diff --git a/CLAUDE.md b/CLAUDE.md
index d4a64eb..cbddc77 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -63,10 +63,10 @@ Providers support URI-based configuration (e.g., `keyring://`, `onepassword://va
 When adding a new provider, update **every** location below — provider names appear in several listings that drift out of sync if any are missed:
 
 1. `docs/src/content/docs/providers/<provider>.md` - Create the provider's doc page
-2. `docs/astro.config.mjs` - Add to sidebar navigation under "Providers" **and** to the providers sentence in the `starlightLlmsTxt` description block
+2. `docs/astro.config.ts` - Add to sidebar navigation under "Providers" **and** to the providers sentence in the `starlightLlmsTxt` description block
 3. `docs/src/content/docs/concepts/providers.md` - Add a row to the "Available Providers" table
 4. `docs/src/content/docs/reference/providers.md` - Add a provider section **and** a row in the "Security Considerations" table
-5. `docs/src/pages/index.astro` - Add to the `providerMetadata` array (top of file) **and** to the `secretspec config init` mini-terminal in the hero
+5. `docs/src/pages/index.astro` - Add to the `providerMetadata` array (top of file).
 6. `docs/src/content/docs/quick-start.mdx` - Update the `secretspec config init` example output to include the new provider
 7. `README.md` (symlink to `secretspec/README.md`) - Add to the "Providers" bullet list **and** to the `secretspec config init` example output
 
@@ -178,7 +178,7 @@ The docs site is an Astro Starlight site deployed to https://secretspec.dev/.
 
 ### Structure
 
-- `docs/astro.config.mjs` - Sidebar navigation and site config
+- `docs/astro.config.ts` - Sidebar navigation and site config
 - `docs/src/pages/index.astro` - Home page (custom landing layout, not in the content collection)
 - `docs/src/content/docs/` - All other content pages (markdown/mdx)
   - `quick-start.mdx` - Getting started guide
@@ -189,7 +189,7 @@ The docs site is an Astro Starlight site deployed to https://secretspec.dev/.
 
 ### What to update
 
-- **New doc page**: Create the `.md` file and add it to the sidebar in `docs/astro.config.mjs`
+- **New doc page**: Create the `.md` file and add it to the sidebar in `docs/astro.config.ts`
 - **New CLI command**: Update `docs/src/content/docs/reference/cli.md`
 - **New config option**: Update `docs/src/content/docs/reference/configuration.md`
 - **New provider**: See [Adding Provider Documentation](#adding-provider-documentation) above
diff --git a/Cargo.lock b/Cargo.lock
index bb6432e..72a0f60 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -126,6 +126,12 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -1134,6 +1140,26 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-random"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "tiny-keccak",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -1541,6 +1567,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "dlv-list"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
+dependencies = [
+ "const-random",
+]
+
 [[package]]
 name = "document-features"
 version = "0.2.12"
@@ -1605,6 +1640,15 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -2075,6 +2119,12 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -3010,6 +3060,25 @@ version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e62e29dfe041afb8ed2a6c9737ab57db4907285d999ef8ad3a59092a36bdc846"
 
+[[package]]
+name = "ordered-float"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7d950ca161dc355eaf28f82b11345ed76c6e1f6eb1f4f4479e0323b9e2fbd0e"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ordered-multimap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
+dependencies = [
+ "dlv-list",
+ "hashbrown 0.14.5",
+]
+
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -3442,9 +3511,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3471,9 +3540,9 @@ checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "reqwest"
@@ -3602,6 +3671,16 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "rust-ini"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
+dependencies = [
+ "cfg-if",
+ "ordered-multimap",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.27"
@@ -3756,6 +3835,29 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "saphyr"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3767dfe8889ebb55a21409df2b6f36e66abfbe1eb92d64ff76ae799d3f91016"
+dependencies = [
+ "arraydeque",
+ "encoding_rs",
+ "hashlink",
+ "ordered-float",
+ "saphyr-parser",
+]
+
+[[package]]
+name = "saphyr-parser"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb771b59f6b1985d1406325ec28f97cfb14256abcec4fdfb37b36a1766d6af7"
+dependencies = [
+ "arraydeque",
+ "hashlink",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -3857,9 +3959,12 @@ dependencies = [
  "miette",
  "percent-encoding",
  "rand 0.9.2",
+ "regex",
  "reqwest 0.12.28",
  "rsa",
+ "rust-ini",
  "rustls 0.23.37",
+ "saphyr",
  "secrecy",
  "serde",
  "serde_json",
@@ -4413,6 +4518,15 @@ dependencies = [
  "time-core",
 ]
 
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.2"
diff --git a/Cargo.toml b/Cargo.toml
index d2fd984..4ed732b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,6 +22,8 @@ colored = "3.0"
 dotenvy = "0.15"
 inquire = { version = "0.9.4", features = ["experimental-multiline-input"] }
 miette = { version = "7.6", features = ["fancy"] }
+rust-ini = "0.21.3"
+saphyr = "0.0.6"
 serde_json = "1.0"
 tempfile = "3.0"
 http = "1.0"
@@ -50,6 +52,7 @@ rsa = { version = "0.9", features = ["pem"] }
 uuid = { version = "1", features = ["v4"] }
 data-encoding = "2"
 detect-coding-agent = "0.1"
+regex = "1.12.4"
 
 # The profile that 'dist' will build with
 [profile.dist]
diff --git a/devenv.nix b/devenv.nix
index ae55b1d..d030cda 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -5,6 +5,7 @@
     channel = "stable";
     version = "1.92.0";
   };
+
   languages.javascript = {
     enable = true;
     npm = {
@@ -20,6 +21,8 @@
     pkgs.cargo-tarpaulin
     # installers
     pkgs.cargo-dist
+    # For development of the SOPS provider
+    pkgs.sops
   ];
 
   git-hooks.hooks = {
@@ -33,14 +36,36 @@
     cargo test --all
   '';
 
-  scripts.test-cli-integration.exec = ''
-    # Build the CLI for integration tests
-    cargo build --release
-    export PATH="$PWD/target/release:$PATH"
-    
-    # Run CLI integration tests
-    bash tests/cli-integration.sh
-  '';
+  scripts = {
+    generate-encrypted-secrets-files-for-sops-tests =
+      let
+        SOPS_AGE_KEY_FILE = "./secretspec/src/provider/sops/test_fixtures/key.txt";
+        age-public-key = "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34";
+      in
+      {
+        exec = ''
+          extensions=(json yaml bin ini)
+
+          for ext in "''${extensions[@]}"; do
+            infile="./secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.''${ext}"
+
+            outfile="./secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.''${ext}"
+
+            SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE}" \
+              sops encrypt --age "${age-public-key}" "$infile" > "$outfile"
+          done
+        '';
+      };
+
+    test-cli-integration.exec = ''
+      # Build the CLI for integration tests
+      cargo build --release
+      export PATH="$PWD/target/release:$PATH"
+
+      # Run CLI integration tests
+      bash tests/cli-integration.sh
+    '';
+  };
 
   processes.docs.exec = ''
     cd docs && npm run dev
diff --git a/docs/README.md b/docs/README.md
index f9f6d31..7e35ddd 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -25,7 +25,7 @@ Inside of your Astro + Starlight project, you'll see the following folders and f
 │   ├── content/
 │   │   ├── docs/
 │   └── content.config.ts
-├── astro.config.mjs
+├── astro.config.ts
 ├── package.json
 └── tsconfig.json
 ```
diff --git a/docs/astro.config.mjs b/docs/astro.config.ts
similarity index 96%
rename from docs/astro.config.mjs
rename to docs/astro.config.ts
index 8a29293..5848fc2 100644
--- a/docs/astro.config.mjs
+++ b/docs/astro.config.ts
@@ -1,4 +1,4 @@
-// @ts-check
+import type {PluginOption} from "vite";
 import { defineConfig } from "astro/config";
 import starlight from "@astrojs/starlight";
 import starlightLlmsTxt from "starlight-llms-txt";
@@ -8,7 +8,7 @@ import starlightBlog from "starlight-blog";
 // /api/stars would 404 and the star pill would stay hidden locally. Mirror the
 // worker's GitHub proxy here so the pill populates during local development.
 // Production is unaffected — it is served by worker.js.
-const devStarsApi = {
+const devStarsApi: PluginOption = {
   name: "dev-stars-api",
   apply: "serve",
   enforce: "pre",
@@ -109,7 +109,7 @@ $ secretspec import dotenv://.env.production
 
 ## Providers
 
-Secrets can be stored in: keyring (default), dotenv files, environment variables, 1Password, LastPass, Pass, Proton Pass, Google Cloud Secret Manager, AWS Secrets Manager, HashiCorp Vault / OpenBao, or Bitwarden Secrets Manager.`,
+Secrets can be stored in: keyring (default), dotenv files, environment variables, 1Password, LastPass, Pass, Proton Pass, Google Cloud Secret Manager, AWS Secrets Manager, HashiCorp Vault / OpenBao, Bitwarden Secrets Manager, or SOPS: Secrets OPerationS.`,
         }),
       ],
       title: "SecretSpec",
@@ -185,6 +185,7 @@ Secrets can be stored in: keyring (default), dotenv files, environment variables
               label: "Bitwarden Secrets Manager",
               slug: "providers/bws",
             },
+            { label: "SOPS: Secrets OPerationS", slug: "providers/sops" },
           ],
         },
         {
diff --git a/docs/package-lock.json b/docs/package-lock.json
index 665fc1e..e683520 100644
--- a/docs/package-lock.json
+++ b/docs/package-lock.json
@@ -13,12 +13,35 @@
         "sharp": "^0.34.2",
         "starlight-blog": "^0.25.3",
         "starlight-llms-txt": "^0.7.0"
+      },
+      "devDependencies": {
+        "@astrojs/check": "0.9.9",
+        "typescript": "6.0.3"
+      }
+    },
+    "node_modules/@astrojs/check": {
+      "version": "0.9.9",
+      "resolved": "https://registry.npmjs.org/@astrojs/check/-/check-0.9.9.tgz",
+      "integrity": "sha512-A5UW8uIuErLWEoRQvzgXpO1gTjUFtK8r7nU2Z7GewAMxUb7bPvpk11qaKKgxqXlHJWlAvaaxy+Xg28A6bmQ1Tg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@astrojs/language-server": "^2.16.7",
+        "chokidar": "^4.0.3",
+        "kleur": "^4.1.5",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "astro-check": "bin/astro-check.js"
+      },
+      "peerDependencies": {
+        "typescript": "^5.0.0 || ^6.0.0"
       }
     },
     "node_modules/@astrojs/compiler": {
-      "version": "2.13.0",
-      "resolved": "https://registry.npmjs.org/@astrojs/compiler/-/compiler-2.13.0.tgz",
-      "integrity": "sha512-mqVORhUJViA28fwHYaWmsXSzLO9osbdZ5ImUfxBarqsYdMlPbqAqGJCxsNzvppp1BEzc1mJNjOVvQqeDN8Vspw==",
+      "version": "2.13.1",
+      "resolved": "https://registry.npmjs.org/@astrojs/compiler/-/compiler-2.13.1.tgz",
+      "integrity": "sha512-f3FN83d2G/v32ipNClRKgYv30onQlMZX1vCeZMjPsMMPl1mDpmbl0+N5BYo4S/ofzqJyS5hvwacEo0CCVDn/Qg==",
       "license": "MIT"
     },
     "node_modules/@astrojs/internal-helpers": {
@@ -27,6 +50,48 @@
       "integrity": "sha512-vreGnYSSKhAjFJCWAwe/CNhONvoc5lokxtRoZims+0wa3KbHBdPHSSthJsKxPd8d/aic6lWKpRTYGY/hsgK6EA==",
       "license": "MIT"
     },
+    "node_modules/@astrojs/language-server": {
+      "version": "2.16.10",
+      "resolved": "https://registry.npmjs.org/@astrojs/language-server/-/language-server-2.16.10.tgz",
+      "integrity": "sha512-87VQ/5GSdHlRnUA+hGuerYyIGAj+9RbZmATyuKLEUePinUXhQ5YkRnRrHhOD9sSi5JOErLjrLkHnfZFEvGrV8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@astrojs/compiler": "^2.13.1",
+        "@astrojs/yaml2ts": "^0.2.4",
+        "@jridgewell/sourcemap-codec": "^1.5.5",
+        "@volar/kit": "~2.4.28",
+        "@volar/language-core": "~2.4.28",
+        "@volar/language-server": "~2.4.28",
+        "@volar/language-service": "~2.4.28",
+        "muggle-string": "^0.4.1",
+        "tinyglobby": "^0.2.16",
+        "volar-service-css": "0.0.70",
+        "volar-service-emmet": "0.0.70",
+        "volar-service-html": "0.0.70",
+        "volar-service-prettier": "0.0.70",
+        "volar-service-typescript": "0.0.70",
+        "volar-service-typescript-twoslash-queries": "0.0.70",
+        "volar-service-yaml": "0.0.70",
+        "vscode-html-languageservice": "^5.6.2",
+        "vscode-uri": "^3.1.0"
+      },
+      "bin": {
+        "astro-ls": "bin/nodeServer.js"
+      },
+      "peerDependencies": {
+        "prettier": "^3.0.0",
+        "prettier-plugin-astro": ">=0.11.0"
+      },
+      "peerDependenciesMeta": {
+        "prettier": {
+          "optional": true
+        },
+        "prettier-plugin-astro": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@astrojs/markdown-remark": {
       "version": "6.3.10",
       "resolved": "https://registry.npmjs.org/@astrojs/markdown-remark/-/markdown-remark-6.3.10.tgz",
@@ -182,6 +247,16 @@
         "node": "18.20.8 || ^20.3.0 || >=22.0.0"
       }
     },
+    "node_modules/@astrojs/yaml2ts": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/@astrojs/yaml2ts/-/yaml2ts-0.2.4.tgz",
+      "integrity": "sha512-8oddpOae35pJsXPQXhTkM0ypfKPskVsh2bCxRtbf7e+/Epw2nReakFYpLKjZMEr75CsoF203PMnCocpfz0s69A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yaml": "^2.8.3"
+      }
+    },
     "node_modules/@babel/helper-string-parser": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
@@ -258,6 +333,68 @@
         "node": ">=14"
       }
     },
+    "node_modules/@emmetio/abbreviation": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/@emmetio/abbreviation/-/abbreviation-2.3.3.tgz",
+      "integrity": "sha512-mgv58UrU3rh4YgbE/TzgLQwJ3pFsHHhCLqY20aJq+9comytTXUDNGG/SMtSeMJdkpxgXSXunBGLD8Boka3JyVA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@emmetio/scanner": "^1.0.4"
+      }
+    },
+    "node_modules/@emmetio/css-abbreviation": {
+      "version": "2.1.8",
+      "resolved": "https://registry.npmjs.org/@emmetio/css-abbreviation/-/css-abbreviation-2.1.8.tgz",
+      "integrity": "sha512-s9yjhJ6saOO/uk1V74eifykk2CBYi01STTK3WlXWGOepyKa23ymJ053+DNQjpFcy1ingpaO7AxCcwLvHFY9tuw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@emmetio/scanner": "^1.0.4"
+      }
+    },
+    "node_modules/@emmetio/css-parser": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@emmetio/css-parser/-/css-parser-0.4.1.tgz",
+      "integrity": "sha512-2bC6m0MV/voF4CTZiAbG5MWKbq5EBmDPKu9Sb7s7nVcEzNQlrZP6mFFFlIaISM8X6514H9shWMme1fCm8cWAfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@emmetio/stream-reader": "^2.2.0",
+        "@emmetio/stream-reader-utils": "^0.1.0"
+      }
+    },
+    "node_modules/@emmetio/html-matcher": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@emmetio/html-matcher/-/html-matcher-1.3.0.tgz",
+      "integrity": "sha512-NTbsvppE5eVyBMuyGfVu2CRrLvo7J4YHb6t9sBFLyY03WYhXET37qA4zOYUjBWFCRHO7pS1B9khERtY0f5JXPQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@emmetio/scanner": "^1.0.0"
+      }
+    },
+    "node_modules/@emmetio/scanner": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@emmetio/scanner/-/scanner-1.0.4.tgz",
+      "integrity": "sha512-IqRuJtQff7YHHBk4G8YZ45uB9BaAGcwQeVzgj/zj8/UdOhtQpEIupUhSk8dys6spFIWVZVeK20CzGEnqR5SbqA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@emmetio/stream-reader": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@emmetio/stream-reader/-/stream-reader-2.2.0.tgz",
+      "integrity": "sha512-fXVXEyFA5Yv3M3n8sUGT7+fvecGrZP4k6FnWWMSZVQf69kAq0LLpaBQLGcPR30m3zMmKYhECP4k/ZkzvhEW5kw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@emmetio/stream-reader-utils": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/@emmetio/stream-reader-utils/-/stream-reader-utils-0.1.0.tgz",
+      "integrity": "sha512-ZsZ2I9Vzso3Ho/pjZFsmmZ++FWeEd/txqybHTm4OgaZzdS8V9V/YYWQwg5TC38Z7uLWUV1vavpLLbjJtKubR1A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@emnapi/runtime": {
       "version": "1.4.4",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.4.4.tgz",
@@ -1726,6 +1863,104 @@
       "integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
       "license": "ISC"
     },
+    "node_modules/@volar/kit": {
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/kit/-/kit-2.4.28.tgz",
+      "integrity": "sha512-cKX4vK9dtZvDRaAzeoUdaAJEew6IdxHNCRrdp5Kvcl6zZOqb6jTOfk3kXkIkG3T7oTFXguEMt5+9ptyqYR84Pg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@volar/language-service": "2.4.28",
+        "@volar/typescript": "2.4.28",
+        "typesafe-path": "^0.2.2",
+        "vscode-languageserver-textdocument": "^1.0.11",
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "typescript": "*"
+      }
+    },
+    "node_modules/@volar/language-core": {
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/language-core/-/language-core-2.4.28.tgz",
+      "integrity": "sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@volar/source-map": "2.4.28"
+      }
+    },
+    "node_modules/@volar/language-server": {
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/language-server/-/language-server-2.4.28.tgz",
+      "integrity": "sha512-NqcLnE5gERKuS4PUFwlhMxf6vqYo7hXtbMFbViXcbVkbZ905AIVWhnSo0ZNBC2V127H1/2zP7RvVOVnyITFfBw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@volar/language-core": "2.4.28",
+        "@volar/language-service": "2.4.28",
+        "@volar/typescript": "2.4.28",
+        "path-browserify": "^1.0.1",
+        "request-light": "^0.7.0",
+        "vscode-languageserver": "^9.0.1",
+        "vscode-languageserver-protocol": "^3.17.5",
+        "vscode-languageserver-textdocument": "^1.0.11",
+        "vscode-uri": "^3.0.8"
+      }
+    },
+    "node_modules/@volar/language-service": {
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/language-service/-/language-service-2.4.28.tgz",
+      "integrity": "sha512-Rh/wYCZJrI5vCwMk9xyw/Z+MsWxlJY1rmMZPsxUoJKfzIRjS/NF1NmnuEcrMbEVGja00aVpCsInJfixQTMdvLw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@volar/language-core": "2.4.28",
+        "vscode-languageserver-protocol": "^3.17.5",
+        "vscode-languageserver-textdocument": "^1.0.11",
+        "vscode-uri": "^3.0.8"
+      }
+    },
+    "node_modules/@volar/source-map": {
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/source-map/-/source-map-2.4.28.tgz",
+      "integrity": "sha512-yX2BDBqJkRXfKw8my8VarTyjv48QwxdJtvRgUpNE5erCsgEUdI2DsLbpa+rOQVAJYshY99szEcRDmyHbF10ggQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@volar/typescript": {
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/typescript/-/typescript-2.4.28.tgz",
+      "integrity": "sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@volar/language-core": "2.4.28",
+        "path-browserify": "^1.0.1",
+        "vscode-uri": "^3.0.8"
+      }
+    },
+    "node_modules/@vscode/emmet-helper": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@vscode/emmet-helper/-/emmet-helper-2.11.0.tgz",
+      "integrity": "sha512-QLxjQR3imPZPQltfbWRnHU6JecWTF1QSWhx3GAKQpslx7y3Dp6sIIXhKjiUJ/BR9FX8PVthjr9PD6pNwOJfAzw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emmet": "^2.4.3",
+        "jsonc-parser": "^2.3.0",
+        "vscode-languageserver-textdocument": "^1.0.1",
+        "vscode-languageserver-types": "^3.15.1",
+        "vscode-uri": "^3.0.8"
+      }
+    },
+    "node_modules/@vscode/l10n": {
+      "version": "0.0.18",
+      "resolved": "https://registry.npmjs.org/@vscode/l10n/-/l10n-0.0.18.tgz",
+      "integrity": "sha512-KYSIHVmslkaCDyw013pphY+d7x1qV8IZupYfeIfzNA+nsaWHbn5uPuQRvdRFsa9zFzGeudPuoGoZ1Op4jrJXIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/acorn": {
       "version": "8.15.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
@@ -1747,6 +1982,38 @@
         "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-draft-04": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/ajv-draft-04/-/ajv-draft-04-1.0.0.tgz",
+      "integrity": "sha512-mv00Te6nmYbRp5DCwclxtt7yV/joXJPGS7nM+97GdxvuttCOfgI3K4U25zboyeX0O+myI8ERluxQe5wljMmVIw==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "ajv": "^8.5.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/ansi-align": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/ansi-align/-/ansi-align-3.0.1.tgz",
@@ -2024,6 +2291,50 @@
         "node": ">= 18"
       }
     },
+    "node_modules/astro/node_modules/tsconfck": {
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/tsconfck/-/tsconfck-3.1.6.tgz",
+      "integrity": "sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==",
+      "deprecated": "unmaintained",
+      "license": "MIT",
+      "bin": {
+        "tsconfck": "bin/tsconfck.js"
+      },
+      "engines": {
+        "node": "^18 || >=20"
+      },
+      "peerDependencies": {
+        "typescript": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/astro/node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/astro/node_modules/zod-to-ts": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/zod-to-ts/-/zod-to-ts-1.2.0.tgz",
+      "integrity": "sha512-x30XE43V+InwGpvTySRNz9kB7qFU8DlyEy7BsSTCHPH1R0QasMmHWZDCzYm6bVXtj/9NNJAZF3jW8rzFvH5OFA==",
+      "peerDependencies": {
+        "typescript": "^4.9.4 || ^5.0.2",
+        "zod": "^3"
+      }
+    },
     "node_modules/axobject-query": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
@@ -2230,6 +2541,100 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/cliui": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cliui/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/cliui/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cliui/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
     "node_modules/clsx": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
@@ -2640,6 +3045,23 @@
         "node": ">=4"
       }
     },
+    "node_modules/emmet": {
+      "version": "2.4.11",
+      "resolved": "https://registry.npmjs.org/emmet/-/emmet-2.4.11.tgz",
+      "integrity": "sha512-23QPJB3moh/U9sT4rQzGgeyyGIrcM+GH5uVYg2C6wZIxAIJq7Ng3QLT79tl8FUwDXhyq9SusfknOrofAKqvgyQ==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "./packages/scanner",
+        "./packages/abbreviation",
+        "./packages/css-abbreviation",
+        "./"
+      ],
+      "dependencies": {
+        "@emmetio/abbreviation": "^2.3.3",
+        "@emmetio/css-abbreviation": "^2.1.8"
+      }
+    },
     "node_modules/emoji-regex": {
       "version": "10.4.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.4.0.tgz",
@@ -2737,6 +3159,16 @@
         "@esbuild/win32-x64": "0.25.6"
       }
     },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/escape-string-regexp": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
@@ -2864,6 +3296,30 @@
       "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "license": "MIT"
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
+      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fast-xml-builder": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
@@ -2975,6 +3431,16 @@
         "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
     "node_modules/get-east-asian-width": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.3.0.tgz",
@@ -3631,6 +4097,30 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jsonc-parser": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-2.3.1.tgz",
+      "integrity": "sha512-H8jvkz1O50L3dMZCsLqiuB2tA7muqbSg1AtGEkN0leAqGjsUzDJir3Zwr02BhqdcITPg3ei3mZ+HjMocAknhhg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/kleur": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
+      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/klona": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/klona/-/klona-2.0.6.tgz",
@@ -4845,6 +5335,13 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
+    "node_modules/muggle-string": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/muggle-string/-/muggle-string-0.4.1.tgz",
+      "integrity": "sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/nanoid": {
       "version": "3.3.11",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
@@ -5072,6 +5569,13 @@
         "url": "https://github.com/inikulin/parse5?sponsor=1"
       }
     },
+    "node_modules/path-browserify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-1.0.1.tgz",
+      "integrity": "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/path-expression-matcher": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
@@ -5100,9 +5604,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -5177,6 +5681,22 @@
         "node": ">=4"
       }
     },
+    "node_modules/prettier": {
+      "version": "3.8.4",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
+      "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
     "node_modules/prismjs": {
       "version": "1.30.0",
       "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.30.0.tgz",
@@ -5569,6 +6089,33 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/request-light": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/request-light/-/request-light-0.7.0.tgz",
+      "integrity": "sha512-lMbBMrDoxgsyO+yB3sDcrDuX85yYt7sS8BfQd11jtbW/z5ZWgLZRcEGLsLoYw7I0WSUGQBs8CC8ScIxkTX1+6Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/retext": {
       "version": "9.0.0",
       "resolved": "https://registry.npmjs.org/retext/-/retext-9.0.0.tgz",
@@ -6012,13 +6559,13 @@
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -6069,26 +6616,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/tsconfck": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/tsconfck/-/tsconfck-3.1.6.tgz",
-      "integrity": "sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==",
-      "license": "MIT",
-      "bin": {
-        "tsconfck": "bin/tsconfck.js"
-      },
-      "engines": {
-        "node": "^18 || >=20"
-      },
-      "peerDependencies": {
-        "typescript": "^5.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -6108,12 +6635,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/typesafe-path": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/typesafe-path/-/typesafe-path-0.2.2.tgz",
+      "integrity": "sha512-OJabfkAg1WLZSqJAJ0Z6Sdt3utnbzr/jh+NAHoyWHJe8CMSy79Gm085094M9nvTPy22KzTVn5Zq5mbapCI/hPA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/typescript": {
-      "version": "5.8.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz",
-      "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -6122,6 +6656,16 @@
         "node": ">=14.17"
       }
     },
+    "node_modules/typescript-auto-import-cache": {
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/typescript-auto-import-cache/-/typescript-auto-import-cache-0.3.6.tgz",
+      "integrity": "sha512-RpuHXrknHdVdK7wv/8ug3Fr0WNsNi5l5aB8MYYuXhq2UH5lnEB1htJ1smhtD5VeCsGr2p8mUDtd83LCQDFVgjQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.8"
+      }
+    },
     "node_modules/ufo": {
       "version": "1.6.2",
       "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.2.tgz",
@@ -6564,6 +7108,296 @@
         }
       }
     },
+    "node_modules/volar-service-css": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-css/-/volar-service-css-0.0.70.tgz",
+      "integrity": "sha512-K1qyOvBpE3rzdAv3e4/6Rv5yizrYPy5R/ne3IWCAzLBuMO4qBMV3kSqWzj6KUVe6S0AnN6wxF7cRkiaKfYMYJw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-css-languageservice": "^6.3.0",
+        "vscode-languageserver-textdocument": "^1.0.11",
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/volar-service-emmet": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-emmet/-/volar-service-emmet-0.0.70.tgz",
+      "integrity": "sha512-xi5bC4m/VyE3zy/n2CXspKeDZs3qA41tHLTw275/7dNWM/RqE2z3BnDICQybHIVp/6G1iOQj5c1qXMgQC08TNg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@emmetio/css-parser": "^0.4.1",
+        "@emmetio/html-matcher": "^1.3.0",
+        "@vscode/emmet-helper": "^2.9.3",
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/volar-service-html": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-html/-/volar-service-html-0.0.70.tgz",
+      "integrity": "sha512-eR6vCgMdmYAo4n+gcT7DSyBQbwB8S3HZZvSagTf0sxNaD4WppMCFfpqWnkrlGStPKMZvMiejRRVmqsX9dYcTvQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-html-languageservice": "^5.3.0",
+        "vscode-languageserver-textdocument": "^1.0.11",
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/volar-service-prettier": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-prettier/-/volar-service-prettier-0.0.70.tgz",
+      "integrity": "sha512-Z6BCFSpGVCd8BPAsZ785Kce1BGlWd5ODqmqZGVuB14MJvrR4+CYz6cDy4F+igmE1gMifqfvMhdgT8Aud4M5ngg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0",
+        "prettier": "^2.2 || ^3.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        },
+        "prettier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/volar-service-typescript": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-typescript/-/volar-service-typescript-0.0.70.tgz",
+      "integrity": "sha512-l46Bx4cokkUedTd74ojO5H/zqHZJ8SUuyZ0IB8JN4jfRqUM3bQFBHoOwlZCyZmOeO0A3RQNkMnFclxO4c++gsg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-browserify": "^1.0.1",
+        "semver": "^7.6.2",
+        "typescript-auto-import-cache": "^0.3.5",
+        "vscode-languageserver-textdocument": "^1.0.11",
+        "vscode-nls": "^5.2.0",
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/volar-service-typescript-twoslash-queries": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-typescript-twoslash-queries/-/volar-service-typescript-twoslash-queries-0.0.70.tgz",
+      "integrity": "sha512-IdD13Z9N2Bu8EM6CM0fDV1E69olEYGHDU25X51YXmq8Y0CmJ2LNj6gOiBJgpS5JGUqFzECVhMNBW7R0sPdRTMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-uri": "^3.0.8"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/volar-service-yaml": {
+      "version": "0.0.70",
+      "resolved": "https://registry.npmjs.org/volar-service-yaml/-/volar-service-yaml-0.0.70.tgz",
+      "integrity": "sha512-0c8bXDBeoATF9F6iPIlOuYTuZAC4c+yi0siQo920u7eiBJk8oQmUmg9cDUbR4+Gl++bvGP4plj3fErbJuPqdcQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-uri": "^3.0.8",
+        "yaml-language-server": "~1.20.0"
+      },
+      "peerDependencies": {
+        "@volar/language-service": "~2.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@volar/language-service": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vscode-css-languageservice": {
+      "version": "6.3.10",
+      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.10.tgz",
+      "integrity": "sha512-eq5N9Er3fC4vA9zd9EFhyBG90wtCCuXgRSpAndaOgXMh1Wgep5lBgRIeDgjZBW9pa+332yC9+49cZMW8jcL3MA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vscode/l10n": "^0.0.18",
+        "vscode-languageserver-textdocument": "^1.0.12",
+        "vscode-languageserver-types": "3.17.5",
+        "vscode-uri": "^3.1.0"
+      }
+    },
+    "node_modules/vscode-css-languageservice/node_modules/vscode-languageserver-types": {
+      "version": "3.17.5",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.5.tgz",
+      "integrity": "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vscode-html-languageservice": {
+      "version": "5.6.2",
+      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.6.2.tgz",
+      "integrity": "sha512-ulCrSnFnfQ16YzvwnYUgEbUEl/ZG7u2eV27YhvLObSHKkb8fw1Z9cgsnUwjTEeDIdJDoTDTDpxuhQwoenoLNMg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vscode/l10n": "^0.0.18",
+        "vscode-languageserver-textdocument": "^1.0.12",
+        "vscode-languageserver-types": "^3.17.5",
+        "vscode-uri": "^3.1.0"
+      }
+    },
+    "node_modules/vscode-json-languageservice": {
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/vscode-json-languageservice/-/vscode-json-languageservice-4.1.8.tgz",
+      "integrity": "sha512-0vSpg6Xd9hfV+eZAaYN63xVVMOTmJ4GgHxXnkLCh+9RsQBkWKIghzLhW2B9ebfG+LQQg8uLtsQ2aUKjTgE+QOg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "jsonc-parser": "^3.0.0",
+        "vscode-languageserver-textdocument": "^1.0.1",
+        "vscode-languageserver-types": "^3.16.0",
+        "vscode-nls": "^5.0.0",
+        "vscode-uri": "^3.0.2"
+      },
+      "engines": {
+        "npm": ">=7.0.0"
+      }
+    },
+    "node_modules/vscode-json-languageservice/node_modules/jsonc-parser": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
+      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vscode-jsonrpc": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-9.0.0.tgz",
+      "integrity": "sha512-+VvMmQPJhtvJ+8O+zu2JKIRiLxXF8NW7krWgyMGeOHrp4Cn23T5hc0v2LknNeopDOB70wghHAds7mKtcZ0I4Sg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/vscode-languageserver": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver/-/vscode-languageserver-9.0.1.tgz",
+      "integrity": "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-languageserver-protocol": "3.17.5"
+      },
+      "bin": {
+        "installServerIntoExtension": "bin/installServerIntoExtension"
+      }
+    },
+    "node_modules/vscode-languageserver-protocol": {
+      "version": "3.18.0",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.18.0.tgz",
+      "integrity": "sha512-Zdz+kJ12Iz6tc11xfZyEo501bBATHXrCjmMfnaR3pMnf1CoqZBKIynba3P+/bi9VEdrMbNtAVKYpKhbODvqy+Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-jsonrpc": "9.0.0",
+        "vscode-languageserver-types": "3.18.0"
+      }
+    },
+    "node_modules/vscode-languageserver-textdocument": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-textdocument/-/vscode-languageserver-textdocument-1.0.12.tgz",
+      "integrity": "sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vscode-languageserver-types": {
+      "version": "3.18.0",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.18.0.tgz",
+      "integrity": "sha512-8TsGPNMIMiiBdkORgRSvLjuiEIiAFtO+KssmYWxQ+uSVvlf7RjK8YKCOjPzZ+YA04jXEV7+7LvkSmHkhpNS99g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vscode-languageserver/node_modules/vscode-jsonrpc": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.2.0.tgz",
+      "integrity": "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/vscode-languageserver/node_modules/vscode-languageserver-protocol": {
+      "version": "3.17.5",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.5.tgz",
+      "integrity": "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vscode-jsonrpc": "8.2.0",
+        "vscode-languageserver-types": "3.17.5"
+      }
+    },
+    "node_modules/vscode-languageserver/node_modules/vscode-languageserver-types": {
+      "version": "3.17.5",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.5.tgz",
+      "integrity": "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vscode-nls": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/vscode-nls/-/vscode-nls-5.2.0.tgz",
+      "integrity": "sha512-RAaHx7B14ZU04EU31pT+rKz2/zSl7xMsfIZuo8pd+KZO6PXtQmpevpq3vxvWNcrGbdmhM/rr5Uw5Mz+NBfhVng==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vscode-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz",
+      "integrity": "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/web-namespaces": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/web-namespaces/-/web-namespaces-2.0.1.tgz",
@@ -6636,6 +7470,94 @@
       "integrity": "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA==",
       "license": "MIT"
     },
+    "node_modules/y18n": {
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yaml": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "devOptional": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
+    "node_modules/yaml-language-server": {
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/yaml-language-server/-/yaml-language-server-1.20.0.tgz",
+      "integrity": "sha512-qhjK/bzSRZ6HtTvgeFvjNPJGWdZ0+x5NREV/9XZWFjIGezew2b4r5JPy66IfOhd5OA7KeFwk1JfmEbnTvev0cA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vscode/l10n": "^0.0.18",
+        "ajv": "^8.17.1",
+        "ajv-draft-04": "^1.0.0",
+        "prettier": "^3.5.0",
+        "request-light": "^0.5.7",
+        "vscode-json-languageservice": "4.1.8",
+        "vscode-languageserver": "^9.0.0",
+        "vscode-languageserver-textdocument": "^1.0.1",
+        "vscode-languageserver-types": "^3.16.0",
+        "vscode-uri": "^3.0.2",
+        "yaml": "2.7.1"
+      },
+      "bin": {
+        "yaml-language-server": "bin/yaml-language-server"
+      }
+    },
+    "node_modules/yaml-language-server/node_modules/request-light": {
+      "version": "0.5.8",
+      "resolved": "https://registry.npmjs.org/request-light/-/request-light-0.5.8.tgz",
+      "integrity": "sha512-3Zjgh+8b5fhRJBQZoy+zbVKpAQGLyka0MPgW3zruTF4dFFJ8Fqcfu9YsAvi/rvdcaTeWG3MkbZv4WKxAn/84Lg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/yaml-language-server/node_modules/yaml": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.1.tgz",
+      "integrity": "sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/yargs": {
+      "version": "17.7.2",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
+      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/yargs-parser": {
       "version": "21.1.1",
       "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
@@ -6645,6 +7567,51 @@
         "node": ">=12"
       }
     },
+    "node_modules/yargs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/yargs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/yocto-queue": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.1.tgz",
@@ -6702,15 +7669,6 @@
         "zod": "^3.25 || ^4"
       }
     },
-    "node_modules/zod-to-ts": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/zod-to-ts/-/zod-to-ts-1.2.0.tgz",
-      "integrity": "sha512-x30XE43V+InwGpvTySRNz9kB7qFU8DlyEy7BsSTCHPH1R0QasMmHWZDCzYm6bVXtj/9NNJAZF3jW8rzFvH5OFA==",
-      "peerDependencies": {
-        "typescript": "^4.9.4 || ^5.0.2",
-        "zod": "^3"
-      }
-    },
     "node_modules/zwitch": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
diff --git a/docs/package.json b/docs/package.json
index 82cf5c7..3a75e02 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -5,7 +5,7 @@
   "scripts": {
     "dev": "astro dev",
     "start": "astro dev",
-    "build": "astro build",
+    "build": "astro check && astro build",
     "preview": "astro preview",
     "astro": "astro"
   },
@@ -15,5 +15,9 @@
     "sharp": "^0.34.2",
     "starlight-blog": "^0.25.3",
     "starlight-llms-txt": "^0.7.0"
+  },
+  "devDependencies": {
+    "@astrojs/check": "0.9.9",
+    "typescript": "6.0.3"
   }
 }
diff --git a/docs/src/assets/sops-logo.svg b/docs/src/assets/sops-logo.svg
new file mode 100644
index 0000000..7d5889f
--- /dev/null
+++ b/docs/src/assets/sops-logo.svg
@@ -0,0 +1,4 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="60" height="60" fill="black"/>
+<path d="M16.2869 26.8182C16.223 26.2784 15.9638 25.8594 15.5092 25.5611C15.0547 25.2628 14.4972 25.1136 13.8366 25.1136C13.3537 25.1136 12.9311 25.1918 12.5689 25.348C12.2102 25.5043 11.9297 25.7191 11.7273 25.9925C11.5284 26.266 11.429 26.5767 11.429 26.9247C11.429 27.2159 11.4982 27.4663 11.6367 27.6758C11.7788 27.8817 11.9599 28.054 12.18 28.1925C12.4002 28.3274 12.631 28.4393 12.8725 28.5281C13.114 28.6133 13.3359 28.6825 13.5384 28.7358L14.6463 29.0341C14.9304 29.1087 15.2464 29.2116 15.5945 29.343C15.946 29.4744 16.2816 29.6538 16.6012 29.881C16.9244 30.1048 17.1907 30.3924 17.4002 30.744C17.6097 31.0955 17.7145 31.527 17.7145 32.0384C17.7145 32.6278 17.56 33.1605 17.2511 33.6364C16.9457 34.1122 16.4982 34.4904 15.9087 34.771C15.3228 35.0515 14.6108 35.1918 13.7727 35.1918C12.9915 35.1918 12.315 35.0657 11.7433 34.8136C11.1751 34.5614 10.7276 34.2099 10.4009 33.7589C10.0778 33.3079 9.89489 32.7841 9.85227 32.1875H11.2159C11.2514 32.5994 11.3899 32.9403 11.6314 33.2102C11.8764 33.4766 12.1854 33.6754 12.5582 33.8068C12.9347 33.9347 13.3395 33.9986 13.7727 33.9986C14.277 33.9986 14.7298 33.9169 15.131 33.7536C15.5323 33.5866 15.8501 33.3558 16.0845 33.0611C16.3189 32.7628 16.4361 32.4148 16.4361 32.017C16.4361 31.6548 16.3349 31.3601 16.1325 31.1328C15.93 30.9055 15.6637 30.7209 15.3335 30.5788C15.0032 30.4368 14.6463 30.3125 14.2628 30.206L12.9205 29.8224C12.0682 29.5774 11.3935 29.2276 10.8963 28.7731C10.3991 28.3185 10.1506 27.7237 10.1506 26.9886C10.1506 26.3778 10.3157 25.8452 10.646 25.3906C10.9798 24.9325 11.4272 24.5774 11.9883 24.3253C12.5529 24.0696 13.1832 23.9418 13.8793 23.9418C14.5824 23.9418 15.2074 24.0678 15.7543 24.32C16.3011 24.5685 16.7344 24.9094 17.054 25.3427C17.3771 25.7759 17.5476 26.2678 17.5653 26.8182H16.2869ZM29.091 29.5455C29.091 30.696 28.8833 31.6903 28.4678 32.5284C28.0523 33.3665 27.4823 34.0128 26.7579 34.4673C26.0335 34.9219 25.2061 35.1491 24.2757 35.1491C23.3453 35.1491 22.5178 34.9219 21.7934 34.4673C21.069 34.0128 20.499 33.3665 20.0835 32.5284C19.6681 31.6903 19.4603 30.696 19.4603 29.5455C19.4603 28.3949 19.6681 27.4006 20.0835 26.5625C20.499 25.7244 21.069 25.0781 21.7934 24.6236C22.5178 24.169 23.3453 23.9418 24.2757 23.9418C25.2061 23.9418 26.0335 24.169 26.7579 24.6236C27.4823 25.0781 28.0523 25.7244 28.4678 26.5625C28.8833 27.4006 29.091 28.3949 29.091 29.5455ZM27.8126 29.5455C27.8126 28.6009 27.6546 27.8036 27.3385 27.1538C27.026 26.5039 26.6017 26.0121 26.0654 25.6783C25.5328 25.3445 24.9362 25.1776 24.2757 25.1776C23.6151 25.1776 23.0168 25.3445 22.4806 25.6783C21.9479 26.0121 21.5235 26.5039 21.2075 27.1538C20.895 27.8036 20.7387 28.6009 20.7387 29.5455C20.7387 30.4901 20.895 31.2873 21.2075 31.9371C21.5235 32.587 21.9479 33.0788 22.4806 33.4126C23.0168 33.7464 23.6151 33.9134 24.2757 33.9134C24.9362 33.9134 25.5328 33.7464 26.0654 33.4126C26.6017 33.0788 27.026 32.587 27.3385 31.9371C27.6546 31.2873 27.8126 30.4901 27.8126 29.5455ZM31.3122 35V24.0909H34.9983C35.8541 24.0909 36.5537 24.2454 37.097 24.5543C37.6439 24.8597 38.0487 25.2734 38.3115 25.7955C38.5743 26.3175 38.7057 26.8999 38.7057 27.5426C38.7057 28.1854 38.5743 28.7695 38.3115 29.2951C38.0523 29.8207 37.651 30.2397 37.1077 30.5522C36.5644 30.8612 35.8683 31.0156 35.0196 31.0156H32.3776V29.8438H34.977C35.5629 29.8438 36.0335 29.7425 36.3886 29.5401C36.7437 29.3377 37.0012 29.0643 37.161 28.7198C37.3243 28.3718 37.406 27.9794 37.406 27.5426C37.406 27.1058 37.3243 26.7152 37.161 26.3707C37.0012 26.0263 36.7419 25.7564 36.3833 25.5611C36.0246 25.3622 35.5487 25.2628 34.9557 25.2628H32.6333V35H31.3122ZM46.7996 26.8182C46.7357 26.2784 46.4765 25.8594 46.0219 25.5611C45.5674 25.2628 45.0099 25.1136 44.3493 25.1136C43.8664 25.1136 43.4438 25.1918 43.0816 25.348C42.7229 25.5043 42.4424 25.7191 42.24 25.9925C42.0411 26.266 41.9417 26.5767 41.9417 26.9247C41.9417 27.2159 42.0109 27.4663 42.1494 27.6758C42.2915 27.8817 42.4726 28.054 42.6927 28.1925C42.9129 28.3274 43.1437 28.4393 43.3852 28.5281C43.6267 28.6133 43.8486 28.6825 44.051 28.7358L45.159 29.0341C45.4431 29.1087 45.7591 29.2116 46.1072 29.343C46.4587 29.4744 46.7943 29.6538 47.1139 29.881C47.4371 30.1048 47.7034 30.3924 47.9129 30.744C48.1224 31.0955 48.2272 31.527 48.2272 32.0384C48.2272 32.6278 48.0727 33.1605 47.7638 33.6364C47.4584 34.1122 47.0109 34.4904 46.4214 34.771C45.8355 35.0515 45.1235 35.1918 44.2854 35.1918C43.5042 35.1918 42.8277 35.0657 42.2559 34.8136C41.6878 34.5614 41.2403 34.2099 40.9136 33.7589C40.5905 33.3079 40.4076 32.7841 40.365 32.1875H41.7286C41.7641 32.5994 41.9026 32.9403 42.1441 33.2102C42.3891 33.4766 42.6981 33.6754 43.0709 33.8068C43.4474 33.9347 43.8522 33.9986 44.2854 33.9986C44.7897 33.9986 45.2425 33.9169 45.6437 33.7536C46.045 33.5866 46.3628 33.3558 46.5972 33.0611C46.8316 32.7628 46.9488 32.4148 46.9488 32.017C46.9488 31.6548 46.8476 31.3601 46.6452 31.1328C46.4427 30.9055 46.1764 30.7209 45.8461 30.5788C45.5159 30.4368 45.159 30.3125 44.7755 30.206L43.4332 29.8224C42.5809 29.5774 41.9062 29.2276 41.409 28.7731C40.9118 28.3185 40.6633 27.7237 40.6633 26.9886C40.6633 26.3778 40.8284 25.8452 41.1586 25.3906C41.4925 24.9325 41.9399 24.5774 42.501 24.3253C43.0656 24.0696 43.6959 23.9418 44.392 23.9418C45.0951 23.9418 45.7201 24.0678 46.267 24.32C46.8138 24.5685 47.2471 24.9094 47.5667 25.3427C47.8898 25.7759 48.0603 26.2678 48.078 26.8182H46.7996Z" fill="white"/>
+</svg>
diff --git a/docs/src/content/docs/concepts/providers.md b/docs/src/content/docs/concepts/providers.md
index a29c138..9fc442b 100644
--- a/docs/src/content/docs/concepts/providers.md
+++ b/docs/src/content/docs/concepts/providers.md
@@ -20,6 +20,7 @@ Providers are pluggable storage backends that handle the storage and retrieval o
 | **awssm** | AWS Secrets Manager (requires `--features awssm`) | ✓ | ✓ | ✓ |
 | **vault** | HashiCorp Vault / OpenBao (requires `--features vault`) | ✓ | ✓ | ✓ |
 | **bws** | Bitwarden Secrets Manager (requires `--features bws`) | ✓ | ✓ | ✓ |
+| **sops** | SOPS: Secrets OPerationS (requires `--features sops`) | ✓ | ✓ | ✓ |
 
 ## Provider Selection
 
diff --git a/docs/src/content/docs/providers/sops.md b/docs/src/content/docs/providers/sops.md
new file mode 100644
index 0000000..4ffaf9d
--- /dev/null
+++ b/docs/src/content/docs/providers/sops.md
@@ -0,0 +1,124 @@
+---
+title: "SOPS: Secrets OPerationS"
+description: SOPS integration
+---
+
+The Vault provider integrates with HashiCorp Vault and OpenBao for centralized secret management using the KV (Key-Value) secrets engine. Since OpenBao is an API-compatible fork of Vault, a single provider works for both.
+
+## Prerequisites
+
+- A running Vault or OpenBao server
+- Authentication credentials (see [Authentication](#authentication))
+- KV secrets engine enabled (v1 or v2)
+- Build with `--features vault`
+
+## Configuration
+
+### URI Format
+
+```
+vault://[namespace@]host[:port][/mount][?key=value&...]
+openbao://[namespace@]host[:port][/mount][?key=value&...]
+```
+
+- `host[:port]`: Vault server address (falls back to `VAULT_ADDR` env var)
+- `mount`: KV engine mount path (default: `secret`)
+- `namespace@`: Optional Vault namespace (also reads `VAULT_NAMESPACE` env var)
+- `?auth=approle`: Use AppRole authentication (default: `token`)
+- `?kv=1`: Use KV v1 engine (default: v2)
+- `?tls=false`: Disable TLS (for development servers)
+
+### Examples
+
+```bash
+# Set a secret using Vault KV v2
+$ secretspec set DATABASE_URL --provider vault://vault.example.com:8200/secret
+
+# Get a secret
+$ secretspec get DATABASE_URL --provider vault://vault.example.com:8200/secret
+
+# Check secrets
+$ secretspec check --provider vault://vault.example.com:8200/secret
+
+# Run with secrets
+$ secretspec run --provider vault://vault.example.com:8200/secret -- npm start
+```
+
+## Usage
+
+### Basic Commands
+
+```bash
+# With default "secret" mount
+$ secretspec set DATABASE_URL --provider vault://vault.example.com:8200
+Enter value for DATABASE_URL: postgresql://localhost/mydb
+✓ Secret 'DATABASE_URL' saved to vault (profile: default)
+
+# With custom mount
+$ secretspec set API_KEY --provider vault://vault.example.com:8200/custom-kv
+
+# Using OpenBao
+$ secretspec check --provider openbao://bao.internal:8200/secret
+```
+
+### KV Version 1
+
+```bash
+# Use KV v1 engine
+$ secretspec set DATABASE_URL --provider "vault://vault.example.com:8200/secret?kv=1"
+```
+
+### Vault Namespaces
+
+```bash
+# Using namespace in URI
+$ secretspec check --provider vault://team-a@vault.example.com:8200/secret
+
+# Or via environment variable
+$ export VAULT_NAMESPACE=team-a
+$ secretspec check --provider vault://vault.example.com:8200/secret
+```
+
+### Secret Naming
+
+Secrets are stored at the KV path: `secretspec/{project}/{profile}/{key}`
+
+Each secret is stored as a KV entry with a `value` field.
+
+Example for KV v2: `GET /v1/secret/data/secretspec/myapp/production/DATABASE_URL`
+
+### Development Mode
+
+For local development with Vault in dev mode:
+
+```bash
+# Start Vault in dev mode
+$ vault server -dev
+
+# Use with TLS disabled
+$ export VAULT_TOKEN=hvs.dev-root-token
+$ secretspec check --provider "vault://127.0.0.1:8200/secret?tls=false"
+```
+
+### Authentication
+
+The authentication method is selected via the `auth` query parameter.
+
+#### Token (default)
+
+Reads the token from `VAULT_TOKEN` environment variable or `~/.vault-token` file.
+
+```bash
+export VAULT_TOKEN=hvs.your-token-here
+secretspec run --provider vault://vault.example.com:8200 -- npm start
+```
+
+#### AppRole
+
+Authenticates using `VAULT_ROLE_ID` and `VAULT_SECRET_ID` environment variables. Useful for CI/CD pipelines and deployment platforms where a static token is not appropriate.
+
+```bash
+export VAULT_ROLE_ID=your-role-id
+export VAULT_SECRET_ID=your-secret-id
+secretspec run --provider "vault://vault.example.com:8200/secret?auth=approle" -- deploy
+```
diff --git a/docs/src/content/docs/quick-start.mdx b/docs/src/content/docs/quick-start.mdx
index 700fb41..4626827 100644
--- a/docs/src/content/docs/quick-start.mdx
+++ b/docs/src/content/docs/quick-start.mdx
@@ -100,6 +100,7 @@ $ secretspec config init
   awssm: AWS Secrets Manager
   vault: HashiCorp Vault / OpenBao secret management
   bws: Bitwarden Secrets Manager
+  sops: Secrets OPerationS
 ? Select your default profile:
 > development
   default
diff --git a/docs/src/content/docs/reference/providers.md b/docs/src/content/docs/reference/providers.md
index 16cbf6a..d925317 100644
--- a/docs/src/content/docs/reference/providers.md
+++ b/docs/src/content/docs/reference/providers.md
@@ -153,6 +153,18 @@ API endpoints are derived as `https://SERVER_BASE/identity` and
 **Prerequisites**: BWS subscription, machine account access token, build with `--features bws`
 **Storage**: Flat key names in the specified BWS project
 
+## SOPS: Secrets OPerationS Provider
+
+**URI**: `sops://PROJECT_UUID` - Stores secrets in Bitwarden Secrets Manager
+
+```bash
+sops://a9230ec4-5507-4870-b8b5-b3f500587e4c   # BWS project UUID
+```
+
+**Features**: Read/write, cloud sync, project-scoped, end-to-end encryption
+**Prerequisites**: BWS subscription, machine account access token, build with `--features bws`
+**Storage**: Flat key names in the specified BWS project
+
 ## Provider Selection
 
 ### Command Line
@@ -190,3 +202,4 @@ export SECRETSPEC_PROVIDER="dotenv:///config/.env"
 | AWSSM | ✅ AWS KMS | Cloud (AWS) | ✅ Yes |
 | Vault/OpenBao | ✅ Vault encryption | Vault/OpenBao server | ✅ Yes |
 | BWS | ✅ End-to-end | Cloud (Bitwarden) | ✅ Yes |
+| SOPS | ✅ End-to-end | Local Filesystem or Cloud (assorted) | ✅ Yes |
diff --git a/docs/src/pages/index.astro b/docs/src/pages/index.astro
index acecfa3..f33b2e6 100644
--- a/docs/src/pages/index.astro
+++ b/docs/src/pages/index.astro
@@ -41,6 +41,7 @@ const providerMetadata: ProviderMetadata[] = [
   { icon: 'dotenv', slug: 'dotenv', label: '.env files' },
   { icon: 'linux', slug: 'keyring', label: 'Secret Service' },
   { slug: 'keyring', label: 'Credential Manager' },
+  { slug: 'sops', label: 'SOPS: Secrets OPerationS' },
 ];
 
 
@@ -632,7 +633,7 @@ REDIS_URL=redis://…</code></pre>
 <img referrerpolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=ddbe4178-cff6-4549-9365-facbc08f3b6f" alt="" width="1" height="1" style="position:absolute;left:-9999px;top:auto;width:1px;height:1px;overflow:hidden" />
 
 <script>
-  // ── Provider switcher ──
+    // ── Provider switcher ──
   (function () {
     const tabs = document.querySelectorAll('#secret-tabs .landing-provider-tab');
 
diff --git a/secretspec/Cargo.toml b/secretspec/Cargo.toml
index a921eae..79693ae 100644
--- a/secretspec/Cargo.toml
+++ b/secretspec/Cargo.toml
@@ -47,12 +47,16 @@ rsa.workspace = true
 uuid.workspace = true
 data-encoding.workspace = true
 detect-coding-agent.workspace = true
+regex = { workspace = true, optional = true }
+rust-ini = { workspace = true, optional = true }
+saphyr = { workspace = true, optional = true }
 
 [features]
-default = ["cli", "keyring", "gcsm", "awssm", "vault", "bws"]
+default = ["cli", "keyring", "gcsm", "awssm", "vault", "bws", "sops"]
 cli = ["dep:toml_edit"]
 keyring = ["dep:keyring", "dep:whoami"]
 gcsm = ["dep:google-cloud-secretmanager-v1"]
 awssm = ["dep:aws-config", "dep:aws-sdk-secretsmanager"]
 vault = ["dep:reqwest"]
 bws = ["dep:bitwarden", "dep:rustls"]
+sops = ["dep:regex", "dep:rust-ini", "dep:saphyr"]
\ No newline at end of file
diff --git a/secretspec/README.md b/secretspec/README.md
index a74d3eb..359ebae 100644
--- a/secretspec/README.md
+++ b/secretspec/README.md
@@ -61,6 +61,7 @@ $ secretspec config init
   awssm: AWS Secrets Manager
   vault: HashiCorp Vault / OpenBao secret management
   bws: Bitwarden Secrets Manager
+  sops: Secrets OPerationS
 ? Select your default profile:
 > development
   default
@@ -143,6 +144,7 @@ SecretSpec supports multiple storage backends for secrets:
 - **[AWS Secrets Manager](https://secretspec.dev/providers/awssm)** - AWS secret management
 - **[Vault / OpenBao](https://secretspec.dev/providers/vault)** - HashiCorp Vault and OpenBao KV engine
 - **[Bitwarden Secrets Manager](https://secretspec.dev/providers/bws)** - Bitwarden Secrets Manager integration
+- **[SOPS: Secrets OPerationS](https://secretspec.dev/providers/sops)** - SOPS integration
 
 ```bash
 $ secretspec run --provider keyring -- npm start
diff --git a/secretspec/src/provider/mod.rs b/secretspec/src/provider/mod.rs
index f2d0ea0..630a31b 100644
--- a/secretspec/src/provider/mod.rs
+++ b/secretspec/src/provider/mod.rs
@@ -141,6 +141,12 @@ impl ProviderUrl {
     }
 }
 
+impl std::fmt::Display for ProviderUrl {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
 /// Executes an async future in a blocking context.
 ///
 /// If already inside a tokio runtime, uses `block_in_place` with the
@@ -171,8 +177,11 @@ pub mod lastpass;
 pub mod onepassword;
 pub mod pass;
 pub mod protonpass;
+#[cfg(feature = "sops")]
+pub mod sops;
 #[cfg(feature = "vault")]
 pub mod vault;
+
 #[macro_use]
 pub mod macros;
 
diff --git a/secretspec/src/provider/sops/config.rs b/secretspec/src/provider/sops/config.rs
new file mode 100644
index 0000000..2f24700
--- /dev/null
+++ b/secretspec/src/provider/sops/config.rs
@@ -0,0 +1,294 @@
+use crate::{
+    Result, SecretSpecError,
+    provider::{
+        ProviderUrl,
+        sops::{
+            SopsFormat,
+            SopsMode::{self},
+            fields::{PATHBUF_FIELDS, STRING_FIELDS},
+            pattern::SopsPathPattern,
+        },
+    },
+};
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::str::FromStr;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SopsConfig {
+    pub format: Option<SopsFormat>,
+    pub mode: SopsMode,
+
+    // Age configuration
+    pub age_key_file: Option<PathBuf>,
+    pub age_key: Option<String>,
+    pub age_key_cmd: Option<String>,
+    pub age_recipients: Option<String>,
+    pub age_ssh_private_key_file: Option<PathBuf>,
+    pub age_ssh_private_key_cmd: Option<String>,
+
+    // AWS KMS configuration
+    pub kms_arn: Option<String>,
+    pub aws_profile: Option<String>,
+    pub aws_access_key_id: Option<String>,
+    pub aws_secret_access_key: Option<String>,
+    pub aws_secret_key: Option<String>, // alias
+    pub aws_region: Option<String>,
+
+    // Azure configuration
+    pub azure_client_id: Option<String>,
+    pub azure_client_secret: Option<String>,
+    pub azure_tenant_id: Option<String>,
+    pub azure_keyvault_urls: Option<String>,
+
+    // GCP KMS configuration
+    pub gcp_kms: Option<String>,
+    pub gcp_kms_client_type: Option<String>,
+    pub gcp_kms_endpoint: Option<String>,
+    pub gcp_kms_ids: Option<String>,
+    pub gcp_kms_universe_domain: Option<String>,
+
+    // PGP configuration
+    pub pgp_fp: Option<String>,
+    pub gpg_exec: Option<String>,
+
+    // HashiCorp Vault configuration
+    pub hc_vault_addr: Option<String>,
+    pub hc_vault_token: Option<String>,
+    pub hc_vault_allowlist: Option<String>,
+
+    // Huawei Cloud KMS
+    pub huawei_sdk_ak: Option<String>,
+    pub huawei_sdk_sk: Option<String>,
+    pub huawei_sdk_project_id: Option<String>,
+    pub huawei_kms_ids: Option<String>,
+
+    // Generic SOPS settings
+    pub sops_config: Option<String>,
+    pub sops_decryption_order: Option<String>,
+    pub sops_editor: Option<String>,
+    pub sops_enable_local_keyservice: Option<String>,
+    pub sops_keyservice: Option<String>,
+
+    // AES_GCM
+    pub aes_gcm: Option<String>,
+
+    // ENCRYPT_DECRYPT toggle
+    pub encrypt_decrypt: Option<String>,
+
+    // Google OAuth token
+    pub google_oauth_access_token: Option<String>,
+}
+
+impl Default for SopsConfig {
+    fn default() -> Self {
+        Self {
+            aes_gcm: None,
+            age_key_cmd: None,
+            age_key_file: None,
+            age_key: None,
+            age_recipients: None,
+            age_ssh_private_key_cmd: None,
+            age_ssh_private_key_file: None,
+            aws_access_key_id: None,
+            aws_profile: None,
+            aws_region: None,
+            aws_secret_access_key: None,
+            aws_secret_key: None,
+            azure_client_id: None,
+            azure_client_secret: None,
+            azure_keyvault_urls: None,
+            azure_tenant_id: None,
+            encrypt_decrypt: None,
+            format: None,
+            gcp_kms_client_type: None,
+            gcp_kms_endpoint: None,
+            gcp_kms_ids: None,
+            gcp_kms_universe_domain: None,
+            gcp_kms: None,
+            google_oauth_access_token: None,
+            gpg_exec: None,
+            hc_vault_addr: None,
+            hc_vault_allowlist: None,
+            hc_vault_token: None,
+            huawei_kms_ids: None,
+            huawei_sdk_ak: None,
+            huawei_sdk_project_id: None,
+            huawei_sdk_sk: None,
+            kms_arn: None,
+            mode: SopsMode::Uninitialized,
+            pgp_fp: None,
+            sops_config: None,
+            sops_decryption_order: None,
+            sops_editor: None,
+            sops_enable_local_keyservice: None,
+            sops_keyservice: None,
+        }
+    }
+}
+
+fn split_template_path(path: &str) -> (PathBuf, String) {
+    let bytes = path.as_bytes();
+    let mut first_placeholder = None;
+
+    for i in 0..bytes.len() {
+        if bytes[i] == b'{' {
+            first_placeholder = Some(i);
+            break;
+        }
+    }
+
+    match first_placeholder {
+        None => (PathBuf::from(path), String::new()),
+        Some(idx) => {
+            let (dir, pat) = path.split_at(idx);
+            (PathBuf::from(dir.trim_end_matches('/')), pat.to_string())
+        }
+    }
+}
+
+fn infer_format_from_pattern(pattern: &str) -> SopsFormat {
+    if let Some(ext) = pattern.split('.').last() {
+        SopsFormat::from_extension(ext)
+    } else {
+        SopsFormat::Yaml
+    }
+}
+
+impl TryFrom<&ProviderUrl> for SopsConfig {
+    type Error = SecretSpecError;
+
+    fn try_from(url: &ProviderUrl) -> std::result::Result<Self, Self::Error> {
+        if url.scheme() != "sops" {
+            return Err(SecretSpecError::ProviderOperationFailed(format!(
+                "Invalid scheme '{}' for SOPS provider",
+                url.scheme()
+            )));
+        }
+
+        let mut target_path = PathBuf::new();
+
+        if let Some(host) = url.host()
+            && host != "localhost"
+            && !host.is_empty()
+        {
+            target_path.push(host);
+        }
+
+        let url_path = url.path();
+
+        if !url_path.is_empty() && url_path != "/" {
+            let path_part = if target_path.as_os_str().is_empty() {
+                url_path.as_str()
+            } else {
+                url_path.trim_start_matches('/')
+            };
+
+            if !path_part.is_empty() {
+                target_path.push(path_part);
+            }
+        }
+
+        if target_path.as_os_str().is_empty() {
+            target_path = PathBuf::from("secrets.enc.yaml");
+        }
+
+        let raw_path = target_path.to_string_lossy().to_string();
+
+        let mut config = SopsConfig::default();
+
+        let mut explicit_format: Option<SopsFormat> = None;
+
+        for (key, value) in url.query_pairs() {
+            match key.as_ref() {
+                "format" => {
+                    explicit_format = Some(SopsFormat::from_str(value.as_ref()).map_err(|e| {
+                        SecretSpecError::ProviderOperationFailed(format!(
+                            "Invalid format parameter: {}",
+                            e
+                        ))
+                    })?);
+                }
+                other => {
+                    config.apply_url_field(other, value.as_ref())?;
+                }
+            }
+        }
+
+        let (dir_path, pattern) = split_template_path(&raw_path);
+
+        let format = if let Some(fmt) = explicit_format {
+            fmt
+        } else if !pattern.is_empty() {
+            infer_format_from_pattern(&pattern)
+        } else {
+            match target_path.extension().and_then(|e| e.to_str()) {
+                Some(ext) => SopsFormat::from_extension(ext),
+                None => SopsFormat::Yaml,
+            }
+        };
+
+        let mode = if pattern.is_empty() {
+            Some(SopsMode::SingleFile(PathBuf::from(raw_path)))
+        } else {
+            if let Ok(path_pattern) = SopsPathPattern::try_from(pattern) {
+                Some(SopsMode::Directory {
+                    path: dir_path,
+                    pattern: path_pattern,
+                    format,
+                })
+            } else {
+                None
+            }
+        };
+
+        if let Some(sops_mode) = mode {
+            Ok(SopsConfig {
+                format: Some(format),
+                mode: sops_mode,
+                ..config
+            })
+        } else {
+            Err(SecretSpecError::ProviderOperationFailed(format!(
+                "Failed to instantiate path patterning for SOPS provider"
+            )))
+        }
+    }
+}
+
+impl SopsConfig {
+    pub fn apply_env(&self, cmd: &mut std::process::Command) {
+        for spec in STRING_FIELDS {
+            if let Some(v) = (spec.field)(self) {
+                cmd.env(spec.env_key, v);
+            }
+        }
+
+        for spec in PATHBUF_FIELDS {
+            if let Some(v) = (spec.field)(self) {
+                cmd.env(spec.env_key, v);
+            }
+        }
+    }
+
+    pub fn apply_url_field(&mut self, key: &str, value: &str) -> Result<()> {
+        // format and pattern are handled explicitly in `try_from`
+        for spec in STRING_FIELDS {
+            if spec.url_key == key {
+                *(spec.field_mut)(self) = Some(String::from(value));
+
+                return Ok(());
+            }
+        }
+
+        for spec in PATHBUF_FIELDS {
+            if spec.url_key == key {
+                *(spec.field_mut)(self) = Some(PathBuf::from(value));
+
+                return Ok(());
+            }
+        }
+
+        Ok(())
+    }
+}
diff --git a/secretspec/src/provider/sops/fields.rs b/secretspec/src/provider/sops/fields.rs
new file mode 100644
index 0000000..8caab2c
--- /dev/null
+++ b/secretspec/src/provider/sops/fields.rs
@@ -0,0 +1,242 @@
+use std::path::PathBuf;
+
+pub struct FieldSpec<T> {
+    pub env_key: &'static str,
+    pub field: fn(&super::SopsConfig) -> &Option<T>,
+    pub field_mut: fn(&mut super::SopsConfig) -> &mut Option<T>,
+    pub url_key: &'static str,
+}
+
+pub static STRING_FIELDS: &[FieldSpec<String>] = &[
+    FieldSpec {
+        field: |c| &c.age_key,
+        field_mut: |c| &mut c.age_key,
+        url_key: "age_key",
+        env_key: "SOPS_AGE_KEY",
+    },
+    FieldSpec {
+        field: |c| &c.age_key_cmd,
+        field_mut: |c| &mut c.age_key_cmd,
+        url_key: "age_key_cmd",
+        env_key: "SOPS_AGE_KEY_CMD",
+    },
+    FieldSpec {
+        field: |c| &c.age_recipients,
+        field_mut: |c| &mut c.age_recipients,
+        url_key: "age_recipients",
+        env_key: "SOPS_AGE_RECIPIENTS",
+    },
+    FieldSpec {
+        field: |c| &c.age_ssh_private_key_cmd,
+        field_mut: |c| &mut c.age_ssh_private_key_cmd,
+        url_key: "age_ssh_private_key_cmd",
+        env_key: "SOPS_AGE_SSH_PRIVATE_KEY_CMD",
+    },
+    FieldSpec {
+        field: |c| &c.kms_arn,
+        field_mut: |c| &mut c.kms_arn,
+        url_key: "kms_arn",
+        env_key: "SOPS_KMS_ARN",
+    },
+    FieldSpec {
+        field: |c| &c.aws_profile,
+        field_mut: |c| &mut c.aws_profile,
+        url_key: "aws_profile",
+        env_key: "AWS_PROFILE",
+    },
+    FieldSpec {
+        field: |c| &c.aws_access_key_id,
+        field_mut: |c| &mut c.aws_access_key_id,
+        url_key: "aws_access_key_id",
+        env_key: "AWS_ACCESS_KEY_ID",
+    },
+    FieldSpec {
+        field: |c| &c.aws_secret_access_key,
+        field_mut: |c| &mut c.aws_secret_access_key,
+        url_key: "aws_secret_access_key",
+        env_key: "AWS_SECRET_ACCESS_KEY",
+    },
+    FieldSpec {
+        field: |c| &c.aws_secret_key,
+        field_mut: |c| &mut c.aws_secret_key,
+        url_key: "aws_secret_key",
+        env_key: "AWS_SECRET_KEY",
+    },
+    FieldSpec {
+        field: |c| &c.aws_region,
+        field_mut: |c| &mut c.aws_region,
+        url_key: "aws_region",
+        env_key: "AWS_REGION",
+    },
+    FieldSpec {
+        field: |c| &c.azure_client_id,
+        field_mut: |c| &mut c.azure_client_id,
+        url_key: "azure_client_id",
+        env_key: "AZURE_CLIENT_ID",
+    },
+    FieldSpec {
+        field: |c| &c.azure_client_secret,
+        field_mut: |c| &mut c.azure_client_secret,
+        url_key: "azure_client_secret",
+        env_key: "AZURE_CLIENT_SECRET",
+    },
+    FieldSpec {
+        field: |c| &c.azure_tenant_id,
+        field_mut: |c| &mut c.azure_tenant_id,
+        url_key: "azure_tenant_id",
+        env_key: "AZURE_TENANT_ID",
+    },
+    FieldSpec {
+        field: |c| &c.azure_keyvault_urls,
+        field_mut: |c| &mut c.azure_keyvault_urls,
+        url_key: "azure_keyvault_urls",
+        env_key: "SOPS_AZURE_KEYVAULT_URLS",
+    },
+    FieldSpec {
+        field: |c| &c.gcp_kms,
+        field_mut: |c| &mut c.gcp_kms,
+        url_key: "gcp_kms",
+        env_key: "SOPS_GCP_KMS",
+    },
+    FieldSpec {
+        field: |c| &c.gcp_kms_client_type,
+        field_mut: |c| &mut c.gcp_kms_client_type,
+        url_key: "gcp_kms_client_type",
+        env_key: "SOPS_GCP_KMS_CLIENT_TYPE",
+    },
+    FieldSpec {
+        field: |c| &c.gcp_kms_endpoint,
+        field_mut: |c| &mut c.gcp_kms_endpoint,
+        url_key: "gcp_kms_endpoint",
+        env_key: "SOPS_GCP_KMS_ENDPOINT",
+    },
+    FieldSpec {
+        field: |c| &c.gcp_kms_ids,
+        field_mut: |c| &mut c.gcp_kms_ids,
+        url_key: "gcp_kms_ids",
+        env_key: "SOPS_GCP_KMS_IDS",
+    },
+    FieldSpec {
+        field: |c| &c.gcp_kms_universe_domain,
+        field_mut: |c| &mut c.gcp_kms_universe_domain,
+        url_key: "gcp_kms_universe_domain",
+        env_key: "SOPS_GCP_KMS_UNIVERSE_DOMAIN",
+    },
+    FieldSpec {
+        field: |c| &c.pgp_fp,
+        field_mut: |c| &mut c.pgp_fp,
+        url_key: "pgp_fp",
+        env_key: "SOPS_PGP_FP",
+    },
+    FieldSpec {
+        field: |c| &c.gpg_exec,
+        field_mut: |c| &mut c.gpg_exec,
+        url_key: "gpg_exec",
+        env_key: "SOPS_GPG_EXEC",
+    },
+    FieldSpec {
+        field: |c| &c.hc_vault_addr,
+        field_mut: |c| &mut c.hc_vault_addr,
+        url_key: "hc_vault_addr",
+        env_key: "VAULT_ADDR",
+    },
+    FieldSpec {
+        field: |c| &c.hc_vault_token,
+        field_mut: |c| &mut c.hc_vault_token,
+        url_key: "hc_vault_token",
+        env_key: "VAULT_TOKEN",
+    },
+    FieldSpec {
+        field: |c| &c.hc_vault_allowlist,
+        field_mut: |c| &mut c.hc_vault_allowlist,
+        url_key: "hc_vault_allowlist",
+        env_key: "SOPS_HC_VAULT_ALLOWLIST",
+    },
+    FieldSpec {
+        field: |c| &c.huawei_sdk_ak,
+        field_mut: |c| &mut c.huawei_sdk_ak,
+        url_key: "huawei_sdk_ak",
+        env_key: "HUAWEICLOUD_SDK_AK",
+    },
+    FieldSpec {
+        field: |c| &c.huawei_sdk_sk,
+        field_mut: |c| &mut c.huawei_sdk_sk,
+        url_key: "huawei_sdk_sk",
+        env_key: "HUAWEICLOUD_SDK_SK",
+    },
+    FieldSpec {
+        field: |c| &c.huawei_sdk_project_id,
+        field_mut: |c| &mut c.huawei_sdk_project_id,
+        url_key: "huawei_sdk_project_id",
+        env_key: "HUAWEICLOUD_SDK_PROJECT_ID",
+    },
+    FieldSpec {
+        field: |c| &c.huawei_kms_ids,
+        field_mut: |c| &mut c.huawei_kms_ids,
+        url_key: "huawei_kms_ids",
+        env_key: "SOPS_HUAWEICLOUD_KMS_IDS",
+    },
+    FieldSpec {
+        field: |c| &c.sops_config,
+        field_mut: |c| &mut c.sops_config,
+        url_key: "sops_config",
+        env_key: "SOPS_CONFIG",
+    },
+    FieldSpec {
+        field: |c| &c.sops_decryption_order,
+        field_mut: |c| &mut c.sops_decryption_order,
+        url_key: "sops_decryption_order",
+        env_key: "SOPS_DECRYPTION_ORDER",
+    },
+    FieldSpec {
+        field: |c| &c.sops_editor,
+        field_mut: |c| &mut c.sops_editor,
+        url_key: "sops_editor",
+        env_key: "SOPS_EDITOR",
+    },
+    FieldSpec {
+        field: |c| &c.sops_enable_local_keyservice,
+        field_mut: |c| &mut c.sops_enable_local_keyservice,
+        url_key: "sops_enable_local_keyservice",
+        env_key: "SOPS_ENABLE_LOCAL_KEYSERVICE",
+    },
+    FieldSpec {
+        field: |c| &c.sops_keyservice,
+        field_mut: |c| &mut c.sops_keyservice,
+        url_key: "sops_keyservice",
+        env_key: "SOPS_KEYSERVICE",
+    },
+    FieldSpec {
+        field: |c| &c.aes_gcm,
+        field_mut: |c| &mut c.aes_gcm,
+        url_key: "aes_gcm",
+        env_key: "AES_GCM",
+    },
+    FieldSpec {
+        field: |c| &c.encrypt_decrypt,
+        field_mut: |c| &mut c.encrypt_decrypt,
+        url_key: "encrypt_decrypt",
+        env_key: "ENCRYPT_DECRYPT",
+    },
+    FieldSpec {
+        field: |c| &c.google_oauth_access_token,
+        field_mut: |c| &mut c.google_oauth_access_token,
+        url_key: "google_oauth_access_token",
+        env_key: "GOOGLE_OAUTH_ACCESS_TOKEN",
+    },
+];
+
+pub static PATHBUF_FIELDS: &[FieldSpec<PathBuf>] = &[
+    FieldSpec {
+        field: |c| &c.age_key_file,
+        field_mut: |c| &mut c.age_key_file,
+        url_key: "age_key_file",
+        env_key: "SOPS_AGE_KEY_FILE",
+    },
+    FieldSpec {
+        field: |c| &c.age_ssh_private_key_file,
+        field_mut: |c| &mut c.age_ssh_private_key_file,
+        url_key: "age_ssh_private_key_file",
+        env_key: "SOPS_AGE_SSH_PRIVATE_KEY_FILE",
+    },
+];
diff --git a/secretspec/src/provider/sops/format.rs b/secretspec/src/provider/sops/format.rs
new file mode 100644
index 0000000..4f4d7e8
--- /dev/null
+++ b/secretspec/src/provider/sops/format.rs
@@ -0,0 +1,91 @@
+use std::{fmt, str::FromStr};
+
+use serde::{Deserialize, Serialize};
+
+use crate::SecretSpecError;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub enum SopsFormat {
+    /// YAML configuration files (.yaml, .yml)
+    #[default]
+    Yaml,
+    /// JSON configuration files (.json)
+    Json,
+    /// Environment variable files (.env)
+    Env,
+    /// INI configuration files (.ini)
+    Ini,
+    /// Binary files (encrypted as base64 under tree['data'] in JSON format)
+    Binary,
+}
+
+impl fmt::Display for SopsFormat {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Yaml => write!(f, "yaml"),
+            Self::Json => write!(f, "json"),
+            Self::Env => write!(f, "env"),
+            Self::Ini => write!(f, "ini"),
+            Self::Binary => write!(f, "binary"),
+        }
+    }
+}
+
+impl FromStr for SopsFormat {
+    type Err = SecretSpecError;
+
+    fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
+        match s.to_lowercase().as_str() {
+            "yaml" | "yml" => Ok(Self::Yaml),
+            "json" => Ok(Self::Json),
+            "env" | "dotenv" => Ok(Self::Env),
+            "ini" => Ok(Self::Ini),
+            "binary" | "bin" => Ok(Self::Binary),
+            _ => Err(SecretSpecError::ProviderOperationFailed(format!(
+                "Unsupported SOPS format: {}. Supported formats: yaml, json, env, ini, binary",
+                s
+            ))),
+        }
+    }
+}
+
+impl SopsFormat {
+    /// Detect format from file extension
+    pub fn from_extension(ext: &str) -> Self {
+        match ext.to_lowercase().as_str() {
+            "yml" | "yaml" => Self::Yaml,
+            "json" => Self::Json,
+            "env" => Self::Env,
+            "ini" => Self::Ini,
+            // Any other extension is treated as binary
+            _ => Self::Binary,
+        }
+    }
+
+    /// Get the canonical string representation for SOPS CLI
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Yaml => "yaml",
+            Self::Json => "json",
+            Self::Env => "env",
+            Self::Ini => "ini",
+            Self::Binary => "binary",
+        }
+    }
+
+    /// Get common file extensions for this format
+    pub fn extensions(&self) -> &'static [&'static str] {
+        match self {
+            Self::Yaml => &["yaml", "yml"],
+            Self::Json => &["json"],
+            Self::Env => &["env"],
+            Self::Ini => &["ini"],
+            Self::Binary => &["bin", "dat", "key", "cert", "p12", "pfx"], // Common binary file extensions
+        }
+    }
+
+    /// Check if this format supports structured data (key-value lookup)
+    pub fn is_structured(&self) -> bool {
+        matches!(self, Self::Yaml | Self::Json | Self::Env | Self::Ini)
+    }
+}
diff --git a/secretspec/src/provider/sops/mod.rs b/secretspec/src/provider/sops/mod.rs
new file mode 100644
index 0000000..6115305
--- /dev/null
+++ b/secretspec/src/provider/sops/mod.rs
@@ -0,0 +1,661 @@
+use super::Provider;
+use crate::provider::sops::config::SopsConfig;
+use crate::provider::sops::format::SopsFormat;
+use crate::provider::sops::pattern::SopsPathPattern;
+use crate::{Result, SecretSpecError};
+use ini::Ini;
+use saphyr::{LoadableYamlNode, Yaml};
+use secrecy::ExposeSecret;
+use secrecy::SecretString;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+mod config;
+mod fields;
+mod format;
+mod pattern;
+
+#[cfg(test)]
+mod tests;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub enum SopsMode {
+    SingleFile(PathBuf),
+    Directory {
+        path: PathBuf,
+        pattern: SopsPathPattern,
+        format: SopsFormat,
+    },
+    Uninitialized,
+}
+
+pub struct SopsProvider {
+    config: SopsConfig,
+}
+
+crate::register_provider! {
+    struct: SopsProvider,
+    config: SopsConfig,
+    name: "sops",
+    description: "SOPS encrypted file provider supporting YAML, JSON, ENV, INI, and binary files",
+    schemes: ["sops"],
+    examples: [
+    "sops://.enc.yaml",
+    "sops://config/secrets.enc.json",
+    "sops://secrets-dir",
+    "sops://secrets-dir/{project}.{profile}.enc.json",
+    "sops://secrets-dir/{project}/{profile}.enc.yaml",
+    "sops://binary-secrets.enc.bin?format=binary",
+    "sops://.enc.yaml?age_key_file=/home/user/.config/sops/age/keys.txt",
+    "sops://secrets-dir?format=json&kms_arn=arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
+    ],
+}
+
+pub struct BuildLookupPathsParams<'a> {
+    pub project: &'a str,
+    pub key: &'a str,
+    pub profile: &'a str,
+}
+
+pub struct ParseDecryptedContentParams<'a> {
+    pub content: &'a [u8],
+    pub format: &'a SopsFormat,
+    pub project: &'a str,
+    pub key: &'a str,
+    pub profile: &'a str,
+}
+
+impl SopsProvider {
+    pub fn new(config: SopsConfig) -> Self {
+        Self { config }
+    }
+
+    fn resolve_file_path(&self, project: &str, profile: &str) -> Result<Option<PathBuf>> {
+        match &self.config.mode {
+            SopsMode::SingleFile(path) => {
+                if path.exists() {
+                    Ok(Some(path.clone()))
+                } else {
+                    Ok(None)
+             }
+            },
+            SopsMode::Directory {
+                path,
+                pattern,
+                format,
+            } => self.find_matching_file(path, pattern, project, profile, format),
+            SopsMode::Uninitialized => Err(SecretSpecError::ProviderOperationFailed(
+            "SOPS provider's mode was 'Uninitialized', but must be initialized to either 'SingleFile' or 'Directory'".to_string(),
+            )),
+          }
+    }
+
+    fn find_matching_file(
+        &self,
+        dir_path: &Path,
+        pattern: &SopsPathPattern,
+        project: &str,
+        profile: &str,
+        format: &SopsFormat,
+    ) -> Result<Option<PathBuf>> {
+        // If a pattern is provided, use it first and only
+        // if !pattern.is_empty() {
+        self.try_pattern_matching(dir_path, pattern, project, profile, format)
+        // }
+
+        // No pattern: fall back to heuristics
+
+        // 1. Hierarchical directory structure
+        // if !project.is_empty() {
+        //     if let Some(path) =
+        //         self.try_hierarchical_structure(dir_path, project, profile, format)?
+        //     {
+        //         return Ok(Some(path));
+        //     }
+        // }
+
+        // 2. Flat directory fallback patterns
+        // self.try_flat_fallback_patterns(dir_path, project, profile, format)
+
+        // Ok(None)
+    }
+
+    // fn try_hierarchical_structure(
+    //     &self,
+    //     base_path: &Path,
+    //     project: &str,
+    //     profile: &str,
+    //     format: &SopsFormat,
+    // ) -> Result<Option<PathBuf>> {
+    //     let project_dir = base_path.join(project);
+
+    //     if !project_dir.exists() || !project_dir.is_dir() {
+    //         return Ok(None);
+    //     }
+
+    //     // Try various profile file naming patterns within the project directory
+    //     let profile_patterns = [
+    //         format!("{}.enc.{}", profile, format.as_str()),
+    //         format!("{}.sops.{}", profile, format.as_str()),
+    //         format!("{}.{}", profile, format.as_str()),
+    //         format!("sops.{}.{}", profile, format.as_str()),
+    //         format!("{}.sops", profile),
+    //     ];
+
+    //     // Also try all extensions for the format
+    //     let mut all_patterns = profile_patterns.to_vec();
+
+    //     for ext in format.extensions() {
+    //         all_patterns.extend([
+    //             format!("{}.enc.{}", profile, ext),
+    //             format!("{}.sops.{}", profile, ext),
+    //             format!("{}.{}", profile, ext),
+    //             format!("sops.{}.{}", profile, ext),
+    //         ]);
+    //     }
+
+    //     for pattern in all_patterns {
+    //         let file_path = project_dir.join(&pattern);
+
+    //         if file_path.exists() && file_path.is_file() {
+    //             return Ok(Some(file_path));
+    //         }
+    //     }
+
+    //     Ok(None)
+    // }
+
+    fn try_pattern_matching(
+        &self,
+        dir_path: &Path,
+        pattern: &SopsPathPattern,
+        project: &str,
+        profile: &str,
+        _format: &SopsFormat, // no longer used here
+    ) -> Result<Option<PathBuf>> {
+        let rel_path = pattern.render(project, profile);
+
+        let full_path = dir_path.join(rel_path);
+
+        if full_path.exists() && full_path.is_file() {
+            Ok(Some(full_path))
+        } else {
+            Ok(None)
+        }
+    }
+
+    // fn try_flat_fallback_patterns(
+    //     &self,
+    //     dir_path: &Path,
+    //     project: &str,
+    //     profile: &str,
+    //     format: &SopsFormat,
+    // ) -> Result<Option<PathBuf>> {
+    //     let fallback_patterns = [
+    //         // Standard flat patterns
+    //         format!("{}.{}.sops.{}", project, profile, format.as_str()),
+    //         format!("{}-{}.sops.{}", project, profile, format.as_str()),
+    //         format!("{}_{}.sops.{}", project, profile, format.as_str()),
+    //         format!("{}.sops.{}", project, format.as_str()),
+    //         format!("{}.{}", project, format.as_str()),
+    //     ];
+
+    //     // Try all extensions for the format
+    //     let mut all_patterns = fallback_patterns.to_vec();
+    //     for ext in format.extensions() {
+    //         all_patterns.extend([
+    //             format!("{}.{}.sops.{}", project, profile, ext),
+    //             format!("{}-{}.sops.{}", project, profile, ext),
+    //             format!("{}_{}.sops.{}", project, profile, ext),
+    //             format!("{}.sops.{}", project, ext),
+    //             format!("{}.{}", project, ext),
+    //         ]);
+    //     }
+
+    //     for pattern in &all_patterns {
+    //         let file_path = dir_path.join(pattern);
+    //         if file_path.exists() {
+    //             return Ok(Some(file_path));
+    //         }
+    //     }
+
+    //     Ok(None)
+    // }
+
+    fn detect_format(&self, path: &Path) -> SopsFormat {
+        // Use explicit format if provided
+        if let Some(format) = &self.config.format {
+            return format.clone();
+        }
+
+        // Otherwise detect from file extension
+        path.extension()
+            .and_then(|ext| ext.to_str())
+            .map(SopsFormat::from_extension)
+            .unwrap()
+    }
+
+    fn execute_sops_command(&self, args: &[&str]) -> Result<Vec<u8>> {
+        let mut cmd = Command::new("sops");
+
+        cmd.args(args);
+
+        self.config.apply_env(&mut cmd);
+
+        let output = match cmd.output() {
+            Ok(o) => o,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                return Err(SecretSpecError::ProviderOperationFailed(
+                    "The 'sops' CLI is not installed.\n\
+                Install it from https://github.com/getsops/sops or via your package manager."
+                        .to_string(),
+                ));
+            }
+            Err(e) => return Err(e.into()),
+        };
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+
+            return Err(SecretSpecError::ProviderOperationFailed(stderr.to_string()));
+        }
+
+        Ok(output.stdout)
+    }
+
+    fn navigate_nested_value(&self, data: &serde_json::Value, path: &[&str]) -> Option<String> {
+        let mut current = data;
+
+        for segment in path {
+            match current {
+                serde_json::Value::Object(map) => {
+                    current = map.get(*segment)?;
+                }
+                _ => return None,
+            }
+        }
+
+        match current {
+            serde_json::Value::String(s) => Some(s.clone()),
+            other => Some(other.to_string()),
+        }
+    }
+
+    fn navigate_yaml_value(&self, yaml: &Yaml, path: &[&str]) -> Option<String> {
+        let mut current = yaml;
+
+        for segment in path {
+            if current.is_mapping() {
+                current = current.as_mapping_get(segment)?;
+            } else {
+                return None;
+            }
+        }
+
+        Some(self.yaml_to_string(current))
+    }
+
+    fn yaml_to_string(&self, yaml: &Yaml) -> String {
+        if yaml.is_null() {
+            String::new()
+        } else if let Some(s) = yaml.as_str() {
+            s.to_string()
+        } else if let Some(i) = yaml.as_integer() {
+            i.to_string()
+        } else if let Some(f) = yaml.as_floating_point() {
+            f.to_string()
+        } else if let Some(b) = yaml.as_bool() {
+            b.to_string()
+        } else {
+            format!("{:?}", yaml)
+        }
+    }
+
+    fn build_lookup_paths<'a>(
+        &self,
+        params: BuildLookupPathsParams<'a>,
+    ) -> Result<Vec<Vec<&'a str>>> {
+        let BuildLookupPathsParams {
+            key,
+            profile,
+            project,
+        } = params;
+
+        match &self.config.mode {
+            SopsMode::SingleFile(_) => {
+                let mut paths = Vec::new();
+
+                if !project.is_empty() {
+                    if !profile.is_empty() && profile != "default" {
+                        paths.push(vec![project, profile, key]);
+                    }
+                    paths.push(vec![profile, key]);
+                }
+                paths.push(vec![key]);
+
+                Ok(paths)
+            }
+    SopsMode::Directory { .. } => {
+        Ok(vec![vec![key]])
+    }
+            SopsMode::Uninitialized => Err(SecretSpecError::ProviderOperationFailed(
+            "SOPS provider's mode was 'Uninitialized', but must be initialized to either 'SingleFile' or 'Directory'".to_string(),
+            ))
+        }
+    }
+
+    fn parse_decrypted_content(
+        &self,
+        params: ParseDecryptedContentParams,
+    ) -> Result<Option<String>> {
+        let ParseDecryptedContentParams {
+            content,
+            format,
+            project,
+            key,
+            profile,
+        } = params;
+
+        match format {
+            SopsFormat::Yaml => {
+                let content_str = String::from_utf8_lossy(content);
+
+                let docs = Yaml::load_from_str(&content_str).map_err(|e| {
+                    SecretSpecError::ProviderOperationFailed(format!("Failed to parse YAML: {}", e))
+                })?;
+
+                match self.build_lookup_paths(BuildLookupPathsParams {
+                    key,
+                    profile,
+                    project,
+                }) {
+                    Ok(paths) => {
+                        for doc in &docs {
+                            for path in &paths {
+                                if let Some(value) = self.navigate_yaml_value(doc, path) {
+                                    return Ok(Some(value));
+                                }
+                            }
+                        }
+                        Ok(None)
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            SopsFormat::Json => {
+                let data: serde_json::Value = serde_json::from_slice(content).map_err(|e| {
+                    SecretSpecError::ProviderOperationFailed(format!("Failed to parse JSON: {}", e))
+                })?;
+
+                match self.build_lookup_paths(BuildLookupPathsParams {
+                    key,
+                    profile,
+                    project,
+                }) {
+                    Ok(paths) => {
+                        for path in paths {
+                            if let Some(value) = self.navigate_nested_value(&data, &path) {
+                                return Ok(Some(value));
+                            }
+                        }
+                        Ok(None)
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            SopsFormat::Env => {
+                let content_str = String::from_utf8_lossy(content);
+
+                for line in content_str.lines() {
+                    let line = line.trim();
+                    if line.is_empty() || line.starts_with('#') {
+                        continue;
+                    }
+
+                    if let Some((env_key, value)) = line.split_once('=')
+                        && env_key.trim() == key
+                    {
+                        let value = value.trim();
+                        let value = if (value.starts_with('"') && value.ends_with('"'))
+                            || (value.starts_with('\'') && value.ends_with('\''))
+                        {
+                            &value[1..value.len() - 1]
+                        } else {
+                            value
+                        };
+                        return Ok(Some(value.to_string()));
+                    }
+                }
+                Ok(None)
+            }
+            SopsFormat::Ini => {
+                let content_str = String::from_utf8_lossy(content);
+
+                let conf = Ini::load_from_str(&content_str).map_err(|e| {
+                    SecretSpecError::ProviderOperationFailed(format!(
+                        "Failed to parse INI content for project '{}', profile '{}': {}",
+                        project, profile, e
+                    ))
+                })?;
+
+                for (sec, prop) in conf.iter() {
+                    match (sec, prop) {
+                        (None, properties) => {
+                            if let Some(value) = properties.get(key) {
+                                return Ok(Some(value.to_string()));
+                            }
+                        }
+                        (Some(s), properties) if s == profile => {
+                            if let Some(value) = properties.get(key) {
+                                return Ok(Some(value.to_string()));
+                            }
+                        }
+                        _ => {}
+                    }
+                }
+
+                // INI always stores top-level keys under DEFAULT
+                if let Some(default) = conf.section(Some("DEFAULT")) {
+                    if let Some(value) = default.get(key) {
+                        return Ok(Some(value.to_string()));
+                    }
+                }
+
+                if let Some(section) = conf.section(Some(profile)) {
+                    if let Some(value) = section.get(key) {
+                        return Ok(Some(value.to_string()));
+                    }
+                }
+
+                Ok(None)
+            }
+            SopsFormat::Binary => {
+                // For binary files, SOPS stores the encrypted data as base64 under tree['data']
+                // The decrypted content should be the raw binary data
+                // Since we're looking for a specific key, this doesn't make much sense for binary files
+                // Return the entire content as a hex string for consistency
+                let hex_string = content
+                    .iter()
+                    .map(|b| format!("{:02x}", b))
+                    .collect::<String>();
+                Ok(Some(hex_string))
+            }
+        }
+    }
+
+    fn create_new_sops_file(&self, project: &str, profile: &str) -> Result<PathBuf> {
+        let path = match &self.config.mode {
+            SopsMode::SingleFile(p) => p.clone(),
+            SopsMode::Directory { path, pattern, .. } => {
+                path.join(pattern.render(project, profile))
+            }
+            SopsMode::Uninitialized => {
+                return Err(SecretSpecError::ProviderOperationFailed(
+                    "SOPS provider uninitialized".into(),
+                ));
+            }
+        };
+
+        // Ensure parent directories exist
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)
+                .map_err(|e| SecretSpecError::ProviderOperationFailed(format!("mkdir: {}", e)))?;
+        }
+
+        // Determine initial plaintext content based on format
+        let initial = match self.config.format {
+            Some(SopsFormat::Json) => "{}\n",
+            Some(SopsFormat::Yaml) => "---\n",
+            Some(SopsFormat::Env) => "",
+            Some(SopsFormat::Ini) => "",
+            Some(SopsFormat::Binary) => {
+                return Err(SecretSpecError::ProviderOperationFailed(
+                    "Cannot create new binary SOPS files automatically".into(),
+                ));
+            }
+            None => "---\n",
+        };
+
+        // Write initial plaintext
+        std::fs::write(&path, initial)
+            .map_err(|e| SecretSpecError::ProviderOperationFailed(format!("write: {}", e)))?;
+
+        // Encrypt in place using SOPS
+        self.execute_sops_command(&["encrypt", "-i", &path.to_string_lossy()])?;
+
+        Ok(path)
+    }
+}
+
+impl Provider for SopsProvider {
+    fn name(&self) -> &'static str {
+        Self::PROVIDER_NAME
+    }
+
+    fn get(&self, project: &str, key: &str, profile: &str) -> Result<Option<SecretString>> {
+        let file_path = match self.resolve_file_path(project, profile)? {
+            Some(p) => p,
+            None => return Ok(None),
+        };
+
+        let format = self.detect_format(file_path.as_path());
+
+        let path_str = file_path.to_string_lossy().to_string();
+
+        let decrypted = match self.execute_sops_command(&["-d", &path_str]) {
+            Ok(out) => out,
+            Err(e) => return Err(e),
+        };
+
+        match self.parse_decrypted_content(ParseDecryptedContentParams {
+            content: &decrypted,
+            format: &format,
+            project,
+            key,
+            profile,
+        })? {
+            Some(v) => Ok(Some(SecretString::from(v))),
+            None => Ok(None),
+        }
+    }
+
+    fn set(&self, project: &str, key: &str, value: &SecretString, profile: &str) -> Result<()> {
+        let file_path = match self.resolve_file_path(project, profile)? {
+            Some(p) => p,
+            None => self.create_new_sops_file(project, profile)?,
+        };
+
+        let format = self.detect_format(&file_path);
+
+        if !format.is_structured() {
+            return Err(SecretSpecError::ProviderOperationFailed(format!(
+                "Cannot set key '{}' in non-structured SOPS file format {}",
+                key, format
+            )));
+        }
+
+        let sops_path = {
+            let mut lookup_paths = self.build_lookup_paths(BuildLookupPathsParams {
+                key,
+                project,
+                profile,
+            })?;
+
+            // INI files do not supported nested sections.
+            //
+            // Secrets can either be stored at the "top level" under "[DEFAULT]",
+            // or under a single section heading which necessarily means "[<profile>]".
+            //
+            // Need to always filter out the fully qualified project.profile.key lookup path, and if the
+            // secrets live in multiple files in a directory tree, then also drop the profile.key lookup path,
+            // as the files themselves will only contain top-level entries.
+            if !lookup_paths.is_empty() && SopsFormat::Ini == format {
+                let specificity_count = if matches!(self.config.mode, SopsMode::Directory { .. }) {
+                    1 // Just the key
+                } else {
+                    2 // Profile and key
+                };
+
+                while let Some(first) = lookup_paths.first() {
+                    if first.len() <= specificity_count {
+                        break;
+                    }
+
+                    lookup_paths.remove(0);
+                }
+
+                // In the case of just using the key to qualify the secret, we need to re-add a section named "DEFAULT"
+                // to the front of the lookup path. See: https://github.com/getsops/sops/issues/2121
+                if 1 == specificity_count {
+                    if let Some(last) = lookup_paths.last_mut() {
+                        if 1 == last.len() {
+                            last.insert(0, "DEFAULT");
+                        }
+                    }
+                }
+            }
+
+            let lookup_paths = lookup_paths;
+
+            let chosen_path = lookup_paths.first().ok_or_else(|| {
+                SecretSpecError::ProviderOperationFailed("No lookup paths available".into())
+            })?;
+
+            chosen_path
+                .iter()
+                .map(|segment| format!(r#"["{}"]"#, segment))
+                .collect::<String>()
+        };
+
+        let json_value = serde_json::to_string(value.expose_secret()).map_err(|e| {
+            SecretSpecError::ProviderOperationFailed(format!("JSON encode error: {}", e))
+        })?;
+
+        let file_str = file_path.to_string_lossy().to_string();
+
+        // If file exists but is not a SOPS file, encrypt it first
+        if file_path.exists() {
+            // Try decrypting; if it fails with "sops metadata not found", encrypt it
+            match self.execute_sops_command(&["decrypt", &file_str]) {
+                Ok(_) => {} // already a SOPS file
+                Err(_) => {
+                    // Encrypt in place
+                    self.execute_sops_command(&["encrypt", "-i", &file_str])?;
+                }
+            }
+        }
+
+        self.execute_sops_command(&["set", &file_str, &sops_path, &json_value])?;
+
+        Ok(())
+    }
+
+    fn allows_set(&self) -> bool {
+        true
+    }
+
+    fn uri(&self) -> String {
+        "".to_string()
+    }
+}
diff --git a/secretspec/src/provider/sops/notes.md b/secretspec/src/provider/sops/notes.md
new file mode 100644
index 0000000..7f135b2
--- /dev/null
+++ b/secretspec/src/provider/sops/notes.md
@@ -0,0 +1,42 @@
+# SOPS Provider Notes
+
+## Environment Variables mentioned in SOPS documentation
+
+| Name                          | Addressed | Comments |
+| ----------------------------- | --------- | -------- |
+| AES_GCM                       | [ ]       |          |
+| AWS_ACCESS_KEY_ID             | [ ]       |          |
+| AWS_SECRET_ACCESS_KEY         | [ ]       |          |
+| AWS_SECRET_KEY                | [ ]       |          |
+| AZURE_CLIENT_ID               | [ ]       |          |
+| AZURE_CLIENT_SECRET           | [ ]       |          |
+| AZURE_TENANT_ID               | [ ]       |          |
+| ENCRYPT_DECRYPT               | [ ]       |          |
+| GOOGLE_OAUTH_ACCESS_TOKEN     | [ ]       |          |
+| HUAWEICLOUD_SDK_AK            | [ ]       |          |
+| HUAWEICLOUD_SDK_PROJECT_ID    | [ ]       |          |
+| HUAWEICLOUD_SDK_SK            | [ ]       |          |
+| SOPS_AGE_KEY                  | [ ]       |          |
+| SOPS_AGE_KEY_CMD              | [ ]       |          |
+| SOPS_AGE_KEY_FILE             | [ ]       |          |
+| SOPS_AGE_RECIPIENT            | [ ]       |          |
+| SOPS_AGE_RECIPIENTS           | [ ]       |          |
+| SOPS_AGE_SSH_PRIVATE_KEY_CMD  | [ ]       |          |
+| SOPS_AGE_SSH_PRIVATE_KEY_FILE | [ ]       |          |
+| SOPS_AZURE_KEYVAULT_URLS      | [ ]       |          |
+| SOPS_CONFIG                   | [ ]       |          |
+| SOPS_DECRYPTION_ORDER         | [ ]       |          |
+| SOPS_EDITOR                   | [ ]       |          |
+| SOPS_ENABLE_LOCAL_KEYSERVICE  | [ ]       |          |
+| SOPS_GCP_KMS_CLIENT_TYPE      | [ ]       |          |
+| SOPS_GCP_KMS_ENDPOINT         | [ ]       |          |
+| SOPS_GCP_KMS_IDS              | [ ]       |          |
+| SOPS_GCP_KMS_UNIVERSE_DOMAIN  | [ ]       |          |
+| SOPS_GPG_EXEC                 | [ ]       |          |
+| SOPS_HC_VAULT_ALLOWLIST       | [ ]       |          |
+| SOPS_HUAWEICLOUD_KMS_IDS      | [ ]       |          |
+| SOPS_KEYSERVICE               | [ ]       |          |
+| SOPS_KMS_ARN                  | [ ]       |          |
+| SOPS_PGP_FP                   | [ ]       |          |
+| VAULT_ADDR                    | [ ]       |          |
+| VAULT_TOKEN                   | [ ]       |          |
diff --git a/secretspec/src/provider/sops/parser_tests.rs b/secretspec/src/provider/sops/parser_tests.rs
new file mode 100644
index 0000000..0982b4b
--- /dev/null
+++ b/secretspec/src/provider/sops/parser_tests.rs
@@ -0,0 +1,99 @@
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use url::Url;
+
+    fn parse(url: &str) -> SopsConfig {
+        let provider = ProviderUrl::from_url(&Url::parse(url).unwrap()).unwrap();
+        SopsConfig::try_from(&provider).unwrap()
+    }
+
+    #[test]
+    fn single_file_simple() {
+        let cfg = parse("sops://.enc.yaml");
+
+        assert_eq!(cfg.mode, SopsMode::SingleFile(PathBuf::from(".enc.yaml")));
+        assert_eq!(cfg.format, Some(SopsFormat::Yaml));
+    }
+
+    #[test]
+    fn directory_with_placeholders() {
+        let cfg = parse("sops://secrets/{project}/{profile}.enc.json");
+
+        match cfg.mode {
+            SopsMode::Directory {
+                path,
+                pattern,
+                format,
+            } => {
+                assert_eq!(path, PathBuf::from("secrets"));
+                assert_eq!(pattern, "{project}/{profile}.enc.json");
+                assert_eq!(format, SopsFormat::Json);
+            }
+            _ => panic!("Expected directory mode"),
+        }
+    }
+
+    #[test]
+    fn directory_with_single_placeholder() {
+        let cfg = parse("sops://secrets/{project}.enc.yaml");
+
+        match cfg.mode {
+            SopsMode::Directory {
+                path,
+                pattern,
+                format,
+            } => {
+                assert_eq!(path, PathBuf::from("secrets"));
+                assert_eq!(pattern, "{project}.enc.yaml");
+                assert_eq!(format, SopsFormat::Yaml);
+            }
+            _ => panic!("Expected directory mode"),
+        }
+    }
+
+    #[test]
+    fn explicit_format_override() {
+        let cfg = parse("sops://binary.enc.bin?format=binary");
+
+        assert_eq!(cfg.format, Some(SopsFormat::Binary));
+        assert_eq!(
+            cfg.mode,
+            SopsMode::SingleFile(PathBuf::from("binary.enc.bin"))
+        );
+    }
+
+    #[test]
+    fn unknown_placeholder_rejected() {
+        let provider =
+            ProviderUrl::from_url(&Url::parse("sops://secrets/{unknown}.enc.yaml").unwrap())
+                .unwrap();
+
+        let err = SopsConfig::try_from(&provider).unwrap_err();
+
+        assert!(format!("{:?}", err).contains("Unknown placeholder"));
+    }
+
+    #[test]
+    fn nested_directories() {
+        let cfg = parse("sops://config/secrets/{project}.{profile}.enc.yaml");
+
+        match cfg.mode {
+            SopsMode::Directory { path, pattern, .. } => {
+                assert_eq!(path, PathBuf::from("config/secrets"));
+                assert_eq!(pattern, "{project}.{profile}.enc.yaml");
+            }
+            _ => panic!("Expected directory mode"),
+        }
+    }
+
+    #[test]
+    fn no_placeholders_means_single_file() {
+        let cfg = parse("sops://config/secrets.enc.json");
+
+        assert_eq!(
+            cfg.mode,
+            SopsMode::SingleFile(PathBuf::from("config/secrets.enc.json"))
+        );
+    }
+}
diff --git a/secretspec/src/provider/sops/pattern.rs b/secretspec/src/provider/sops/pattern.rs
new file mode 100644
index 0000000..8c6de07
--- /dev/null
+++ b/secretspec/src/provider/sops/pattern.rs
@@ -0,0 +1,116 @@
+use std::{collections::HashSet, path::PathBuf};
+
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+
+use crate::{Result, SecretSpecError};
+
+fn extract_placeholders(s: &str) -> Vec<String> {
+    let re = Regex::new(r"\{([^}]+)\}").unwrap();
+
+    re.captures_iter(s).map(|cap| cap[1].to_string()).collect()
+}
+
+fn validate_template(template: &str) -> std::result::Result<(), SecretSpecError> {
+    let placeholders = extract_placeholders(template);
+
+    if placeholders.len() > 0 {
+        let mut expected_placeholders: HashSet<&str> = HashSet::new();
+
+        expected_placeholders.insert("profile");
+        expected_placeholders.insert("project");
+
+        for placeholder in &placeholders {
+            match placeholder.as_str() {
+                "profile" | "project" => {
+                    expected_placeholders.take(placeholder.as_str());
+                }
+                other => {
+                    return Err(SecretSpecError::ProviderOperationFailed(format!(
+                        "Unknown placeholder '{{{}}}' in SOPS path",
+                        other
+                    )));
+                }
+            }
+        }
+
+        if 0 != expected_placeholders.len() {
+            return Err(SecretSpecError::ProviderOperationFailed(format!(
+                "SOPS provider URL missing templating placeholders: {}",
+                expected_placeholders
+                    .drain()
+                    .map(|p| format!("{{{}}}", p))
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            )));
+        }
+    }
+
+    // // Detect malformed braces
+    // if template.contains('{') && !template.contains('}') {
+    //     return Err(SecretSpecError::ProviderOperationFailed(
+    //         "Unclosed '{' in SOPS path template".into(),
+    //     ));
+    // }
+
+    // if template.contains('}') && !template.contains('{') {
+    //     return Err(SecretSpecError::ProviderOperationFailed(
+    //         "Unmatched '}' in SOPS path template".into(),
+    //     ));
+    // }
+
+    // // Empty placeholder "{}"
+    // if template.contains("{}") {
+    //     return Err(SecretSpecError::ProviderOperationFailed(
+    //         "Empty placeholder '{}' is not allowed".into(),
+    //     ));
+    // }
+
+    Ok(())
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SopsPathPattern {
+    template: String,
+}
+
+impl TryFrom<String> for SopsPathPattern {
+    type Error = SecretSpecError;
+
+    fn try_from(template: String) -> Result<Self> {
+        let pattern = Self { template };
+
+        pattern.validate()?;
+
+        Ok(pattern)
+    }
+}
+
+impl TryFrom<&str> for SopsPathPattern {
+    type Error = SecretSpecError;
+
+    fn try_from(template: &str) -> Result<Self> {
+        let pattern = Self {
+            template: template.to_string(),
+        };
+
+        pattern.validate()?;
+
+        Ok(pattern)
+    }
+}
+
+impl SopsPathPattern {
+    pub fn validate(&self) -> Result<()> {
+        validate_template(&self.template)
+    }
+
+    pub fn render(&self, project: &str, profile: &str) -> PathBuf {
+        let rendered = self
+            .template
+            .replace("{project}", project)
+            .replace("{profile}", profile);
+
+        PathBuf::from(rendered)
+    }
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development.enc.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development.enc.json
new file mode 100644
index 0000000..d267dd2
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development.enc.json
@@ -0,0 +1,15 @@
+{
+	"foobar": "ENC[AES256_GCM,data:W28m,iv:70H9v8FGGo8S/L4lafu67P+kq6Wg2TQJuHfhNlAHhCQ=,tag:RprMy3IBMyurFZ4e02WEuA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMjkrVnhkbjJTRDJibjhs\ncUdrT1BxUzhLOFVuLzlIc2lZTGpkNUFZc3dNClhGaUhyR2VtVHgvZm1sa1NpRmEr\nMDBqaG5uTzA0c29xN1BmaHVZUCtOdzgKLS0tIE83RW9FSW5ESlhJcHRnbGhaTHdw\namFaemM1SUpoaHppOTZOdDJqQjBkbW8KGemmJyxH4iMuTCKpli2lJbVPsTrra9Ms\nBSPbANwhVBLJYgxtYQBXGFtRmqT+wUuqTV2y0BApbCO6GgQmt9d+Fg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-12T02:43:15Z",
+		"mac": "ENC[AES256_GCM,data:IeK18Eut4vzhZn8/72v/4ipQJ/lPuTslk83HdeABr2c91ArfqRiilfz4cmfSbL9dboNsIomweWTnL/IdUfMTrg3pX2Agdz2kHnE1RV+S9rHc3CYbu0FOxNq5dhr3DmHWnZeKYDT9Cog6iumiuuUrTo9J/rlcYcaFIyBa8bL+zfE=,iv:UD71uBp4HqpzUyxX7V0QpJ8Z2lzTB9wEQr/KaHHvlhM=,tag:D4KuBOIkXeQwbct7zCQliw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.1"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development.json
new file mode 100644
index 0000000..1948434
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development.json
@@ -0,0 +1,3 @@
+{
+  "foobar": "bar"
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development/secrets.enc.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development/secrets.enc.json
new file mode 100644
index 0000000..f9bc731
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development/secrets.enc.json
@@ -0,0 +1,15 @@
+{
+	"foobar": "ENC[AES256_GCM,data:mFOR,iv:EkkxnNkEadmYF/4qc0D+1W2ZDLx3PtUCSuLRjrX/4gw=,tag:F0J74Q0Up+80d9OmWn3aSw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCQWZNRnZ6M2Y3dE5MUUR6\nbVppS1pzd1hMUEFiQTAwL0d0ZmZZUGU5VENJCjFHMkRrSStweHlMTHFjRDBBaDNk\nUFI0aHRaY1pSeEdwOG44UVpyNy8xN1UKLS0tIGpaWndXaUdtdDNoMGU1bElFK1dF\nN1BjbTgvVk9VVXJud3Fjdm14bXhrUE0Ky3HeH9eEkbjI+6EDGlIGU5rHeZdgGwE4\nZA4s/eMN7sp81u03WeL8a2ftzJZPBQlNzDTwg40oBMj8+2eKqBlPSQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-10T22:17:42Z",
+		"mac": "ENC[AES256_GCM,data:nHicPXcfd9eeMF+kXN2CDKQ7Siyo55BefFKHnGNZoy1ZaYTYdfWzgf05p/X3NR013YhGw0yP/9U+xzLBrdP4iHDB6YFA3VZJjGkcVxiRWaBhDv0FcUawFF9VLJDxHewZ//GwH1jqf81n1WFz9uPmPv0w4ha0PYMnmwOFmxslv6Q=,iv:MRb28vjym6JptjFMtUQv4ZWwMTLzPzK6nBkaE+rSoQo=,tag:PirwBEuix6UMPYunQr/rkQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.1"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development/secrets.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development/secrets.json
new file mode 100644
index 0000000..1948434
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/development/secrets.json
@@ -0,0 +1,3 @@
+{
+  "foobar": "bar"
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production.enc.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production.enc.json
new file mode 100644
index 0000000..e4632f5
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production.enc.json
@@ -0,0 +1,15 @@
+{
+	"foobar": "ENC[AES256_GCM,data:vDcK,iv:dTorfSfF5dC/Kr1+Ua+bJk3k12hcEnKOENhmOPgzGe8=,tag:yUlwNC6lggUnzx3u6p3oeQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwcmU4SUQwOEJPbzFOQ3pP\nUkR1UHRqUWZQbEI3c1Y1OHdFN2JJb3JQMFNVCmFBTWxYR1JyTlJoa3RJYjRGRWxh\nT3VZWmNIUmNDVFIrY1Y4c3I4RjBpVFUKLS0tIEFZRi9qUGZmWFdOM3NsdkY4WE1W\nU2dDY1IrSytNRjBZdFBVWHNGUmlYbVkKRjTpRWIMNrOxbtT+2TNt5z6oBgvSlLBV\nSjtFngq0ysTRn7D6aP9kGqwIevGlKnt1Cyezzp5VgL+a7fgMV5XPWQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-12T02:43:12Z",
+		"mac": "ENC[AES256_GCM,data:+lm0za+e9yxe1XzGq2+ZTY8EM0WPW2JUBO85KRkxKrTqI+5eyR955XAyoleYZ1HEHlQiAnNaXbcPV7fbuIqODZy5LeUchYLrjb60jLumLD1mzmC9MaykzYTijA3aQfT9et1FDIrRlA/QZau8Wk4XnAr9xfVId9howRu3EOveU60=,iv:+9mcGL9D/tCtLULwxRF54RV2k/0D4rQbRh8Y7/HI9Ng=,tag:q1gWZmmSahUPOtzFf9GKJg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.1"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production.json
new file mode 100644
index 0000000..cbd009c
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production.json
@@ -0,0 +1,3 @@
+{
+  "foobar": "baz"
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production/secrets.enc.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production/secrets.enc.json
new file mode 100644
index 0000000..24f2589
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production/secrets.enc.json
@@ -0,0 +1,15 @@
+{
+	"foobar": "ENC[AES256_GCM,data:fkjx,iv:5V770iDFQd2izbLG3IVg0/UZMFsYpHrZ+Zuo2FWDtjo=,tag:jDZvCF6dkAW7lV6Da94Jpw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEdWpvOGUybGlOU2RDU1J2\nVXo4Ky9PUnNiYzJRSFVYZUtmWXMybkZDdFJJCk1aWkp0L0pXT0NldXVPUEw5c25U\nOVN0UTVFRWtWWlJEdUFreE90RTVTa1EKLS0tIHZBdEtMbU54dUlrSlhRQlNMam1M\nRitheHY5enA0NHJtOTRpa29laUlwQ2sK2aFLYoXNv3GVingGfYbxLXAiWmBkZocj\nv4L9/dEgQ1H61lNR5krVqwVN9GQ2JHIuh3xhq7EQfyJqixbw0T91gQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-10T22:18:10Z",
+		"mac": "ENC[AES256_GCM,data:SSHXNHE+ci364C12rcu5QiS/w01lwPmcgc9I7eO7k3YsppZKodgxV/Y3yLKzcuLeP/KOBlxp1ufGaoYpaMAybqPMe3m+EMlJTCC88ygjiW5COf8dntGVUVXhR6P0Tl9c1Hq3vxUTCuKjDnO1naSl48E/e6qotwbSytpxP68sXzQ=,iv:GD9Cp+xX9A8msEjtgTKLknHJ5oVoWbcEIkQm12r9GXA=,tag:zZ0lBOiDSjamHwufh8n64Q==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.1"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production/secrets.json b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production/secrets.json
new file mode 100644
index 0000000..cbd009c
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/directory/some-project-name/production/secrets.json
@@ -0,0 +1,3 @@
+{
+  "foobar": "baz"
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/key.txt b/secretspec/src/provider/sops/test_fixtures/key.txt
new file mode 100644
index 0000000..8781d8c
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/key.txt
@@ -0,0 +1,3 @@
+# created: 2026-01-29T16:46:30-08:00
+# public key: age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34
+AGE-SECRET-KEY-1JA63S0F306F9Q3AQPD5QQWV03H858UUCFPL9NN5E0F00R5G3Q8QSHCEU2M
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.bin b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.bin
new file mode 100644
index 0000000..f0f8778
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.bin
@@ -0,0 +1 @@
+ewogICJkZXZlbG9wbWVudCI6IHsKICAgICJmb29iYXIiOiAiYmFyIgogIH0sCiAgInByb2R1Y3Rpb24iOiB7CiAgICAiZm9vYmFyIjogImJheiIKICB9Cn0K
\ No newline at end of file
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.bin b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.bin
new file mode 100644
index 0000000..249384f
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:23VeQghFJSSHPrKrQ/LQdc2MDl3jPcI8zd6XJjmIJN0Y+aUEfTNLK3YZfrgwG1httf60tpG51dtZ4kvE5gSnP4MDlEi2XBnRUElcOHKNJefzkhYqBFeZRknOtFc7Q7LFRUJUyAmdhFQgxcIis6/hHAqwGhxJEu1y,iv:IvFby/GX3IbhgpXIVTEtslA+Luyoqbr6w+JIqYGByN8=,tag:iAhRsZOA9zqdIRuq+/B1uQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCQW93a3lwbTZjNTBKVTJu\na1I0UHAxTjk2S1V5RFB6blJiUzViY01hT1d3CjlSM3pURnB5YmptSS9hZ1Npb2E2\nSCtITWRjUHhvV2xkTWExWHBwdFhoTHMKLS0tIGFBNDJpOUV1ZTQ0bUNXdFIraDNk\nZkdIUDYyaDhFK0FmOE4weWdsa1VBSjAKHHDkFR4/yBwD3BAcYEhaCimzKRPHcJzj\nCz0dcBAr7+tumR95Gs8pHk8/cSCNtysrhvNz8YvYUDftidG4dcWO3g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-10T21:22:08Z",
+		"mac": "ENC[AES256_GCM,data:EFinILiCl2nLBfjXd0xVjOmnv1ZZ/b+moWBNWUFCzncV0xmYPyYY/QVGnE696rDWNmAj1nK/Y04ySAcJFmy8l02r3L6cKL0f2JcuIna4hZ+ITvzB7QgLdDXSXBT252Fpq+Sm6IkWcPIkhbXeTtzLXfMfnCTQ61s17lg/Og3o+KA=,iv:hd7ps49dKnsHDAVxF6PdyQ3HkKmN9vsVyEQSNbNFpmo=,tag:SO4tefYYWPtR2WNoWlsnHg==,type:str]",
+		"version": "3.12.1"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.ini b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.ini
new file mode 100644
index 0000000..44ab982
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.ini
@@ -0,0 +1,13 @@
+[development]
+foobar = ENC[AES256_GCM,data:Q5TM,iv:zBty0+zxfHxa3xbPPxwTutd6arGPpr5vwLAHFbJQy+0=,tag:xKlptHBWCFwpKooY6g7c3A==,type:str]
+
+[production]
+foobar = ENC[AES256_GCM,data:kJR5,iv:8HREB9FQu+/H2NZFvM7CwWD1Z+3MJvhTQlOw7uxtScY=,tag:blxjjlbHOOicPLsjZhoIeg==,type:str]
+
+[sops]
+age__list_0__map_recipient = age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34
+age__list_0__map_enc       = -----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdVFYYjZPL0VBYzl6OWxC\nSTAxM2o3VzRuTW9haTJHMjErRUp5WWJLdFRBClRqRVhyUUpJQXRPbDN5MU0zcVVa\nc3NMTVZIc2k3SkZ5M0JVdTBSMCtnKzgKLS0tIDhoblVPUTBGdCtMMm1QQVNwcVMw\nMEpNVXlpQThHUFc1VjFGMTUxaVN1cE0KAp+W0WKhtvo/rvocn/JN4aCqyaS7xs64\nEcLR2mm6V9PNM7zLsTvu5bQ496uyZw3KbzwE6d55H3iazrZsCgAIQg==\n-----END AGE ENCRYPTED FILE-----\n
+lastmodified               = 2026-06-10T21:22:08Z
+mac                        = ENC[AES256_GCM,data:ns42A4BX/atMSJXQOCN5ZfKUJuPVjPO6vwapYB74xHnENQzPrpLZOynxJys/rgh/NdfU/h7wQLTPo1QvOy1oMz+T+LKFUkHrFpkY8Atl5lDITj1r1TEzUkAwICwTXl4myny4dvWLAEGRtvyoFWK8+wAMCTug2y9fC3A44bVtyP4=,iv:enEYbAoWWo7/qd/nCVleRsosda4NzOUVx9MwZYJv0DI=,tag:J04pD1qp5CPNWEn6yumkuw==,type:str]
+unencrypted_suffix         = _unencrypted
+version                    = 3.12.1
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.json b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.json
new file mode 100644
index 0000000..ad237d1
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.json
@@ -0,0 +1,20 @@
+{
+	"development": {
+		"foobar": "ENC[AES256_GCM,data:C1Q2,iv:UQo9LrCXcZsDlEg9++LEDEIb+4CwXKpty8ZlmIjGBsc=,tag:ghlXJUd/qjabVvBsbfwq4w==,type:str]"
+	},
+	"production": {
+		"foobar": "ENC[AES256_GCM,data:G3Pl,iv:AtvLlvfRgexb5q6YpoyMhAUjkOiI3BY8OgVPxMvA+vA=,tag:feiy2PNYCwr5OUHNzRriNg==,type:str]"
+	},
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhWGtXWjlaOFVBbmt6cW92\nVlNOSHVBVHNxaW1QWWlKZ3JUVWI4Y3VucENBCkY3SnJnUGNvT2FzMlJxMWlWbldT\ncXMvUlV1Tk5oeUFkbjc3ZGloK2VqcmsKLS0tIG52Sk9BSTh1MmNZNUJvaU01UEw0\nTy9UMWJMNURpTWY0aHMxRGFNTzBJcWMKISrvJLMnVoPgRY45Z2fnghnCTmCEmPXj\n/5NK8IWmxypf40XfTLQNigYPghVbzl8mJZ0vW90QUauqrseDBmuf2A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-10T21:22:08Z",
+		"mac": "ENC[AES256_GCM,data:W4mEAr+moawm+q5f/g+XJ50+jMxfmlH1zyhc1EHiO/vOEhysIoO8q8bo21uOD5WZRThIRnpmUGRlnfRTx/zWSEeMjP6U/6E2t5tUdZHWLId1GhDPNI44TKHD27QDOO6kZiN8kcpGr+vLl6EGp6q8auxFt6o+6Dfuf1Th551u+wI=,iv:zpVP6B1eVemYG9PvBqZmRD0z05qPvcEAlxKijnbUs50=,tag:U2LW+vMJTy+MZsAs/AIhjg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.1"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.yaml b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.yaml
new file mode 100644
index 0000000..d6938e0
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.enc.yaml
@@ -0,0 +1,20 @@
+some-project-name:
+    development:
+        foobar: ENC[AES256_GCM,data:AOJg,iv:3OyAq3nKrBYyWrjN4Ix+LWQ0V1eMZYAC3HViLR/k0eU=,tag:dKk8epPsdJPkqmrz5inN0Q==,type:str]
+    production:
+        foobar: ENC[AES256_GCM,data:YtF7,iv:H3YL5P1aWDmK/hk1y6VxWDb42G9tObV3GkX9cRFLkR8=,tag:jex4dc7nSGSiXfClAVENqg==,type:str]
+sops:
+    age:
+        - recipient: age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMME1QZzJrcUs1cnVpUk9E
+            SXpqZCtJRVdudk9HMmlzUEIzNWJ5bC9tbHhvCmpuTll6L1B3Y0cyLytGSWt5Y3JV
+            azhPMzZMZkFndUYwWlVzclRNRE41Q0kKLS0tIFNIYzB4QXJ1dlVtbjQwUVo3S2NF
+            YzN1TVB3d3F2dDVqVUNJMG0zMndlZkUKCc4dSqvIk7d/MkigeOaP7HHYXd38w3yo
+            OPG33e4JfWOOw5EcgHNNhkuBiPvJaMz5Xm3HjjzhboK+7dLK+bIwQA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-06-10T21:22:08Z"
+    mac: ENC[AES256_GCM,data:RxAXaU3pfEGK7nAY9IGKia/lcXdDv05DvkpYvIfBBYM0lO8oWPR5zJwAaxX1C/vTMgvANdAfb0u+rJbVENgE4U7r/elTJD4nchIzsKCC1vHlCNCZRLxYw4dVdjCRr7tL98W2nEA+8edTG4PbC8q+bARYHHkJc+7o7yXfa0ZLC1A=,iv:Dm2TW4nMaISSi9OG/L6qjX+v0B+N7T6oS7CsNUnF/is=,tag:lCn9yhUtD04igmGxuUoMgQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.ini b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.ini
new file mode 100644
index 0000000..8c02e61
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.ini
@@ -0,0 +1,5 @@
+[development]
+foobar=bar
+
+[production]
+foobar=baz
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.json b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.json
new file mode 100644
index 0000000..51db1fc
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.json
@@ -0,0 +1,8 @@
+{
+  "development": {
+    "foobar": "bar"
+  },
+  "production": {
+    "foobar": "baz"
+  }
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.yaml b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.yaml
new file mode 100644
index 0000000..62ded95
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/single_file/some-project-name.yaml
@@ -0,0 +1,5 @@
+some-project-name:
+  development:
+    foobar: bar
+  production:
+    foobar: baz
diff --git a/secretspec/src/provider/sops/test_fixtures/test_secrets/some-project-name.enc.json b/secretspec/src/provider/sops/test_fixtures/test_secrets/some-project-name.enc.json
new file mode 100644
index 0000000..4891501
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/test_secrets/some-project-name.enc.json
@@ -0,0 +1,20 @@
+{
+	"development": {
+		"foobar": "ENC[AES256_GCM,data:xy9W,iv:62tR2rT0iNmAC3g9mmebRyKvSIZn8hxHx/uTQe0koog=,tag:YmveudtDgTi3M2OMZSaZ5A==,type:str]"
+	},
+	"production": {
+		"foobar": "ENC[AES256_GCM,data:Gguu,iv:CAj1ZKkmaFosInq1ajVa2xy0j+Hgpz4btMqwh1RVLYo=,tag:e2iwU94tpNiWhQwVgztegw==,type:str]"
+	},
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWTjVkQmtBTUQrYzhTWjlP\nZnhlUGNpY25Bb2kwcmpKd0hSWHJEQlhTd0VNCmlmdTVKQ0lWNEM2L0UvOVp3UUVI\nVGFoQk9FcmRIOHFtbkpJcGNreWF3R1UKLS0tIGZDL2lIam52Q1kvNjFjaC90Znkz\nbm1TWnBuQTQrOE1sRDAxVUh0bFdRZm8KLgM9T09k9shr550/iT/M5f/AJuDLGTFU\noYsc1tXqlx1I4mox+PI+su9Lrh7dN4vz7GwHdhb3Nac+3iBiGJEvAw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-27T21:01:40Z",
+		"mac": "ENC[AES256_GCM,data:ZrlB3sFXzybBme0cI8vek9FSRxiFKcB/A46xF+tg/iIkZfffwg2NEzg0gqZfIKQmeZl7/XQ5EPIA6ZH9Eprzh//NVNyn2RiTDJrVdHA0dCIruqN5/+emmkMWw9RUCbkg8bliFOMd+wE/5Q6fPoKeMQVnlQXFg4xmu3ZfvTnqgfc=,iv:Uqe2cI/YjVY5ERZKThF/GBNrJzQOJQL8+xhYJ0Q0+jQ=,tag:3nh9yGjp8gWtuEGh+ZE1lw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}
diff --git a/secretspec/src/provider/sops/test_fixtures/test_secrets/some-project-name.json b/secretspec/src/provider/sops/test_fixtures/test_secrets/some-project-name.json
new file mode 100644
index 0000000..3fa197e
--- /dev/null
+++ b/secretspec/src/provider/sops/test_fixtures/test_secrets/some-project-name.json
@@ -0,0 +1,8 @@
+{
+  "development": {
+    "foobar": "foo"
+  },
+  "production": {
+    "foobar": "baz"
+  }
+}
diff --git a/secretspec/src/provider/sops/tests.rs b/secretspec/src/provider/sops/tests.rs
new file mode 100644
index 0000000..059627b
--- /dev/null
+++ b/secretspec/src/provider/sops/tests.rs
@@ -0,0 +1,457 @@
+use crate::provider::sops::config::SopsConfig;
+
+use super::*;
+use std::{fs, str::FromStr};
+use tempfile::TempDir;
+use url::Url;
+
+#[test]
+fn test_sops_format_from_str() {
+    assert_eq!(SopsFormat::from_str("yaml").unwrap(), SopsFormat::Yaml);
+    assert_eq!(SopsFormat::from_str("yml").unwrap(), SopsFormat::Yaml);
+    assert_eq!(SopsFormat::from_str("json").unwrap(), SopsFormat::Json);
+    assert_eq!(SopsFormat::from_str("env").unwrap(), SopsFormat::Env);
+    assert_eq!(SopsFormat::from_str("dotenv").unwrap(), SopsFormat::Env);
+    assert_eq!(SopsFormat::from_str("ini").unwrap(), SopsFormat::Ini);
+    assert_eq!(SopsFormat::from_str("binary").unwrap(), SopsFormat::Binary);
+    assert_eq!(SopsFormat::from_str("bin").unwrap(), SopsFormat::Binary);
+
+    assert!(SopsFormat::from_str("invalid").is_err());
+    let err = SopsFormat::from_str("invalid").unwrap_err();
+    assert!(
+        err.to_string()
+            .contains("Supported formats: yaml, json, env, ini, binary")
+    );
+}
+
+#[test]
+fn test_sops_format_extensions() {
+    assert_eq!(SopsFormat::Yaml.extensions(), &["yaml", "yml"]);
+    assert_eq!(SopsFormat::Json.extensions(), &["json"]);
+    assert_eq!(SopsFormat::Env.extensions(), &["env"]);
+    assert_eq!(SopsFormat::Ini.extensions(), &["ini"]);
+    assert_eq!(
+        SopsFormat::Binary.extensions(),
+        &["bin", "dat", "key", "cert", "p12", "pfx"]
+    );
+}
+
+#[test]
+fn test_sops_format_is_structured() {
+    assert!(SopsFormat::Yaml.is_structured());
+    assert!(SopsFormat::Json.is_structured());
+    assert!(SopsFormat::Env.is_structured());
+    assert!(SopsFormat::Ini.is_structured());
+    assert!(!SopsFormat::Binary.is_structured());
+}
+
+#[test]
+fn test_sops_format_from_extension() {
+    assert_eq!(SopsFormat::from_extension("yaml"), SopsFormat::Yaml);
+    assert_eq!(SopsFormat::from_extension("yml"), SopsFormat::Yaml);
+    assert_eq!(SopsFormat::from_extension("json"), SopsFormat::Json);
+    assert_eq!(SopsFormat::from_extension("env"), SopsFormat::Env);
+    assert_eq!(SopsFormat::from_extension("ini"), SopsFormat::Ini);
+
+    // Unknown extensions default to binary
+    assert_eq!(SopsFormat::from_extension("bin"), SopsFormat::Binary);
+    assert_eq!(SopsFormat::from_extension("key"), SopsFormat::Binary);
+    assert_eq!(SopsFormat::from_extension("unknown"), SopsFormat::Binary);
+}
+
+// #[test]
+// fn test_hierarchical_directory_structure() {
+//     let temp_dir = TempDir::new().unwrap();
+//     let base_path = temp_dir.path();
+
+//     // Create hierarchical structure: base/myapp/production.sops.json
+//     let project_dir = base_path.join("myapp");
+//     fs::create_dir_all(&project_dir).unwrap();
+//     fs::write(
+//         project_dir.join("production.sops.json"),
+//         r#"{"database_url": "prod-db"}"#,
+//     )
+//     .unwrap();
+//     fs::write(
+//         project_dir.join("development.sops.json"),
+//         r#"{"database_url": "dev-db"}"#,
+//     )
+//     .unwrap();
+
+//     let config = SopsConfig {
+//         mode: SopsMode::Directory {
+//             path: base_path.to_path_buf(),
+//             pattern: SopsPathPattern::try_from("{project}/{profile}.sops.json").unwrap(),
+//             format: SopsFormat::Json,
+//         },
+//         ..Default::default()
+//     };
+//     let provider = SopsProvider::new(config);
+
+//     // Test hierarchical lookup
+//     let result = provider
+//         .try_hierarchical_structure(base_path, "myapp", "production", &SopsFormat::Json)
+//         .unwrap();
+
+//     assert!(result.is_some());
+//     let path = result.unwrap();
+//     assert_eq!(path.file_name().unwrap(), "production.sops.json");
+//     assert_eq!(path.parent().unwrap().file_name().unwrap(), "myapp");
+// }
+
+#[test]
+fn test_build_lookup_paths_single_file_vs_directory() {
+    // Single file mode - hierarchical lookup
+    let single_file_config = SopsConfig {
+        mode: SopsMode::SingleFile(PathBuf::from(".sops.yaml")),
+        ..Default::default()
+    };
+    let provider = SopsProvider::new(single_file_config);
+
+    let paths = provider.build_lookup_paths(BuildLookupPathsParams {
+        key: "database_url",
+        profile: "production",
+        project: "myapp",
+    });
+
+    assert_eq!(
+        paths.unwrap(),
+        vec![
+            vec!["myapp", "production", "database_url"],
+            vec!["myapp", "database_url"],
+            vec!["database_url"]
+        ]
+    );
+
+    // Directory mode - direct lookup
+    let dir_config = SopsConfig {
+        mode: SopsMode::Directory {
+            path: PathBuf::from("secrets"),
+            pattern: SopsPathPattern::try_from("{project}.{profile}.sops.json").unwrap(),
+            format: SopsFormat::Json,
+        },
+        ..Default::default()
+    };
+    let provider = SopsProvider::new(dir_config);
+
+    let paths = provider.build_lookup_paths(BuildLookupPathsParams {
+        key: "database_url",
+        profile: "production",
+        project: "myapp",
+    });
+    assert_eq!(paths.unwrap(), vec![vec!["database_url"]]);
+}
+
+#[test]
+fn test_parse_decrypted_content_binary() {
+    let provider = SopsProvider::new(SopsConfig::default());
+    let binary_content = b"\x00\x01\x02\x03\xFF";
+
+    let result = provider
+        .parse_decrypted_content(ParseDecryptedContentParams {
+            content: binary_content,
+            format: &SopsFormat::Binary,
+            project: "",
+            key: "any_key",
+            profile: "",
+        })
+        .unwrap();
+
+    // Should return hex encoded content
+    assert!(result.is_some());
+    let value = result.unwrap();
+    assert_eq!(value, "00010203ff");
+}
+
+fn run_sops_single_file_test(ext: &str) {
+    let url = Url::parse(&format!(
+        "sops://{}?age_key_file=./src/provider/sops/test_fixtures/key.txt",
+        format!("src/provider/sops/test_fixtures/single_file/some-project-name.enc.{ext}")
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    let expected = [("development", "bar"), ("production", "baz")];
+
+    for (profile, expected_value) in expected {
+        if let Some(value) = provider
+            .get("some-project-name", "foobar", profile)
+            .expect("Failed to fetch secret")
+        {
+            let secret = value.expose_secret();
+
+            assert_eq!(
+                expected_value, secret,
+                r#"Expected "{expected_value}", got "{secret}""#
+            );
+        }
+    }
+}
+
+#[test]
+fn test_sops_single_file_get_ini() {
+    run_sops_single_file_test("ini");
+}
+
+#[test]
+fn test_sops_single_file_get_yaml() {
+    run_sops_single_file_test("yaml");
+}
+
+#[test]
+fn test_sops_single_file_get_json() {
+    run_sops_single_file_test("json");
+}
+
+#[test]
+fn test_sops_directory_get_json() {
+    let url = Url::parse(&format!(
+        "sops://{}?age_key_file=src/provider/sops/test_fixtures/key.txt",
+        "src/provider/sops/test_fixtures/directory/{project}/{profile}/secrets.enc.json"
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    let expected = [("development", "bar"), ("production", "baz")];
+
+    for (profile, expected_value) in expected {
+        match provider.get("some-project-name", "foobar", profile) {
+            Ok(value) => match value {
+                Some(secret_box) => {
+                    let secret = secret_box.expose_secret();
+
+                    assert_eq!(
+                        expected_value, secret,
+                        r#"Expected "{expected_value}", got "{secret}""#
+                    );
+                }
+                None => panic!(
+                    "'foobar' under profile '{}' in project 'some-project-name' not found",
+                    profile,
+                ),
+            },
+            Err(e) => {
+                panic!("{}", e);
+            }
+        }
+    }
+}
+
+#[test]
+fn test_oeusops_directory_get_json_two() {
+    let url = Url::parse(&format!(
+        "sops://{}?age_key_file=src/provider/sops/test_fixtures/key.txt",
+        "src/provider/sops/test_fixtures/directory/{project}/{profile}.enc.json"
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    let expected = [("development", "bar"), ("production", "baz")];
+
+    for (profile, expected_value) in expected {
+        match provider.get("some-project-name", "foobar", profile) {
+            Ok(value) => match value {
+                Some(secret_box) => {
+                    let secret = secret_box.expose_secret();
+
+                    assert_eq!(
+                        expected_value, secret,
+                        r#"Expected "{expected_value}", got "{secret}""#
+                    );
+                }
+                None => panic!(
+                    "'foobar' under profile '{}' in project 'some-project-name' not found",
+                    profile,
+                ),
+            },
+            Err(e) => {
+                panic!("{}", e);
+            }
+        }
+    }
+}
+
+#[test]
+fn test_sops_set_single_file_creates_tree_and_sets_value() {
+    let temp = TempDir::new().unwrap();
+    let file_path = temp.path().join("secrets.enc.yaml");
+
+    // Build provider URL
+    let url = Url::parse(&format!(
+        "sops://{}?age_key_file=src/provider/sops/test_fixtures/key.txt&age_recipients=age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+        file_path.to_string_lossy()
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    // Set a value into a file that does not exist yet
+    provider
+        .set(
+            "myapp",
+            "database_url",
+            &SecretString::new("postgres://prod".into()),
+            "production",
+        )
+        .expect("set failed");
+
+    // Now read it back
+    let value = provider
+        .get("myapp", "database_url", "production")
+        .expect("get failed")
+        .expect("missing value");
+
+    assert_eq!(value.expose_secret(), "postgres://prod");
+}
+
+#[test]
+fn test_sops_set_directory_creates_file_and_sets_value() {
+    let temp = TempDir::new().unwrap();
+    let base = temp.path();
+
+    // pattern = {project}/{profile}.enc.json
+    let url = Url::parse(&format!(
+        "sops://{}/{{project}}/{{profile}}.enc.json?age_key_file=src/provider/sops/test_fixtures/key.txt&age_recipients=age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+        base.to_string_lossy()
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    // Set a value into a file that does not exist yet
+    provider
+        .set(
+            "myapp",
+            "api_key",
+            &SecretString::new("xyz123".into()),
+            "development",
+        )
+        .expect("set failed");
+
+    // File should now exist
+    let expected_file = base.join("myapp/development.enc.json");
+    assert!(expected_file.exists());
+
+    // Read it back
+    let value = provider
+        .get("myapp", "api_key", "development")
+        .expect("get failed")
+        .expect("missing value");
+
+    assert_eq!(value.expose_secret(), "xyz123");
+}
+
+#[test]
+fn test_sops_set_overwrites_existing_value() {
+    let temp = TempDir::new().unwrap();
+    let file_path = temp.path().join("secrets.enc.json");
+
+    // Create initial file
+    fs::write(&file_path, "{}").unwrap();
+
+    let url = Url::parse(&format!(
+        "sops://{}?age_key_file=src/provider/sops/test_fixtures/key.txt&age_recipients=age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+        file_path.to_string_lossy()
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    provider
+        .set("proj", "token", &SecretString::new("first".into()), "dev")
+        .expect("set failed");
+
+    // Overwrite
+    provider
+        .set("proj", "token", &SecretString::new("second".into()), "dev")
+        .expect("set failed");
+
+    let value = provider
+        .get("proj", "token", "dev")
+        .expect("get failed")
+        .expect("missing value");
+
+    assert_eq!(value.expose_secret(), "second");
+}
+
+#[test]
+fn test_sops_set_single_file_default_profile() {
+    let temp = TempDir::new().unwrap();
+    let file_path = temp.path().join("secrets.enc.yaml");
+
+    let url = Url::parse(&format!(
+        "sops://{}?age_key_file=src/provider/sops/test_fixtures/key.txt&age_recipients=age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+        file_path.to_string_lossy()
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    provider
+        .set(
+            "myapp",
+            "service_url",
+            &SecretString::new("http://localhost".into()),
+            "default",
+        )
+        .expect("set failed");
+
+    let value = provider
+        .get("myapp", "service_url", "default")
+        .expect("get failed")
+        .expect("missing value");
+
+    assert_eq!(value.expose_secret(), "http://localhost");
+}
+
+#[test]
+fn test_sops_set_directory_multiple_profiles() {
+    let temp = TempDir::new().unwrap();
+    let base = temp.path();
+
+    let url = Url::parse(&format!(
+        "sops://{}/{{project}}/{{profile}}.enc.yaml?age_key_file=src/provider/sops/test_fixtures/key.txt&age_recipients=age1jpa8rf5qmrg6pw444fcgpkaxg8x4neueszrexzagdjpunjlgeyzq304w34",
+        base.to_string_lossy()
+    ))
+    .unwrap();
+
+    let provider: Box<dyn Provider> = (&url).try_into().expect("Provider init failed");
+
+    provider
+        .set(
+            "myapp",
+            "db",
+            &SecretString::new("dev-db".into()),
+            "development",
+        )
+        .expect("set failed");
+
+    provider
+        .set(
+            "myapp",
+            "db",
+            &SecretString::new("prod-db".into()),
+            "production",
+        )
+        .expect("set failed");
+
+    let dev = provider
+        .get("myapp", "db", "development")
+        .unwrap()
+        .unwrap()
+        .expose_secret()
+        .to_string();
+
+    let prod = provider
+        .get("myapp", "db", "production")
+        .unwrap()
+        .unwrap()
+        .expose_secret()
+        .to_string();
+
+    assert_eq!(dev, "dev-db");
+    assert_eq!(prod, "prod-db");
+}
diff --git a/secretspec/src/tests.rs b/secretspec/src/tests.rs
index 74dcc63..828ed30 100644
--- a/secretspec/src/tests.rs
+++ b/secretspec/src/tests.rs
@@ -1,3 +1,4 @@
+use crate::Provider;
 use crate::config::{
     Config, GlobalConfig, GlobalDefaults, ParseError, Profile, Project, RequireReason, Resolved,
     Secret,
@@ -11,6 +12,7 @@ use std::convert::TryFrom;
 use std::path::Path;
 use std::{fs, io};
 use tempfile::TempDir;
+use url::Url;
 
 // Helper function for tests that need to parse from string
 fn parse_spec_from_str(content: &str, _base_path: Option<&Path>) -> Result<Config> {
@@ -5135,3 +5137,74 @@ fn test_resolve_profile_unknown_returns_invalid_profile() {
         other => panic!("expected InvalidProfile, got {other:?}"),
     }
 }
+
+#[test]
+fn test_sops_provider_registration() {
+    let url = Url::parse("sops://./secrets").unwrap();
+
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+
+    assert!(provider_result.is_ok());
+
+    let provider = provider_result.unwrap();
+
+    assert_eq!(provider.name(), "sops");
+
+    assert!(provider.allows_set());
+}
+
+#[test]
+fn test_sops_provider_with_age_config() {
+    let url = Url::parse("sops://./secrets?age_key_file=/tmp/age_key&format=json").unwrap();
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+    assert!(provider_result.is_ok());
+
+    let provider = provider_result.unwrap();
+    assert_eq!(provider.name(), "sops");
+}
+
+#[test]
+fn test_sops_provider_with_real_age_config() {
+    let url = Url::parse("sops://./provider/sops/test-fixtures/test-secrets.enc.json?age_key_file=./provider/sops/test-fixtures/key.txt&format=json").unwrap();
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+    assert!(provider_result.is_ok());
+
+    let provider = provider_result.unwrap();
+    assert_eq!(provider.name(), "sops");
+}
+
+#[test]
+fn test_sops_provider_with_aws_config() {
+    let url = Url::parse(
+        "sops://./secrets?kms_arn=arn:aws:kms:us-east-1:123456789012:key/test&aws_profile=prod",
+    )
+    .unwrap();
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+    assert!(provider_result.is_ok());
+
+    let provider = provider_result.unwrap();
+    assert_eq!(provider.name(), "sops");
+}
+
+#[test]
+fn test_sops_format_parsing() {
+    let url = Url::parse("sops://./secrets?format=json").unwrap();
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+    assert!(provider_result.is_ok());
+}
+
+#[test]
+fn test_sops_invalid_format() {
+    let url = Url::parse("sops://./secrets?format=invalid").unwrap();
+
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+
+    assert!(provider_result.is_err());
+}
+
+#[test]
+fn test_sops_provider_invalid_scheme() {
+    let url = Url::parse("invalid://./secrets").unwrap();
+    let provider_result: std::result::Result<Box<dyn Provider>, _> = (&url).try_into();
+    assert!(provider_result.is_err());
+}