{
  "id": "secretspec",
  "name": "SecretSpec",
  "homepage": "https://secretspec.dev/",
  "description": "A declarative interface for every secret provider.",
  "executables": [
    "secretspec"
  ],
  "dotfiles": {
    "paths": [
      "[configHome]/secretspec/config.toml"
    ],
    "secret": []
  },
  "commands": {
    "format": 1,
    "label": "SecretSpec",
    "description": "Check, read and run commands with secrets declared in secretspec.toml. Set, import, init and provider configuration subcommands are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "subcommand": [
      {
        "path": [
          "check"
        ],
        "label": "Check secrets",
        "description": "Verify that every declared secret resolves, without printing values.",
        "source": [
          {
            "id": "cli",
            "kind": "manual",
            "url": "https://secretspec.dev/reference/cli/",
            "revision": "2026-10-27",
            "evidence": "secretspec check [OPTIONS]\n-p, --provider <PROVIDER> - Provider backend to use\n-P, --profile <PROFILE> - Profile to use\n-n, --no-prompt - Don't prompt for missing secrets (exit with error if any are missing)\n--json - Print a value-free resolution report as JSON instead of prompting\n--explain - Print a value-free, human-readable resolution trace instead of prompting\n-f, --file <FILE>Path to secretspec.toml (default: auto-detect). Env: SECRETSPEC_FILE\n"
          }
        ],
        "field": [
          {
            "id": "profile",
            "label": "Profile",
            "type": "string",
            "option": [
              "--profile",
              "-P"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "provider",
            "label": "Provider",
            "description": "Provider URI or name, for example env or dotenv://.env.",
            "type": "string",
            "option": [
              "--provider",
              "-p"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "file",
            "label": "secretspec.toml path",
            "type": "path",
            "path": {
              "kind": "file",
              "role": "input"
            },
            "option": [
              "--file",
              "-f"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "no_prompt",
            "label": "Do not prompt",
            "type": "boolean",
            "option": [
              "--no-prompt",
              "-n"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "json",
            "label": "JSON report",
            "type": "boolean",
            "option": [
              "--json"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "explain",
            "label": "Explain resolution",
            "type": "boolean",
            "option": [
              "--explain"
            ],
            "sources": [
              "cli"
            ]
          }
        ],
        "task": [
          {
            "id": "check",
            "label": "Check a profile",
            "fields": [
              "profile"
            ],
            "required": []
          },
          {
            "id": "explain",
            "label": "Explain resolution",
            "fields": [
              "profile"
            ],
            "required": [],
            "set": {
              "explain": [
                true
              ]
            }
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "profile",
              "provider",
              "no_prompt",
              "explain",
              "json"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "file"
            ]
          }
        ]
      },
      {
        "path": [
          "get"
        ],
        "label": "Get one secret",
        "description": "Print the value of a single secret to the terminal.",
        "source": [
          {
            "id": "cli",
            "kind": "manual",
            "url": "https://secretspec.dev/reference/cli/",
            "revision": "2026-10-27",
            "evidence": "secretspec get [OPTIONS] <NAME>\n-p, --provider <PROVIDER> - Provider backend to use\n-P, --profile <PROFILE> - Profile to use\n$ secretspec get DATABASE_URL --profile production\n-f, --file <FILE>Path to secretspec.toml (default: auto-detect). Env: SECRETSPEC_FILE\n"
          }
        ],
        "field": [
          {
            "id": "name",
            "label": "Secret name",
            "type": "string",
            "position": 0,
            "min": 1,
            "sources": [
              "cli"
            ]
          },
          {
            "id": "profile",
            "label": "Profile",
            "type": "string",
            "option": [
              "--profile",
              "-P"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "provider",
            "label": "Provider",
            "type": "string",
            "option": [
              "--provider",
              "-p"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "file",
            "label": "secretspec.toml path",
            "type": "path",
            "path": {
              "kind": "file",
              "role": "input"
            },
            "option": [
              "--file",
              "-f"
            ],
            "sources": [
              "cli"
            ]
          }
        ],
        "task": [
          {
            "id": "get",
            "label": "Get a secret",
            "fields": [
              "name",
              "profile"
            ],
            "required": [
              "name"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "name",
              "profile",
              "provider",
              "file"
            ]
          }
        ]
      },
      {
        "path": [
          "run"
        ],
        "label": "Run with secrets",
        "description": "Run a command with the declared secrets injected as environment variables.",
        "source": [
          {
            "id": "cli",
            "kind": "manual",
            "url": "https://secretspec.dev/reference/cli/",
            "revision": "2026-10-27",
            "evidence": "secretspec run [OPTIONS] -- <COMMAND>\n$ secretspec run --reason \"Deploying web frontend\" -- ./deploy.sh\n--reason <REASON>Reason for accessing secrets, recorded by providers that support audit logging (e.g. Proton Pass agent sessions).\n-p, --provider <PROVIDER> - Provider backend to use\n-P, --profile <PROFILE> - Profile to use\n-f, --file <FILE>Path to secretspec.toml (default: auto-detect). Env: SECRETSPEC_FILE\n"
          }
        ],
        "field": [
          {
            "id": "profile",
            "label": "Profile",
            "type": "string",
            "option": [
              "--profile",
              "-P"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "provider",
            "label": "Provider",
            "type": "string",
            "option": [
              "--provider",
              "-p"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "reason",
            "label": "Access reason",
            "description": "Recorded by providers that support audit logging.",
            "type": "string",
            "option": [
              "--reason"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "file",
            "label": "secretspec.toml path",
            "type": "path",
            "path": {
              "kind": "file",
              "role": "input"
            },
            "option": [
              "--file",
              "-f"
            ],
            "sources": [
              "cli"
            ]
          },
          {
            "id": "command",
            "label": "Command",
            "description": "Command and arguments to run, placed after --.",
            "type": "string",
            "position": 0,
            "multiple": true,
            "min": 1,
            "sources": [
              "cli"
            ]
          }
        ],
        "task": [
          {
            "id": "run",
            "label": "Run a command",
            "fields": [
              "profile",
              "reason",
              "command"
            ],
            "required": [
              "command"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "profile",
              "provider",
              "reason",
              "command"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "file"
            ]
          }
        ]
      }
    ]
  }
}