return this._mode;
         }
-        if (/[\r\n]/.test(key)) {
-          throw new AuthenticationError(
-            "Malformed API key: contains invalid characters (CR/LF). Re-store with 'apcli config set auth.api_key'."
-          );
+        if (!this._disableEnv) {
+          const envMode = this._parseEnv(process.env.APCORE_CLI_APCLI);
+          if (envMode !== null) {
+            return envMode;
+          }
         }
-        headers.Authorization = `Bearer ${key.trim()}`;
-        return headers;
+        if (this._mode !== "auto") {
+          return this._mode;
+        }
+        return this._registryInjected ? "none" : "all";
       }
       /**
-       * Handle an HTTP response status code for auth-related errors.
+       * True iff `subcommand` passes the include/exclude filter.
+       *
+       * Callers MUST first check {@link resolveVisibility} — this method throws
+       * under modes `"all"` or `"none"` (caller bug per spec §4.6).
        */
-      handleResponse(statusCode) {
-        if (statusCode === 401 || statusCode === 403) {
-          throw new AuthenticationError(
-            "Authentication failed. Verify your API key."
-          );
-        }
+      isSubcommandIncluded(subcommand) {
+        const mode = this.resolveVisibility();
+        if (mode === "include") return this._include.includes(subcommand);
+        if (mode === "exclude") return !this._exclude.includes(subcommand);
+        throw new Error(
+          `isSubcommandIncluded called under mode '${mode}'; caller should bypass.`
+        );
       }
-    };
-  }
-});
-
-// src/security/index.ts
-var security_exports = {};
-__export(security_exports, {
-  AuditLogger: () => AuditLogger,
-  AuthProvider: () => AuthProvider,
-  ConfigEncryptor: () => ConfigEncryptor,
-  Sandbox: () => Sandbox,
-  getAuditLogger: () => getAuditLogger,
-  setAuditLogger: () => setAuditLogger
+      /** True iff the `apcli` group itself should appear in root `--help`. */
+      isGroupVisible() {
+        return this.resolveVisibility() !== "none";
+      }
+      // -------------------------------------------------------------------------
+      // Env parser (Tier 2) — co-located per spec §4.4
+      // -------------------------------------------------------------------------
+      /**
+       * Parse APCORE_CLI_APCLI. Case-insensitive.
+       *
+       * - `show` / `1` / `true` → `"all"`
+       * - `hide` / `0` / `false` → `"none"`
+       * - Empty / unset → `null`
+       * - Anything else → warn and return `null`
+       */
+      _parseEnv(raw) {
+        if (raw === void 0 || raw === "") return null;
+        const normalized = raw.trim().toLowerCase();
+        if (normalized === "") return null;
+        if (normalized === "show" || normalized === "1" || normalized === "true") {
+          return "all";
+        }
+        if (normalized === "hide" || normalized === "0" || normalized === "false") {
+          return "none";
+        }
+        warn(
+          `Unknown APCORE_CLI_APCLI value '${raw}', ignoring. Expected: show, hide, 1, 0, true, false.`
+        );
+        return null;
+      }
+    };
+  }
 });
-var init_security = __esm({
-  "src/security/index.ts"() {
+
+// src/cli.ts
+import { Command as Command2 } from "commander";
+function listAllDefinitions(registry) {
+  const defs = [];
+  for (const id of registry.list()) {
+    const def = registry.getDefinition(id);
+    if (def) defs.push(def);
+  }
+  return defs;
+}
+var init_cli = __esm({
+  "src/cli.ts"() {
     "use strict";
     init_esm_shims();
-    init_audit();
-    init_auth();
-    init_config_encryptor();
-    init_sandbox();
+    init_main();
+    init_display_helpers();
+    init_exposure();
+    init_logger();
+    init_builtin_group();
+    init_errors();
   }
 });
 
-// src/discovery.ts
-import { Command as Command2, Option as Option2 } from "commander";
-function validateTag(tag) {
-  if (!TAG_PATTERN.test(tag)) {
-    process.stderr.write(
-      `Error: Invalid tag format: '${tag}'. Tags must match [a-z][a-z0-9_-]*.
-`
-    );
-    process.exit(EXIT_CODES.INVALID_CLI_INPUT);
-  }
-}
-function collectTag(value, previous) {
-  return previous.concat([value]);
+// src/security/audit.ts
+var audit_exports = {};
+__export(audit_exports, {
+  AuditLogger: () => AuditLogger,
+  canonicalizeForHash: () => canonicalizeForHash,
+  getAuditLogger: () => getAuditLogger,
+  setAuditLogger: () => setAuditLogger
+});
+import * as crypto from "crypto";
+import * as fs3 from "fs";
+import * as os from "os";
+import * as path3 from "path";
+function setAuditLogger(auditLogger) {
+  _auditLogger = auditLogger;
 }
-function collectAnnotation(value, previous) {
-  return previous.concat([value]);
+function getAuditLogger() {
+  return _auditLogger;
 }
-function getAnnotationFlag(moduleDef, flag) {
-  const annotations = moduleDef.annotations;
-  if (!annotations || typeof annotations !== "object") return false;
-  const ann = annotations;
-  const map = {
-    "destructive": "destructive",
-    "requires-approval": "requires_approval",
-    "readonly": "readonly",
-    "streaming": "streaming",
-    "cacheable": "cacheable",
-    "idempotent": "idempotent",
-    "paginated": "paginated"
-  };
-  const attr = map[flag] ?? flag;
-  return ann[attr] === true;
+function canonicalizeForHash(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(canonicalizeForHash);
+  const src = value;
+  const sorted = {};
+  for (const key of Object.keys(src).sort()) {
+    sorted[key] = canonicalizeForHash(src[key]);
+  }
+  return sorted;
 }
-function registerListCommand(apcliGroup, registry, exposureFilter) {
-  const listCmd = new Command2("list").description("List available modules in the registry.").option("--tag <tag>", "Filter modules by tag (AND logic). Repeatable.", collectTag, []).option("--flat", "Show flat list (no grouping).", false).addOption(
-    new Option2("--format <format>", "Output format.").choices(["table", "json", "csv", "yaml", "jsonl", "markdown", "skill"])
-  ).option("-s, --search <query>", "Filter by substring match on ID and description.").addOption(
-    new Option2("--status <status>", "Filter by module status.").choices(["enabled", "disabled", "all"]).default("enabled")
-  ).option("-a, --annotation <flag>", "Filter by annotation flag (AND logic). Repeatable.", collectAnnotation, []).addOption(
-    new Option2("--sort <field>", "Sort order.").choices(["id", "calls", "errors", "latency"]).default("id")
-  ).option("--reverse", "Reverse sort order.", false).option("--deprecated", "Include deprecated modules.", false).option("--deps", "Show dependency count column.", false).addOption(
-    new Option2("--exposure <mode>", "Filter by exposure status.").choices(["exposed", "hidden", "all"]).default("exposed")
-  ).action((opts) => {
-    for (const t of opts.tag) {
-      validateTag(t);
-    }
-    let modules = [];
-    for (const m of registry.listModules()) {
-      modules.push(m);
-    }
-    if (opts.tag.length > 0) {
-      const filterTags = new Set(opts.tag);
-      modules = modules.filter((m) => {
-        const mTags = m.tags ?? [];
-        return [...filterTags].every((t) => mTags.includes(t));
-      });
-    }
-    if (opts.search) {
-      const query = opts.search.toLowerCase();
-      modules = modules.filter(
-        (m) => (m.id ?? "").toLowerCase().includes(query) || (m.description ?? "").toLowerCase().includes(query)
+var _auditLogger, AuditLogger;
+var init_audit = __esm({
+  "src/security/audit.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    _auditLogger = null;
+    AuditLogger = class _AuditLogger {
+      static DEFAULT_PATH = path3.join(
+        os.homedir(),
+        ".apcore-cli",
+        "audit.jsonl"
       );
-    }
-    if (opts.status === "enabled") {
-      modules = modules.filter((m) => {
-        const enabled = m.enabled;
-        return enabled !== false;
-      });
-    } else if (opts.status === "disabled") {
-      modules = modules.filter((m) => {
-        const enabled = m.enabled;
-        return enabled === false;
-      });
-    }
-    if (!opts.deprecated) {
-      modules = modules.filter((m) => {
-        const deprecated = m.deprecated;
-        return deprecated !== true;
-      });
-    }
-    if (opts.annotation.length > 0) {
-      for (const annFlag of opts.annotation) {
-        modules = modules.filter((m) => getAnnotationFlag(m, annFlag));
+      logPath;
+      writeFailureWarned = false;
+      constructor(path6) {
+        this.logPath = path6 ?? _AuditLogger.DEFAULT_PATH;
+        this.ensureDirectory();
       }
-    }
-    if (opts.sort === "calls" || opts.sort === "errors" || opts.sort === "latency") {
-      const { used } = sortModulesByUsage(modules, opts.sort, { reverse: !opts.reverse });
-      if (!used) {
-        process.stderr.write(
-          `note: no usage data available for --sort ${opts.sort}; sorted by id. Run some modules first to populate ~/.apcore-cli/audit.jsonl.
-`
-        );
+      ensureDirectory() {
+        const dir = path3.dirname(this.logPath);
+        try {
+          fs3.mkdirSync(dir, { recursive: true });
+          try {
+            fs3.chmodSync(dir, 448);
+          } catch {
+          }
+        } catch {
+        }
       }
-    } else {
-      modules.sort((a, b) => (a.id ?? "").localeCompare(b.id ?? ""));
-      if (opts.reverse) {
-        modules.reverse();
+      logExecution(moduleId, inputData, status, exitCode, durationMs) {
+        const entry = {
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          user: this.getUser(),
+          module_id: moduleId,
+          input_hash: this.hashInput(inputData),
+          status,
+          exit_code: exitCode,
+          duration_ms: durationMs
+        };
+        try {
+          fs3.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
+          try {
+            fs3.chmodSync(this.logPath, 384);
+          } catch {
+          }
+        } catch (err) {
+          if (!this.writeFailureWarned) {
+            this.writeFailureWarned = true;
+            warn(`Could not write audit log: ${err}`);
+          }
+        }
       }
-    }
-    let showExposureCol = false;
-    if (exposureFilter && opts.exposure !== "all") {
-      if (opts.exposure === "exposed") {
-        modules = modules.filter((m) => exposureFilter.isExposed(m.id ?? ""));
-      } else if (opts.exposure === "hidden") {
-        modules = modules.filter((m) => !exposureFilter.isExposed(m.id ?? ""));
+      hashInput(inputData) {
+        const salt = crypto.randomBytes(16);
+        const payload = JSON.stringify(canonicalizeForHash(inputData));
+        return crypto.createHash("sha256").update(Buffer.concat([salt, Buffer.from(payload, "utf-8")])).digest("hex");
       }
-    }
-    if (opts.exposure === "all" && exposureFilter) {
-      showExposureCol = true;
-    }
-    const fmt = resolveFormat(opts.format);
-    const filterTagsArg = opts.tag.length > 0 ? opts.tag : void 0;
-    void formatModuleList(modules, fmt, filterTagsArg, opts.deps, showExposureCol ? exposureFilter : void 0);
-  });
-  apcliGroup.addCommand(listCmd);
-}
-function registerDescribeCommand(apcliGroup, registry) {
-  const describeCmd = new Command2("describe").description("Show metadata, schema, and annotations for a module.").argument("<module-id>", "Module ID to describe").addOption(
-    new Option2("--format <format>", "Output format.").choices(["table", "json", "csv", "yaml", "jsonl", "markdown", "skill"])
-  ).action((moduleId, opts) => {
-    validateModuleId(moduleId);
-    const moduleDef = registry.getModule(moduleId);
-    if (!moduleDef) {
-      process.stderr.write(
-        `Error: Module '${moduleId}' not found.
-`
-      );
-      process.exit(EXIT_CODES.MODULE_NOT_FOUND);
-    }
-    const fmt = resolveFormat(opts.format);
-    void formatModuleDetail(moduleDef, fmt);
-  });
-  apcliGroup.addCommand(describeCmd);
-}
-function registerExecCommand(apcliGroup, registry, executor) {
-  const execCmd = new Command2("exec").description("Execute a module by ID with JSON input.").argument("<module-id>", "Module ID to execute").option("--format <format>", "Output format (json, table, csv, yaml, jsonl).").option("--fields <fields>", "Comma-separated dot-paths to select from the result.").option(
-    "--input <json>",
-    "JSON object passed as input to the module. Use '-' to read JSON from stdin."
-  ).option("-y, --yes", "Auto-approve if the module declares requires_approval.", false).option(
-    "--approval-timeout <seconds>",
-    "Seconds to wait for interactive approval.",
-    parseInt
-  ).option("--sandbox", "Run module in an isolated subprocess with restricted env.", false).option("--strategy <name>", "Execution strategy (standard, parallel, sequential, etc.).").option("--trace", "Enable pipeline trace output.", false).option("--dry-run", "Validate inputs without executing the module.", false).option("--stream", "Stream output as JSONL instead of buffering.", false).action(async (moduleId, opts) => {
-    validateModuleId(moduleId);
-    const moduleDef = registry.getModule(moduleId);
-    if (!moduleDef) {
-      process.stderr.write(`Error: Module '${moduleId}' not found.
-`);
-      process.exit(EXIT_CODES.MODULE_NOT_FOUND);
-    }
-    let merged = {};
-    if (opts.input === "-") {
-      merged = await collectInput("-", {}, false);
-    } else if (opts.input !== void 0) {
-      try {
-        const parsed = JSON.parse(opts.input);
-        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-          process.stderr.write("Error: --input JSON must be an object.\n");
-          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
+      getUser() {
+        try {
+          return os.userInfo().username;
+        } catch {
+          return process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         }
-        merged = parsed;
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`Error: --input is not valid JSON: ${msg}
-`);
-        process.exit(EXIT_CODES.INVALID_CLI_INPUT);
       }
-    }
-    const startTime = performance.now();
+    };
+  }
+});
+
+// src/system-usage.ts
+import * as fs4 from "fs";
+import * as os2 from "os";
+import * as path4 from "path";
+function computeSummary(options = {}) {
+  const auditPath = options.auditPath ?? DEFAULT_AUDIT_PATH;
+  const period = options.period ?? "24h";
+  const cutoff = (options.now ?? /* @__PURE__ */ new Date()).getTime() - PERIOD_TO_MS[period];
+  if (!fs4.existsSync(auditPath)) {
+    return /* @__PURE__ */ new Map();
+  }
+  let raw;
+  try {
+    raw = fs4.readFileSync(auditPath, "utf-8");
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  const counts = /* @__PURE__ */ new Map();
+  const errors = /* @__PURE__ */ new Map();
+  const latencySum = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry;
     try {
-      await checkApproval(moduleDef, opts.yes, opts.approvalTimeout);
-      if (opts.dryRun) {
-        if (executor.validate) {
-          const preflight = await executor.validate(moduleId, merged);
-          formatPreflightResult(preflight, opts.format);
-        } else {
-          process.stdout.write(JSON.stringify({ valid: true }) + "\n");
-        }
-        return;
-      }
-      let result;
-      if ((opts.trace || opts.strategy) && executor.callWithTrace) {
-        const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });
-        result = res;
-      } else {
-        const { Sandbox: Sandbox2 } = await Promise.resolve().then(() => (init_security(), security_exports));
-        const sandbox = new Sandbox2(opts.sandbox);
-        result = await sandbox.execute(moduleId, merged, executor);
-      }
-      const durationMs = Math.round(performance.now() - startTime);
-      const fmt = resolveFormat(opts.format);
-      formatExecResult(result, fmt, opts.fields);
-      const auditLogger = getAuditLogger();
-      if (auditLogger) {
-        auditLogger.logExecution(moduleId, merged, "success", 0, durationMs);
-      }
-    } catch (err) {
-      const exitCode = exitCodeForError(err);
-      const durationMs = Math.round(performance.now() - startTime);
-      try {
-        const auditLogger = getAuditLogger();
-        if (auditLogger) {
-          auditLogger.logExecution(moduleId, merged, "error", exitCode, durationMs);
-        }
-      } catch {
-      }
-      process.stderr.write(`Error: ${err instanceof Error ? err.message : err}
-`);
-      process.exit(exitCode);
-    }
-  });
-  apcliGroup.addCommand(execCmd);
-}
-function registerValidateCommand(cli, registry, executor) {
-  const validateCmd = new Command2("validate").description("Run preflight checks without executing a module.").argument("<module-id>", "Module ID to validate").option("--input <source>", "JSON input file or '-' for stdin.").option("--format <format>", "Output format.").action(async (moduleId, opts) => {
-    validateModuleId(moduleId);
-    const moduleDef = registry.getModule(moduleId);
-    if (!moduleDef) {
-      process.stderr.write(`Error: Module '${moduleId}' not found.
-`);
-      process.exit(EXIT_CODES.MODULE_NOT_FOUND);
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
     }
-    const merged = opts.input ? await collectInput(opts.input, {}, false) : {};
-    if (!executor.validate) {
-      process.stderr.write("Error: Executor does not support validate.\n");
-      process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);
+    const ts = typeof entry.timestamp === "string" ? Date.parse(entry.timestamp) : NaN;
+    if (Number.isNaN(ts) || ts < cutoff) continue;
+    const moduleId = typeof entry.module_id === "string" ? entry.module_id : null;
+    if (!moduleId) continue;
+    counts.set(moduleId, (counts.get(moduleId) ?? 0) + 1);
+    if (entry.status === "error") {
+      errors.set(moduleId, (errors.get(moduleId) ?? 0) + 1);
     }
-    try {
-      const preflight = await executor.validate(moduleId, merged);
-      formatPreflightResult(preflight, opts.format);
-      process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));
-    } catch (err) {
-      const exitCode = exitCodeForError(err);
-      try {
-        const auditLogger = getAuditLogger();
-        if (auditLogger) {
-          auditLogger.logExecution(moduleId, merged, "error", exitCode, 0);
-        }
-      } catch {
-      }
-      process.stderr.write(`Error: ${err instanceof Error ? err.message : err}
-`);
-      process.exit(exitCode);
+    const duration = entry.duration_ms;
+    if (typeof duration === "number") {
+      latencySum.set(moduleId, (latencySum.get(moduleId) ?? 0) + duration);
     }
-  });
-  cli.addCommand(validateCmd);
-}
-var TAG_PATTERN;
-var init_discovery = __esm({
-  "src/discovery.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_approval();
-    init_errors();
-    init_main();
-    init_output();
-    init_audit();
-    init_system_usage();
-    TAG_PATTERN = /^[a-z][a-z0-9_-]*$/;
   }
-});
-
-// src/system-cmd.ts
-import { Command as Command3 } from "commander";
-async function callSystemModule(executor, moduleId, inputs) {
-  if (executor.call) {
-    return executor.call(moduleId, inputs);
+  const out = /* @__PURE__ */ new Map();
+  for (const [id, calls] of counts) {
+    out.set(id, {
+      module_id: id,
+      calls,
+      errors: errors.get(id) ?? 0,
+      latency_ms: calls > 0 ? (latencySum.get(id) ?? 0) / calls : 0
+    });
   }
-  return executor.execute(moduleId, inputs);
+  return out;
 }
-function emitResult(jsonPayload, fmt, ttyRender) {
-  if (fmt === "json" || !process.stdout.isTTY) {
-    process.stdout.write(JSON.stringify(jsonPayload, null, 2) + "\n");
-  } else {
-    ttyRender();
+function sortModulesByUsage(modules, field, options = {}) {
+  const reverse = options.reverse ?? true;
+  const summary = computeSummary({
+    auditPath: options.auditPath,
+    period: options.period
+  });
+  const idOf = (m) => m.moduleId ?? m.id ?? m.module_id ?? "";
+  if (summary.size === 0) {
+    modules.sort((a, b) => idOf(a).localeCompare(idOf(b)));
+    if (reverse) modules.reverse();
+    return { used: false };
   }
-}
-function emitErrorAndExit(e) {
-  process.stderr.write(`Error: ${e instanceof Error ? e.message : e}
-`);
-  process.exit(exitCodeForError(e));
-}
-async function requireApprovalForSystemCommand(moduleId, autoApprove) {
-  const syntheticModuleDef = {
-    id: moduleId,
-    name: moduleId,
-    description: `system command: ${moduleId}`,
-    annotations: { requires_approval: true }
+  const key = (m) => {
+    const id = idOf(m);
+    const s = summary.get(id);
+    if (!s) return 0;
+    return field === "latency" ? s.latency_ms : field === "calls" ? s.calls : s.errors;
   };
-  await checkApproval(syntheticModuleDef, autoApprove, void 0);
+  modules.sort((a, b) => {
+    const diff = key(a) - key(b);
+    if (diff !== 0) return reverse ? -diff : diff;
+    return idOf(a).localeCompare(idOf(b));
+  });
+  return { used: true };
 }
-function formatHealthSummaryTty(result) {
-  const summary = result.summary ?? {};
-  const modules = result.modules ?? [];
-  if (modules.length === 0) {
-    process.stdout.write("No modules found.\n");
-    return;
-  }
-  const total = summary.total_modules ?? modules.length;
-  process.stdout.write(`Health Overview (${total} modules)
-
-`);
-  process.stdout.write(`  ${"Module".padEnd(28)} ${"Status".padEnd(12)} ${"Error Rate".padEnd(12)} Top Error
-`);
-  process.stdout.write(`  ${"-".repeat(28)} ${"-".repeat(12)} ${"-".repeat(12)} ${"-".repeat(20)}
-`);
-  for (const m of modules) {
-    const top = m.top_error;
-    const topStr = top ? `${top.code} (${top.count ?? "?"})` : "\u2014";
-    const rate = `${((m.error_rate ?? 0) * 100).toFixed(1)}%`;
-    process.stdout.write(
-      `  ${String(m.module_id).padEnd(28)} ${String(m.status).padEnd(12)} ${rate.padEnd(12)} ${topStr}
-`
+var PERIOD_TO_MS, DEFAULT_AUDIT_PATH;
+var init_system_usage = __esm({
+  "src/system-usage.ts"() {
+    "use strict";
+    init_esm_shims();
+    PERIOD_TO_MS = {
+      "1h": 60 * 60 * 1e3,
+      "24h": 24 * 60 * 60 * 1e3,
+      "7d": 7 * 24 * 60 * 60 * 1e3,
+      "30d": 30 * 24 * 60 * 60 * 1e3
+    };
+    DEFAULT_AUDIT_PATH = path4.join(
+      os2.homedir(),
+      ".apcore-cli",
+      "audit.jsonl"
     );
   }
-  const parts = [];
-  for (const key of ["healthy", "degraded", "error"]) {
-    const count = summary[key];
-    if (count) parts.push(`${count} ${key}`);
-  }
-  process.stdout.write(`
-Summary: ${parts.join(", ") || "no data"}
-`);
-}
-function formatHealthModuleTty(result) {
-  process.stdout.write(`Module: ${result.module_id ?? "?"}
-`);
-  process.stdout.write(`Status: ${result.status ?? "unknown"}
-`);
-  const total = result.total_calls ?? 0;
-  const errors = result.error_count ?? 0;
-  const rate = result.error_rate ?? 0;
-  const avg = result.avg_latency_ms ?? 0;
-  const p99 = result.p99_latency_ms ?? 0;
-  process.stdout.write(`Calls: ${total.toLocaleString()} total | ${errors.toLocaleString()} errors | ${(rate * 100).toFixed(1)}% error rate
-`);
-  process.stdout.write(`Latency: ${avg.toFixed(0)}ms avg | ${p99.toFixed(0)}ms p99
-`);
-  const recent = result.recent_errors ?? [];
-  if (recent.length > 0) {
-    process.stdout.write(`
-Recent Errors (top ${recent.length}):
-`);
-    for (const e of recent) {
-      const count = e.count ?? "?";
-      const last = e.last_occurred ?? "?";
-      process.stdout.write(`  ${String(e.code ?? "?").padEnd(24)} x${count}  (last: ${last})
-`);
-    }
+});
+
+// src/security/config-encryptor.ts
+import * as crypto2 from "crypto";
+import * as os3 from "os";
+async function getKeytar() {
+  if (keytarModule) return keytarModule;
+  try {
+    keytarModule = await import("keytar");
+    return keytarModule;
+  } catch {
+    return null;
   }
 }
-function formatUsageSummaryTty(result) {
-  const modules = result.modules ?? [];
-  const period = result.period ?? "?";
-  if (modules.length === 0) {
-    process.stdout.write(`No usage data for period ${period}.
-`);
-    return;
-  }
-  process.stdout.write(`Usage Summary (last ${period})
-
-`);
-  process.stdout.write(`  ${"Module".padEnd(24)} ${"Calls".padStart(8)} ${"Errors".padStart(8)} ${"Avg Latency".padStart(12)} ${"Trend".padStart(10)}
-`);
-  process.stdout.write(`  ${"-".repeat(24)} ${"-".repeat(8)} ${"-".repeat(8)} ${"-".repeat(12)} ${"-".repeat(10)}
-`);
-  for (const m of modules) {
-    const avg = `${(m.avg_latency_ms ?? 0).toFixed(0)}ms`;
-    process.stdout.write(
-      `  ${String(m.module_id).padEnd(24)} ${String(m.call_count ?? 0).padStart(8)} ${String(m.error_count ?? 0).padStart(8)} ${avg.padStart(12)} ${String(m.trend ?? "").padStart(10)}
-`
-    );
-  }
-  const totalCalls = result.total_calls ?? modules.reduce((s, m) => s + (m.call_count ?? 0), 0);
-  const totalErrors = result.total_errors ?? modules.reduce((s, m) => s + (m.error_count ?? 0), 0);
-  process.stdout.write(`
-Total: ${totalCalls.toLocaleString()} calls | ${totalErrors.toLocaleString()} errors
-`);
-}
-function registerHealthCommand(apcliGroup, executor) {
-  const healthCmd = new Command3("health").description("Show module health status. Optionally specify a module ID for details.").argument("[module-id]", "Module ID for detailed health").option("--threshold <number>", "Error rate threshold (default: 0.01).", parseFloat, 0.01).option("--all", "Include healthy modules.", false).option("--errors <count>", "Max recent errors (module detail only).", parseInt, 10).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
-    const fmt = resolveFormat(opts.format);
-    try {
-      if (moduleId) {
-        const result = await callSystemModule(executor, "system.health.module", {
-          module_id: moduleId,
-          error_limit: opts.errors
-        });
-        emitResult(result, fmt, () => formatHealthModuleTty(result));
-      } else {
-        const result = await callSystemModule(executor, "system.health.summary", {
-          error_rate_threshold: opts.threshold,
-          include_healthy: opts.all
-        });
-        emitResult(result, fmt, () => formatHealthSummaryTty(result));
-      }
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  apcliGroup.addCommand(healthCmd);
-}
-function registerUsageCommand(apcliGroup, executor) {
-  const usageCmd = new Command3("usage").description("Show module usage statistics. Optionally specify a module ID for details.").argument("[module-id]", "Module ID for detailed usage").option("--period <period>", "Time window: 1h, 24h, 7d, 30d.", "24h").option("--format <format>", "Output format.").action(async (moduleId, opts) => {
-    const fmt = resolveFormat(opts.format);
-    try {
-      let result;
-      if (moduleId) {
-        result = await callSystemModule(executor, "system.usage.module", {
-          module_id: moduleId,
-          period: opts.period
-        });
-      } else {
-        result = await callSystemModule(executor, "system.usage.summary", {
-          period: opts.period
-        });
-      }
-      emitResult(result, fmt, () => {
-        if (moduleId) {
-          formatExecResult(result, fmt);
-        } else {
-          formatUsageSummaryTty(result);
-        }
-      });
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  apcliGroup.addCommand(usageCmd);
-}
-function registerEnableCommand(apcliGroup, executor) {
-  const enableCmd = new Command3("enable").description("Enable a disabled module at runtime.").argument("<module-id>", "Module ID to enable").requiredOption("--reason <reason>", "Reason for enabling (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
-    const fmt = resolveFormat(opts.format);
-    try {
-      await requireApprovalForSystemCommand("system.control.toggle_feature", opts.yes);
-      const result = await callSystemModule(executor, "system.control.toggle_feature", {
-        module_id: moduleId,
-        enabled: true,
-        reason: opts.reason
-      });
-      emitResult(result, fmt, () => {
-        process.stdout.write(`Module '${moduleId}' enabled.
-  Reason: ${opts.reason}
-`);
-      });
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  apcliGroup.addCommand(enableCmd);
-}
-function registerDisableCommand(apcliGroup, executor) {
-  const disableCmd = new Command3("disable").description("Disable a module at runtime (calls are rejected until re-enabled).").argument("<module-id>", "Module ID to disable").requiredOption("--reason <reason>", "Reason for disabling (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
-    const fmt = resolveFormat(opts.format);
-    try {
-      await requireApprovalForSystemCommand("system.control.toggle_feature", opts.yes);
-      const result = await callSystemModule(executor, "system.control.toggle_feature", {
-        module_id: moduleId,
-        enabled: false,
-        reason: opts.reason
-      });
-      emitResult(result, fmt, () => {
-        process.stdout.write(`Module '${moduleId}' disabled.
-  Reason: ${opts.reason}
-`);
-      });
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  apcliGroup.addCommand(disableCmd);
-}
-function registerReloadCommand(apcliGroup, executor) {
-  const reloadCmd = new Command3("reload").description("Hot-reload a module from disk.").argument("<module-id>", "Module ID to reload").requiredOption("--reason <reason>", "Reason for reload (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
-    const fmt = resolveFormat(opts.format);
-    try {
-      await requireApprovalForSystemCommand("system.control.reload_module", opts.yes);
-      const result = await callSystemModule(executor, "system.control.reload_module", {
-        module_id: moduleId,
-        reason: opts.reason
-      });
-      emitResult(result, fmt, () => {
-        const prev = result.previous_version ?? "?";
-        const newVer = result.new_version ?? "?";
-        const dur = result.reload_duration_ms ?? "?";
-        process.stdout.write(`Module '${moduleId}' reloaded.
-`);
-        process.stdout.write(`  Version: ${prev} -> ${newVer}
-`);
-        process.stdout.write(`  Duration: ${dur}ms
-`);
-      });
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  apcliGroup.addCommand(reloadCmd);
-}
-function registerConfigCommand(apcliGroup, executor) {
-  const configGroup = new Command3("config").description("Read or update runtime configuration.");
-  const configGetCmd = new Command3("get").description("Read a configuration value by dot-path key.").argument("<key>", "Configuration key (dot-path)").option("--format <format>", "Output format.", "table").action(async (key, opts) => {
-    const fmt = resolveFormat(opts.format);
-    try {
-      const result = await callSystemModule(executor, "system.config.get", { key });
-      const value = result?.value ?? result;
-      emitResult({ key, value }, fmt, () => {
-        process.stdout.write(`${key} = ${JSON.stringify(value)}
-`);
-      });
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  configGroup.addCommand(configGetCmd);
-  const configSetCmd = new Command3("set").description("Update a runtime configuration value (audit-logged; client-side approval gate applies).").argument("<key>", "Configuration key (dot-path)").argument("<value>", "New value").requiredOption("--reason <reason>", "Reason for config change (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (key, value, opts) => {
-    const fmt = resolveFormat(opts.format);
-    let parsedValue;
-    try {
-      parsedValue = JSON.parse(value);
-    } catch {
-      parsedValue = value;
-    }
-    try {
-      await requireApprovalForSystemCommand("system.control.update_config", opts.yes);
-      const result = await callSystemModule(executor, "system.control.update_config", {
-        key,
-        value: parsedValue,
-        reason: opts.reason
-      });
-      emitResult(result, fmt, () => {
-        const old = result.old_value ?? "?";
-        const newVal = result.new_value ?? "?";
-        process.stdout.write(`Config updated: ${key}
-`);
-        process.stdout.write(`  ${JSON.stringify(old)} -> ${JSON.stringify(newVal)}
-`);
-        process.stdout.write(`  Reason: ${opts.reason}
-`);
-      });
-    } catch (e) {
-      emitErrorAndExit(e);
-    }
-  });
-  configGroup.addCommand(configSetCmd);
-  apcliGroup.addCommand(configGroup);
-}
-var init_system_cmd = __esm({
-  "src/system-cmd.ts"() {
+var PBKDF2_ITERATIONS, V1_STATIC_SALT, keytarModule, ConfigEncryptor;
+var init_config_encryptor = __esm({
+  "src/security/config-encryptor.ts"() {
     "use strict";
     init_esm_shims();
-    init_approval();
     init_errors();
-    init_output();
+    init_logger();
+    PBKDF2_ITERATIONS = 6e5;
+    V1_STATIC_SALT = Buffer.from("apcore-cli-config-v1");
+    keytarModule = null;
+    ConfigEncryptor = class _ConfigEncryptor {
+      static SERVICE_NAME = "apcore-cli";
+      // One-shot flag so the "obfuscation only" warning fires exactly once
+      // per process instead of once per encrypt/decrypt call.
+      static weakFallbackWarned = false;
+      /**
+       * Encrypt and store a configuration value.
+       *
+       * Cross-SDK contract (D10-003, 2026-04-26): when the OS keyring is
+       * detected as available but `setPassword` then throws (locked keyring,
+       * transient backend failure, permission revoked, etc.), the error is
+       * propagated wrapped in a `ConfigDecryptionError`. Previously TS
+       * caught the exception and silently fell through to AES file encryption
+       * — a quiet downgrade that surprised users who expected a hard failure.
+       * Python lets the keyring exception propagate raw; Rust returns
+       * `ConfigDecryptionError::KeyringError`. The fall-through to AES is
+       * still reached when `getKeytar()` returns `null` (keyring
+       * genuinely unavailable on this platform / install).
+       */
+      async store(key, value) {
+        const keytar = await getKeytar();
+        if (keytar) {
+          try {
+            await keytar.setPassword(_ConfigEncryptor.SERVICE_NAME, key, value);
+            return `keyring:${key}`;
+          } catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new ConfigDecryptionError(
+              `Failed to store '${key}' in OS keyring: ${detail}. Unset APCORE_CLI_CONFIG_PASSPHRASE-aware backends or unlock the keyring before retrying.`
+            );
+          }
+        }
+        warn("OS keyring unavailable. Using file-based encryption.");
+        const ciphertext = this.aesEncrypt(value);
+        return `enc:v2:${ciphertext.toString("base64")}`;
+      }
+      /**
+       * Retrieve and decrypt a configuration value.
+       */
+      async retrieve(configValue, key) {
+        if (configValue.startsWith("keyring:")) {
+          const keytar = await getKeytar();
+          if (!keytar) {
+            throw new ConfigDecryptionError(
+              `Keyring module not available to retrieve '${key}'.`
+            );
+          }
+          try {
+            const refKey = configValue.slice("keyring:".length);
+            const result = await keytar.getPassword(
+              _ConfigEncryptor.SERVICE_NAME,
+              refKey
+            );
+            if (result === null || result === void 0) {
+              throw new ConfigDecryptionError(
+                `Keyring entry not found for '${refKey}'.`
+              );
+            }
+            return result;
+          } catch (err) {
+            if (err instanceof ConfigDecryptionError) throw err;
+            throw new ConfigDecryptionError(
+              `Failed to retrieve from keyring: ${err}`
+            );
+          }
+        }
+        if (configValue.startsWith("enc:v2:")) {
+          const data = Buffer.from(configValue.slice("enc:v2:".length), "base64");
+          try {
+            return this.aesDecrypt(data);
+          } catch {
+            throw new ConfigDecryptionError(
+              `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`
+            );
+          }
+        }
+        if (configValue.startsWith("enc:")) {
+          const data = Buffer.from(configValue.slice("enc:".length), "base64");
+          try {
+            return this.aesDecryptV1(data);
+          } catch {
+            throw new ConfigDecryptionError(
+              `Failed to decrypt configuration value '${key}'. Re-configure with 'apcore-cli config set ${key}'.`
+            );
+          }
+        }
+        return configValue;
+      }
+      // Derive an AES-256 key with a provided salt (v2 format).
+      //
+      // Order of preference:
+      //   1. APCORE_CLI_CONFIG_PASSPHRASE env var — a real secret supplied by
+      //      the user; produces a key an attacker with filesystem read cannot
+      //      reconstruct without also knowing the passphrase.
+      //   2. hostname + username — obfuscation-only derivation for backward
+      //      compatibility. Emits a loud stderr warning on first use so
+      //      operators know the stored value is NOT protected against a
+      //      filesystem-read attacker.
+      deriveKey(salt) {
+        const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
+        if (passphrase && passphrase.length > 0) {
+          return crypto2.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, 32, "sha256");
+        }
+        if (!_ConfigEncryptor.weakFallbackWarned) {
+          warn(
+            "APCORE_CLI_CONFIG_PASSPHRASE is not set. The `enc:v2:` fallback uses a key derived from hostname+username (non-secret inputs) and is OBFUSCATION ONLY \u2014 an attacker with filesystem read access can reconstruct the key. Set APCORE_CLI_CONFIG_PASSPHRASE or ensure the OS keyring is available for real encryption."
+          );
+          _ConfigEncryptor.weakFallbackWarned = true;
+        }
+        const hostname2 = os3.hostname();
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
+        const material = `${hostname2}:${username}`;
+        return crypto2.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, "sha256");
+      }
+      aesEncrypt(plaintext) {
+        const salt = crypto2.randomBytes(16);
+        const key = this.deriveKey(salt);
+        const nonce = crypto2.randomBytes(12);
+        const cipher = crypto2.createCipheriv("aes-256-gcm", key, nonce);
+        const ct = Buffer.concat([
+          cipher.update(plaintext, "utf-8"),
+          cipher.final()
+        ]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([salt, nonce, tag, ct]);
+      }
+      aesDecrypt(data) {
+        const salt = data.subarray(0, 16);
+        const nonce = data.subarray(16, 28);
+        const tag = data.subarray(28, 44);
+        const ct = data.subarray(44);
+        const key = this.deriveKey(salt);
+        const decipher = crypto2.createDecipheriv("aes-256-gcm", key, nonce);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf-8");
+      }
+      /** Decrypt legacy v1-format values: nonce(12)+tag(16)+ct, static salt. */
+      aesDecryptV1(data) {
+        const nonce = data.subarray(0, 12);
+        const tag = data.subarray(12, 28);
+        const ct = data.subarray(28);
+        const hostname2 = os3.hostname();
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
+        const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
+        const materials = passphrase ? [passphrase, `${hostname2}:${username}`] : [`${hostname2}:${username}`];
+        for (const material of materials) {
+          for (const iterations of [6e5, 1e5]) {
+            try {
+              const key = crypto2.pbkdf2Sync(material, V1_STATIC_SALT, iterations, 32, "sha256");
+              const decipher = crypto2.createDecipheriv("aes-256-gcm", key, nonce);
+              decipher.setAuthTag(tag);
+              return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf-8");
+            } catch {
+            }
+          }
+        }
+        throw new Error("v1 decryption failed with all material+iteration combinations");
+      }
+    };
   }
 });
 
-// src/strategy.ts
-import { Command as Command4, Option as Option3 } from "commander";
-function lookupStrategyInfo(executor, strategyName) {
-  if (typeof executor.describePipeline === "function") {
-    try {
-      const current = executor.describePipeline();
-      if (current && current.name === strategyName) {
-        return { info: current, isCurrent: true };
+// src/security/auth.ts
+var AuthProvider;
+var init_auth = __esm({
+  "src/security/auth.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_errors();
+    init_config_encryptor();
+    AuthProvider = class {
+      config;
+      _encryptor;
+      constructor(config, encryptor) {
+        this.config = config;
+        this._encryptor = encryptor;
+      }
+      /**
+       * Resolve the active ConfigEncryptor instance.
+       *
+       * D11-005 (2026-05-12): three-tier fallback chain matching Python's
+       * `_get_encryptor` (auth.py:33): explicit constructor arg > peer attribute
+       * `config.encryptor` (set by embedders injecting forced-AES test fixtures
+       * or shared instances) > fresh `new ConfigEncryptor()`. Previously TS
+       * skipped the peer-attribute tier, silently giving embedders a different
+       * encryptor than the one they wired on the config.
+       */
+      getEncryptor() {
+        if (this._encryptor) return this._encryptor;
+        const fromConfig = this.config.encryptor;
+        if (fromConfig) return fromConfig;
+        return new ConfigEncryptor();
+      }
+      /**
+       * Retrieve the API key from the configured sources.
+       * Handles keyring: and enc: prefixes via ConfigEncryptor.
+       */
+      async getApiKey() {
+        const result = this.config.resolve(
+          "auth.api_key",
+          "--api-key",
+          "APCORE_AUTH_API_KEY"
+        );
+        if (result === null || result === void 0) {
+          return null;
+        }
+        const strResult = String(result);
+        if (strResult.startsWith("keyring:") || strResult.startsWith("enc:")) {
+          try {
+            return await this.getEncryptor().retrieve(strResult, "auth.api_key");
+          } catch (err) {
+            if (err instanceof ConfigDecryptionError) {
+              throw new AuthenticationError(
+                "Failed to decrypt stored API key. Re-store with 'apcli config set auth.api_key'."
+              );
+            }
+            throw err;
+          }
+        }
+        return strResult;
+      }
+      /**
+       * Add authentication headers to an outgoing request.
+       *
+       * Cross-SDK contract (D10-002, 2026-04-26): the input `headers` object
+       * is mutated **in place** and the same reference is returned. Callers
+       * that share the headers reference (the documented pattern in
+       * apcore-cli/docs/features/security.md §AuthProvider) can read
+       * `headers.Authorization` after the call without re-binding the
+       * return value. Python and Rust both mutate-and-return; TS previously
+       * spread into a new object, which silently broke shared-reference
+       * callers.
+       */
+      async authenticateRequest(headers) {
+        const key = await this.getApiKey();
+        if (!key) {
+          throw new AuthenticationError(
+            "Remote registry requires authentication. Set --api-key, APCORE_AUTH_API_KEY, or auth.api_key in config."
+          );
+        }
+        if (/[\r\n]/.test(key)) {
+          throw new AuthenticationError(
+            "Malformed API key: contains invalid characters (CR/LF). Re-store with 'apcli config set auth.api_key'."
+          );
+        }
+        headers.Authorization = `Bearer ${key.trim()}`;
+        return headers;
       }
-    } catch {
-    }
-  }
-  const ctor = executor.constructor;
-  if (ctor && typeof ctor.listStrategies === "function") {
-    try {
-      const all = ctor.listStrategies();
-      const info = all.find((s) => s.name === strategyName) ?? null;
-      return { info, isCurrent: false };
-    } catch {
-      return { info: null, isCurrent: false };
-    }
-  }
-  return { info: null, isCurrent: false };
-}
-function registerPipelineCommand(cli, executor) {
-  const pipelineCmd = new Command4("describe-pipeline").description("Show the execution pipeline steps for a strategy.").addOption(
-    new Option3("--strategy <name>", "Strategy to describe (default: standard).").choices(["standard", "internal", "testing", "performance", "minimal"]).default("standard")
-  ).option("--format <format>", "Output format.").action((opts) => {
-    const fmt = resolveFormat(opts.format);
-    const { info, isCurrent } = lookupStrategyInfo(executor, opts.strategy);
-    if (info) {
-      const strategySteps = isCurrent ? executor.currentStrategy?.steps ?? [] : [];
-      const header = `Pipeline: ${info.name} (${info.stepCount} steps)`;
-      if (fmt === "json" || !process.stdout.isTTY) {
-        const payload = {
-          strategy: info.name,
-          step_count: info.stepCount,
-          description: info.description,
-          steps: info.stepNames.map((name, i) => {
-            const stepMeta = strategySteps[i];
-            return {
-              index: i + 1,
-              name,
-              pure: stepMeta?.pure ?? false,
-              removable: stepMeta?.removable ?? true,
-              timeout_ms: stepMeta?.timeoutMs ?? null
-            };
-          })
-        };
-        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
-      } else {
-        process.stdout.write(`${header}
-
-`);
-        process.stdout.write(`  ${"#".padEnd(4)} ${"Step".padEnd(28)} ${"Pure".padEnd(6)} ${"Removable".padEnd(11)} Timeout
-`);
-        process.stdout.write(`  ${"-".repeat(4)} ${"-".repeat(28)} ${"-".repeat(6)} ${"-".repeat(11)} ${"-".repeat(8)}
-`);
-        for (let i = 0; i < info.stepNames.length; i++) {
-          const stepMeta = strategySteps[i];
-          const pure = stepMeta?.pure ? "yes" : "no";
-          const removable = stepMeta?.removable !== false ? "yes" : "no";
-          const timeout = stepMeta?.timeoutMs ? `${stepMeta.timeoutMs}ms` : "\u2014";
-          process.stdout.write(`  ${String(i + 1).padEnd(4)} ${info.stepNames[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} ${timeout}
-`);
+      /**
+       * Handle an HTTP response status code for auth-related errors.
+       */
+      handleResponse(statusCode) {
+        if (statusCode === 401 || statusCode === 403) {
+          throw new AuthenticationError(
+            "Authentication failed. Verify your API key."
+          );
         }
       }
-      return;
-    }
-    const steps = PRESET_STEPS[opts.strategy] ?? [];
-    const pureSteps = /* @__PURE__ */ new Set([
-      "context_creation",
-      "call_chain_guard",
-      "module_lookup",
-      "acl_check",
-      "input_validation"
-    ]);
-    const nonRemovable = /* @__PURE__ */ new Set([
-      "context_creation",
-      "module_lookup",
-      "execute",
-      "return_result"
-    ]);
-    if (fmt === "json" || !process.stdout.isTTY) {
-      const payload = {
-        strategy: opts.strategy,
-        step_count: steps.length,
-        steps: steps.map((s, i) => ({
-          index: i + 1,
-          name: s,
-          pure: pureSteps.has(s),
-          removable: !nonRemovable.has(s)
-        }))
-      };
-      process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
-    } else {
-      process.stdout.write(`Pipeline: ${opts.strategy} (${steps.length} steps)
+    };
+  }
+});
 
-`);
-      process.stdout.write(`  ${"#".padEnd(4)} ${"Step".padEnd(28)} ${"Pure".padEnd(6)} ${"Removable".padEnd(11)} Timeout
-`);
-      process.stdout.write(`  ${"-".repeat(4)} ${"-".repeat(28)} ${"-".repeat(6)} ${"-".repeat(11)} ${"-".repeat(8)}
-`);
-      for (let i = 0; i < steps.length; i++) {
-        const pure = pureSteps.has(steps[i]) ? "yes" : "no";
-        const removable = nonRemovable.has(steps[i]) ? "no" : "yes";
-        process.stdout.write(`  ${String(i + 1).padEnd(4)} ${steps[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} \u2014
-`);
-      }
-    }
-  });
-  cli.addCommand(pipelineCmd);
-}
-var PRESET_STEPS;
-var init_strategy = __esm({
-  "src/strategy.ts"() {
+// src/security/index.ts
+var security_exports = {};
+__export(security_exports, {
+  AuditLogger: () => AuditLogger,
+  AuthProvider: () => AuthProvider,
+  ConfigEncryptor: () => ConfigEncryptor,
+  Sandbox: () => Sandbox,
+  getAuditLogger: () => getAuditLogger,
+  setAuditLogger: () => setAuditLogger
+});
+var init_security = __esm({
+  "src/security/index.ts"() {
     "use strict";
     init_esm_shims();
-    init_output();
-    PRESET_STEPS = {
-      standard: [
-        "context_creation",
-        "call_chain_guard",
-        "module_lookup",
-        "acl_check",
-        "approval_gate",
-        "middleware_before",
-        "input_validation",
-        "execute",
-        "output_validation",
-        "middleware_after",
-        "return_result"
-      ],
-      internal: [
-        "context_creation",
-        "call_chain_guard",
-        "module_lookup",
-        "middleware_before",
-        "input_validation",
-        "execute",
-        "output_validation",
-        "middleware_after",
-        "return_result"
-      ],
-      testing: [
-        "context_creation",
-        "module_lookup",
-        "middleware_before",
-        "input_validation",
-        "execute",
-        "output_validation",
-        "middleware_after",
-        "return_result"
-      ],
-      performance: [
-        "context_creation",
-        "call_chain_guard",
-        "module_lookup",
-        "acl_check",
-        "approval_gate",
-        "input_validation",
-        "execute",
-        "output_validation",
-        "return_result"
-      ],
-      minimal: [
-        "context_creation",
-        "module_lookup",
-        "execute",
-        "return_result"
-      ]
-    };
+    init_audit();
+    init_auth();
+    init_config_encryptor();
+    init_sandbox();
   }
 });
 
-// src/builtin-group.ts
-function setReservedGroupNames(names) {
-  _effectiveReservedNames = names;
-}
-function _validateBuiltinGroupName(name) {
-  if (!name || !_NAME_REGEX.test(name)) {
-    throw new ApcliGroupError(
-      `builtinGroupName ${JSON.stringify(name)} must match /^[a-z][a-z0-9_-]*$/ (non-empty, lowercase, alphanumeric + '_' / '-', leading letter).`
+// src/discovery.ts
+import { Command as Command3, Option as Option2 } from "commander";
+function validateTag(tag) {
+  if (!TAG_PATTERN.test(tag)) {
+    process.stderr.write(
+      `Error: Invalid tag format: '${tag}'. Tags must match [a-z][a-z0-9_-]*.
+`
     );
+    process.exit(EXIT_CODES.INVALID_CLI_INPUT);
   }
 }
-var ApcliGroupError, DEFAULT_BUILTIN_GROUP_NAME, RESERVED_GROUP_NAMES, _effectiveReservedNames, _NAME_REGEX, VALID_USER_MODES, APCLI_SUBCOMMAND_NAMES, ApcliGroup;
-var init_builtin_group = __esm({
-  "src/builtin-group.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_errors();
-    init_logger();
-    ApcliGroupError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "ApcliGroupError";
+function collectTag(value, previous) {
+  return previous.concat([value]);
+}
+function collectAnnotation(value, previous) {
+  return previous.concat([value]);
+}
+function getAnnotationFlag(moduleDef, flag) {
+  const annotations = moduleDef.annotations;
+  if (!annotations || typeof annotations !== "object") return false;
+  const ann = annotations;
+  const map = {
+    "destructive": "destructive",
+    "requires-approval": "requires_approval",
+    "readonly": "readonly",
+    "streaming": "streaming",
+    "cacheable": "cacheable",
+    "idempotent": "idempotent",
+    "paginated": "paginated"
+  };
+  const attr = map[flag] ?? flag;
+  return ann[attr] === true;
+}
+function registerListCommand(apcliGroup, registry, exposureFilter) {
+  const listCmd = new Command3("list").description("List available modules in the registry.").option("--tag <tag>", "Filter modules by tag (AND logic). Repeatable.", collectTag, []).option("--flat", "Show flat list (no grouping).", false).addOption(
+    new Option2("--format <format>", "Output format.").choices(["table", "json", "csv", "yaml", "jsonl", "markdown", "skill"])
+  ).option("-s, --search <query>", "Filter by substring match on ID and description.").addOption(
+    new Option2("--status <status>", "Filter by module status.").choices(["enabled", "disabled", "all"]).default("enabled")
+  ).option("-a, --annotation <flag>", "Filter by annotation flag (AND logic). Repeatable.", collectAnnotation, []).addOption(
+    new Option2("--sort <field>", "Sort order.").choices(["id", "calls", "errors", "latency"]).default("id")
+  ).option("--reverse", "Reverse sort order.", false).option("--deprecated", "Include deprecated modules.", false).option("--deps", "Show dependency count column.", false).addOption(
+    new Option2("--exposure <mode>", "Filter by exposure status.").choices(["exposed", "hidden", "all"]).default("exposed")
+  ).action((opts) => {
+    for (const t of opts.tag) {
+      validateTag(t);
+    }
+    let modules = [];
+    for (const m of listAllDefinitions(registry)) {
+      modules.push(m);
+    }
+    if (opts.tag.length > 0) {
+      const filterTags = new Set(opts.tag);
+      modules = modules.filter((m) => {
+        const mTags = m.tags ?? [];
+        return [...filterTags].every((t) => mTags.includes(t));
+      });
+    }
+    if (opts.search) {
+      const query = opts.search.toLowerCase();
+      modules = modules.filter(
+        (m) => (m.moduleId ?? "").toLowerCase().includes(query) || (m.description ?? "").toLowerCase().includes(query)
+      );
+    }
+    if (opts.status === "enabled") {
+      modules = modules.filter((m) => {
+        const enabled = m.enabled;
+        return enabled !== false;
+      });
+    } else if (opts.status === "disabled") {
+      modules = modules.filter((m) => {
+        const enabled = m.enabled;
+        return enabled === false;
+      });
+    }
+    if (!opts.deprecated) {
+      modules = modules.filter((m) => {
+        const deprecated = m.deprecated;
+        return deprecated !== true;
+      });
+    }
+    if (opts.annotation.length > 0) {
+      for (const annFlag of opts.annotation) {
+        modules = modules.filter((m) => getAnnotationFlag(m, annFlag));
       }
-    };
-    DEFAULT_BUILTIN_GROUP_NAME = "apcli";
-    RESERVED_GROUP_NAMES = /* @__PURE__ */ new Set([DEFAULT_BUILTIN_GROUP_NAME]);
-    _effectiveReservedNames = RESERVED_GROUP_NAMES;
-    _NAME_REGEX = /^[a-z][a-z0-9_-]*$/;
-    VALID_USER_MODES = /* @__PURE__ */ new Set([
-      "all",
-      "none",
-      "include",
-      "exclude"
-    ]);
-    APCLI_SUBCOMMAND_NAMES = /* @__PURE__ */ new Set([
-      "list",
-      "describe",
-      "exec",
-      "validate",
-      "init",
-      "health",
-      "usage",
-      "enable",
-      "disable",
-      "reload",
-      "config",
-      "completion",
-      "describe-pipeline"
-    ]);
-    ApcliGroup = class _ApcliGroup {
-      _mode;
-      _include;
-      _exclude;
-      _disableEnv;
-      _registryInjected;
-      _fromCliConfig;
-      _name;
-      constructor(init) {
-        this._mode = init.mode;
-        this._include = init.include;
-        this._exclude = init.exclude;
-        this._disableEnv = init.disableEnv;
-        this._registryInjected = init.registryInjected;
-        this._fromCliConfig = init.fromCliConfig;
-        this._name = init.name;
+    }
+    if (opts.sort === "calls" || opts.sort === "errors" || opts.sort === "latency") {
+      const { used } = sortModulesByUsage(modules, opts.sort, { reverse: !opts.reverse });
+      if (!used) {
+        process.stderr.write(
+          `note: no usage data available for --sort ${opts.sort}; sorted by id. Run some modules first to populate ~/.apcore-cli/audit.jsonl.
+`
+        );
       }
-      /**
-       * Resolved name for the built-in command group (default `"apcli"`).
-       * Overridable via createCli's `builtinGroupName` option for downstream
-       * branded CLIs that want a custom namespace. Cross-SDK parity with
-       * Python `ApcliGroup.name` (2026-05-08).
-       */
-      get name() {
-        return this._name;
+    } else {
+      modules.sort((a, b) => (a.moduleId ?? "").localeCompare(b.moduleId ?? ""));
+      if (opts.reverse) {
+        modules.reverse();
       }
-      /**
-       * Tier 1 constructor — config came from `createCli({ apcli })`.
-       *
-       * A non-auto mode from this tier wins over env var and yaml.
-       */
-      static fromCliConfig(config, opts) {
-        return _ApcliGroup._build(
-          config,
-          opts,
-          /*fromCliConfig*/
-          true
-        );
+    }
+    let showExposureCol = false;
+    if (exposureFilter && opts.exposure !== "all") {
+      if (opts.exposure === "exposed") {
+        modules = modules.filter((m) => exposureFilter.isExposed(m.moduleId ?? ""));
+      } else if (opts.exposure === "hidden") {
+        modules = modules.filter((m) => !exposureFilter.isExposed(m.moduleId ?? ""));
       }
-      /**
-       * Tier 3 constructor — config came from `apcore.yaml`.
-       *
-       * Env var (Tier 2) may override the yaml-supplied mode.
-       */
-      static fromYaml(config, opts) {
-        if (config !== null && config !== void 0 && typeof config !== "boolean" && (typeof config !== "object" || Array.isArray(config))) {
-          const got = Array.isArray(config) ? "array" : typeof config;
-          warn(
-            `apcore.yaml apcli has unexpected type ${got}; using auto-detect.`
-          );
-          return _ApcliGroup._build(
-            void 0,
-            opts,
-            /*fromCliConfig*/
-            false
-          );
+    }
+    if (opts.exposure === "all" && exposureFilter) {
+      showExposureCol = true;
+    }
+    const fmt = resolveFormat(opts.format);
+    const filterTagsArg = opts.tag.length > 0 ? opts.tag : void 0;
+    void formatModuleList(modules, fmt, filterTagsArg, opts.deps, showExposureCol ? exposureFilter : void 0);
+  });
+  apcliGroup.addCommand(listCmd);
+}
+function registerDescribeCommand(apcliGroup, registry) {
+  const describeCmd = new Command3("describe").description("Show metadata, schema, and annotations for a module.").argument("<module-id>", "Module ID to describe").addOption(
+    new Option2("--format <format>", "Output format.").choices(["table", "json", "csv", "yaml", "jsonl", "markdown", "skill"])
+  ).action((moduleId, opts) => {
+    validateModuleId(moduleId);
+    const moduleDef = registry.getDefinition(moduleId);
+    if (!moduleDef) {
+      process.stderr.write(
+        `Error: Module '${moduleId}' not found.
+`
+      );
+      process.exit(EXIT_CODES.MODULE_NOT_FOUND);
+    }
+    const fmt = resolveFormat(opts.format);
+    void formatModuleDetail(moduleDef, fmt);
+  });
+  apcliGroup.addCommand(describeCmd);
+}
+function registerExecCommand(apcliGroup, registry, executor) {
+  const execCmd = new Command3("exec").description("Execute a module by ID with JSON input.").argument("<module-id>", "Module ID to execute").option("--format <format>", "Output format (json, table, csv, yaml, jsonl).").option("--fields <fields>", "Comma-separated dot-paths to select from the result.").option(
+    "--input <json>",
+    "JSON object passed as input to the module. Use '-' to read JSON from stdin."
+  ).option("-y, --yes", "Auto-approve if the module declares requires_approval.", false).option(
+    "--approval-timeout <seconds>",
+    "Seconds to wait for interactive approval.",
+    parseInt
+  ).option("--sandbox", "Run module in an isolated subprocess with restricted env.", false).option("--strategy <name>", "Execution strategy (standard, parallel, sequential, etc.).").option("--trace", "Enable pipeline trace output.", false).option("--dry-run", "Validate inputs without executing the module.", false).option("--stream", "Stream output as JSONL instead of buffering.", false).action(async (moduleId, opts) => {
+    validateModuleId(moduleId);
+    const moduleDef = registry.getDefinition(moduleId);
+    if (!moduleDef) {
+      process.stderr.write(`Error: Module '${moduleId}' not found.
+`);
+      process.exit(EXIT_CODES.MODULE_NOT_FOUND);
+    }
+    let merged = {};
+    if (opts.input === "-") {
+      merged = await collectInput("-", {}, false);
+    } else if (opts.input !== void 0) {
+      try {
+        const parsed = JSON.parse(opts.input);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+          process.stderr.write("Error: --input JSON must be an object.\n");
+          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
         }
-        return _ApcliGroup._build(
-          config,
-          opts,
-          /*fromCliConfig*/
-          false
-        );
+        merged = parsed;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`Error: --input is not valid JSON: ${msg}
+`);
+        process.exit(EXIT_CODES.INVALID_CLI_INPUT);
       }
-      /**
-       * Non-panicking Tier 3 factory (A-001 parity with Rust's `try_from_yaml`).
-       * Returns `[instance, null]` on success or `[null, errorMessage]` on invalid input.
-       * Use this in programmatic contexts where throwing/exiting is unwanted.
-       */
-      static tryFromYaml(config, opts) {
-        if (config !== null && config !== void 0 && typeof config !== "boolean" && (typeof config !== "object" || Array.isArray(config))) {
-          const got = Array.isArray(config) ? "array" : typeof config;
-          return [
-            null,
-            `apcore.yaml 'apcli:' must be a bool, object, or null; got ${got}`
-          ];
-        }
-        if (config !== null && config !== void 0 && typeof config === "object" && !Array.isArray(config)) {
-          const mode = config["mode"];
-          if (mode !== void 0 && mode !== null) {
-            const validModes = ["all", "none", "include", "exclude"];
-            if (typeof mode !== "string" || !validModes.includes(mode)) {
-              return [null, `Invalid apcli mode: '${mode}'. Must be one of: all, none, include, exclude.`];
-            }
-          }
+    }
+    const startTime = performance.now();
+    try {
+      await checkApproval(moduleDef, opts.yes, opts.approvalTimeout);
+      if (opts.dryRun) {
+        if (executor.validate) {
+          const preflight = await executor.validate(moduleId, merged);
+          formatPreflightResult(preflight, opts.format);
+        } else {
+          process.stdout.write(JSON.stringify({ valid: true }) + "\n");
         }
-        return [_ApcliGroup.fromYaml(config, opts), null];
+        return;
       }
-      // -------------------------------------------------------------------------
-      // Internal builder — shared by both factories
-      // -------------------------------------------------------------------------
-      static _build(config, opts, fromCliConfig) {
-        const name = opts.name ?? DEFAULT_BUILTIN_GROUP_NAME;
-        _validateBuiltinGroupName(name);
-        if (config === true) {
-          return new _ApcliGroup({
-            mode: "all",
-            include: [],
-            exclude: [],
-            disableEnv: false,
-            registryInjected: opts.registryInjected,
-            fromCliConfig,
-            name
-          });
-        }
-        if (config === false) {
-          return new _ApcliGroup({
-            mode: "none",
-            include: [],
-            exclude: [],
-            disableEnv: false,
-            registryInjected: opts.registryInjected,
-            fromCliConfig,
-            name
-          });
-        }
-        if (config === void 0 || config === null) {
-          return new _ApcliGroup({
-            mode: "auto",
-            include: [],
-            exclude: [],
-            disableEnv: false,
-            registryInjected: opts.registryInjected,
-            fromCliConfig,
-            name
-          });
+      let result;
+      if ((opts.trace || opts.strategy) && executor.callWithTrace) {
+        const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });
+        result = res;
+      } else {
+        const { Sandbox: Sandbox2 } = await Promise.resolve().then(() => (init_security(), security_exports));
+        const sandbox = new Sandbox2(opts.sandbox);
+        result = await sandbox.execute(moduleId, merged, executor);
+      }
+      const durationMs = Math.round(performance.now() - startTime);
+      const fmt = resolveFormat(opts.format);
+      formatExecResult(result, fmt, opts.fields);
+      const auditLogger = getAuditLogger();
+      if (auditLogger) {
+        auditLogger.logExecution(moduleId, merged, "success", 0, durationMs);
+      }
+    } catch (err) {
+      const exitCode = exitCodeForError(err);
+      const durationMs = Math.round(performance.now() - startTime);
+      try {
+        const auditLogger = getAuditLogger();
+        if (auditLogger) {
+          auditLogger.logExecution(moduleId, merged, "error", exitCode, durationMs);
         }
-        if (typeof config !== "object" || Array.isArray(config)) {
-          process.stderr.write(
-            `Error: apcli config must be a boolean or object; got ${Array.isArray(config) ? "array" : typeof config}.
-`
-          );
-          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
+      } catch {
+      }
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : err}
+`);
+      process.exit(exitCode);
+    }
+  });
+  apcliGroup.addCommand(execCmd);
+}
+function registerValidateCommand(cli, registry, executor) {
+  const validateCmd = new Command3("validate").description("Run preflight checks without executing a module.").argument("<module-id>", "Module ID to validate").option("--input <source>", "JSON input file or '-' for stdin.").option("--format <format>", "Output format.").action(async (moduleId, opts) => {
+    validateModuleId(moduleId);
+    const moduleDef = registry.getDefinition(moduleId);
+    if (!moduleDef) {
+      process.stderr.write(`Error: Module '${moduleId}' not found.
+`);
+      process.exit(EXIT_CODES.MODULE_NOT_FOUND);
+    }
+    const merged = opts.input ? await collectInput(opts.input, {}, false) : {};
+    if (!executor.validate) {
+      process.stderr.write("Error: Executor does not support validate.\n");
+      process.exit(EXIT_CODES.MODULE_EXECUTE_ERROR);
+    }
+    try {
+      const preflight = await executor.validate(moduleId, merged);
+      formatPreflightResult(preflight, opts.format);
+      process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));
+    } catch (err) {
+      const exitCode = exitCodeForError(err);
+      try {
+        const auditLogger = getAuditLogger();
+        if (auditLogger) {
+          auditLogger.logExecution(moduleId, merged, "error", exitCode, 0);
         }
-        const cfg = config;
-        let mode;
-        if (cfg.mode === void 0 || cfg.mode === null) {
-          mode = "auto";
-        } else if (typeof cfg.mode !== "string") {
-          process.stderr.write(
-            `Error: apcli.mode must be a string; got ${typeof cfg.mode}. Expected one of all|none|include|exclude.
+      } catch {
+      }
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : err}
+`);
+      process.exit(exitCode);
+    }
+  });
+  cli.addCommand(validateCmd);
+}
+var TAG_PATTERN;
+var init_discovery = __esm({
+  "src/discovery.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_approval();
+    init_cli();
+    init_errors();
+    init_main();
+    init_output();
+    init_audit();
+    init_system_usage();
+    TAG_PATTERN = /^[a-z][a-z0-9_-]*$/;
+  }
+});
+
+// src/system-cmd.ts
+import { Command as Command4 } from "commander";
+import { Config } from "apcore-js";
+async function callSystemModule(executor, moduleId, inputs) {
+  return executor.call(moduleId, inputs);
+}
+function emitResult(jsonPayload, fmt, ttyRender) {
+  if (fmt === "json" || !process.stdout.isTTY) {
+    process.stdout.write(JSON.stringify(jsonPayload, null, 2) + "\n");
+  } else {
+    ttyRender();
+  }
+}
+function emitErrorAndExit(e) {
+  process.stderr.write(`Error: ${e instanceof Error ? e.message : e}
+`);
+  process.exit(exitCodeForError(e));
+}
+async function requireApprovalForSystemCommand(moduleId, autoApprove) {
+  const syntheticModuleDef = {
+    moduleId,
+    name: moduleId,
+    description: `system command: ${moduleId}`,
+    annotations: { requires_approval: true }
+  };
+  await checkApproval(syntheticModuleDef, autoApprove, void 0);
+}
+function formatHealthSummaryTty(result) {
+  const summary = result.summary ?? {};
+  const modules = result.modules ?? [];
+  if (modules.length === 0) {
+    process.stdout.write("No modules found.\n");
+    return;
+  }
+  const total = summary.total_modules ?? modules.length;
+  process.stdout.write(`Health Overview (${total} modules)
+
+`);
+  process.stdout.write(`  ${"Module".padEnd(28)} ${"Status".padEnd(12)} ${"Error Rate".padEnd(12)} Top Error
+`);
+  process.stdout.write(`  ${"-".repeat(28)} ${"-".repeat(12)} ${"-".repeat(12)} ${"-".repeat(20)}
+`);
+  for (const m of modules) {
+    const top = m.top_error;
+    const topStr = top ? `${top.code} (${top.count ?? "?"})` : "\u2014";
+    const rate = `${((m.error_rate ?? 0) * 100).toFixed(1)}%`;
+    process.stdout.write(
+      `  ${String(m.module_id).padEnd(28)} ${String(m.status).padEnd(12)} ${rate.padEnd(12)} ${topStr}
 `
-          );
-          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
-        } else if (!VALID_USER_MODES.has(cfg.mode)) {
-          process.stderr.write(
-            `Error: apcli.mode '${cfg.mode}' is invalid. Expected one of all|none|include|exclude.
+    );
+  }
+  const parts = [];
+  for (const key of ["healthy", "degraded", "error"]) {
+    const count = summary[key];
+    if (count) parts.push(`${count} ${key}`);
+  }
+  process.stdout.write(`
+Summary: ${parts.join(", ") || "no data"}
+`);
+}
+function formatHealthModuleTty(result) {
+  process.stdout.write(`Module: ${result.module_id ?? "?"}
+`);
+  process.stdout.write(`Status: ${result.status ?? "unknown"}
+`);
+  const total = result.total_calls ?? 0;
+  const errors = result.error_count ?? 0;
+  const rate = result.error_rate ?? 0;
+  const avg = result.avg_latency_ms ?? 0;
+  const p99 = result.p99_latency_ms ?? 0;
+  process.stdout.write(`Calls: ${total.toLocaleString()} total | ${errors.toLocaleString()} errors | ${(rate * 100).toFixed(1)}% error rate
+`);
+  process.stdout.write(`Latency: ${avg.toFixed(0)}ms avg | ${p99.toFixed(0)}ms p99
+`);
+  const recent = result.recent_errors ?? [];
+  if (recent.length > 0) {
+    process.stdout.write(`
+Recent Errors (top ${recent.length}):
+`);
+    for (const e of recent) {
+      const count = e.count ?? "?";
+      const last = e.last_occurred ?? "?";
+      process.stdout.write(`  ${String(e.code ?? "?").padEnd(24)} x${count}  (last: ${last})
+`);
+    }
+  }
+}
+function formatUsageSummaryTty(result) {
+  const modules = result.modules ?? [];
+  const period = result.period ?? "?";
+  if (modules.length === 0) {
+    process.stdout.write(`No usage data for period ${period}.
+`);
+    return;
+  }
+  process.stdout.write(`Usage Summary (last ${period})
+
+`);
+  process.stdout.write(`  ${"Module".padEnd(24)} ${"Calls".padStart(8)} ${"Errors".padStart(8)} ${"Avg Latency".padStart(12)} ${"Trend".padStart(10)}
+`);
+  process.stdout.write(`  ${"-".repeat(24)} ${"-".repeat(8)} ${"-".repeat(8)} ${"-".repeat(12)} ${"-".repeat(10)}
+`);
+  for (const m of modules) {
+    const avg = `${(m.avg_latency_ms ?? 0).toFixed(0)}ms`;
+    process.stdout.write(
+      `  ${String(m.module_id).padEnd(24)} ${String(m.call_count ?? 0).padStart(8)} ${String(m.error_count ?? 0).padStart(8)} ${avg.padStart(12)} ${String(m.trend ?? "").padStart(10)}
 `
-          );
-          process.exit(EXIT_CODES.INVALID_CLI_INPUT);
-        } else {
-          mode = cfg.mode;
-        }
-        const include = _ApcliGroup._normalizeList(cfg.include, "include");
-        const exclude = _ApcliGroup._normalizeList(cfg.exclude, "exclude");
-        const rawDisableEnv = cfg.disableEnv !== void 0 ? cfg.disableEnv : cfg["disable_env"];
-        let disableEnv = false;
-        if (rawDisableEnv !== void 0) {
-          if (typeof rawDisableEnv === "boolean") {
-            disableEnv = rawDisableEnv;
-          } else {
-            warn(
-              `apcli.disable_env must be boolean; got ${typeof rawDisableEnv}. Treating as false.`
-            );
-          }
-        }
-        return new _ApcliGroup({
-          mode,
-          include,
-          exclude,
-          disableEnv,
-          registryInjected: opts.registryInjected,
-          fromCliConfig,
-          name
+    );
+  }
+  const totalCalls = result.total_calls ?? modules.reduce((s, m) => s + (m.call_count ?? 0), 0);
+  const totalErrors = result.total_errors ?? modules.reduce((s, m) => s + (m.error_count ?? 0), 0);
+  process.stdout.write(`
+Total: ${totalCalls.toLocaleString()} calls | ${totalErrors.toLocaleString()} errors
+`);
+}
+function registerHealthCommand(apcliGroup, executor) {
+  const healthCmd = new Command4("health").description("Show module health status. Optionally specify a module ID for details.").argument("[module-id]", "Module ID for detailed health").option("--threshold <number>", "Error rate threshold (default: 0.01).", parseFloat, 0.01).option("--all", "Include healthy modules.", false).option("--errors <count>", "Max recent errors (module detail only).", parseInt, 10).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
+    const fmt = resolveFormat(opts.format);
+    try {
+      if (moduleId) {
+        const result = await callSystemModule(executor, "system.health.module", {
+          module_id: moduleId,
+          error_limit: opts.errors
+        });
+        emitResult(result, fmt, () => formatHealthModuleTty(result));
+      } else {
+        const result = await callSystemModule(executor, "system.health.summary", {
+          error_rate_threshold: opts.threshold,
+          include_healthy: opts.all
+        });
+        emitResult(result, fmt, () => formatHealthSummaryTty(result));
+      }
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  apcliGroup.addCommand(healthCmd);
+}
+function registerUsageCommand(apcliGroup, executor) {
+  const usageCmd = new Command4("usage").description("Show module usage statistics. Optionally specify a module ID for details.").argument("[module-id]", "Module ID for detailed usage").option("--period <period>", "Time window: 1h, 24h, 7d, 30d.", "24h").option("--format <format>", "Output format.").action(async (moduleId, opts) => {
+    const fmt = resolveFormat(opts.format);
+    try {
+      let result;
+      if (moduleId) {
+        result = await callSystemModule(executor, "system.usage.module", {
+          module_id: moduleId,
+          period: opts.period
+        });
+      } else {
+        result = await callSystemModule(executor, "system.usage.summary", {
+          period: opts.period
         });
       }
-      /**
-       * Normalize an include/exclude list. Non-array → warn and return [].
-       *
-       * Unknown but well-formed entries emit a WARNING (spec §7 error table,
-       * T-APCLI-25) but are retained in the returned list for forward-compat —
-       * if apcore-cli later adds a subcommand named `foo`, existing configs
-       * continue to work without a config change. At runtime, unknown names
-       * simply never match any registered subcommand.
-       */
-      static _normalizeList(raw, label) {
-        if (raw === void 0 || raw === null) return [];
-        if (!Array.isArray(raw)) {
-          warn(`apcli.${label} must be a list; got ${typeof raw}. Ignoring.`);
-          return [];
-        }
-        const out = [];
-        for (const entry of raw) {
-          if (typeof entry === "string" && entry.length > 0) {
-            if (!APCLI_SUBCOMMAND_NAMES.has(entry)) {
-              warn(
-                `Unknown apcli subcommand '${entry}' in ${label} list \u2014 ignoring.`
-              );
-            }
-            out.push(entry);
-          } else {
-            warn(`apcli.${label} contains non-string entry; skipping.`);
-          }
-        }
-        return out;
-      }
-      // -------------------------------------------------------------------------
-      // Public API
-      // -------------------------------------------------------------------------
-      /**
-       * Resolve effective visibility mode after applying tier precedence.
-       *
-       * Returns one of `"all" | "none" | "include" | "exclude"` — never `"auto"`.
-       *
-       * Tier order (spec §4.4):
-       *   1. CliConfig non-auto wins outright.
-       *   2. `APCORE_CLI_APCLI` env var (unless sealed by disableEnv).
-       *   3. yaml non-auto.
-       *   4. Auto-detect from registryInjected.
-       */
-      resolveVisibility() {
-        if (this._fromCliConfig && this._mode !== "auto") {
-          return this._mode;
-        }
-        if (!this._disableEnv) {
-          const envMode = this._parseEnv(process.env.APCORE_CLI_APCLI);
-          if (envMode !== null) {
-            return envMode;
-          }
-        }
-        if (this._mode !== "auto") {
-          return this._mode;
+      emitResult(result, fmt, () => {
+        if (moduleId) {
+          formatExecResult(result, fmt);
+        } else {
+          formatUsageSummaryTty(result);
         }
-        return this._registryInjected ? "none" : "all";
-      }
-      /**
-       * True iff `subcommand` passes the include/exclude filter.
-       *
-       * Callers MUST first check {@link resolveVisibility} — this method throws
-       * under modes `"all"` or `"none"` (caller bug per spec §4.6).
-       */
-      isSubcommandIncluded(subcommand) {
-        const mode = this.resolveVisibility();
-        if (mode === "include") return this._include.includes(subcommand);
-        if (mode === "exclude") return !this._exclude.includes(subcommand);
-        throw new Error(
-          `isSubcommandIncluded called under mode '${mode}'; caller should bypass.`
-        );
-      }
-      /** True iff the `apcli` group itself should appear in root `--help`. */
-      isGroupVisible() {
-        return this.resolveVisibility() !== "none";
+      });
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  apcliGroup.addCommand(usageCmd);
+}
+function registerEnableCommand(apcliGroup, executor) {
+  const enableCmd = new Command4("enable").description("Enable a disabled module at runtime.").argument("<module-id>", "Module ID to enable").requiredOption("--reason <reason>", "Reason for enabling (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
+    const fmt = resolveFormat(opts.format);
+    try {
+      await requireApprovalForSystemCommand("system.control.toggle_feature", opts.yes);
+      const result = await callSystemModule(executor, "system.control.toggle_feature", {
+        module_id: moduleId,
+        enabled: true,
+        reason: opts.reason
+      });
+      emitResult(result, fmt, () => {
+        process.stdout.write(`Module '${moduleId}' enabled.
+  Reason: ${opts.reason}
+`);
+      });
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  apcliGroup.addCommand(enableCmd);
+}
+function registerDisableCommand(apcliGroup, executor) {
+  const disableCmd = new Command4("disable").description("Disable a module at runtime (calls are rejected until re-enabled).").argument("<module-id>", "Module ID to disable").requiredOption("--reason <reason>", "Reason for disabling (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
+    const fmt = resolveFormat(opts.format);
+    try {
+      await requireApprovalForSystemCommand("system.control.toggle_feature", opts.yes);
+      const result = await callSystemModule(executor, "system.control.toggle_feature", {
+        module_id: moduleId,
+        enabled: false,
+        reason: opts.reason
+      });
+      emitResult(result, fmt, () => {
+        process.stdout.write(`Module '${moduleId}' disabled.
+  Reason: ${opts.reason}
+`);
+      });
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  apcliGroup.addCommand(disableCmd);
+}
+function registerReloadCommand(apcliGroup, executor) {
+  const reloadCmd = new Command4("reload").description("Hot-reload a module from disk.").argument("<module-id>", "Module ID to reload").requiredOption("--reason <reason>", "Reason for reload (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (moduleId, opts) => {
+    const fmt = resolveFormat(opts.format);
+    try {
+      await requireApprovalForSystemCommand("system.control.reload_module", opts.yes);
+      const result = await callSystemModule(executor, "system.control.reload_module", {
+        module_id: moduleId,
+        reason: opts.reason
+      });
+      emitResult(result, fmt, () => {
+        const prev = result.previous_version ?? "?";
+        const newVer = result.new_version ?? "?";
+        const dur = result.reload_duration_ms ?? "?";
+        process.stdout.write(`Module '${moduleId}' reloaded.
+`);
+        process.stdout.write(`  Version: ${prev} -> ${newVer}
+`);
+        process.stdout.write(`  Duration: ${dur}ms
+`);
+      });
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  apcliGroup.addCommand(reloadCmd);
+}
+function registerConfigCommand(apcliGroup, executor) {
+  const configGroup = new Command4("config").description("Read or update runtime configuration.");
+  const configGetCmd = new Command4("get").description("Read a configuration value by dot-path key.").argument("<key>", "Configuration key (dot-path)").option("--format <format>", "Output format.", "table").action(async (key, opts) => {
+    const fmt = resolveFormat(opts.format);
+    try {
+      const value = new Config().get(key);
+      emitResult({ key, value }, fmt, () => {
+        process.stdout.write(`${key} = ${JSON.stringify(value)}
+`);
+      });
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  configGroup.addCommand(configGetCmd);
+  const configSetCmd = new Command4("set").description("Update a runtime configuration value (audit-logged; client-side approval gate applies).").argument("<key>", "Configuration key (dot-path)").argument("<value>", "New value").requiredOption("--reason <reason>", "Reason for config change (required for audit).").option("-y, --yes", "Skip approval prompt (audit D11-B-001 cross-SDK parity).", false).option("--format <format>", "Output format.").action(async (key, value, opts) => {
+    const fmt = resolveFormat(opts.format);
+    let parsedValue;
+    try {
+      parsedValue = JSON.parse(value);
+    } catch {
+      parsedValue = value;
+    }
+    try {
+      await requireApprovalForSystemCommand("system.control.update_config", opts.yes);
+      const result = await callSystemModule(executor, "system.control.update_config", {
+        key,
+        value: parsedValue,
+        reason: opts.reason
+      });
+      emitResult(result, fmt, () => {
+        const old = result.old_value ?? "?";
+        const newVal = result.new_value ?? "?";
+        process.stdout.write(`Config updated: ${key}
+`);
+        process.stdout.write(`  ${JSON.stringify(old)} -> ${JSON.stringify(newVal)}
+`);
+        process.stdout.write(`  Reason: ${opts.reason}
+`);
+      });
+    } catch (e) {
+      emitErrorAndExit(e);
+    }
+  });
+  configGroup.addCommand(configSetCmd);
+  apcliGroup.addCommand(configGroup);
+}
+var init_system_cmd = __esm({
+  "src/system-cmd.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_approval();
+    init_errors();
+    init_output();
+  }
+});
+
+// src/strategy.ts
+import { Command as Command5, Option as Option3 } from "commander";
+function lookupStrategyInfo(executor, strategyName) {
+  if (typeof executor.describePipeline === "function") {
+    try {
+      const current = executor.describePipeline();
+      if (current && current.name === strategyName) {
+        return { info: current, isCurrent: true };
       }
-      // -------------------------------------------------------------------------
-      // Env parser (Tier 2) — co-located per spec §4.4
-      // -------------------------------------------------------------------------
-      /**
-       * Parse APCORE_CLI_APCLI. Case-insensitive.
-       *
-       * - `show` / `1` / `true` → `"all"`
-       * - `hide` / `0` / `false` → `"none"`
-       * - Empty / unset → `null`
-       * - Anything else → warn and return `null`
-       */
-      _parseEnv(raw) {
-        if (raw === void 0 || raw === "") return null;
-        const normalized = raw.trim().toLowerCase();
-        if (normalized === "") return null;
-        if (normalized === "show" || normalized === "1" || normalized === "true") {
-          return "all";
-        }
-        if (normalized === "hide" || normalized === "0" || normalized === "false") {
-          return "none";
+    } catch {
+    }
+  }
+  const ctor = executor.constructor;
+  if (ctor && typeof ctor.listStrategies === "function") {
+    try {
+      const all = ctor.listStrategies();
+      const info = all.find((s) => s.name === strategyName) ?? null;
+      return { info, isCurrent: false };
+    } catch {
+      return { info: null, isCurrent: false };
+    }
+  }
+  return { info: null, isCurrent: false };
+}
+function registerPipelineCommand(cli, executor) {
+  const pipelineCmd = new Command5("describe-pipeline").description("Show the execution pipeline steps for a strategy.").addOption(
+    new Option3("--strategy <name>", "Strategy to describe (default: standard).").choices(["standard", "internal", "testing", "performance", "minimal"]).default("standard")
+  ).option("--format <format>", "Output format.").action((opts) => {
+    const fmt = resolveFormat(opts.format);
+    const { info, isCurrent } = lookupStrategyInfo(executor, opts.strategy);
+    if (info) {
+      const strategySteps = isCurrent ? executor.currentStrategy?.steps ?? [] : [];
+      const header = `Pipeline: ${info.name} (${info.stepCount} steps)`;
+      if (fmt === "json" || !process.stdout.isTTY) {
+        const payload = {
+          strategy: info.name,
+          step_count: info.stepCount,
+          description: info.description,
+          steps: info.stepNames.map((name, i) => {
+            const stepMeta = strategySteps[i];
+            return {
+              index: i + 1,
+              name,
+              pure: stepMeta?.pure ?? false,
+              removable: stepMeta?.removable ?? true,
+              timeout_ms: stepMeta?.timeoutMs ?? null
+            };
+          })
+        };
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+      } else {
+        process.stdout.write(`${header}
+
+`);
+        process.stdout.write(`  ${"#".padEnd(4)} ${"Step".padEnd(28)} ${"Pure".padEnd(6)} ${"Removable".padEnd(11)} Timeout
+`);
+        process.stdout.write(`  ${"-".repeat(4)} ${"-".repeat(28)} ${"-".repeat(6)} ${"-".repeat(11)} ${"-".repeat(8)}
+`);
+        for (let i = 0; i < info.stepNames.length; i++) {
+          const stepMeta = strategySteps[i];
+          const pure = stepMeta?.pure ? "yes" : "no";
+          const removable = stepMeta?.removable !== false ? "yes" : "no";
+          const timeout = stepMeta?.timeoutMs ? `${stepMeta.timeoutMs}ms` : "\u2014";
+          process.stdout.write(`  ${String(i + 1).padEnd(4)} ${info.stepNames[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} ${timeout}
+`);
         }
-        warn(
-          `Unknown APCORE_CLI_APCLI value '${raw}', ignoring. Expected: show, hide, 1, 0, true, false.`
-        );
-        return null;
       }
-    };
-  }
-});
+      return;
+    }
+    const steps = PRESET_STEPS[opts.strategy] ?? [];
+    const pureSteps = /* @__PURE__ */ new Set([
+      "context_creation",
+      "call_chain_guard",
+      "module_lookup",
+      "acl_check",
+      "input_validation"
+    ]);
+    const nonRemovable = /* @__PURE__ */ new Set([
+      "context_creation",
+      "module_lookup",
+      "execute",
+      "return_result"
+    ]);
+    if (fmt === "json" || !process.stdout.isTTY) {
+      const payload = {
+        strategy: opts.strategy,
+        step_count: steps.length,
+        steps: steps.map((s, i) => ({
+          index: i + 1,
+          name: s,
+          pure: pureSteps.has(s),
+          removable: !nonRemovable.has(s)
+        }))
+      };
+      process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+    } else {
+      process.stdout.write(`Pipeline: ${opts.strategy} (${steps.length} steps)
 
-// src/exposure.ts
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function compilePattern(pattern) {
-  const sentinel = "\0GLOB\0";
-  const escaped = pattern.replaceAll("**", sentinel);
-  const parts = escaped.split("*");
-  const regexParts = parts.map((p) => {
-    const restored = p.replaceAll(sentinel, "**");
-    return escapeRegex(restored);
+`);
+      process.stdout.write(`  ${"#".padEnd(4)} ${"Step".padEnd(28)} ${"Pure".padEnd(6)} ${"Removable".padEnd(11)} Timeout
+`);
+      process.stdout.write(`  ${"-".repeat(4)} ${"-".repeat(28)} ${"-".repeat(6)} ${"-".repeat(11)} ${"-".repeat(8)}
+`);
+      for (let i = 0; i < steps.length; i++) {
+        const pure = pureSteps.has(steps[i]) ? "yes" : "no";
+        const removable = nonRemovable.has(steps[i]) ? "no" : "yes";
+        process.stdout.write(`  ${String(i + 1).padEnd(4)} ${steps[i].padEnd(28)} ${pure.padEnd(6)} ${removable.padEnd(11)} \u2014
+`);
+      }
+    }
   });
-  let regex = regexParts.join("[^.]*");
-  regex = regex.replaceAll("\\*\\*", ".+");
-  return new RegExp(`^${regex}$`);
+  cli.addCommand(pipelineCmd);
 }
-var ExposureFilter;
-var init_exposure = __esm({
-  "src/exposure.ts"() {
+var PRESET_STEPS;
+var init_strategy = __esm({
+  "src/strategy.ts"() {
     "use strict";
     init_esm_shims();
-    init_logger();
-    ExposureFilter = class _ExposureFilter {
-      static VALID_MODES = ["all", "include", "exclude", "none"];
-      _mode;
-      _compiledInclude;
-      _compiledExclude;
-      constructor(mode = "all", include, exclude) {
-        if (!_ExposureFilter.VALID_MODES.includes(mode)) {
-          process.stderr.write(
-            `Warning: Unknown ExposureFilter mode '${mode}' \u2014 defaulting to 'none'. Valid modes: ${_ExposureFilter.VALID_MODES.join(", ")}.
-`
-          );
-          mode = "none";
-        }
-        this._mode = mode;
-        const dedup = (arr) => [...new Set(arr)];
-        this._compiledInclude = dedup(include ?? []).map(compilePattern);
-        this._compiledExclude = dedup(exclude ?? []).map(compilePattern);
-      }
-      /** Return true if the module should be exposed as a CLI command. */
-      isExposed(moduleId) {
-        if (this._mode === "all") return true;
-        if (this._mode === "include") {
-          return this._compiledInclude.some((rx) => rx.test(moduleId));
-        }
-        if (this._mode === "exclude") {
-          return !this._compiledExclude.some((rx) => rx.test(moduleId));
-        }
-        return false;
-      }
-      /** Partition moduleIds into [exposed, hidden] lists. */
-      filterModules(moduleIds) {
-        const exposed = [];
-        const hidden = [];
-        for (const mid of moduleIds) {
-          (this.isExposed(mid) ? exposed : hidden).push(mid);
-        }
-        return [exposed, hidden];
-      }
-      /**
-       * Create an ExposureFilter from a parsed config dict.
-       *
-       * Expected: `{ expose: { mode: "include", include: ["admin.*"] } }`
-       */
-      static fromConfig(config) {
-        const expose = config.expose ?? {};
-        if (typeof expose !== "object" || expose === null || Array.isArray(expose)) {
-          warn("Invalid 'expose' config (expected dict), using mode: all.");
-          return new _ExposureFilter();
-        }
-        const exposeObj = expose;
-        const mode = exposeObj.mode ?? "all";
-        if (!["all", "include", "exclude"].includes(mode)) {
-          throw new Error(
-            `Invalid expose mode: '${mode}'. Must be one of: all, include, exclude.`
-          );
-        }
-        let include = exposeObj.include ?? [];
-        if (!Array.isArray(include)) {
-          warn("Invalid 'expose.include' (expected list), ignoring.");
-          include = [];
-        }
-        let exclude = exposeObj.exclude ?? [];
-        if (!Array.isArray(exclude)) {
-          warn("Invalid 'expose.exclude' (expected list), ignoring.");
-          exclude = [];
-        }
-        const filterList = (arr, label) => {
-          const result = [];
-          for (const p of arr) {
-            if (!p) {
-              warn(`Empty pattern in expose.${label}, skipping.`);
-            } else {
-              result.push(String(p));
-            }
-          }
-          return result;
-        };
-        return new _ExposureFilter(
-          mode,
-          filterList(include, "include"),
-          filterList(exclude, "exclude")
-        );
-      }
+    init_output();
+    PRESET_STEPS = {
+      standard: [
+        "context_creation",
+        "call_chain_guard",
+        "module_lookup",
+        "acl_check",
+        "approval_gate",
+        "middleware_before",
+        "input_validation",
+        "execute",
+        "output_validation",
+        "middleware_after",
+        "return_result"
+      ],
+      internal: [
+        "context_creation",
+        "call_chain_guard",
+        "module_lookup",
+        "middleware_before",
+        "input_validation",
+        "execute",
+        "output_validation",
+        "middleware_after",
+        "return_result"
+      ],
+      testing: [
+        "context_creation",
+        "module_lookup",
+        "middleware_before",
+        "input_validation",
+        "execute",
+        "output_validation",
+        "middleware_after",
+        "return_result"
+      ],
+      performance: [
+        "context_creation",
+        "call_chain_guard",
+        "module_lookup",
+        "acl_check",
+        "approval_gate",
+        "input_validation",
+        "execute",
+        "output_validation",
+        "return_result"
+      ],
+      minimal: [
+        "context_creation",
+        "module_lookup",
+        "execute",
+        "return_result"
+      ]
     };
   }
 });
@@ -3746,7 +3776,8 @@ __export(main_exports, {
 import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import * as path5 from "path";
-import { Command as Command5, CommanderError, Option as Option4 } from "commander";
+import { Command as Command6, CommanderError, Option as Option4 } from "commander";
+import { BindingLoader, DisplayResolver } from "apcore-toolkit";
 function setAllOptionsHelp(allOptions) {
   verboseHelp = allOptions;
 }
@@ -3925,7 +3956,7 @@ function createCli(extensionsDirOrOpts, progName, allOptions = false) {
     }
   }
   const registryInjected = registry !== void 0;
-  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--all-options", "Show all options in help output (including built-in options)");
+  const program = new Command6(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--all-options", "Show all options in help output (including built-in options)");
   if (appVersion) {
     program.version(appVersion, "-V, --version", "Print version");
   }
@@ -4038,8 +4069,8 @@ function _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exp
     process.exit(EXIT_CODES.CONFIG_INVALID);
   };
   const effectiveRegistry = registry ?? {
-    listModules: () => emitUnwiredError(),
-    getModule: () => emitUnwiredError()
+    list: () => emitUnwiredError(),
+    getDefinition: () => emitUnwiredError()
   };
   const TABLE = [
     { name: "list", requiresExecutor: false, register: (g) => registerListCommand(g, effectiveRegistry, exposureFilter) },
@@ -4056,6 +4087,17 @@ function _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exp
     { name: "completion", requiresExecutor: false, register: (g) => registerCompletionCommand(g) },
     { name: "describe-pipeline", requiresExecutor: true, register: (g, _r, ex) => registerPipelineCommand(g, ex) }
   ];
+  const _SYSTEM_COMMANDS = /* @__PURE__ */ new Set(["health", "usage", "enable", "disable", "reload", "config"]);
+  const systemModulesAvailable = (() => {
+    if (!executor) return false;
+    const reg = executor.registry ?? registry;
+    if (!reg) return false;
+    try {
+      return reg.getDefinition("system.health.summary") != null;
+    } catch {
+      return false;
+    }
+  })();
   const mode = apcliCfg.resolveVisibility();
   for (const entry of TABLE) {
     let shouldRegister;
@@ -4065,6 +4107,7 @@ function _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exp
       shouldRegister = _ALWAYS_REGISTERED.has(entry.name) || apcliCfg.isSubcommandIncluded(entry.name);
     }
     if (!shouldRegister) continue;
+    if (_SYSTEM_COMMANDS.has(entry.name) && !systemModulesAvailable) continue;
     if (entry.requiresExecutor && !executor) {
       if (_ALWAYS_REGISTERED.has(entry.name)) {
         warn(
@@ -4086,38 +4129,22 @@ async function applyToolkitIntegration(commandsDir, bindingPath, options = {}) {
   if (!commandsDir && !bindingPath) {
     return;
   }
-  let toolkit;
-  try {
-    const toolkitModule = "apcore-toolkit";
-    toolkit = await import(
-      /* @vite-ignore */
-      toolkitModule
-    );
-  } catch {
-    warn("apcore-toolkit not installed \u2014 toolkit features unavailable");
-    return;
-  }
   if (commandsDir) {
     warn("Convention scanning not available in the TypeScript toolkit");
   }
   if (bindingPath) {
     try {
-      await loadBindingDisplayOverlay(toolkit, bindingPath, options.allowedPrefixes);
+      await loadBindingDisplayOverlay(bindingPath, options.allowedPrefixes);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       warn(`apcore-toolkit: failed to load binding '${bindingPath}': ${msg}`);
     }
   }
 }
-async function loadBindingDisplayOverlay(toolkit, bindingPath, allowedPrefixes) {
-  const BindingLoaderCtor = toolkit.BindingLoader;
-  const DisplayResolverCtor = toolkit.DisplayResolver;
-  if (!BindingLoaderCtor || !DisplayResolverCtor) {
-    return;
-  }
-  const loader = new BindingLoaderCtor();
+async function loadBindingDisplayOverlay(bindingPath, allowedPrefixes) {
+  const loader = new BindingLoader();
   const scanned = loader.load(bindingPath);
-  const resolver = new DisplayResolverCtor();
+  const resolver = new DisplayResolver();
   const resolved = resolver.resolve(scanned, { bindingPath });
   const prefixes = allowedPrefixes && allowedPrefixes.length > 0 ? allowedPrefixes : null;
   const isTargetAllowed = (target) => {
@@ -4166,7 +4193,7 @@ function main(progName) {
   }
 }
 function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdName, verbose = verboseHelp) {
-  const moduleId = moduleDef.id;
+  const moduleId = moduleDef.moduleId;
   let resolvedSchema = {};
   let schemaOptions = [];
   const display = getDisplay(moduleDef);
@@ -4192,7 +4219,7 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
     }
     schemaOptions = schemaToCliOptions(resolvedSchema, helpTextMaxLength);
   }
-  const cmd = new Command5(effectiveCmdName).description(cmdHelp);
+  const cmd = new Command6(effectiveCmdName).description(cmdHelp);
   const inputOpt = new Option4("--input <source>", "Read JSON input from a file path, or use '-' to read from stdin pipe");
   const yesOpt = new Option4("-y, --yes", "Skip interactive approval prompts (for scripts and CI)").default(false);
   const largeInputOpt = new Option4("--large-input", "Allow stdin input larger than 10MB (default limit protects against accidental pipes)").default(false);