From 94ee6ec9a28410c269d8a08c0fcb7fa85851930e Mon Sep 17 00:00:00 2001
From: Brian Majewski <brian.majewski@gmail.com>
Date: Mon, 8 Jun 2026 06:02:11 -0700
Subject: [PATCH] feat: secrets which prints the manifest version (EGB-700)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Completes EGB-700 — the store-format line (format: vN) shipped in v0.6.0.0;
this adds the manifest schema version to the `which` manifest header
(version N, validated == MANIFEST_VERSION by _check_manifest_file). Now a
single `secrets which` surfaces both the store format and the manifest
version for the dual-format debugging window. 1 bats test. Suite 237/237.
---
 secrets            | 5 ++++-
 test/manifest.bats | 8 ++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/secrets b/secrets
index 97676b8..6b18cfe 100755
--- a/secrets
+++ b/secrets
@@ -1918,7 +1918,10 @@ cmd_which() {
   local json_manifest="$PWD/$SECRETS_JSON_NAME"
   if [ -e "$json_manifest" ]; then
     _check_manifest_file "$json_manifest"
-    echo "manifest ($SECRETS_JSON_NAME at $json_manifest):"
+    # EGB-700: surface the manifest schema version (validated == MANIFEST_VERSION
+    # by _check_manifest_file above) alongside the store format printed earlier.
+    local mver; mver=$(jq -r '.version // "?"' "$json_manifest")
+    echo "manifest ($SECRETS_JSON_NAME at $json_manifest, version $mver):"
     local entry
     while IFS= read -r entry; do
       [ -n "$entry" ] || continue
diff --git a/test/manifest.bats b/test/manifest.bats
index 37564c7..eb5c42a 100644
--- a/test/manifest.bats
+++ b/test/manifest.bats
@@ -97,6 +97,14 @@ load test_helper
   [[ "$output" == *".env"* ]] || false
 }
 
+@test "which prints the manifest version (EGB-700)" {
+  create_project_dir manifestver
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" which
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"version 2"* ]] || false
+}
+
 @test "malformed .secrets.json dies with a directed error naming the file" {
   create_project_dir addproj
   echo '{ not json' > .secrets.json