diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index b02ac8ec..bdccf89d 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - multicloud
     paths:
       - ".github/labels.yml"
       - ".github/workflows/labels.yml"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2af74c66..ef6aaff4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,9 +2,9 @@ name: Test
 
 on:
   push:
-    branches: [main]
+    branches: [main, multicloud]
   pull_request:
-    branches: [main]
+    branches: [main, multicloud]
 
 permissions:
   contents: read
@@ -390,6 +390,7 @@ jobs:
     runs-on: windows-latest
     if: >-
       github.ref == 'refs/heads/main' ||
+      github.ref == 'refs/heads/multicloud' ||
       contains(github.event.head_commit.message, '[CI: windows]')
     defaults:
       run:
diff --git a/e2e/e2e_test.go b/e2e/e2e_test.go
index 46cb9c06..967ab561 100644
--- a/e2e/e2e_test.go
+++ b/e2e/e2e_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
+	"github.com/mpyw/suve/internal/staging"
 	"github.com/mpyw/suve/internal/staging/store"
 	"github.com/mpyw/suve/internal/staging/store/agent"
 	"github.com/mpyw/suve/internal/staging/store/agent/daemon"
@@ -56,8 +57,8 @@ func TestMain(m *testing.M) {
 		os.Exit(1)
 	}
 
-	// Start daemon with error channel (localstack uses account "000000000000" and region "us-east-1")
-	testDaemon = daemon.NewRunner("000000000000", "us-east-1", agent.DaemonOptions()...)
+	// Start daemon with error channel
+	testDaemon = daemon.NewRunner(agent.DaemonOptions()...)
 	daemonErrCh := make(chan error, 1)
 
 	go func() {
@@ -87,8 +88,7 @@ func TestMain(m *testing.M) {
 
 // waitForDaemon waits for the daemon to be ready by polling with ping.
 func waitForDaemon(timeout time.Duration, daemonErrCh <-chan error) error {
-	// Use same account/region as the daemon
-	launcher := daemon.NewLauncher("000000000000", "us-east-1", daemon.WithAutoStartDisabled())
+	launcher := daemon.NewLauncher(daemon.WithAutoStartDisabled())
 
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
@@ -142,16 +142,15 @@ func setupTempHome(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 }
 
-// newStore creates a new staging store for E2E tests.
+// testScope is the default scope for E2E tests.
 // localstack uses account ID "000000000000" and region "us-east-1".
-func newStore() store.AgentStore {
-	return agent.NewStore("000000000000", "us-east-1")
-}
+//
+//nolint:gochecknoglobals // Test-only constant
+var testScope = staging.AWSScope("000000000000", "us-east-1")
 
-// newStoreForAccount creates a staging store for a specific account and region.
-// Used for testing error cases when daemon is not running for that account.
-func newStoreForAccount(accountID, region string) store.AgentStore {
-	return agent.NewStore(accountID, region)
+// newStore creates a new staging store for E2E tests.
+func newStore() store.AgentStore {
+	return agent.NewStore(testScope)
 }
 
 // runCommand executes a CLI command and returns stdout, stderr, and error.
diff --git a/e2e/staging_test.go b/e2e/staging_test.go
index 8df63980..a19be5c3 100644
--- a/e2e/staging_test.go
+++ b/e2e/staging_test.go
@@ -1134,7 +1134,7 @@ func TestDaemonLauncher_Ping(t *testing.T) {
 	setupTempHome(t)
 
 	// Create launcher for the running test daemon
-	launcher := daemon.NewLauncher("000000000000", "us-east-1", daemon.WithAutoStartDisabled())
+	launcher := daemon.NewLauncher(daemon.WithAutoStartDisabled())
 
 	// Test Ping
 	t.Run("ping-success", func(t *testing.T) {
@@ -1166,7 +1166,7 @@ func TestDaemonLauncher_EnsureRunning(t *testing.T) {
 	setupTempHome(t)
 
 	// Create launcher for the running test daemon
-	launcher := daemon.NewLauncher("000000000000", "us-east-1", daemon.WithAutoStartDisabled())
+	launcher := daemon.NewLauncher(daemon.WithAutoStartDisabled())
 
 	// Test EnsureRunning (daemon is already running from TestMain)
 	t.Run("ensure-running-when-running", func(t *testing.T) {
@@ -1231,13 +1231,25 @@ func TestDaemonLauncher_ViaStore(t *testing.T) {
 	})
 }
 
+// setupIsolatedSocketPath sets socket-related environment variables to a temp directory,
+// causing the daemon to look for a socket in a different location where no daemon is running.
+// This simulates the "daemon not running" scenario for E2E tests.
+// Darwin uses TMPDIR, Linux uses XDG_RUNTIME_DIR, Windows uses LOCALAPPDATA.
+func setupIsolatedSocketPath(t *testing.T) {
+	t.Helper()
+	tempDir := t.TempDir()
+	t.Setenv("TMPDIR", tempDir)
+	t.Setenv("XDG_RUNTIME_DIR", tempDir)
+	t.Setenv("LOCALAPPDATA", tempDir)
+}
+
 // TestDaemonLauncher_NotRunning tests launcher behavior when daemon is not running.
 func TestDaemonLauncher_NotRunning(t *testing.T) {
 	setupEnv(t)
 	setupTempHome(t)
+	setupIsolatedSocketPath(t) // Use different socket path where no daemon exists
 
-	// Create launcher for a different account where no daemon is running
-	launcher := daemon.NewLauncher("999999999999", "ap-northeast-1", daemon.WithAutoStartDisabled())
+	launcher := daemon.NewLauncher(daemon.WithAutoStartDisabled())
 
 	// Test Ping fails when daemon not running
 	t.Run("ping-not-running", func(t *testing.T) {
@@ -1257,9 +1269,9 @@ func TestDaemonLauncher_NotRunning(t *testing.T) {
 func TestAgentStore_NotRunning(t *testing.T) {
 	setupEnv(t)
 	setupTempHome(t)
+	setupIsolatedSocketPath(t) // Use different socket path where no daemon exists
 
-	// Create store for a different account where no daemon is running
-	store := newStoreForAccount("999999999999", "ap-northeast-1")
+	store := newStore()
 
 	// Test GetEntry fails when daemon not running
 	t.Run("get-entry-not-running", func(t *testing.T) {
diff --git a/internal/api/paramapi/types.go b/internal/api/paramapi/types.go
index 454e57b9..2da1bfab 100644
--- a/internal/api/paramapi/types.go
+++ b/internal/api/paramapi/types.go
@@ -118,3 +118,9 @@ var NewDescribeParametersPaginator = ssm.NewDescribeParametersPaginator
 const (
 	FilterNameStringTypeName = types.ParametersFilterKeyName
 )
+
+// ParameterTier is a re-exported SSM model type.
+type ParameterTier = types.ParameterTier
+
+// ParameterInlinePolicy is a re-exported SSM model type.
+type ParameterInlinePolicy = types.ParameterInlinePolicy
diff --git a/internal/cli/commands/param/create/create.go b/internal/cli/commands/param/create/create.go
index 8b87e60c..f2154b3a 100644
--- a/internal/cli/commands/param/create/create.go
+++ b/internal/cli/commands/param/create/create.go
@@ -9,9 +9,8 @@ import (
 
 	"github.com/urfave/cli/v3"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -92,13 +91,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		paramType = "SecureString"
 	}
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &param.CreateUseCase{Client: client},
+		UseCase: &param.CreateUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 		Stderr:  cmd.Root().ErrWriter,
 	}
@@ -116,7 +115,7 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	result, err := r.UseCase.Execute(ctx, param.CreateInput{
 		Name:        opts.Name,
 		Value:       opts.Value,
-		Type:        paramapi.ParameterType(opts.Type),
+		Type:        opts.Type,
 		Description: opts.Description,
 	})
 	if err != nil {
diff --git a/internal/cli/commands/param/create/create_test.go b/internal/cli/commands/param/create/create_test.go
index 26346392..c5a5ad4b 100644
--- a/internal/cli/commands/param/create/create_test.go
+++ b/internal/cli/commands/param/create/create_test.go
@@ -3,16 +3,15 @@ package create_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/create"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -47,18 +46,16 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	putParameterFunc func(ctx context.Context, params *paramapi.PutParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error)
+	putParameterFunc func(ctx context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error)
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) PutParameter(ctx context.Context, params *paramapi.PutParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
+func (m *mockClient) PutParameter(ctx context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error) {
 	if m.putParameterFunc != nil {
-		return m.putParameterFunc(ctx, params, optFns...)
+		return m.putParameterFunc(ctx, p, overwrite)
 	}
 
-	return nil, fmt.Errorf("PutParameter not mocked")
+	return nil, errors.New("PutParameter not mocked")
 }
 
 func TestRun(t *testing.T) {
@@ -79,15 +76,19 @@ func TestRun(t *testing.T) {
 				Type:  "SecureString",
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				putParameterFunc: func(_ context.Context, params *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					assert.Equal(t, "/app/param", lo.FromPtr(params.Name))
-					assert.Equal(t, "test-value", lo.FromPtr(params.Value))
-					assert.Equal(t, paramapi.ParameterTypeSecureString, params.Type)
-					assert.False(t, lo.FromPtr(params.Overwrite))
-
-					return &paramapi.PutParameterOutput{
-						Version: 1,
+				putParameterFunc: func(_ context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error) {
+					assert.Equal(t, "/app/param", p.Name)
+					assert.Equal(t, "test-value", p.Value)
+
+					if meta := p.AWSMeta(); meta != nil {
+						assert.Equal(t, "SecureString", meta.Type)
+					}
+
+					assert.False(t, overwrite)
+
+					return &model.ParameterWriteResult{
+						Name:    "/app/param",
+						Version: "1",
 					}, nil
 				},
 			},
@@ -107,13 +108,13 @@ func TestRun(t *testing.T) {
 				Description: "Test description",
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				putParameterFunc: func(_ context.Context, params *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					assert.Equal(t, "Test description", lo.FromPtr(params.Description))
-					assert.False(t, lo.FromPtr(params.Overwrite))
+				putParameterFunc: func(_ context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error) {
+					assert.Equal(t, "Test description", p.Description)
+					assert.False(t, overwrite)
 
-					return &paramapi.PutParameterOutput{
-						Version: 1,
+					return &model.ParameterWriteResult{
+						Name:    "/app/param",
+						Version: "1",
 					}, nil
 				},
 			},
@@ -123,8 +124,8 @@ func TestRun(t *testing.T) {
 			opts:    create.Options{Name: "/app/param", Value: "test-value", Type: "String"},
 			wantErr: "failed to create parameter",
 			mock: &mockClient{
-				putParameterFunc: func(_ context.Context, _ *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					return nil, &paramapi.ParameterAlreadyExists{Message: lo.ToPtr("already exists")}
+				putParameterFunc: func(_ context.Context, _ *model.Parameter, _ bool) (*model.ParameterWriteResult, error) {
+					return nil, errors.New("parameter already exists")
 				},
 			},
 		},
@@ -133,8 +134,8 @@ func TestRun(t *testing.T) {
 			opts:    create.Options{Name: "/app/param", Value: "test-value", Type: "String"},
 			wantErr: "failed to create parameter",
 			mock: &mockClient{
-				putParameterFunc: func(_ context.Context, _ *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				putParameterFunc: func(_ context.Context, _ *model.Parameter, _ bool) (*model.ParameterWriteResult, error) {
+					return nil, errors.New("AWS error")
 				},
 			},
 		},
diff --git a/internal/cli/commands/param/delete/delete.go b/internal/cli/commands/param/delete/delete.go
index ff7d63be..e240718d 100644
--- a/internal/cli/commands/param/delete/delete.go
+++ b/internal/cli/commands/param/delete/delete.go
@@ -13,6 +13,7 @@ import (
 	"github.com/mpyw/suve/internal/cli/confirm"
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/infra"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -61,7 +62,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 	name := cmd.Args().First()
 	skipConfirm := cmd.Bool("yes")
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
@@ -72,7 +73,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		identity, _ = infra.GetAWSIdentity(ctx)
 	}
 
-	useCase := &param.DeleteUseCase{Client: client}
+	useCase := &param.DeleteUseCase{Client: adapter}
 
 	// Show current value before confirming
 	if !skipConfirm {
diff --git a/internal/cli/commands/param/delete/delete_test.go b/internal/cli/commands/param/delete/delete_test.go
index d8d10d6b..03c920ea 100644
--- a/internal/cli/commands/param/delete/delete_test.go
+++ b/internal/cli/commands/param/delete/delete_test.go
@@ -3,15 +3,15 @@ package delete_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/delete"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -28,28 +28,25 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	deleteParameterFunc func(ctx context.Context, params *paramapi.DeleteParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.DeleteParameterOutput, error)
-	getParameterFunc    func(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error)
+	deleteParameterFunc func(ctx context.Context, name string) error
+	getParameterFunc    func(ctx context.Context, name string, version string) (*model.Parameter, error)
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) DeleteParameter(ctx context.Context, params *paramapi.DeleteParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.DeleteParameterOutput, error) {
+func (m *mockClient) DeleteParameter(ctx context.Context, name string) error {
 	if m.deleteParameterFunc != nil {
-		return m.deleteParameterFunc(ctx, params, optFns...)
+		return m.deleteParameterFunc(ctx, name)
 	}
 
-	return nil, fmt.Errorf("DeleteParameter not mocked")
+	return errors.New("DeleteParameter not mocked")
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameter(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockClient) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
 	if m.getParameterFunc != nil {
-		return m.getParameterFunc(ctx, params, optFns...)
+		return m.getParameterFunc(ctx, name, version)
 	}
 
-	return nil, &paramapi.ParameterNotFound{}
+	return nil, errors.New("not found")
 }
 
 func TestRun(t *testing.T) {
@@ -65,9 +62,8 @@ func TestRun(t *testing.T) {
 			name: "delete parameter",
 			opts: delete.Options{Name: "/app/param"},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				deleteParameterFunc: func(_ context.Context, _ *paramapi.DeleteParameterInput, _ ...func(*paramapi.Options)) (*paramapi.DeleteParameterOutput, error) {
-					return &paramapi.DeleteParameterOutput{}, nil
+				deleteParameterFunc: func(_ context.Context, _ string) error {
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -80,9 +76,8 @@ func TestRun(t *testing.T) {
 			name: "error from AWS",
 			opts: delete.Options{Name: "/app/param"},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				deleteParameterFunc: func(_ context.Context, _ *paramapi.DeleteParameterInput, _ ...func(*paramapi.Options)) (*paramapi.DeleteParameterOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				deleteParameterFunc: func(_ context.Context, _ string) error {
+					return errors.New("AWS error")
 				},
 			},
 			wantErr: true,
diff --git a/internal/cli/commands/param/diff/diff.go b/internal/cli/commands/param/diff/diff.go
index ba44895e..f7b36372 100644
--- a/internal/cli/commands/param/diff/diff.go
+++ b/internal/cli/commands/param/diff/diff.go
@@ -11,8 +11,8 @@ import (
 
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/cli/pager"
-	"github.com/mpyw/suve/internal/infra"
 	"github.com/mpyw/suve/internal/jsonutil"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
@@ -94,7 +94,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return err
 	}
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
@@ -112,7 +112,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 
 	return pager.WithPagerWriter(cmd.Root().Writer, noPager, func(w io.Writer) error {
 		r := &Runner{
-			UseCase: &param.DiffUseCase{Client: client},
+			UseCase: &param.DiffUseCase{Client: adapter},
 			Stdout:  w,
 			Stderr:  cmd.Root().ErrWriter,
 		}
diff --git a/internal/cli/commands/param/diff/diff_test.go b/internal/cli/commands/param/diff/diff_test.go
index 8fe3aea5..463a6a74 100644
--- a/internal/cli/commands/param/diff/diff_test.go
+++ b/internal/cli/commands/param/diff/diff_test.go
@@ -11,16 +11,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	paramdiff "github.com/mpyw/suve/internal/cli/commands/param/diff"
 	"github.com/mpyw/suve/internal/cli/diffargs"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
-const testParamVersion1 = "/app/param:1"
-
 func TestCommand_Validation(t *testing.T) {
 	t.Parallel()
 
@@ -377,31 +375,31 @@ func assertSpec(t *testing.T, label string, got *paramversion.Spec, want *wantSp
 	assert.Equal(t, want.shift, got.Shift, "%s.Shift", label)
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	getParameterFunc        func(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error)
-	getParameterHistoryFunc func(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error)
+	getParameterFunc        func(ctx context.Context, name string, version string) (*model.Parameter, error)
+	getParameterHistoryFunc func(ctx context.Context, name string) (*model.ParameterHistory, error)
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameter(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockClient) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
 	if m.getParameterFunc != nil {
-		return m.getParameterFunc(ctx, params, optFns...)
+		return m.getParameterFunc(ctx, name, version)
 	}
 
 	return nil, fmt.Errorf("GetParameter not mocked")
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameterHistory(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
+func (m *mockClient) GetParameterHistory(ctx context.Context, name string) (*model.ParameterHistory, error) {
 	if m.getParameterHistoryFunc != nil {
-		return m.getParameterHistoryFunc(ctx, params, optFns...)
+		return m.getParameterHistoryFunc(ctx, name)
 	}
 
 	return nil, fmt.Errorf("GetParameterHistory not mocked")
 }
 
-//nolint:funlen // Table-driven test with many cases
+func (m *mockClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	return nil, fmt.Errorf("ListParameters not mocked")
+}
+
 func TestRun(t *testing.T) {
 	t.Parallel()
 
@@ -421,29 +419,21 @@ func TestRun(t *testing.T) {
 				Spec2: &paramversion.Spec{Name: "/app/param", Absolute: paramversion.AbsoluteSpec{Version: lo.ToPtr(int64(2))}},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					name := lo.FromPtr(params.Name)
-					if name == testParamVersion1 {
-						return &paramapi.GetParameterOutput{
-							Parameter: &paramapi.Parameter{
-								Name:             lo.ToPtr("/app/param"),
-								Value:            lo.ToPtr("old-value"),
-								Version:          1,
-								Type:             paramapi.ParameterTypeString,
-								LastModifiedDate: lo.ToPtr(now.Add(-time.Hour)),
-							},
+				getParameterFunc: func(_ context.Context, _ string, version string) (*model.Parameter, error) {
+					if version == "1" {
+						return &model.Parameter{
+							Name:      "/app/param",
+							Value:     "old-value",
+							Version:   "1",
+							UpdatedAt: lo.ToPtr(now.Add(-time.Hour)),
 						}, nil
 					}
 
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/app/param"),
-							Value:            lo.ToPtr("new-value"),
-							Version:          2,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
+					return &model.Parameter{
+						Name:      "/app/param",
+						Value:     "new-value",
+						Version:   "2",
+						UpdatedAt: &now,
 					}, nil
 				},
 			},
@@ -460,14 +450,11 @@ func TestRun(t *testing.T) {
 				Spec2: &paramversion.Spec{Name: "/app/param", Absolute: paramversion.AbsoluteSpec{Version: lo.ToPtr(int64(2))}},
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/app/param"),
-							Value:   lo.ToPtr("same-value"),
-							Version: 1,
-							Type:    paramapi.ParameterTypeString,
-						},
+				getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+					return &model.Parameter{
+						Name:    "/app/param",
+						Value:   "same-value",
+						Version: "1",
 					}, nil
 				},
 			},
@@ -484,18 +471,15 @@ func TestRun(t *testing.T) {
 				Spec2: &paramversion.Spec{Name: "/app/param", Absolute: paramversion.AbsoluteSpec{Version: lo.ToPtr(int64(2))}},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					if lo.FromPtr(params.Name) == testParamVersion1 {
+				getParameterFunc: func(_ context.Context, _ string, version string) (*model.Parameter, error) {
+					if version == "1" {
 						return nil, fmt.Errorf("version not found")
 					}
 
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/app/param"),
-							Value:   lo.ToPtr("value"),
-							Version: 2,
-						},
+					return &model.Parameter{
+						Name:    "/app/param",
+						Value:   "value",
+						Version: "2",
 					}, nil
 				},
 			},
@@ -508,18 +492,15 @@ func TestRun(t *testing.T) {
 				Spec2: &paramversion.Spec{Name: "/app/param", Absolute: paramversion.AbsoluteSpec{Version: lo.ToPtr(int64(2))}},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					if lo.FromPtr(params.Name) == "/app/param:2" {
+				getParameterFunc: func(_ context.Context, _ string, version string) (*model.Parameter, error) {
+					if version == "2" {
 						return nil, fmt.Errorf("version not found")
 					}
 
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/app/param"),
-							Value:   lo.ToPtr("value"),
-							Version: 1,
-						},
+					return &model.Parameter{
+						Name:    "/app/param",
+						Value:   "value",
+						Version: "1",
 					}, nil
 				},
 			},
@@ -533,27 +514,19 @@ func TestRun(t *testing.T) {
 				ParseJSON: true,
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					name := lo.FromPtr(params.Name)
-					if name == testParamVersion1 {
-						return &paramapi.GetParameterOutput{
-							Parameter: &paramapi.Parameter{
-								Name:    lo.ToPtr("/app/param"),
-								Value:   lo.ToPtr(`{"key":"old"}`),
-								Version: 1,
-								Type:    paramapi.ParameterTypeString,
-							},
+				getParameterFunc: func(_ context.Context, _ string, version string) (*model.Parameter, error) {
+					if version == "1" {
+						return &model.Parameter{
+							Name:    "/app/param",
+							Value:   `{"key":"old"}`,
+							Version: "1",
 						}, nil
 					}
 
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/app/param"),
-							Value:   lo.ToPtr(`{"key":"new"}`),
-							Version: 2,
-							Type:    paramapi.ParameterTypeString,
-						},
+					return &model.Parameter{
+						Name:    "/app/param",
+						Value:   `{"key":"new"}`,
+						Version: "2",
 					}, nil
 				},
 			},
@@ -571,27 +544,19 @@ func TestRun(t *testing.T) {
 				ParseJSON: true,
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					name := lo.FromPtr(params.Name)
-					if name == testParamVersion1 {
-						return &paramapi.GetParameterOutput{
-							Parameter: &paramapi.Parameter{
-								Name:    lo.ToPtr("/app/param"),
-								Value:   lo.ToPtr("not json"),
-								Version: 1,
-								Type:    paramapi.ParameterTypeString,
-							},
+				getParameterFunc: func(_ context.Context, _ string, version string) (*model.Parameter, error) {
+					if version == "1" {
+						return &model.Parameter{
+							Name:    "/app/param",
+							Value:   "not json",
+							Version: "1",
 						}, nil
 					}
 
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/app/param"),
-							Value:   lo.ToPtr("also not json"),
-							Version: 2,
-							Type:    paramapi.ParameterTypeString,
-						},
+					return &model.Parameter{
+						Name:    "/app/param",
+						Value:   "also not json",
+						Version: "2",
 					}, nil
 				},
 			},
@@ -635,14 +600,11 @@ func TestRun_IdenticalWarning(t *testing.T) {
 	t.Parallel()
 
 	mock := &mockClient{
-		getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			return &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Name:    lo.ToPtr("/app/param"),
-					Value:   lo.ToPtr("same-value"),
-					Version: 1,
-					Type:    paramapi.ParameterTypeString,
-				},
+		getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+			return &model.Parameter{
+				Name:    "/app/param",
+				Value:   "same-value",
+				Version: "1",
 			}, nil
 		},
 	}
diff --git a/internal/cli/commands/param/log/log.go b/internal/cli/commands/param/log/log.go
index 9180ef04..6a01e415 100644
--- a/internal/cli/commands/param/log/log.go
+++ b/internal/cli/commands/param/log/log.go
@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"strconv"
 	"time"
 
 	"github.com/urfave/cli/v3"
@@ -17,8 +18,8 @@ import (
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/cli/pager"
 	"github.com/mpyw/suve/internal/cli/terminal"
-	"github.com/mpyw/suve/internal/infra"
 	"github.com/mpyw/suve/internal/jsonutil"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/timeutil"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
@@ -198,7 +199,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		}
 	}
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
@@ -208,7 +209,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 
 	return pager.WithPagerWriter(cmd.Root().Writer, noPager, func(w io.Writer) error {
 		r := &Runner{
-			UseCase: &param.LogUseCase{Client: client},
+			UseCase: &param.LogUseCase{Client: adapter},
 			Stdout:  w,
 			Stderr:  cmd.Root().ErrWriter,
 		}
@@ -239,13 +240,15 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	if opts.Output == output.FormatJSON {
 		items := make([]JSONOutputItem, len(entries))
 		for i, entry := range entries {
+			version, _ := strconv.ParseInt(entry.Version, 10, 64)
+
 			items[i] = JSONOutputItem{
-				Version: entry.Version,
-				Type:    string(entry.Type),
+				Version: version,
+				Type:    entry.Type,
 				Value:   entry.Value,
 			}
-			if entry.LastModified != nil {
-				items[i].Modified = timeutil.FormatRFC3339(*entry.LastModified)
+			if entry.UpdatedAt != nil {
+				items[i].Modified = timeutil.FormatRFC3339(*entry.UpdatedAt)
 			}
 		}
 
@@ -259,8 +262,8 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 		if opts.Oneline && !opts.ShowPatch {
 			// Compact one-line format: VERSION  DATE  VALUE_PREVIEW
 			dateStr := ""
-			if entry.LastModified != nil {
-				dateStr = entry.LastModified.Format("2006-01-02")
+			if entry.UpdatedAt != nil {
+				dateStr = entry.UpdatedAt.Format("2006-01-02")
 			}
 
 			value := entry.Value
@@ -287,7 +290,7 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 				currentMark = colors.Current(" (current)")
 			}
 
-			output.Printf(r.Stdout, "%s%d%s  %s  %s\n",
+			output.Printf(r.Stdout, "%s%s%s  %s  %s\n",
 				colors.Version(""),
 				entry.Version,
 				currentMark,
@@ -298,15 +301,15 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 			continue
 		}
 
-		versionLabel := fmt.Sprintf("Version %d", entry.Version)
+		versionLabel := fmt.Sprintf("Version %s", entry.Version)
 		if entry.IsCurrent {
 			versionLabel += " " + colors.Current("(current)")
 		}
 
 		output.Println(r.Stdout, colors.Version(versionLabel))
 
-		if entry.LastModified != nil {
-			output.Printf(r.Stdout, "%s %s\n", colors.FieldLabel("Date:"), timeutil.FormatRFC3339(*entry.LastModified))
+		if entry.UpdatedAt != nil {
+			output.Printf(r.Stdout, "%s %s\n", colors.FieldLabel("Date:"), timeutil.FormatRFC3339(*entry.UpdatedAt))
 		}
 
 		if opts.ShowPatch {
@@ -331,8 +334,8 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 					oldValue, newValue = jsonutil.TryFormatOrWarn2(oldValue, newValue, r.Stderr, "")
 				}
 
-				oldName := fmt.Sprintf("%s#%d", result.Name, oldEntry.Version)
-				newName := fmt.Sprintf("%s#%d", result.Name, newEntry.Version)
+				oldName := fmt.Sprintf("%s#%s", result.Name, oldEntry.Version)
+				newName := fmt.Sprintf("%s#%s", result.Name, newEntry.Version)
 
 				diff := output.Diff(oldName, newName, oldValue, newValue)
 				if diff != "" {
diff --git a/internal/cli/commands/param/log/log_test.go b/internal/cli/commands/param/log/log_test.go
index a3bb1662..6e7f8d4c 100644
--- a/internal/cli/commands/param/log/log_test.go
+++ b/internal/cli/commands/param/log/log_test.go
@@ -12,10 +12,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/log"
 	"github.com/mpyw/suve/internal/cli/output"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -107,18 +107,40 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	getParameterHistoryFunc func(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error)
+	getParameterResult *model.Parameter
+	getParameterErr    error
+	getHistoryResult   *model.ParameterHistory
+	getHistoryErr      error
+	listParametersErr  error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameterHistory(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-	if m.getParameterHistoryFunc != nil {
-		return m.getParameterHistoryFunc(ctx, params, optFns...)
+func (m *mockClient) GetParameter(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+	if m.getParameterErr != nil {
+		return nil, m.getParameterErr
 	}
 
-	return nil, fmt.Errorf("GetParameterHistory not mocked")
+	return m.getParameterResult, nil
+}
+
+func (m *mockClient) GetParameterHistory(_ context.Context, _ string) (*model.ParameterHistory, error) {
+	if m.getHistoryErr != nil {
+		return nil, m.getHistoryErr
+	}
+
+	if m.getHistoryResult == nil {
+		return &model.ParameterHistory{}, nil
+	}
+
+	return m.getHistoryResult, nil
+}
+
+func (m *mockClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	if m.listParametersErr != nil {
+		return nil, m.listParametersErr
+	}
+
+	return nil, nil
 }
 
 //nolint:funlen // Table-driven test with many cases
@@ -138,16 +160,12 @@ func TestRun(t *testing.T) {
 			name: "show history",
 			opts: log.Options{Name: "/app/param", MaxResults: 10},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, params *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					assert.Equal(t, "/app/param", lo.FromPtr(params.Name))
-
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -161,15 +179,14 @@ func TestRun(t *testing.T) {
 			name: "normal mode shows full value without truncation",
 			opts: log.Options{Name: "/app/param", MaxResults: 10},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					longValue := "this is a very long value that should NOT be truncated in normal mode"
-
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr(longValue), Version: 1, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: "this is a very long value that should NOT be truncated in normal mode",
+							Version: "1", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -183,15 +200,14 @@ func TestRun(t *testing.T) {
 			name: "max-value-length truncates in normal mode",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, MaxValueLength: 20},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					longValue := "this is a very long value that should be truncated"
-
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr(longValue), Version: 1, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: "this is a very long value that should be truncated",
+							Version: "1", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -205,14 +221,18 @@ func TestRun(t *testing.T) {
 			name: "show patch between versions",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, ShowPatch: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("old-value"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("new-value"), Version: 2, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: "old-value", Version: "1",
+							UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+						{
+							Name: "/app/param", Value: "new-value", Version: "2",
+							UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
+						},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -227,13 +247,11 @@ func TestRun(t *testing.T) {
 			name: "patch with single version shows no diff",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, ShowPatch: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("only-value"), Version: 1, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "only-value", Version: "1", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -243,28 +261,21 @@ func TestRun(t *testing.T) {
 			},
 		},
 		{
-			name: "error from AWS",
-			opts: log.Options{Name: "/app/param", MaxResults: 10},
-			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return nil, fmt.Errorf("AWS error")
-				},
-			},
+			name:    "error from AWS",
+			opts:    log.Options{Name: "/app/param", MaxResults: 10},
+			mock:    &mockClient{getHistoryErr: fmt.Errorf("AWS error")},
 			wantErr: true,
 		},
 		{
 			name: "reverse order shows oldest first",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Reverse: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -285,14 +296,18 @@ func TestRun(t *testing.T) {
 			name: "reverse with patch shows diff correctly",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, ShowPatch: true, Reverse: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("old-value"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("new-value"), Version: 2, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: "old-value", Version: "1",
+							UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+						{
+							Name: "/app/param", Value: "new-value", Version: "2",
+							UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
+						},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -307,11 +322,9 @@ func TestRun(t *testing.T) {
 			name: "empty history",
 			opts: log.Options{Name: "/app/param", MaxResults: 10},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name:       "/app/param",
+					Parameters: []*model.Parameter{},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -323,14 +336,12 @@ func TestRun(t *testing.T) {
 			name: "oneline format",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Oneline: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -347,15 +358,14 @@ func TestRun(t *testing.T) {
 			name: "oneline truncates long values",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Oneline: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					longValue := "this is a very long value that exceeds forty characters"
-
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr(longValue), Version: 1, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: "this is a very long value that exceeds forty characters",
+							Version: "1", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -369,15 +379,13 @@ func TestRun(t *testing.T) {
 			name: "filter by since date",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Since: lo.ToPtr(now.Add(-90 * time.Minute))},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-2 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -391,15 +399,13 @@ func TestRun(t *testing.T) {
 			name: "filter by until date",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Until: lo.ToPtr(now.Add(-30 * time.Minute))},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-2 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -413,16 +419,14 @@ func TestRun(t *testing.T) {
 			name: "filter by since and until date range",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Since: lo.ToPtr(now.Add(-150 * time.Minute)), Until: lo.ToPtr(now.Add(-30 * time.Minute))},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-3 * time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v4"), Version: 4, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-3 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: lo.ToPtr(now.Add(-2 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v3", Version: "3", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v4", Version: "4", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -437,13 +441,11 @@ func TestRun(t *testing.T) {
 			name: "filter with no matching dates returns empty",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Since: lo.ToPtr(now.Add(time.Hour)), Until: lo.ToPtr(now.Add(2 * time.Hour))},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -455,14 +457,12 @@ func TestRun(t *testing.T) {
 			name: "filter skips versions without LastModifiedDate",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Since: lo.ToPtr(now.Add(-30 * time.Minute))},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: nil},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: nil, Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "v2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -475,14 +475,12 @@ func TestRun(t *testing.T) {
 			name: "JSON output format",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Output: output.FormatJSON},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("value1"), Version: 1, Type: paramapi.ParameterTypeString, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("value2"), Version: 2, Type: paramapi.ParameterTypeSecureString, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "value1", Version: "1", UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/app/param", Value: "value2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "SecureString"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -497,13 +495,11 @@ func TestRun(t *testing.T) {
 			name: "JSON output without LastModifiedDate",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Output: output.FormatJSON},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("value1"), Version: 1, Type: paramapi.ParameterTypeString, LastModifiedDate: nil},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "value1", Version: "1", UpdatedAt: nil, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -516,14 +512,18 @@ func TestRun(t *testing.T) {
 			name: "patch with JSON format",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, ShowPatch: true, ParseJSON: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr(`{"key":"old"}`), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr(`{"key":"new"}`), Version: 2, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: `{"key":"old"}`, Version: "1",
+							UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+						{
+							Name: "/app/param", Value: `{"key":"new"}`, Version: "2",
+							UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
+						},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -532,16 +532,14 @@ func TestRun(t *testing.T) {
 			},
 		},
 		{
-			name: "version without LastModifiedDate shows correctly",
+			name: "version without UpdatedAt shows correctly",
 			opts: log.Options{Name: "/app/param", MaxResults: 10},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: nil},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: nil, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -554,13 +552,11 @@ func TestRun(t *testing.T) {
 			name: "oneline without LastModifiedDate",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, Oneline: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: nil},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Value: "v1", Version: "1", UpdatedAt: nil, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -572,14 +568,18 @@ func TestRun(t *testing.T) {
 			name: "patch with identical values shows no diff",
 			opts: log.Options{Name: "/app/param", MaxResults: 10, ShowPatch: true},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("same-value"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/app/param"), Value: lo.ToPtr("same-value"), Version: 2, LastModifiedDate: &now},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{
+							Name: "/app/param", Value: "same-value", Version: "1",
+							UpdatedAt: lo.ToPtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"},
+						},
+						{
+							Name: "/app/param", Value: "same-value", Version: "2",
+							UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
diff --git a/internal/cli/commands/param/show/show.go b/internal/cli/commands/param/show/show.go
index 3de07bd2..1d84d597 100644
--- a/internal/cli/commands/param/show/show.go
+++ b/internal/cli/commands/param/show/show.go
@@ -11,11 +11,10 @@ import (
 	"github.com/samber/lo"
 	"github.com/urfave/cli/v3"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/cli/pager"
-	"github.com/mpyw/suve/internal/infra"
 	"github.com/mpyw/suve/internal/jsonutil"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/timeutil"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
@@ -112,7 +111,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("--raw and --output=json cannot be used together")
 	}
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
@@ -130,7 +129,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 
 	return pager.WithPagerWriter(cmd.Root().Writer, noPager, func(w io.Writer) error {
 		r := &Runner{
-			UseCase: &param.ShowUseCase{Client: client},
+			UseCase: &param.ShowUseCase{Client: adapter},
 			Stdout:  w,
 			Stderr:  cmd.Root().ErrWriter,
 		}
@@ -154,7 +153,7 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	// Warn if --parse-json is used in cases where it's not meaningful
 	if opts.ParseJSON {
 		switch result.Type {
-		case paramapi.ParameterTypeStringList:
+		case "StringList":
 			output.Warning(r.Stderr, "--parse-json has no effect on StringList type (comma-separated values)")
 		default:
 			formatted := jsonutil.TryFormatOrWarn(value, r.Stderr, "")
@@ -174,10 +173,11 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 
 	// JSON output mode
 	if opts.Output == output.FormatJSON {
+		version, _ := strconv.ParseInt(result.Version, 10, 64)
 		jsonOut := JSONOutput{
 			Name:    result.Name,
-			Version: result.Version,
-			Type:    string(result.Type),
+			Version: version,
+			Type:    result.Type,
 			Value:   value,
 		}
 		// Show json_parsed only when --parse-json was used and succeeded
@@ -185,8 +185,8 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 			jsonOut.JSONParsed = lo.ToPtr(true)
 		}
 
-		if result.LastModified != nil {
-			jsonOut.Modified = timeutil.FormatRFC3339(*result.LastModified)
+		if result.UpdatedAt != nil {
+			jsonOut.Modified = timeutil.FormatRFC3339(*result.UpdatedAt)
 		}
 
 		jsonOut.Tags = make(map[string]string)
@@ -203,15 +203,15 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	// Normal mode: show metadata + value
 	out := output.New(r.Stdout)
 	out.Field("Name", result.Name)
-	out.Field("Version", strconv.FormatInt(result.Version, 10))
-	out.Field("Type", string(result.Type))
+	out.Field("Version", result.Version)
+	out.Field("Type", result.Type)
 	// Show json_parsed only when --parse-json was used and succeeded
 	if jsonParsed {
 		out.Field("JsonParsed", "true")
 	}
 
-	if result.LastModified != nil {
-		out.Field("Modified", timeutil.FormatRFC3339(*result.LastModified))
+	if result.UpdatedAt != nil {
+		out.Field("Modified", timeutil.FormatRFC3339(*result.UpdatedAt))
 	}
 
 	if len(result.Tags) > 0 {
diff --git a/internal/cli/commands/param/show/show_test.go b/internal/cli/commands/param/show/show_test.go
index 309d5d01..16a09db4 100644
--- a/internal/cli/commands/param/show/show_test.go
+++ b/internal/cli/commands/param/show/show_test.go
@@ -8,14 +8,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/show"
 	"github.com/mpyw/suve/internal/cli/output"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
@@ -42,30 +41,59 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	getParameterFunc        func(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error)
-	getParameterHistoryFunc func(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error)
-	listTagsForResourceFunc func(ctx context.Context, params *paramapi.ListTagsForResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.ListTagsForResourceOutput, error)
+	getParameterResult   *model.Parameter
+	getParameterErr      error
+	getHistoryResult     *model.ParameterHistory
+	getHistoryErr        error
+	listParametersResult []*model.ParameterListItem
+	listParametersErr    error
+	getTagsResult        map[string]string
+	getTagsErr           error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameter(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-	return m.getParameterFunc(ctx, params, optFns...)
+func (m *mockClient) GetParameter(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+	if m.getParameterErr != nil {
+		return nil, m.getParameterErr
+	}
+
+	return m.getParameterResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameterHistory(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-	return m.getParameterHistoryFunc(ctx, params, optFns...)
+func (m *mockClient) GetParameterHistory(_ context.Context, _ string) (*model.ParameterHistory, error) {
+	if m.getHistoryErr != nil {
+		return nil, m.getHistoryErr
+	}
+
+	if m.getHistoryResult == nil {
+		return &model.ParameterHistory{}, nil
+	}
+
+	return m.getHistoryResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) ListTagsForResource(ctx context.Context, params *paramapi.ListTagsForResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.ListTagsForResourceOutput, error) {
-	if m.listTagsForResourceFunc != nil {
-		return m.listTagsForResourceFunc(ctx, params, optFns...)
+func (m *mockClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	if m.listParametersErr != nil {
+		return nil, m.listParametersErr
 	}
 
-	return &paramapi.ListTagsForResourceOutput{}, nil
+	return m.listParametersResult, nil
+}
+
+func (m *mockClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	if m.getTagsErr != nil {
+		return nil, m.getTagsErr
+	}
+
+	return m.getTagsResult, nil
+}
+
+func (m *mockClient) AddTags(_ context.Context, _ string, _ map[string]string) error {
+	return nil
+}
+
+func (m *mockClient) RemoveTags(_ context.Context, _ string, _ []string) error {
+	return nil
 }
 
 //nolint:funlen // Table-driven test with many cases
@@ -87,16 +115,14 @@ func TestRun(t *testing.T) {
 				Spec: &paramversion.Spec{Name: "/my/param"},
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/my/param"),
-							Value:            lo.ToPtr("test-value"),
-							Version:          3,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:      "/my/param",
+					Value:     "test-value",
+					Version:   "3",
+					UpdatedAt: &now,
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -111,15 +137,17 @@ func TestRun(t *testing.T) {
 				Spec: &paramversion.Spec{Name: "/my/param", Shift: 1},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: &now},
-							{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/my/param",
+					Parameters: []*model.Parameter{
+						{Name: "/my/param", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/my/param", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{
+							Name: "/my/param", Value: "v1", Version: "1",
+							UpdatedAt: timePtr(now.Add(-2 * time.Hour)),
+							Metadata:  model.AWSParameterMeta{Type: "String"},
 						},
-					}, nil
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -134,16 +162,14 @@ func TestRun(t *testing.T) {
 				ParseJSON: true,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/my/param"),
-							Value:            lo.ToPtr(`{"zebra":"last","apple":"first"}`),
-							Version:          1,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:      "/my/param",
+					Value:     `{"zebra":"last","apple":"first"}`,
+					Version:   "1",
+					UpdatedAt: &now,
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -159,28 +185,22 @@ func TestRun(t *testing.T) {
 			},
 		},
 		{
-			name: "error from AWS",
-			opts: show.Options{Spec: &paramversion.Spec{Name: "/my/param"}},
-			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return nil, fmt.Errorf("AWS error")
-				},
-			},
+			name:    "error from AWS",
+			opts:    show.Options{Spec: &paramversion.Spec{Name: "/my/param"}},
+			mock:    &mockClient{getParameterErr: fmt.Errorf("AWS error")},
 			wantErr: true,
 		},
 		{
 			name: "show without LastModifiedDate",
 			opts: show.Options{Spec: &paramversion.Spec{Name: "/my/param"}},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/my/param"),
-							Value:   lo.ToPtr("test-value"),
-							Version: 1,
-							Type:    paramapi.ParameterTypeString,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:    "/my/param",
+					Value:   "test-value",
+					Version: "1",
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -196,15 +216,13 @@ func TestRun(t *testing.T) {
 				ParseJSON: true,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/my/param"),
-							Value:   lo.ToPtr("a,b,c"),
-							Version: 1,
-							Type:    paramapi.ParameterTypeStringList,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:    "/my/param",
+					Value:   "a,b,c",
+					Version: "1",
+					Metadata: model.AWSParameterMeta{
+						Type: "StringList",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -219,15 +237,13 @@ func TestRun(t *testing.T) {
 				ParseJSON: true,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/my/param"),
-							Value:   lo.ToPtr("encrypted-blob"),
-							Version: 1,
-							Type:    paramapi.ParameterTypeSecureString,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:    "/my/param",
+					Value:   "encrypted-blob",
+					Version: "1",
+					Metadata: model.AWSParameterMeta{
+						Type: "SecureString",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -243,15 +259,13 @@ func TestRun(t *testing.T) {
 				ParseJSON: true,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/my/param"),
-							Value:   lo.ToPtr("not json"),
-							Version: 1,
-							Type:    paramapi.ParameterTypeString,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:    "/my/param",
+					Value:   "not json",
+					Version: "1",
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -268,16 +282,14 @@ func TestRun(t *testing.T) {
 				Raw:  true,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/my/param"),
-							Value:            lo.ToPtr("raw-value"),
-							Version:          1,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:      "/my/param",
+					Value:     "raw-value",
+					Version:   "1",
+					UpdatedAt: &now,
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -293,14 +305,12 @@ func TestRun(t *testing.T) {
 				Raw:  true,
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-					return &paramapi.GetParameterHistoryOutput{
-						Parameters: []paramapi.ParameterHistory{
-							{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-							{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: &now},
-						},
-					}, nil
+				getHistoryResult: &model.ParameterHistory{
+					Name: "/my/param",
+					Parameters: []*model.Parameter{
+						{Name: "/my/param", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+						{Name: "/my/param", Value: "v2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -317,16 +327,14 @@ func TestRun(t *testing.T) {
 				Raw:       true,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/my/param"),
-							Value:            lo.ToPtr(`{"zebra":"last","apple":"first"}`),
-							Version:          1,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:      "/my/param",
+					Value:     `{"zebra":"last","apple":"first"}`,
+					Version:   "1",
+					UpdatedAt: &now,
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -346,25 +354,18 @@ func TestRun(t *testing.T) {
 				Spec: &paramversion.Spec{Name: "/my/param"},
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/my/param"),
-							Value:            lo.ToPtr("test-value"),
-							Version:          1,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:      "/my/param",
+					Value:     "test-value",
+					Version:   "1",
+					UpdatedAt: &now,
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
-				//nolint:lll // inline mock function in test table
-				listTagsForResourceFunc: func(_ context.Context, _ *paramapi.ListTagsForResourceInput, _ ...func(*paramapi.Options)) (*paramapi.ListTagsForResourceOutput, error) {
-					return &paramapi.ListTagsForResourceOutput{
-						TagList: []paramapi.Tag{
-							{Key: lo.ToPtr("Environment"), Value: lo.ToPtr("production")},
-							{Key: lo.ToPtr("Team"), Value: lo.ToPtr("backend")},
-						},
-					}, nil
+				getTagsResult: map[string]string{
+					"Environment": "production",
+					"Team":        "backend",
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -385,25 +386,18 @@ func TestRun(t *testing.T) {
 				Output: output.FormatJSON,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:             lo.ToPtr("/my/param"),
-							Value:            lo.ToPtr("test-value"),
-							Version:          1,
-							Type:             paramapi.ParameterTypeString,
-							LastModifiedDate: &now,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:      "/my/param",
+					Value:     "test-value",
+					Version:   "1",
+					UpdatedAt: &now,
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
-				//nolint:lll // inline mock function in test table
-				listTagsForResourceFunc: func(_ context.Context, _ *paramapi.ListTagsForResourceInput, _ ...func(*paramapi.Options)) (*paramapi.ListTagsForResourceOutput, error) {
-					return &paramapi.ListTagsForResourceOutput{
-						TagList: []paramapi.Tag{
-							{Key: lo.ToPtr("Environment"), Value: lo.ToPtr("production")},
-							{Key: lo.ToPtr("Team"), Value: lo.ToPtr("backend")},
-						},
-					}, nil
+				getTagsResult: map[string]string{
+					"Environment": "production",
+					"Team":        "backend",
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -423,15 +417,13 @@ func TestRun(t *testing.T) {
 				Output: output.FormatJSON,
 			},
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return &paramapi.GetParameterOutput{
-						Parameter: &paramapi.Parameter{
-							Name:    lo.ToPtr("/my/param"),
-							Value:   lo.ToPtr("test-value"),
-							Version: 1,
-							Type:    paramapi.ParameterTypeString,
-						},
-					}, nil
+				getParameterResult: &model.Parameter{
+					Name:    "/my/param",
+					Value:   "test-value",
+					Version: "1",
+					Metadata: model.AWSParameterMeta{
+						Type: "String",
+					},
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -469,3 +461,7 @@ func TestRun(t *testing.T) {
 		})
 	}
 }
+
+func timePtr(t time.Time) *time.Time {
+	return &t
+}
diff --git a/internal/cli/commands/param/tag/tag.go b/internal/cli/commands/param/tag/tag.go
index f28246e1..d8bc9a6b 100644
--- a/internal/cli/commands/param/tag/tag.go
+++ b/internal/cli/commands/param/tag/tag.go
@@ -10,7 +10,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -57,13 +57,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return err
 	}
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &param.TagUseCase{Client: client},
+		UseCase: &param.TagUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 	}
 
diff --git a/internal/cli/commands/param/tag/tag_test.go b/internal/cli/commands/param/tag/tag_test.go
index a75221c5..5b03f30f 100644
--- a/internal/cli/commands/param/tag/tag_test.go
+++ b/internal/cli/commands/param/tag/tag_test.go
@@ -6,11 +6,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/tag"
 	"github.com/mpyw/suve/internal/usecase/param"
@@ -56,28 +54,30 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
+// mockClient implements provider.ParameterTagger for testing.
 type mockClient struct {
-	addTagsFunc    func(ctx context.Context, params *paramapi.AddTagsToResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error)
-	removeTagsFunc func(ctx context.Context, params *paramapi.RemoveTagsFromResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error)
+	addTagsFunc    func(ctx context.Context, name string, tags map[string]string) error
+	removeTagsFunc func(ctx context.Context, name string, keys []string) error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) AddTagsToResource(ctx context.Context, params *paramapi.AddTagsToResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error) {
+func (m *mockClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	return nil, nil //nolint:nilnil // mock implementation
+}
+
+func (m *mockClient) AddTags(ctx context.Context, name string, tags map[string]string) error {
 	if m.addTagsFunc != nil {
-		return m.addTagsFunc(ctx, params, optFns...)
+		return m.addTagsFunc(ctx, name, tags)
 	}
 
-	return &paramapi.AddTagsToResourceOutput{}, nil
+	return nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) RemoveTagsFromResource(ctx context.Context, params *paramapi.RemoveTagsFromResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error) {
+func (m *mockClient) RemoveTags(ctx context.Context, name string, keys []string) error {
 	if m.removeTagsFunc != nil {
-		return m.removeTagsFunc(ctx, params, optFns...)
+		return m.removeTagsFunc(ctx, name, keys)
 	}
 
-	return &paramapi.RemoveTagsFromResourceOutput{}, nil
+	return nil
 }
 
 func TestRun(t *testing.T) {
@@ -97,13 +97,11 @@ func TestRun(t *testing.T) {
 				Tags: map[string]string{"env": "prod"},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				addTagsFunc: func(_ context.Context, params *paramapi.AddTagsToResourceInput, _ ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error) {
-					assert.Equal(t, "/app/param", lo.FromPtr(params.ResourceId))
-					assert.Equal(t, paramapi.ResourceTypeForTaggingParameter, params.ResourceType)
-					assert.Len(t, params.Tags, 1)
+				addTagsFunc: func(_ context.Context, name string, tags map[string]string) error {
+					assert.Equal(t, "/app/param", name)
+					assert.Len(t, tags, 1)
 
-					return &paramapi.AddTagsToResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -119,11 +117,10 @@ func TestRun(t *testing.T) {
 				Tags: map[string]string{"env": "prod", "team": "backend"},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock
-				addTagsFunc: func(_ context.Context, params *paramapi.AddTagsToResourceInput, _ ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error) {
-					assert.Len(t, params.Tags, 2)
+				addTagsFunc: func(_ context.Context, _ string, tags map[string]string) error {
+					assert.Len(t, tags, 2)
 
-					return &paramapi.AddTagsToResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -138,9 +135,8 @@ func TestRun(t *testing.T) {
 				Tags: map[string]string{"env": "prod"},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				addTagsFunc: func(_ context.Context, _ *paramapi.AddTagsToResourceInput, _ ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				addTagsFunc: func(_ context.Context, _ string, _ map[string]string) error {
+					return fmt.Errorf("AWS error")
 				},
 			},
 			wantErr: "failed to add tags",
diff --git a/internal/cli/commands/param/untag/untag.go b/internal/cli/commands/param/untag/untag.go
index f59feb10..d157002c 100644
--- a/internal/cli/commands/param/untag/untag.go
+++ b/internal/cli/commands/param/untag/untag.go
@@ -9,7 +9,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -50,13 +50,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 	name := cmd.Args().Get(0)
 	keys := cmd.Args().Slice()[1:]
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &param.TagUseCase{Client: client},
+		UseCase: &param.TagUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 	}
 
diff --git a/internal/cli/commands/param/untag/untag_test.go b/internal/cli/commands/param/untag/untag_test.go
index f8b9c4e7..93383020 100644
--- a/internal/cli/commands/param/untag/untag_test.go
+++ b/internal/cli/commands/param/untag/untag_test.go
@@ -6,11 +6,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/untag"
 	"github.com/mpyw/suve/internal/usecase/param"
@@ -38,28 +36,30 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
+// mockClient implements provider.ParameterTagger for testing.
 type mockClient struct {
-	addTagsFunc    func(ctx context.Context, params *paramapi.AddTagsToResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error)
-	removeTagsFunc func(ctx context.Context, params *paramapi.RemoveTagsFromResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error)
+	addTagsFunc    func(ctx context.Context, name string, tags map[string]string) error
+	removeTagsFunc func(ctx context.Context, name string, keys []string) error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) AddTagsToResource(ctx context.Context, params *paramapi.AddTagsToResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error) {
+func (m *mockClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	return nil, nil //nolint:nilnil // mock implementation
+}
+
+func (m *mockClient) AddTags(ctx context.Context, name string, tags map[string]string) error {
 	if m.addTagsFunc != nil {
-		return m.addTagsFunc(ctx, params, optFns...)
+		return m.addTagsFunc(ctx, name, tags)
 	}
 
-	return &paramapi.AddTagsToResourceOutput{}, nil
+	return nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) RemoveTagsFromResource(ctx context.Context, params *paramapi.RemoveTagsFromResourceInput, optFns ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error) {
+func (m *mockClient) RemoveTags(ctx context.Context, name string, keys []string) error {
 	if m.removeTagsFunc != nil {
-		return m.removeTagsFunc(ctx, params, optFns...)
+		return m.removeTagsFunc(ctx, name, keys)
 	}
 
-	return &paramapi.RemoveTagsFromResourceOutput{}, nil
+	return nil
 }
 
 func TestRun(t *testing.T) {
@@ -79,13 +79,11 @@ func TestRun(t *testing.T) {
 				Keys: []string{"env"},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				removeTagsFunc: func(_ context.Context, params *paramapi.RemoveTagsFromResourceInput, _ ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error) {
-					assert.Equal(t, "/app/param", lo.FromPtr(params.ResourceId))
-					assert.Equal(t, paramapi.ResourceTypeForTaggingParameter, params.ResourceType)
-					assert.Equal(t, []string{"env"}, params.TagKeys)
+				removeTagsFunc: func(_ context.Context, name string, keys []string) error {
+					assert.Equal(t, "/app/param", name)
+					assert.Equal(t, []string{"env"}, keys)
 
-					return &paramapi.RemoveTagsFromResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -101,11 +99,10 @@ func TestRun(t *testing.T) {
 				Keys: []string{"env", "team"},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				removeTagsFunc: func(_ context.Context, params *paramapi.RemoveTagsFromResourceInput, _ ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error) {
-					assert.Len(t, params.TagKeys, 2)
+				removeTagsFunc: func(_ context.Context, _ string, keys []string) error {
+					assert.Len(t, keys, 2)
 
-					return &paramapi.RemoveTagsFromResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -120,9 +117,8 @@ func TestRun(t *testing.T) {
 				Keys: []string{"env"},
 			},
 			mock: &mockClient{
-				//nolint:lll // inline mock function in test table
-				removeTagsFunc: func(_ context.Context, _ *paramapi.RemoveTagsFromResourceInput, _ ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				removeTagsFunc: func(_ context.Context, _ string, _ []string) error {
+					return fmt.Errorf("AWS error")
 				},
 			},
 			wantErr: "failed to remove tags",
diff --git a/internal/cli/commands/param/update/update.go b/internal/cli/commands/param/update/update.go
index 1f6a3a86..fda5c560 100644
--- a/internal/cli/commands/param/update/update.go
+++ b/internal/cli/commands/param/update/update.go
@@ -7,13 +7,12 @@ import (
 	"io"
 	"os"
 
-	"github.com/samber/lo"
 	"github.com/urfave/cli/v3"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	"github.com/mpyw/suve/internal/cli/confirm"
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/infra"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -100,17 +99,17 @@ func action(ctx context.Context, cmd *cli.Command) error {
 	name := cmd.Args().Get(0)
 	skipConfirm := cmd.Bool("yes")
 
-	client, err := infra.NewParamClient(ctx)
+	adapter, err := awsparam.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
-	uc := &param.UpdateUseCase{Client: client}
+	uc := &param.UpdateUseCase{Client: adapter}
 	newValue := cmd.Args().Get(1)
 
 	// Fetch current value and show diff before confirming
 	if !skipConfirm {
-		currentValue, _ := getCurrentValue(ctx, client, name)
+		currentValue, _ := uc.GetCurrentValue(ctx, name)
 		if currentValue != "" {
 			diff := output.Diff(name+" (AWS)", name+" (new)", currentValue, newValue)
 			if diff != "" {
@@ -159,7 +158,7 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	result, err := r.UseCase.Execute(ctx, param.UpdateInput{
 		Name:        opts.Name,
 		Value:       opts.Value,
-		Type:        paramapi.ParameterType(opts.Type),
+		Type:        opts.Type,
 		Description: opts.Description,
 	})
 	if err != nil {
@@ -170,21 +169,3 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 
 	return nil
 }
-
-// getCurrentValue fetches the current parameter value.
-// Returns the value if exists, empty string if not found.
-func getCurrentValue(ctx context.Context, client paramapi.GetParameterAPI, name string) (string, bool) {
-	result, err := client.GetParameter(ctx, &paramapi.GetParameterInput{
-		Name:           lo.ToPtr(name),
-		WithDecryption: lo.ToPtr(true),
-	})
-	if err != nil {
-		return "", false
-	}
-
-	if result.Parameter == nil || result.Parameter.Value == nil {
-		return "", false
-	}
-
-	return *result.Parameter.Value, true
-}
diff --git a/internal/cli/commands/param/update/update_internal_test.go b/internal/cli/commands/param/update/update_internal_test.go
deleted file mode 100644
index 6ca58835..00000000
--- a/internal/cli/commands/param/update/update_internal_test.go
+++ /dev/null
@@ -1,89 +0,0 @@
-package update
-
-import (
-	"context"
-	"testing"
-
-	"github.com/samber/lo"
-	"github.com/stretchr/testify/assert"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
-)
-
-type mockGetParameterClient struct {
-	output *paramapi.GetParameterOutput
-	err    error
-}
-
-//nolint:lll // mock function signature
-func (m *mockGetParameterClient) GetParameter(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-	if m.err != nil {
-		return nil, m.err
-	}
-
-	return m.output, nil
-}
-
-func TestGetCurrentValue(t *testing.T) {
-	t.Parallel()
-
-	t.Run("returns value when parameter exists", func(t *testing.T) {
-		t.Parallel()
-
-		client := &mockGetParameterClient{
-			output: &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Name:  lo.ToPtr("/app/config"),
-					Value: lo.ToPtr("test-value"),
-				},
-			},
-		}
-
-		value, ok := getCurrentValue(context.Background(), client, "/app/config")
-		assert.True(t, ok)
-		assert.Equal(t, "test-value", value)
-	})
-
-	t.Run("returns false when error occurs", func(t *testing.T) {
-		t.Parallel()
-
-		client := &mockGetParameterClient{
-			err: &paramapi.ParameterNotFound{Message: lo.ToPtr("not found")},
-		}
-
-		value, ok := getCurrentValue(context.Background(), client, "/app/missing")
-		assert.False(t, ok)
-		assert.Empty(t, value)
-	})
-
-	t.Run("returns false when parameter is nil", func(t *testing.T) {
-		t.Parallel()
-
-		client := &mockGetParameterClient{
-			output: &paramapi.GetParameterOutput{
-				Parameter: nil,
-			},
-		}
-
-		value, ok := getCurrentValue(context.Background(), client, "/app/config")
-		assert.False(t, ok)
-		assert.Empty(t, value)
-	})
-
-	t.Run("returns false when value is nil", func(t *testing.T) {
-		t.Parallel()
-
-		client := &mockGetParameterClient{
-			output: &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Name:  lo.ToPtr("/app/config"),
-					Value: nil,
-				},
-			},
-		}
-
-		value, ok := getCurrentValue(context.Background(), client, "/app/config")
-		assert.False(t, ok)
-		assert.Empty(t, value)
-	})
-}
diff --git a/internal/cli/commands/param/update/update_test.go b/internal/cli/commands/param/update/update_test.go
index e03c8ccb..d3d56fec 100644
--- a/internal/cli/commands/param/update/update_test.go
+++ b/internal/cli/commands/param/update/update_test.go
@@ -3,16 +3,15 @@ package update_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/param/update"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -47,40 +46,35 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	getParameterFunc func(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error)
-	putParameterFunc func(ctx context.Context, params *paramapi.PutParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error)
+	getParameterFunc func(ctx context.Context, name string, version string) (*model.Parameter, error)
+	putParameterFunc func(ctx context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error)
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameter(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockClient) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
 	if m.getParameterFunc != nil {
-		return m.getParameterFunc(ctx, params, optFns...)
+		return m.getParameterFunc(ctx, name, version)
 	}
 
-	return nil, fmt.Errorf("GetParameter not mocked")
+	return nil, errors.New("GetParameter not mocked")
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) PutParameter(ctx context.Context, params *paramapi.PutParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
+func (m *mockClient) PutParameter(ctx context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error) {
 	if m.putParameterFunc != nil {
-		return m.putParameterFunc(ctx, params, optFns...)
+		return m.putParameterFunc(ctx, p, overwrite)
 	}
 
-	return nil, fmt.Errorf("PutParameter not mocked")
+	return nil, errors.New("PutParameter not mocked")
 }
 
 func TestRun(t *testing.T) {
 	t.Parallel()
 
 	// Default mock for GetParameter (returns existing parameter)
-	defaultGetParameter := func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-		return &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{
-				Name:  lo.ToPtr("/app/param"),
-				Value: lo.ToPtr("old-value"),
-			},
+	defaultGetParameter := func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+		return &model.Parameter{
+			Name:  "/app/param",
+			Value: "old-value",
 		}, nil
 	}
 
@@ -100,15 +94,19 @@ func TestRun(t *testing.T) {
 			},
 			mock: &mockClient{
 				getParameterFunc: defaultGetParameter,
-				//nolint:lll // inline mock function in test table
-				putParameterFunc: func(_ context.Context, params *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					assert.Equal(t, "/app/param", lo.FromPtr(params.Name))
-					assert.Equal(t, "test-value", lo.FromPtr(params.Value))
-					assert.Equal(t, paramapi.ParameterTypeSecureString, params.Type)
-					assert.True(t, lo.FromPtr(params.Overwrite))
-
-					return &paramapi.PutParameterOutput{
-						Version: 2,
+				putParameterFunc: func(_ context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error) {
+					assert.Equal(t, "/app/param", p.Name)
+					assert.Equal(t, "test-value", p.Value)
+
+					if meta := p.AWSMeta(); meta != nil {
+						assert.Equal(t, "SecureString", meta.Type)
+					}
+
+					assert.True(t, overwrite)
+
+					return &model.ParameterWriteResult{
+						Name:    "/app/param",
+						Version: "2",
 					}, nil
 				},
 			},
@@ -129,13 +127,13 @@ func TestRun(t *testing.T) {
 			},
 			mock: &mockClient{
 				getParameterFunc: defaultGetParameter,
-				//nolint:lll // inline mock function in test table
-				putParameterFunc: func(_ context.Context, params *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					assert.Equal(t, "Test description", lo.FromPtr(params.Description))
-					assert.True(t, lo.FromPtr(params.Overwrite))
+				putParameterFunc: func(_ context.Context, p *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error) {
+					assert.Equal(t, "Test description", p.Description)
+					assert.True(t, overwrite)
 
-					return &paramapi.PutParameterOutput{
-						Version: 2,
+					return &model.ParameterWriteResult{
+						Name:    "/app/param",
+						Version: "2",
 					}, nil
 				},
 			},
@@ -145,8 +143,8 @@ func TestRun(t *testing.T) {
 			opts:    update.Options{Name: "/app/param", Value: "test-value", Type: "String"},
 			wantErr: "parameter not found",
 			mock: &mockClient{
-				getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-					return nil, &paramapi.ParameterNotFound{Message: lo.ToPtr("not found")}
+				getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+					return nil, errors.New("not found")
 				},
 			},
 		},
@@ -156,8 +154,8 @@ func TestRun(t *testing.T) {
 			wantErr: "failed to update parameter",
 			mock: &mockClient{
 				getParameterFunc: defaultGetParameter,
-				putParameterFunc: func(_ context.Context, _ *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				putParameterFunc: func(_ context.Context, _ *model.Parameter, _ bool) (*model.ParameterWriteResult, error) {
+					return nil, errors.New("AWS error")
 				},
 			},
 		},
diff --git a/internal/cli/commands/secret/create/create.go b/internal/cli/commands/secret/create/create.go
index b56e400b..6dfbc095 100644
--- a/internal/cli/commands/secret/create/create.go
+++ b/internal/cli/commands/secret/create/create.go
@@ -9,7 +9,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -62,13 +62,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("usage: suve secret create <name> <value>")
 	}
 
-	client, err := infra.NewSecretClient(ctx)
+	adapter, err := awssecret.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &secret.CreateUseCase{Client: client},
+		UseCase: &secret.CreateUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 		Stderr:  cmd.Root().ErrWriter,
 	}
diff --git a/internal/cli/commands/secret/create/create_test.go b/internal/cli/commands/secret/create/create_test.go
index 7c4adccb..981b597f 100644
--- a/internal/cli/commands/secret/create/create_test.go
+++ b/internal/cli/commands/secret/create/create_test.go
@@ -3,16 +3,15 @@ package create_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/secret/create"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -39,17 +38,15 @@ func TestCommand_Validation(t *testing.T) {
 }
 
 type mockClient struct {
-	//nolint:lll // mock function signature
-	createSecretFunc func(ctx context.Context, params *secretapi.CreateSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.CreateSecretOutput, error)
+	createSecretFunc func(ctx context.Context, s *model.Secret) (*model.SecretWriteResult, error)
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) CreateSecret(ctx context.Context, params *secretapi.CreateSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.CreateSecretOutput, error) {
+func (m *mockClient) CreateSecret(ctx context.Context, s *model.Secret) (*model.SecretWriteResult, error) {
 	if m.createSecretFunc != nil {
-		return m.createSecretFunc(ctx, params, optFns...)
+		return m.createSecretFunc(ctx, s)
 	}
 
-	return nil, fmt.Errorf("CreateSecret not mocked")
+	return nil, errors.New("CreateSecret not mocked")
 }
 
 func TestRun(t *testing.T) {
@@ -65,14 +62,13 @@ func TestRun(t *testing.T) {
 			name: "create secret",
 			opts: create.Options{Name: "my-secret", Value: "secret-value"},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				createSecretFunc: func(_ context.Context, params *secretapi.CreateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.CreateSecretOutput, error) {
-					assert.Equal(t, "my-secret", lo.FromPtr(params.Name))
-					assert.Equal(t, "secret-value", lo.FromPtr(params.SecretString))
-
-					return &secretapi.CreateSecretOutput{
-						Name:      lo.ToPtr("my-secret"),
-						VersionId: lo.ToPtr("abc123"),
+				createSecretFunc: func(_ context.Context, s *model.Secret) (*model.SecretWriteResult, error) {
+					assert.Equal(t, "my-secret", s.Name)
+					assert.Equal(t, "secret-value", s.Value)
+
+					return &model.SecretWriteResult{
+						Name:    "my-secret",
+						Version: "abc123",
 					}, nil
 				},
 			},
@@ -86,13 +82,12 @@ func TestRun(t *testing.T) {
 			name: "create with description",
 			opts: create.Options{Name: "my-secret", Value: "secret-value", Description: "Test description"},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				createSecretFunc: func(_ context.Context, params *secretapi.CreateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.CreateSecretOutput, error) {
-					assert.Equal(t, "Test description", lo.FromPtr(params.Description))
+				createSecretFunc: func(_ context.Context, s *model.Secret) (*model.SecretWriteResult, error) {
+					assert.Equal(t, "Test description", s.Description)
 
-					return &secretapi.CreateSecretOutput{
-						Name:      lo.ToPtr("my-secret"),
-						VersionId: lo.ToPtr("abc123"),
+					return &model.SecretWriteResult{
+						Name:    "my-secret",
+						Version: "abc123",
 					}, nil
 				},
 			},
@@ -102,8 +97,8 @@ func TestRun(t *testing.T) {
 			opts:    create.Options{Name: "my-secret", Value: "secret-value"},
 			wantErr: "failed to create secret",
 			mock: &mockClient{
-				createSecretFunc: func(_ context.Context, _ *secretapi.CreateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.CreateSecretOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				createSecretFunc: func(_ context.Context, _ *model.Secret) (*model.SecretWriteResult, error) {
+					return nil, errors.New("AWS error")
 				},
 			},
 		},
diff --git a/internal/cli/commands/secret/delete/delete.go b/internal/cli/commands/secret/delete/delete.go
index 0ff3f01d..f0735e27 100644
--- a/internal/cli/commands/secret/delete/delete.go
+++ b/internal/cli/commands/secret/delete/delete.go
@@ -12,6 +12,7 @@ import (
 	"github.com/mpyw/suve/internal/cli/confirm"
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/infra"
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -81,7 +82,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 	name := cmd.Args().First()
 	skipConfirm := cmd.Bool("yes")
 
-	client, err := infra.NewSecretClient(ctx)
+	adapter, err := awssecret.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
@@ -92,7 +93,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		identity, _ = infra.GetAWSIdentity(ctx)
 	}
 
-	uc := &secret.DeleteUseCase{Client: client}
+	uc := &secret.DeleteUseCase{Client: adapter}
 
 	// Show current value before confirming
 	if !skipConfirm {
@@ -142,9 +143,8 @@ func action(ctx context.Context, cmd *cli.Command) error {
 // Run executes the delete command.
 func (r *Runner) Run(ctx context.Context, opts Options) error {
 	result, err := r.UseCase.Execute(ctx, secret.DeleteInput{
-		Name:           opts.Name,
-		Force:          opts.Force,
-		RecoveryWindow: int64(opts.RecoveryWindow),
+		Name:  opts.Name,
+		Force: opts.Force,
 	})
 	if err != nil {
 		return err
diff --git a/internal/cli/commands/secret/delete/delete_test.go b/internal/cli/commands/secret/delete/delete_test.go
index 82503815..122cf872 100644
--- a/internal/cli/commands/secret/delete/delete_test.go
+++ b/internal/cli/commands/secret/delete/delete_test.go
@@ -3,17 +3,16 @@ package delete_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 	"time"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/secret/delete"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -31,28 +30,24 @@ func TestCommand_Validation(t *testing.T) {
 }
 
 type mockClient struct {
-	//nolint:lll // mock function signature
-	getSecretValueFunc func(ctx context.Context, params *secretapi.GetSecretValueInput, optFns ...func(*secretapi.Options)) (*secretapi.GetSecretValueOutput, error)
-	//nolint:lll // mock function signature
-	deleteSecretFunc func(ctx context.Context, params *secretapi.DeleteSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.DeleteSecretOutput, error)
+	getSecretFunc    func(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error)
+	deleteSecretFunc func(ctx context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error)
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) GetSecretValue(ctx context.Context, params *secretapi.GetSecretValueInput, optFns ...func(*secretapi.Options)) (*secretapi.GetSecretValueOutput, error) {
-	if m.getSecretValueFunc != nil {
-		return m.getSecretValueFunc(ctx, params, optFns...)
+func (m *mockClient) GetSecret(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error) {
+	if m.getSecretFunc != nil {
+		return m.getSecretFunc(ctx, name, versionID, versionStage)
 	}
 
-	return nil, &secretapi.ResourceNotFoundException{Message: lo.ToPtr("not found")}
+	return nil, errors.New("not found")
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) DeleteSecret(ctx context.Context, params *secretapi.DeleteSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.DeleteSecretOutput, error) {
+func (m *mockClient) DeleteSecret(ctx context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error) {
 	if m.deleteSecretFunc != nil {
-		return m.deleteSecretFunc(ctx, params, optFns...)
+		return m.deleteSecretFunc(ctx, name, forceDelete)
 	}
 
-	return nil, fmt.Errorf("DeleteSecret not mocked")
+	return nil, errors.New("DeleteSecret not mocked")
 }
 
 func TestRun(t *testing.T) {
@@ -72,13 +67,12 @@ func TestRun(t *testing.T) {
 			name: "delete with recovery window",
 			opts: delete.Options{Name: "my-secret", Force: false, RecoveryWindow: 30},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				deleteSecretFunc: func(_ context.Context, params *secretapi.DeleteSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DeleteSecretOutput, error) {
-					assert.False(t, lo.FromPtr(params.ForceDeleteWithoutRecovery), "expected ForceDeleteWithoutRecovery to be false")
-					assert.Equal(t, int64(30), lo.FromPtr(params.RecoveryWindowInDays))
+				deleteSecretFunc: func(_ context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error) {
+					assert.Equal(t, "my-secret", name)
+					assert.False(t, forceDelete)
 
-					return &secretapi.DeleteSecretOutput{
-						Name:         lo.ToPtr("my-secret"),
+					return &model.SecretDeleteResult{
+						Name:         "my-secret",
 						DeletionDate: &deletionDate,
 					}, nil
 				},
@@ -93,12 +87,12 @@ func TestRun(t *testing.T) {
 			name: "force delete",
 			opts: delete.Options{Name: "my-secret", Force: true},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				deleteSecretFunc: func(_ context.Context, params *secretapi.DeleteSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DeleteSecretOutput, error) {
-					assert.True(t, lo.FromPtr(params.ForceDeleteWithoutRecovery), "expected ForceDeleteWithoutRecovery to be true")
+				deleteSecretFunc: func(_ context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error) {
+					assert.Equal(t, "my-secret", name)
+					assert.True(t, forceDelete)
 
-					return &secretapi.DeleteSecretOutput{
-						Name: lo.ToPtr("my-secret"),
+					return &model.SecretDeleteResult{
+						Name: "my-secret",
 					}, nil
 				},
 			},
@@ -111,8 +105,8 @@ func TestRun(t *testing.T) {
 			name: "error from AWS",
 			opts: delete.Options{Name: "my-secret"},
 			mock: &mockClient{
-				deleteSecretFunc: func(_ context.Context, _ *secretapi.DeleteSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DeleteSecretOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				deleteSecretFunc: func(_ context.Context, _ string, _ bool) (*model.SecretDeleteResult, error) {
+					return nil, errors.New("AWS error")
 				},
 			},
 			wantErr: true,
diff --git a/internal/cli/commands/secret/restore/restore.go b/internal/cli/commands/secret/restore/restore.go
index e47bd17a..bd46fac7 100644
--- a/internal/cli/commands/secret/restore/restore.go
+++ b/internal/cli/commands/secret/restore/restore.go
@@ -9,7 +9,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -48,13 +48,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("usage: suve secret restore <name>")
 	}
 
-	client, err := infra.NewSecretClient(ctx)
+	adapter, err := awssecret.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &secret.RestoreUseCase{Client: client},
+		UseCase: &secret.RestoreUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 		Stderr:  cmd.Root().ErrWriter,
 	}
diff --git a/internal/cli/commands/secret/restore/restore_test.go b/internal/cli/commands/secret/restore/restore_test.go
index 83abb54a..0a06e75e 100644
--- a/internal/cli/commands/secret/restore/restore_test.go
+++ b/internal/cli/commands/secret/restore/restore_test.go
@@ -3,16 +3,15 @@ package restore_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/secret/restore"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -30,17 +29,15 @@ func TestCommand_Validation(t *testing.T) {
 }
 
 type mockClient struct {
-	//nolint:lll // mock function signature
-	restoreSecretFunc func(ctx context.Context, params *secretapi.RestoreSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.RestoreSecretOutput, error)
+	restoreSecretFunc func(ctx context.Context, name string) (*model.SecretRestoreResult, error)
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) RestoreSecret(ctx context.Context, params *secretapi.RestoreSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.RestoreSecretOutput, error) {
+func (m *mockClient) RestoreSecret(ctx context.Context, name string) (*model.SecretRestoreResult, error) {
 	if m.restoreSecretFunc != nil {
-		return m.restoreSecretFunc(ctx, params, optFns...)
+		return m.restoreSecretFunc(ctx, name)
 	}
 
-	return nil, fmt.Errorf("RestoreSecret not mocked")
+	return nil, errors.New("RestoreSecret not mocked")
 }
 
 func TestRun(t *testing.T) {
@@ -56,12 +53,11 @@ func TestRun(t *testing.T) {
 			name: "restore secret",
 			opts: restore.Options{Name: "my-secret"},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				restoreSecretFunc: func(_ context.Context, params *secretapi.RestoreSecretInput, _ ...func(*secretapi.Options)) (*secretapi.RestoreSecretOutput, error) {
-					assert.Equal(t, "my-secret", lo.FromPtr(params.SecretId))
+				restoreSecretFunc: func(_ context.Context, name string) (*model.SecretRestoreResult, error) {
+					assert.Equal(t, "my-secret", name)
 
-					return &secretapi.RestoreSecretOutput{
-						Name: lo.ToPtr("my-secret"),
+					return &model.SecretRestoreResult{
+						Name: "my-secret",
 					}, nil
 				},
 			},
@@ -75,9 +71,8 @@ func TestRun(t *testing.T) {
 			name: "error from AWS",
 			opts: restore.Options{Name: "my-secret"},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				restoreSecretFunc: func(_ context.Context, _ *secretapi.RestoreSecretInput, _ ...func(*secretapi.Options)) (*secretapi.RestoreSecretOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				restoreSecretFunc: func(_ context.Context, _ string) (*model.SecretRestoreResult, error) {
+					return nil, errors.New("AWS error")
 				},
 			},
 			wantErr: true,
diff --git a/internal/cli/commands/secret/tag/tag.go b/internal/cli/commands/secret/tag/tag.go
index d9c91eb5..56b99622 100644
--- a/internal/cli/commands/secret/tag/tag.go
+++ b/internal/cli/commands/secret/tag/tag.go
@@ -10,7 +10,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -57,13 +57,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return err
 	}
 
-	client, err := infra.NewSecretClient(ctx)
+	adapter, err := awssecret.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &secret.TagUseCase{Client: client},
+		UseCase: &secret.TagUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 	}
 
diff --git a/internal/cli/commands/secret/tag/tag_test.go b/internal/cli/commands/secret/tag/tag_test.go
index 4a3e1da2..3079e3d6 100644
--- a/internal/cli/commands/secret/tag/tag_test.go
+++ b/internal/cli/commands/secret/tag/tag_test.go
@@ -6,11 +6,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/secret/tag"
 	"github.com/mpyw/suve/internal/usecase/secret"
@@ -56,42 +54,30 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
+// mockClient implements provider.SecretTagger for testing.
 type mockClient struct {
-	//nolint:lll // mock function signature
-	describeSecretFunc func(ctx context.Context, params *secretapi.DescribeSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error)
-	//nolint:lll // mock function signature
-	tagResourceFunc func(ctx context.Context, params *secretapi.TagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error)
-	//nolint:lll // mock function signature
-	untagResourceFunc func(ctx context.Context, params *secretapi.UntagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error)
+	addTagsFunc    func(ctx context.Context, name string, tags map[string]string) error
+	removeTagsFunc func(ctx context.Context, name string, keys []string) error
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) DescribeSecret(ctx context.Context, params *secretapi.DescribeSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error) {
-	if m.describeSecretFunc != nil {
-		return m.describeSecretFunc(ctx, params, optFns...)
-	}
-
-	return &secretapi.DescribeSecretOutput{
-		ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-	}, nil
+func (m *mockClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	return nil, nil //nolint:nilnil // mock implementation
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) TagResource(ctx context.Context, params *secretapi.TagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error) {
-	if m.tagResourceFunc != nil {
-		return m.tagResourceFunc(ctx, params, optFns...)
+func (m *mockClient) AddTags(ctx context.Context, name string, tags map[string]string) error {
+	if m.addTagsFunc != nil {
+		return m.addTagsFunc(ctx, name, tags)
 	}
 
-	return &secretapi.TagResourceOutput{}, nil
+	return nil
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) UntagResource(ctx context.Context, params *secretapi.UntagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error) {
-	if m.untagResourceFunc != nil {
-		return m.untagResourceFunc(ctx, params, optFns...)
+func (m *mockClient) RemoveTags(ctx context.Context, name string, keys []string) error {
+	if m.removeTagsFunc != nil {
+		return m.removeTagsFunc(ctx, name, keys)
 	}
 
-	return &secretapi.UntagResourceOutput{}, nil
+	return nil
 }
 
 func TestRun(t *testing.T) {
@@ -111,12 +97,11 @@ func TestRun(t *testing.T) {
 				Tags: map[string]string{"env": "prod"},
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				tagResourceFunc: func(_ context.Context, params *secretapi.TagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error) {
-					assert.Contains(t, lo.FromPtr(params.SecretId), "arn:aws:secretsmanager")
-					assert.Len(t, params.Tags, 1)
+				addTagsFunc: func(_ context.Context, name string, tags map[string]string) error {
+					assert.Equal(t, "my-secret", name)
+					assert.Len(t, tags, 1)
 
-					return &secretapi.TagResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -132,11 +117,10 @@ func TestRun(t *testing.T) {
 				Tags: map[string]string{"env": "prod", "team": "backend"},
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				tagResourceFunc: func(_ context.Context, params *secretapi.TagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error) {
-					assert.Len(t, params.Tags, 2)
+				addTagsFunc: func(_ context.Context, _ string, tags map[string]string) error {
+					assert.Len(t, tags, 2)
 
-					return &secretapi.TagResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -145,28 +129,14 @@ func TestRun(t *testing.T) {
 			},
 		},
 		{
-			name: "describe secret error",
-			opts: tag.Options{
-				Name: "my-secret",
-				Tags: map[string]string{"env": "prod"},
-			},
-			mock: &mockClient{
-				//nolint:lll // mock function signature
-				describeSecretFunc: func(_ context.Context, _ *secretapi.DescribeSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error) {
-					return nil, fmt.Errorf("AWS error")
-				},
-			},
-			wantErr: "failed to describe secret",
-		},
-		{
-			name: "tag resource error",
+			name: "add tags error",
 			opts: tag.Options{
 				Name: "my-secret",
 				Tags: map[string]string{"env": "prod"},
 			},
 			mock: &mockClient{
-				tagResourceFunc: func(_ context.Context, _ *secretapi.TagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				addTagsFunc: func(_ context.Context, _ string, _ map[string]string) error {
+					return fmt.Errorf("AWS error")
 				},
 			},
 			wantErr: "failed to add tags",
diff --git a/internal/cli/commands/secret/untag/untag.go b/internal/cli/commands/secret/untag/untag.go
index 35016938..c6a1f830 100644
--- a/internal/cli/commands/secret/untag/untag.go
+++ b/internal/cli/commands/secret/untag/untag.go
@@ -9,7 +9,7 @@ import (
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -50,13 +50,13 @@ func action(ctx context.Context, cmd *cli.Command) error {
 	name := cmd.Args().Get(0)
 	keys := cmd.Args().Slice()[1:]
 
-	client, err := infra.NewSecretClient(ctx)
+	adapter, err := awssecret.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
 	r := &Runner{
-		UseCase: &secret.TagUseCase{Client: client},
+		UseCase: &secret.TagUseCase{Client: adapter},
 		Stdout:  cmd.Root().Writer,
 	}
 
diff --git a/internal/cli/commands/secret/untag/untag_test.go b/internal/cli/commands/secret/untag/untag_test.go
index 1a213c13..09871d9b 100644
--- a/internal/cli/commands/secret/untag/untag_test.go
+++ b/internal/cli/commands/secret/untag/untag_test.go
@@ -6,11 +6,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/secret/untag"
 	"github.com/mpyw/suve/internal/usecase/secret"
@@ -38,42 +36,30 @@ func TestCommand_Validation(t *testing.T) {
 	})
 }
 
+// mockClient implements provider.SecretTagger for testing.
 type mockClient struct {
-	//nolint:lll // mock function signature
-	describeSecretFunc func(ctx context.Context, params *secretapi.DescribeSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error)
-	//nolint:lll // mock function signature
-	tagResourceFunc func(ctx context.Context, params *secretapi.TagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error)
-	//nolint:lll // mock function signature
-	untagResourceFunc func(ctx context.Context, params *secretapi.UntagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error)
+	addTagsFunc    func(ctx context.Context, name string, tags map[string]string) error
+	removeTagsFunc func(ctx context.Context, name string, keys []string) error
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) DescribeSecret(ctx context.Context, params *secretapi.DescribeSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error) {
-	if m.describeSecretFunc != nil {
-		return m.describeSecretFunc(ctx, params, optFns...)
-	}
-
-	return &secretapi.DescribeSecretOutput{
-		ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-	}, nil
+func (m *mockClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	return nil, nil //nolint:nilnil // mock implementation
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) TagResource(ctx context.Context, params *secretapi.TagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error) {
-	if m.tagResourceFunc != nil {
-		return m.tagResourceFunc(ctx, params, optFns...)
+func (m *mockClient) AddTags(ctx context.Context, name string, tags map[string]string) error {
+	if m.addTagsFunc != nil {
+		return m.addTagsFunc(ctx, name, tags)
 	}
 
-	return &secretapi.TagResourceOutput{}, nil
+	return nil
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) UntagResource(ctx context.Context, params *secretapi.UntagResourceInput, optFns ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error) {
-	if m.untagResourceFunc != nil {
-		return m.untagResourceFunc(ctx, params, optFns...)
+func (m *mockClient) RemoveTags(ctx context.Context, name string, keys []string) error {
+	if m.removeTagsFunc != nil {
+		return m.removeTagsFunc(ctx, name, keys)
 	}
 
-	return &secretapi.UntagResourceOutput{}, nil
+	return nil
 }
 
 func TestRun(t *testing.T) {
@@ -93,12 +79,11 @@ func TestRun(t *testing.T) {
 				Keys: []string{"env"},
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				untagResourceFunc: func(_ context.Context, params *secretapi.UntagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error) {
-					assert.Contains(t, lo.FromPtr(params.SecretId), "arn:aws:secretsmanager")
-					assert.Equal(t, []string{"env"}, params.TagKeys)
+				removeTagsFunc: func(_ context.Context, name string, keys []string) error {
+					assert.Equal(t, "my-secret", name)
+					assert.Equal(t, []string{"env"}, keys)
 
-					return &secretapi.UntagResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -114,11 +99,10 @@ func TestRun(t *testing.T) {
 				Keys: []string{"env", "team"},
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				untagResourceFunc: func(_ context.Context, params *secretapi.UntagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error) {
-					assert.Len(t, params.TagKeys, 2)
+				removeTagsFunc: func(_ context.Context, _ string, keys []string) error {
+					assert.Len(t, keys, 2)
 
-					return &secretapi.UntagResourceOutput{}, nil
+					return nil
 				},
 			},
 			check: func(t *testing.T, output string) {
@@ -127,29 +111,14 @@ func TestRun(t *testing.T) {
 			},
 		},
 		{
-			name: "describe secret error",
-			opts: untag.Options{
-				Name: "my-secret",
-				Keys: []string{"env"},
-			},
-			mock: &mockClient{
-				//nolint:lll // mock function signature
-				describeSecretFunc: func(_ context.Context, _ *secretapi.DescribeSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error) {
-					return nil, fmt.Errorf("AWS error")
-				},
-			},
-			wantErr: "failed to describe secret",
-		},
-		{
-			name: "untag resource error",
+			name: "remove tags error",
 			opts: untag.Options{
 				Name: "my-secret",
 				Keys: []string{"env"},
 			},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				untagResourceFunc: func(_ context.Context, _ *secretapi.UntagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error) {
-					return nil, fmt.Errorf("AWS error")
+				removeTagsFunc: func(_ context.Context, _ string, _ []string) error {
+					return fmt.Errorf("AWS error")
 				},
 			},
 			wantErr: "failed to remove tags",
diff --git a/internal/cli/commands/secret/update/update.go b/internal/cli/commands/secret/update/update.go
index 97991805..eab756b7 100644
--- a/internal/cli/commands/secret/update/update.go
+++ b/internal/cli/commands/secret/update/update.go
@@ -12,6 +12,7 @@ import (
 	"github.com/mpyw/suve/internal/cli/confirm"
 	"github.com/mpyw/suve/internal/cli/output"
 	"github.com/mpyw/suve/internal/infra"
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -69,12 +70,12 @@ func action(ctx context.Context, cmd *cli.Command) error {
 	name := cmd.Args().Get(0)
 	skipConfirm := cmd.Bool("yes")
 
-	client, err := infra.NewSecretClient(ctx)
+	adapter, err := awssecret.NewAdapter(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
-	uc := &secret.UpdateUseCase{Client: client}
+	uc := &secret.UpdateUseCase{Client: adapter}
 	newValue := cmd.Args().Get(1)
 
 	// Fetch current value and show diff before confirming
@@ -125,9 +126,8 @@ func action(ctx context.Context, cmd *cli.Command) error {
 // Run executes the update command.
 func (r *Runner) Run(ctx context.Context, opts Options) error {
 	result, err := r.UseCase.Execute(ctx, secret.UpdateInput{
-		Name:        opts.Name,
-		Value:       opts.Value,
-		Description: opts.Description,
+		Name:  opts.Name,
+		Value: opts.Value,
 	})
 	if err != nil {
 		return err
diff --git a/internal/cli/commands/secret/update/update_test.go b/internal/cli/commands/secret/update/update_test.go
index c6fe46d8..cf06d16b 100644
--- a/internal/cli/commands/secret/update/update_test.go
+++ b/internal/cli/commands/secret/update/update_test.go
@@ -3,16 +3,15 @@ package update_test
 import (
 	"bytes"
 	"context"
-	"fmt"
+	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	"github.com/mpyw/suve/internal/cli/commands/secret/update"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
@@ -39,41 +38,27 @@ func TestCommand_Validation(t *testing.T) {
 }
 
 type mockClient struct {
-	//nolint:lll // mock function signature
-	getSecretValueFunc func(ctx context.Context, params *secretapi.GetSecretValueInput, optFns ...func(*secretapi.Options)) (*secretapi.GetSecretValueOutput, error)
-	//nolint:lll // mock function signature
-	putSecretValueFunc func(ctx context.Context, params *secretapi.PutSecretValueInput, optFns ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error)
-	//nolint:lll // mock function signature
-	updateSecretFunc func(ctx context.Context, params *secretapi.UpdateSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.UpdateSecretOutput, error)
+	getSecretFunc    func(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error)
+	updateSecretFunc func(ctx context.Context, name string, value string) (*model.SecretWriteResult, error)
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) GetSecretValue(ctx context.Context, params *secretapi.GetSecretValueInput, optFns ...func(*secretapi.Options)) (*secretapi.GetSecretValueOutput, error) {
-	if m.getSecretValueFunc != nil {
-		return m.getSecretValueFunc(ctx, params, optFns...)
+func (m *mockClient) GetSecret(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error) {
+	if m.getSecretFunc != nil {
+		return m.getSecretFunc(ctx, name, versionID, versionStage)
 	}
 
-	return &secretapi.GetSecretValueOutput{
-		ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+	return &model.Secret{
+		Name:  name,
+		Value: "old-value",
 	}, nil
 }
 
-//nolint:lll // mock function signature
-func (m *mockClient) PutSecretValue(ctx context.Context, params *secretapi.PutSecretValueInput, optFns ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error) {
-	if m.putSecretValueFunc != nil {
-		return m.putSecretValueFunc(ctx, params, optFns...)
-	}
-
-	return nil, fmt.Errorf("PutSecretValue not mocked")
-}
-
-//nolint:lll // mock function signature
-func (m *mockClient) UpdateSecret(ctx context.Context, params *secretapi.UpdateSecretInput, optFns ...func(*secretapi.Options)) (*secretapi.UpdateSecretOutput, error) {
+func (m *mockClient) UpdateSecret(ctx context.Context, name string, value string) (*model.SecretWriteResult, error) {
 	if m.updateSecretFunc != nil {
-		return m.updateSecretFunc(ctx, params, optFns...)
+		return m.updateSecretFunc(ctx, name, value)
 	}
 
-	return &secretapi.UpdateSecretOutput{}, nil
+	return nil, errors.New("UpdateSecret not mocked")
 }
 
 func TestRun(t *testing.T) {
@@ -89,15 +74,14 @@ func TestRun(t *testing.T) {
 			name: "update secret",
 			opts: update.Options{Name: "my-secret", Value: "new-value"},
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				putSecretValueFunc: func(_ context.Context, params *secretapi.PutSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error) {
-					assert.Equal(t, "my-secret", lo.FromPtr(params.SecretId))
-					assert.Equal(t, "new-value", lo.FromPtr(params.SecretString))
-
-					return &secretapi.PutSecretValueOutput{
-						Name:      lo.ToPtr("my-secret"),
-						VersionId: lo.ToPtr("new-version-id"),
-						ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+				updateSecretFunc: func(_ context.Context, name string, value string) (*model.SecretWriteResult, error) {
+					assert.Equal(t, "my-secret", name)
+					assert.Equal(t, "new-value", value)
+
+					return &model.SecretWriteResult{
+						Name:    "my-secret",
+						Version: "new-version-id",
+						ARN:     "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 					}, nil
 				},
 			},
@@ -108,57 +92,12 @@ func TestRun(t *testing.T) {
 			},
 		},
 		{
-			name: "update secret with description",
-			opts: update.Options{Name: "my-secret", Value: "new-value", Description: "updated description"},
-			mock: &mockClient{
-				putSecretValueFunc: func(_ context.Context, _ *secretapi.PutSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error) { //nolint:lll
-					return &secretapi.PutSecretValueOutput{
-						Name:      lo.ToPtr("my-secret"),
-						VersionId: lo.ToPtr("new-version-id"),
-						ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-					}, nil
-				},
-				//nolint:lll // mock function signature
-				updateSecretFunc: func(_ context.Context, params *secretapi.UpdateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.UpdateSecretOutput, error) {
-					assert.Equal(t, "my-secret", lo.FromPtr(params.SecretId))
-					assert.Equal(t, "updated description", lo.FromPtr(params.Description))
-
-					return &secretapi.UpdateSecretOutput{
-						ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-					}, nil
-				},
-			},
-			check: func(t *testing.T, output string) {
-				t.Helper()
-				assert.Contains(t, output, "Updated secret")
-			},
-		},
-		{
-			name:    "put secret value error",
+			name:    "update secret error",
 			opts:    update.Options{Name: "my-secret", Value: "new-value"},
-			wantErr: "failed to update secret value",
-			mock: &mockClient{
-				//nolint:lll // mock function signature
-				putSecretValueFunc: func(_ context.Context, _ *secretapi.PutSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error) {
-					return nil, fmt.Errorf("AWS error")
-				},
-			},
-		},
-		{
-			name:    "update description error",
-			opts:    update.Options{Name: "my-secret", Value: "new-value", Description: "desc"},
-			wantErr: "failed to update secret description",
+			wantErr: "failed to update secret",
 			mock: &mockClient{
-				//nolint:lll // mock function signature
-				putSecretValueFunc: func(_ context.Context, _ *secretapi.PutSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error) {
-					return &secretapi.PutSecretValueOutput{
-						Name:      lo.ToPtr("my-secret"),
-						VersionId: lo.ToPtr("new-version-id"),
-						ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-					}, nil
-				},
-				updateSecretFunc: func(_ context.Context, _ *secretapi.UpdateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.UpdateSecretOutput, error) {
-					return nil, fmt.Errorf("description update failed")
+				updateSecretFunc: func(_ context.Context, _ string, _ string) (*model.SecretWriteResult, error) {
+					return nil, errors.New("AWS error")
 				},
 			},
 		},
diff --git a/internal/cli/commands/stage/agent/command.go b/internal/cli/commands/stage/agent/command.go
index 68d1e6d0..79da9969 100644
--- a/internal/cli/commands/stage/agent/command.go
+++ b/internal/cli/commands/stage/agent/command.go
@@ -3,12 +3,10 @@ package agent
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/urfave/cli/v3"
 
 	"github.com/mpyw/suve/internal/cli/output"
-	"github.com/mpyw/suve/internal/infra"
 	agentcfg "github.com/mpyw/suve/internal/staging/store/agent"
 	"github.com/mpyw/suve/internal/staging/store/agent/daemon"
 )
@@ -50,14 +48,6 @@ The daemon will automatically shut down when all staged changes are cleared.
 
 Set ` + agentcfg.EnvDaemonManualMode + `=1 to enable manual mode (disables auto-start and auto-shutdown).`,
 		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:  "account",
-				Usage: "AWS account ID (required, usually passed automatically)",
-			},
-			&cli.StringFlag{
-				Name:  "region",
-				Usage: "AWS region (required, usually passed automatically)",
-			},
 			&cli.BoolFlag{
 				Name:   "foreground",
 				Usage:  "Run daemon in foreground (used internally by spawner)",
@@ -65,30 +55,17 @@ Set ` + agentcfg.EnvDaemonManualMode + `=1 to enable manual mode (disables auto-
 			},
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			accountID := cmd.String("account")
-			region := cmd.String("region")
 			foreground := cmd.Bool("foreground")
 
-			// If not passed via flags, get from AWS identity
-			if accountID == "" || region == "" {
-				identity, err := infra.GetAWSIdentity(ctx)
-				if err != nil {
-					return fmt.Errorf("failed to get AWS identity: %w", err)
-				}
-
-				accountID = identity.AccountID
-				region = identity.Region
-			}
-
 			// Foreground mode: run daemon directly (used by spawner)
 			if foreground {
-				runner := daemon.NewRunner(accountID, region, agentcfg.DaemonOptions()...)
+				runner := daemon.NewRunner(agentcfg.DaemonOptions()...)
 
 				return runner.Run(ctx)
 			}
 
 			// Background mode: spawn daemon via launcher
-			launcher := daemon.NewLauncher(accountID, region)
+			launcher := daemon.NewLauncher()
 
 			// Check if already running
 			if err := launcher.Ping(ctx); err == nil {
@@ -118,12 +95,7 @@ func stopCommand() *cli.Command {
 This command sends a shutdown signal to the running daemon.
 Note: Any staged changes in memory will be lost unless persisted first.`,
 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			identity, err := infra.GetAWSIdentity(ctx)
-			if err != nil {
-				return fmt.Errorf("failed to get AWS identity: %w", err)
-			}
-
-			launcher := daemon.NewLauncher(identity.AccountID, identity.Region)
+			launcher := daemon.NewLauncher()
 
 			// Check if agent is running first
 			if err := launcher.Ping(ctx); err != nil {
diff --git a/internal/cli/commands/stage/agent/command_internal_test.go b/internal/cli/commands/stage/agent/command_internal_test.go
index a1abd0d7..fff34d6f 100644
--- a/internal/cli/commands/stage/agent/command_internal_test.go
+++ b/internal/cli/commands/stage/agent/command_internal_test.go
@@ -64,8 +64,6 @@ func TestStartCommand_HasExpectedFlags(t *testing.T) {
 		return ""
 	})
 
-	assert.Contains(t, flagNames, "account")
-	assert.Contains(t, flagNames, "region")
 	assert.Contains(t, flagNames, "foreground")
 }
 
diff --git a/internal/cli/commands/stage/apply/apply.go b/internal/cli/commands/stage/apply/apply.go
index 94aee164..8bc1c1e3 100644
--- a/internal/cli/commands/stage/apply/apply.go
+++ b/internal/cli/commands/stage/apply/apply.go
@@ -80,7 +80,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("failed to get AWS identity: %w", err)
 	}
 
-	store := agent.NewStore(identity.AccountID, identity.Region)
+	store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 	result, err := lifecycle.ExecuteRead0(ctx, store, lifecycle.CmdApply, func() error {
 		// Check if there are any staged changes
diff --git a/internal/cli/commands/stage/diff/diff.go b/internal/cli/commands/stage/diff/diff.go
index b3b4be91..ae52984c 100644
--- a/internal/cli/commands/stage/diff/diff.go
+++ b/internal/cli/commands/stage/diff/diff.go
@@ -18,7 +18,10 @@ import (
 	"github.com/mpyw/suve/internal/infra"
 	"github.com/mpyw/suve/internal/jsonutil"
 	"github.com/mpyw/suve/internal/maputil"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/parallel"
+	"github.com/mpyw/suve/internal/provider"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/staging"
 	"github.com/mpyw/suve/internal/staging/store"
 	"github.com/mpyw/suve/internal/staging/store/agent"
@@ -44,6 +47,7 @@ type SecretClient interface {
 // Runner executes the diff command.
 type Runner struct {
 	ParamClient  ParamClient
+	ParamReader  provider.ParameterReader // for version resolution
 	SecretClient SecretClient
 	Store        store.ReadWriteOperator
 	Stdout       io.Writer
@@ -93,7 +97,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("failed to get AWS identity: %w", err)
 	}
 
-	store := agent.NewStore(identity.AccountID, identity.Region)
+	store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 	opts := Options{
 		ParseJSON: cmd.Bool("parse-json"),
@@ -144,6 +148,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 			}
 
 			r.ParamClient = paramClient
+			r.ParamReader = awsparam.New(paramClient)
 		}
 
 		if hasSecret {
@@ -193,10 +198,10 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	paramResults := parallel.ExecuteMap(
 		ctx,
 		paramEntries,
-		func(ctx context.Context, name string, _ staging.Entry) (*paramapi.ParameterHistory, error) {
+		func(ctx context.Context, name string, _ staging.Entry) (*model.Parameter, error) {
 			spec := &paramversion.Spec{Name: name}
 
-			return paramversion.GetParameterWithVersion(ctx, r.ParamClient, spec)
+			return paramversion.GetParameterWithVersion(ctx, r.ParamReader, spec)
 		},
 	)
 
@@ -353,8 +358,8 @@ func (r *Runner) Run(ctx context.Context, opts Options) error {
 	return nil
 }
 
-func (r *Runner) outputParamDiff(ctx context.Context, opts Options, name string, entry staging.Entry, param *paramapi.ParameterHistory) error {
-	awsValue := lo.FromPtr(param.Value)
+func (r *Runner) outputParamDiff(ctx context.Context, opts Options, name string, entry staging.Entry, param *model.Parameter) error {
+	awsValue := param.Value
 	stagedValue := lo.FromPtr(entry.Value)
 
 	// For delete operation, staged value is empty
@@ -378,7 +383,7 @@ func (r *Runner) outputParamDiff(ctx context.Context, opts Options, name string,
 		return nil
 	}
 
-	label1 := fmt.Sprintf("%s#%d (AWS)", name, param.Version)
+	label1 := fmt.Sprintf("%s#%s (AWS)", name, param.Version)
 	label2 := fmt.Sprintf(lo.Ternary(
 		entry.Operation == staging.OperationDelete,
 		"%s (staged for deletion)",
diff --git a/internal/cli/commands/stage/diff/diff_test.go b/internal/cli/commands/stage/diff/diff_test.go
index 5e35525b..803a3fcf 100644
--- a/internal/cli/commands/stage/diff/diff_test.go
+++ b/internal/cli/commands/stage/diff/diff_test.go
@@ -17,6 +17,7 @@ import (
 	appcli "github.com/mpyw/suve/internal/cli/commands"
 	stagediff "github.com/mpyw/suve/internal/cli/commands/stage/diff"
 	"github.com/mpyw/suve/internal/maputil"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/staging"
 	"github.com/mpyw/suve/internal/staging/store/testutil"
 )
@@ -131,6 +132,59 @@ func (m *mockSecretClient) DescribeSecret(
 	return &secretapi.DescribeSecretOutput{}, nil
 }
 
+// paramReaderMock implements provider.ParameterReader for testing.
+type paramReaderMock struct {
+	getParameterFunc        func(ctx context.Context, name string, version string) (*model.Parameter, error)
+	getParameterHistoryFunc func(ctx context.Context, name string) (*model.ParameterHistory, error)
+}
+
+func (m *paramReaderMock) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
+	if m.getParameterFunc != nil {
+		return m.getParameterFunc(ctx, name, version)
+	}
+
+	return nil, fmt.Errorf("GetParameter not mocked")
+}
+
+func (m *paramReaderMock) GetParameterHistory(ctx context.Context, name string) (*model.ParameterHistory, error) {
+	if m.getParameterHistoryFunc != nil {
+		return m.getParameterHistoryFunc(ctx, name)
+	}
+
+	return nil, fmt.Errorf("GetParameterHistory not mocked")
+}
+
+func (m *paramReaderMock) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	return nil, fmt.Errorf("ListParameters not mocked")
+}
+
+// newDefaultParamReader creates a paramReaderMock that returns a test value based on the name.
+func newDefaultParamReader() *paramReaderMock {
+	return newParamReaderWithValue("aws-value")
+}
+
+// newParamReaderWithValue creates a paramReaderMock that returns the specified value.
+func newParamReaderWithValue(value string) *paramReaderMock {
+	return &paramReaderMock{
+		getParameterFunc: func(_ context.Context, name string, _ string) (*model.Parameter, error) {
+			return &model.Parameter{
+				Name:    name,
+				Value:   value,
+				Version: "1",
+			}, nil
+		},
+	}
+}
+
+// newParamReaderWithError creates a paramReaderMock that returns an error.
+func newParamReaderWithError(err error) *paramReaderMock {
+	return &paramReaderMock{
+		getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+			return nil, err
+		},
+	}
+}
+
 func TestCommand_Validation(t *testing.T) {
 	t.Parallel()
 
@@ -205,6 +259,7 @@ func TestRun_ParamOnly(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithValue("old-value"),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -308,6 +363,7 @@ func TestRun_BothServices(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient:  paramMock,
+		ParamReader:  newParamReaderWithValue("param-old"),
 		SecretClient: secretMock,
 		Store:        store,
 		Stdout:       &stdout,
@@ -371,6 +427,7 @@ func TestRun_DeleteOperations(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient:  paramMock,
+		ParamReader:  newParamReaderWithValue("existing-value"),
 		SecretClient: secretMock,
 		Store:        store,
 		Stdout:       &stdout,
@@ -414,6 +471,7 @@ func TestRun_IdenticalValues(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithValue("same-value"), // same as staged value
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -458,6 +516,7 @@ func TestRun_ParseJSON(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newDefaultParamReader(),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -493,6 +552,7 @@ func TestRun_ParamUpdateAutoUnstageWhenDeleted(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithError(fmt.Errorf("parameter not found")),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -699,6 +759,7 @@ func TestRun_ParamCreateOperation(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithError(fmt.Errorf("parameter not found")),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -775,16 +836,13 @@ func TestRun_CreateWithParseJSON(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	paramMock := &mockParamClient{
-		getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			return nil, fmt.Errorf("parameter not found")
-		},
-	}
+	paramMock := &mockParamClient{}
 
 	var stdout, stderr bytes.Buffer
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithError(fmt.Errorf("parameter not found")),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -810,16 +868,13 @@ func TestRun_DeleteAutoUnstageWhenAlreadyDeleted(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	paramMock := &mockParamClient{
-		getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			return nil, fmt.Errorf("parameter not found")
-		},
-	}
+	paramMock := &mockParamClient{}
 
 	var stdout, stderr bytes.Buffer
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithError(fmt.Errorf("parameter not found")),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -902,6 +957,7 @@ func TestRun_MetadataWithDescription(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newDefaultParamReader(),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -948,6 +1004,7 @@ func TestRun_MetadataWithTags(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newDefaultParamReader(),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -1133,6 +1190,7 @@ func TestRun_BothEntriesAndTags(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newParamReaderWithValue("old-value"),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -1182,6 +1240,7 @@ func TestRun_ParamTagDiffWithValues(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newDefaultParamReader(),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -1265,6 +1324,7 @@ func TestRun_ParamTagDiffAPIError(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newDefaultParamReader(),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
@@ -1348,6 +1408,7 @@ func TestRun_TagDiffWithMissingValue(t *testing.T) {
 
 	r := &stagediff.Runner{
 		ParamClient: paramMock,
+		ParamReader: newDefaultParamReader(),
 		Store:       store,
 		Stdout:      &stdout,
 		Stderr:      &stderr,
diff --git a/internal/cli/commands/stage/reset/reset.go b/internal/cli/commands/stage/reset/reset.go
index d6e07547..91c5a3a8 100644
--- a/internal/cli/commands/stage/reset/reset.go
+++ b/internal/cli/commands/stage/reset/reset.go
@@ -60,7 +60,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("failed to get AWS identity: %w", err)
 	}
 
-	store := agent.NewStore(identity.AccountID, identity.Region)
+	store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 	result, err := lifecycle.ExecuteRead0(ctx, store, lifecycle.CmdReset, func() error {
 		r := &Runner{
diff --git a/internal/cli/commands/stage/status/status.go b/internal/cli/commands/stage/status/status.go
index 14eefcbc..2c50f9c6 100644
--- a/internal/cli/commands/stage/status/status.go
+++ b/internal/cli/commands/stage/status/status.go
@@ -60,7 +60,7 @@ func action(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("failed to get AWS identity: %w", err)
 	}
 
-	store := agent.NewStore(identity.AccountID, identity.Region)
+	store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 	opts := Options{
 		Verbose: cmd.Bool("verbose"),
diff --git a/internal/gui/app.go b/internal/gui/app.go
index 253e200e..3dc48661 100644
--- a/internal/gui/app.go
+++ b/internal/gui/app.go
@@ -135,7 +135,7 @@ func (a *App) getAgentStore() (store.AgentStore, error) {
 		return nil, err
 	}
 
-	s := agent.NewStore(identity.AccountID, identity.Region)
+	s := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 	a.stagingStore = s
 
 	return s, nil
diff --git a/internal/gui/param.go b/internal/gui/param.go
index 6b7ca081..6e23eb0c 100644
--- a/internal/gui/param.go
+++ b/internal/gui/param.go
@@ -4,12 +4,19 @@ package gui
 
 import (
 	"errors"
+	"strconv"
 
 	"github.com/mpyw/suve/internal/api/paramapi"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
+// parseInt64 converts a string to int64, returning 0 on error.
+func parseInt64(s string) (int64, error) {
+	return strconv.ParseInt(s, 10, 64)
+}
+
 // =============================================================================
 // Param Types
 // =============================================================================
@@ -123,28 +130,30 @@ func (a *App) ParamShow(specStr string) (*ParamShowResult, error) {
 		return nil, err
 	}
 
-	client, err := a.getParamClient()
+	adapter, err := awsparam.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &param.ShowUseCase{Client: client}
+	uc := &param.ShowUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, param.ShowInput{Spec: spec})
 	if err != nil {
 		return nil, err
 	}
 
+	version, _ := parseInt64(result.Version)
+
 	r := &ParamShowResult{
 		Name:        result.Name,
 		Value:       result.Value,
-		Version:     result.Version,
-		Type:        string(result.Type),
+		Version:     version,
+		Type:        result.Type,
 		Description: result.Description,
 		Tags:        make([]ParamShowTag, 0, len(result.Tags)),
 	}
-	if result.LastModified != nil {
-		r.LastModified = result.LastModified.Format("2006-01-02T15:04:05Z07:00")
+	if result.UpdatedAt != nil {
+		r.LastModified = result.UpdatedAt.Format("2006-01-02T15:04:05Z07:00")
 	}
 
 	for _, tag := range result.Tags {
@@ -159,12 +168,12 @@ func (a *App) ParamShow(specStr string) (*ParamShowResult, error) {
 
 // ParamLog shows parameter version history.
 func (a *App) ParamLog(name string, maxResults int32) (*ParamLogResult, error) {
-	client, err := a.getParamClient()
+	adapter, err := awsparam.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &param.LogUseCase{Client: client}
+	uc := &param.LogUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, param.LogInput{
 		Name:       name,
@@ -176,14 +185,16 @@ func (a *App) ParamLog(name string, maxResults int32) (*ParamLogResult, error) {
 
 	entries := make([]ParamLogEntry, len(result.Entries))
 	for i, e := range result.Entries {
+		version, _ := parseInt64(e.Version)
+
 		entry := ParamLogEntry{
-			Version:   e.Version,
+			Version:   version,
 			Value:     e.Value,
-			Type:      string(e.Type),
+			Type:      e.Type,
 			IsCurrent: e.IsCurrent,
 		}
-		if e.LastModified != nil {
-			entry.LastModified = e.LastModified.Format("2006-01-02T15:04:05Z07:00")
+		if e.UpdatedAt != nil {
+			entry.LastModified = e.UpdatedAt.Format("2006-01-02T15:04:05Z07:00")
 		}
 
 		entries[i] = entry
@@ -209,7 +220,9 @@ func (a *App) ParamDiff(spec1Str, spec2Str string) (*ParamDiffResult, error) {
 		return nil, err
 	}
 
-	uc := &param.DiffUseCase{Client: client}
+	// Create adapter that implements provider.ParameterReader
+	adapter := awsparam.New(client)
+	uc := &param.DiffUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, param.DiffInput{
 		Spec1: spec1,
@@ -230,18 +243,18 @@ func (a *App) ParamDiff(spec1Str, spec2Str string) (*ParamDiffResult, error) {
 // ParamSet creates or updates a parameter.
 // It first tries to create the parameter; if it already exists, it updates instead.
 func (a *App) ParamSet(name, value, paramType string) (*ParamSetResult, error) {
-	client, err := a.getParamClient()
+	adapter, err := awsparam.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
 	// Try to create first
-	createUC := &param.CreateUseCase{Client: client}
+	createUC := &param.CreateUseCase{Client: adapter}
 
 	createResult, err := createUC.Execute(a.ctx, param.CreateInput{
 		Name:  name,
 		Value: value,
-		Type:  paramapi.ParameterType(paramType),
+		Type:  paramType,
 	})
 	if err == nil {
 		return &ParamSetResult{
@@ -252,13 +265,14 @@ func (a *App) ParamSet(name, value, paramType string) (*ParamSetResult, error) {
 	}
 
 	// If parameter already exists, update it
-	if pae := (*paramapi.ParameterAlreadyExists)(nil); errors.As(err, &pae) {
-		updateUC := &param.UpdateUseCase{Client: client}
+	var pae *paramapi.ParameterAlreadyExists
+	if errors.As(err, &pae) {
+		updateUC := &param.UpdateUseCase{Client: adapter}
 
 		updateResult, err := updateUC.Execute(a.ctx, param.UpdateInput{
 			Name:  name,
 			Value: value,
-			Type:  paramapi.ParameterType(paramType),
+			Type:  paramType,
 		})
 		if err != nil {
 			return nil, err
@@ -276,12 +290,12 @@ func (a *App) ParamSet(name, value, paramType string) (*ParamSetResult, error) {
 
 // ParamDelete deletes a parameter.
 func (a *App) ParamDelete(name string) (*ParamDeleteResult, error) {
-	client, err := a.getParamClient()
+	adapter, err := awsparam.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &param.DeleteUseCase{Client: client}
+	uc := &param.DeleteUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, param.DeleteInput{Name: name})
 	if err != nil {
@@ -293,12 +307,12 @@ func (a *App) ParamDelete(name string) (*ParamDeleteResult, error) {
 
 // ParamAddTag adds or updates a tag on a parameter.
 func (a *App) ParamAddTag(name, key, value string) error {
-	client, err := a.getParamClient()
+	adapter, err := awsparam.NewAdapter(a.ctx)
 	if err != nil {
 		return err
 	}
 
-	uc := &param.TagUseCase{Client: client}
+	uc := &param.TagUseCase{Client: adapter}
 
 	return uc.Execute(a.ctx, param.TagInput{
 		Name: name,
@@ -308,12 +322,12 @@ func (a *App) ParamAddTag(name, key, value string) error {
 
 // ParamRemoveTag removes a tag from a parameter.
 func (a *App) ParamRemoveTag(name, key string) error {
-	client, err := a.getParamClient()
+	adapter, err := awsparam.NewAdapter(a.ctx)
 	if err != nil {
 		return err
 	}
 
-	uc := &param.TagUseCase{Client: client}
+	uc := &param.TagUseCase{Client: adapter}
 
 	return uc.Execute(a.ctx, param.TagInput{
 		Name:   name,
diff --git a/internal/gui/secret.go b/internal/gui/secret.go
index 810ad851..dddbec99 100644
--- a/internal/gui/secret.go
+++ b/internal/gui/secret.go
@@ -3,6 +3,7 @@
 package gui
 
 import (
+	awssecret "github.com/mpyw/suve/internal/provider/aws/secret"
 	"github.com/mpyw/suve/internal/usecase/secret"
 	"github.com/mpyw/suve/internal/version/secretversion"
 )
@@ -207,12 +208,12 @@ func (a *App) SecretLog(name string, maxResults int32) (*SecretLogResult, error)
 
 // SecretCreate creates a new secret.
 func (a *App) SecretCreate(name, value string) (*SecretCreateResult, error) {
-	client, err := a.getSecretClient()
+	adapter, err := awssecret.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &secret.CreateUseCase{Client: client}
+	uc := &secret.CreateUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, secret.CreateInput{
 		Name:  name,
@@ -231,12 +232,12 @@ func (a *App) SecretCreate(name, value string) (*SecretCreateResult, error) {
 
 // SecretUpdate updates an existing secret.
 func (a *App) SecretUpdate(name, value string) (*SecretUpdateResult, error) {
-	client, err := a.getSecretClient()
+	adapter, err := awssecret.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &secret.UpdateUseCase{Client: client}
+	uc := &secret.UpdateUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, secret.UpdateInput{
 		Name:  name,
@@ -255,12 +256,12 @@ func (a *App) SecretUpdate(name, value string) (*SecretUpdateResult, error) {
 
 // SecretDelete deletes a secret (with recovery window).
 func (a *App) SecretDelete(name string, force bool) (*SecretDeleteResult, error) {
-	client, err := a.getSecretClient()
+	adapter, err := awssecret.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &secret.DeleteUseCase{Client: client}
+	uc := &secret.DeleteUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, secret.DeleteInput{
 		Name:  name,
@@ -283,12 +284,12 @@ func (a *App) SecretDelete(name string, force bool) (*SecretDeleteResult, error)
 
 // SecretAddTag adds or updates a tag on a secret.
 func (a *App) SecretAddTag(name, key, value string) error {
-	client, err := a.getSecretClient()
+	adapter, err := awssecret.NewAdapter(a.ctx)
 	if err != nil {
 		return err
 	}
 
-	uc := &secret.TagUseCase{Client: client}
+	uc := &secret.TagUseCase{Client: adapter}
 
 	return uc.Execute(a.ctx, secret.TagInput{
 		Name: name,
@@ -298,12 +299,12 @@ func (a *App) SecretAddTag(name, key, value string) error {
 
 // SecretRemoveTag removes a tag from a secret.
 func (a *App) SecretRemoveTag(name, key string) error {
-	client, err := a.getSecretClient()
+	adapter, err := awssecret.NewAdapter(a.ctx)
 	if err != nil {
 		return err
 	}
 
-	uc := &secret.TagUseCase{Client: client}
+	uc := &secret.TagUseCase{Client: adapter}
 
 	return uc.Execute(a.ctx, secret.TagInput{
 		Name:   name,
@@ -350,12 +351,12 @@ func (a *App) SecretDiff(spec1Str, spec2Str string) (*SecretDiffResult, error) {
 
 // SecretRestore restores a deleted secret.
 func (a *App) SecretRestore(name string) (*SecretRestoreResult, error) {
-	client, err := a.getSecretClient()
+	adapter, err := awssecret.NewAdapter(a.ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	uc := &secret.RestoreUseCase{Client: client}
+	uc := &secret.RestoreUseCase{Client: adapter}
 
 	result, err := uc.Execute(a.ctx, secret.RestoreInput{Name: name})
 	if err != nil {
diff --git a/internal/gui/staging.go b/internal/gui/staging.go
index 08866033..1befe3f1 100644
--- a/internal/gui/staging.go
+++ b/internal/gui/staging.go
@@ -701,7 +701,7 @@ func (a *App) StagingFileStatus() (*StagingFileStatusResult, error) {
 		return nil, err
 	}
 
-	fileStore, err := file.NewStore(identity.AccountID, identity.Region)
+	fileStore, err := file.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 	if err != nil {
 		return nil, err
 	}
@@ -736,7 +736,7 @@ func (a *App) StagingDrain(service string, passphrase string, keep bool, mode st
 		return nil, err
 	}
 
-	fileStore, err := file.NewStoreWithPassphrase(identity.AccountID, identity.Region, passphrase)
+	fileStore, err := file.NewStoreWithPassphrase(staging.AWSScope(identity.AccountID, identity.Region), passphrase)
 	if err != nil {
 		return nil, err
 	}
@@ -789,7 +789,7 @@ func (a *App) StagingPersist(service string, passphrase string, keep bool, mode
 		return nil, err
 	}
 
-	fileStore, err := file.NewStoreWithPassphrase(identity.AccountID, identity.Region, passphrase)
+	fileStore, err := file.NewStoreWithPassphrase(staging.AWSScope(identity.AccountID, identity.Region), passphrase)
 	if err != nil {
 		return nil, err
 	}
@@ -845,7 +845,7 @@ func (a *App) StagingDrop() (*StagingDropResult, error) {
 		return nil, err
 	}
 
-	fileStore, err := file.NewStore(identity.AccountID, identity.Region)
+	fileStore, err := file.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/gui/staging_integration_internal_test.go b/internal/gui/staging_integration_internal_test.go
index 6b4f6718..21528311 100644
--- a/internal/gui/staging_integration_internal_test.go
+++ b/internal/gui/staging_integration_internal_test.go
@@ -524,10 +524,9 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "stage.json")
 
 		// Create file store
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 
 		// Create state with entries
 		state := staging.NewEmptyState()
@@ -560,10 +559,9 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "stage.json")
 
 		// Create file store with passphrase
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 		fileStore.SetPassphrase("test-passphrase")
 
 		// Create state
@@ -588,7 +586,7 @@ func TestFileDrainPersist(t *testing.T) {
 		assert.Equal(t, "secret-value", lo.FromPtr(drainedState.Entries[staging.ServiceSecret]["my-secret"].Value))
 
 		// Drain with wrong passphrase should fail
-		wrongStore := file.NewStoreWithPath(localFilePath)
+		wrongStore := file.NewStoreWithDir(localTmpDir)
 		wrongStore.SetPassphrase("wrong-passphrase")
 		_, err = wrongStore.Drain(context.Background(), "", true)
 		require.Error(t, err)
@@ -599,9 +597,8 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "stage.json")
 
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 
 		// Create and write state
 		state := staging.NewEmptyState()
@@ -628,9 +625,8 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "stage.json")
 
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 
 		// Create state with tags only (no entries)
 		state := staging.NewEmptyState()
@@ -653,9 +649,8 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "stage.json")
 
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 
 		// Create state with both services
 		state := staging.NewEmptyState()
@@ -682,9 +677,8 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "nonexistent.json")
 
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 
 		exists, err := fileStore.Exists()
 		require.NoError(t, err)
@@ -701,9 +695,8 @@ func TestFileDrainPersist(t *testing.T) {
 		t.Parallel()
 
 		localTmpDir := t.TempDir()
-		localFilePath := filepath.Join(localTmpDir, "stage.json")
 
-		fileStore := file.NewStoreWithPath(localFilePath)
+		fileStore := file.NewStoreWithDir(localTmpDir)
 
 		// Write first state
 		state1 := staging.NewEmptyState()
diff --git a/internal/model/parameter.go b/internal/model/parameter.go
new file mode 100644
index 00000000..28a8de29
--- /dev/null
+++ b/internal/model/parameter.go
@@ -0,0 +1,188 @@
+// Package model provides provider-agnostic domain types for parameters and secrets.
+package model
+
+import "time"
+
+// ============================================================================
+// Generic Parameter (Provider Layer)
+// ============================================================================
+
+// TypedParameter is a parameter with provider-specific metadata.
+// This type is used at the Provider layer for type-safe access to metadata.
+type TypedParameter[M any] struct {
+	Name        string
+	Value       string
+	Version     string
+	Description string
+	CreatedAt   *time.Time
+	UpdatedAt   *time.Time
+	Tags        map[string]string
+	Metadata    M
+}
+
+// ToBase converts to a UseCase layer type.
+func (p *TypedParameter[M]) ToBase() *Parameter {
+	return &Parameter{
+		Name:        p.Name,
+		Value:       p.Value,
+		Version:     p.Version,
+		Description: p.Description,
+		CreatedAt:   p.CreatedAt,
+		UpdatedAt:   p.UpdatedAt,
+		Tags:        p.Tags,
+		Metadata:    p.Metadata,
+	}
+}
+
+// ============================================================================
+// Base Parameter (UseCase Layer)
+// ============================================================================
+
+// Parameter is a provider-agnostic parameter for the UseCase layer.
+type Parameter struct {
+	Name        string
+	Value       string
+	Version     string
+	Description string
+	CreatedAt   *time.Time
+	UpdatedAt   *time.Time
+	Tags        map[string]string
+	Metadata    any // Provider-specific metadata (e.g., AWSParameterMeta)
+}
+
+// AWSMeta returns the AWS-specific metadata if available.
+func (p *Parameter) AWSMeta() *AWSParameterMeta {
+	if meta, ok := p.Metadata.(AWSParameterMeta); ok {
+		return &meta
+	}
+
+	if meta, ok := p.Metadata.(*AWSParameterMeta); ok {
+		return meta
+	}
+
+	return nil
+}
+
+// TypedMetadata casts Metadata to a specific type.
+func TypedMetadata[M any](p *Parameter) (M, bool) {
+	m, ok := p.Metadata.(M)
+
+	return m, ok
+}
+
+// ============================================================================
+// Provider-Specific Metadata
+// ============================================================================
+
+// AWSParameterMeta contains AWS SSM Parameter Store-specific metadata.
+type AWSParameterMeta struct {
+	// Type is the parameter type (e.g., String, SecureString, StringList).
+	Type string
+	// ARN is the Amazon Resource Name of the parameter.
+	ARN string
+	// Tier is the parameter tier (Standard, Advanced, Intelligent-Tiering).
+	Tier string
+	// DataType is the data type for validation (e.g., text, aws:ec2:image).
+	DataType string
+	// AllowedPattern is a regex pattern for validation.
+	AllowedPattern string
+	// Policies contains JSON policy document for parameter policies.
+	Policies string
+}
+
+// AzureAppConfigMeta contains Azure App Configuration-specific metadata.
+type AzureAppConfigMeta struct {
+	// ContentType is the content type of the value.
+	ContentType string
+	// Label is the label associated with the key.
+	Label string
+	// Locked indicates if the key-value is locked.
+	Locked bool
+	// Etag is the entity tag for optimistic concurrency.
+	Etag string
+}
+
+// ============================================================================
+// Type Aliases
+// ============================================================================
+
+// AWSParameter is a Parameter with AWS-specific metadata.
+type AWSParameter = TypedParameter[AWSParameterMeta]
+
+// AzureParameter is a Parameter with Azure-specific metadata.
+type AzureParameter = TypedParameter[AzureAppConfigMeta]
+
+// ============================================================================
+// History Types
+// ============================================================================
+
+// TypedParameterHistory contains version history for a typed parameter.
+type TypedParameterHistory[M any] struct {
+	Name       string
+	Parameters []*TypedParameter[M]
+}
+
+// ToBase converts to a UseCase layer type.
+func (h *TypedParameterHistory[M]) ToBase() *ParameterHistory {
+	params := make([]*Parameter, len(h.Parameters))
+	for i, p := range h.Parameters {
+		params[i] = p.ToBase()
+	}
+
+	return &ParameterHistory{
+		Name:       h.Name,
+		Parameters: params,
+	}
+}
+
+// ParameterHistory contains version history for a parameter.
+type ParameterHistory struct {
+	Name       string
+	Parameters []*Parameter
+}
+
+// AWSParameterHistory is a ParameterHistory with AWS-specific metadata.
+type AWSParameterHistory = TypedParameterHistory[AWSParameterMeta]
+
+// ============================================================================
+// List Types
+// ============================================================================
+
+// ParameterListItem represents a parameter in a list (without value).
+type ParameterListItem struct {
+	Name        string
+	Description string
+	CreatedAt   *time.Time
+	UpdatedAt   *time.Time
+	Tags        map[string]string
+	Metadata    any // Provider-specific metadata (e.g., AWSParameterListItemMeta)
+}
+
+// AWSMeta returns the AWS-specific metadata if available.
+func (p *ParameterListItem) AWSMeta() *AWSParameterListItemMeta {
+	if meta, ok := p.Metadata.(AWSParameterListItemMeta); ok {
+		return &meta
+	}
+
+	if meta, ok := p.Metadata.(*AWSParameterListItemMeta); ok {
+		return meta
+	}
+
+	return nil
+}
+
+// AWSParameterListItemMeta contains AWS SSM-specific metadata for list items.
+type AWSParameterListItemMeta struct {
+	// Type is the parameter type (e.g., String, SecureString, StringList).
+	Type string
+}
+
+// ============================================================================
+// Write Result Types
+// ============================================================================
+
+// ParameterWriteResult contains the result of a parameter write operation.
+type ParameterWriteResult struct {
+	Name    string
+	Version string
+}
diff --git a/internal/model/parameter_test.go b/internal/model/parameter_test.go
new file mode 100644
index 00000000..64413da1
--- /dev/null
+++ b/internal/model/parameter_test.go
@@ -0,0 +1,113 @@
+package model_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/mpyw/suve/internal/model"
+)
+
+func TestTypedParameter_ToBase(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	typed := &model.TypedParameter[model.AWSParameterMeta]{
+		Name:        "test-param",
+		Value:       "test-value",
+		Version:     "1",
+		Description: "test description",
+		CreatedAt:   &now,
+		UpdatedAt:   &now,
+		Tags:        map[string]string{"key": "value"},
+		Metadata: model.AWSParameterMeta{
+			Type: "String",
+			ARN:  "arn:aws:ssm:us-east-1:123456789012:parameter/test-param",
+			Tier: "Standard",
+		},
+	}
+
+	base := typed.ToBase()
+
+	assert.Equal(t, typed.Name, base.Name)
+	assert.Equal(t, typed.Value, base.Value)
+	assert.Equal(t, typed.Version, base.Version)
+	assert.Equal(t, typed.Description, base.Description)
+	assert.Equal(t, typed.CreatedAt, base.CreatedAt)
+	assert.Equal(t, typed.UpdatedAt, base.UpdatedAt)
+	assert.Equal(t, typed.Tags, base.Tags)
+	assert.IsType(t, model.AWSParameterMeta{}, base.Metadata)
+
+	// Verify Type is in Metadata
+	meta := base.AWSMeta()
+	assert.NotNil(t, meta)
+	assert.Equal(t, "String", meta.Type)
+}
+
+func TestTypedMetadata(t *testing.T) {
+	t.Parallel()
+
+	t.Run("valid type cast", func(t *testing.T) {
+		t.Parallel()
+
+		param := &model.Parameter{
+			Name:  "test",
+			Value: "value",
+			Metadata: model.AWSParameterMeta{
+				ARN:  "arn:aws:ssm:us-east-1:123456789012:parameter/test",
+				Tier: "Standard",
+			},
+		}
+
+		meta, ok := model.TypedMetadata[model.AWSParameterMeta](param)
+		assert.True(t, ok)
+		assert.Equal(t, "arn:aws:ssm:us-east-1:123456789012:parameter/test", meta.ARN)
+		assert.Equal(t, "Standard", meta.Tier)
+	})
+
+	t.Run("invalid type cast", func(t *testing.T) {
+		t.Parallel()
+
+		param := &model.Parameter{
+			Name:     "test",
+			Value:    "value",
+			Metadata: "not a struct",
+		}
+
+		_, ok := model.TypedMetadata[model.AWSParameterMeta](param)
+		assert.False(t, ok)
+	})
+}
+
+func TestTypedParameterHistory_ToBase(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	history := &model.TypedParameterHistory[model.AWSParameterMeta]{
+		Name: "test-param",
+		Parameters: []*model.TypedParameter[model.AWSParameterMeta]{
+			{
+				Name:      "test-param",
+				Value:     "value1",
+				Version:   "1",
+				UpdatedAt: &now,
+				Metadata:  model.AWSParameterMeta{Tier: "Standard"},
+			},
+			{
+				Name:      "test-param",
+				Value:     "value2",
+				Version:   "2",
+				UpdatedAt: &now,
+				Metadata:  model.AWSParameterMeta{Tier: "Advanced"},
+			},
+		},
+	}
+
+	base := history.ToBase()
+
+	assert.Equal(t, history.Name, base.Name)
+	assert.Len(t, base.Parameters, 2)
+	assert.Equal(t, "value1", base.Parameters[0].Value)
+	assert.Equal(t, "value2", base.Parameters[1].Value)
+}
diff --git a/internal/model/secret.go b/internal/model/secret.go
new file mode 100644
index 00000000..1e32a048
--- /dev/null
+++ b/internal/model/secret.go
@@ -0,0 +1,228 @@
+package model
+
+import "time"
+
+// ============================================================================
+// Generic Secret (Provider Layer)
+// ============================================================================
+
+// TypedSecret is a secret with provider-specific metadata.
+// This type is used at the Provider layer for type-safe access to metadata.
+type TypedSecret[M any] struct {
+	Name        string
+	Value       string
+	Version     string
+	Description string
+	CreatedAt   *time.Time
+	UpdatedAt   *time.Time
+	Tags        map[string]string
+	Metadata    M
+}
+
+// ToBase converts to a UseCase layer type.
+func (s *TypedSecret[M]) ToBase() *Secret {
+	return &Secret{
+		Name:        s.Name,
+		Value:       s.Value,
+		Version:     s.Version,
+		Description: s.Description,
+		CreatedAt:   s.CreatedAt,
+		UpdatedAt:   s.UpdatedAt,
+		Tags:        s.Tags,
+		Metadata:    s.Metadata,
+	}
+}
+
+// ============================================================================
+// Base Secret (UseCase Layer)
+// ============================================================================
+
+// Secret is a provider-agnostic secret for the UseCase layer.
+type Secret struct {
+	Name        string
+	Value       string
+	Version     string
+	Description string
+	CreatedAt   *time.Time
+	UpdatedAt   *time.Time
+	Tags        map[string]string
+	Metadata    any // Provider-specific metadata (e.g., AWSSecretMeta)
+}
+
+// AWSMeta returns the AWS-specific metadata if available.
+func (s *Secret) AWSMeta() *AWSSecretMeta {
+	if meta, ok := s.Metadata.(AWSSecretMeta); ok {
+		return &meta
+	}
+
+	if meta, ok := s.Metadata.(*AWSSecretMeta); ok {
+		return meta
+	}
+
+	return nil
+}
+
+// TypedSecretMetadata casts Metadata to a specific type.
+func TypedSecretMetadata[M any](s *Secret) (M, bool) {
+	m, ok := s.Metadata.(M)
+
+	return m, ok
+}
+
+// ============================================================================
+// Provider-Specific Metadata
+// ============================================================================
+
+// AWSSecretMeta contains AWS Secrets Manager-specific metadata.
+type AWSSecretMeta struct {
+	// ARN is the Amazon Resource Name of the secret.
+	ARN string
+	// VersionStages are the staging labels for this version.
+	VersionStages []string
+	// KmsKeyID is the ARN of the KMS key used for encryption.
+	KmsKeyID string
+	// RotationEnabled indicates if rotation is enabled.
+	RotationEnabled bool
+	// RotationRules contains rotation configuration.
+	RotationRules *AWSRotationRules
+	// DeletedDate is set if the secret is scheduled for deletion.
+	DeletedDate *time.Time
+}
+
+// AWSRotationRules contains AWS secret rotation configuration.
+type AWSRotationRules struct {
+	AutomaticallyAfterDays int64
+	Duration               string
+	ScheduleExpression     string
+}
+
+// GCPSecretMeta contains GCP Secret Manager-specific metadata.
+type GCPSecretMeta struct {
+	// ReplicationPolicy describes how the secret is replicated.
+	ReplicationPolicy string
+	// State is the secret state (e.g., ENABLED, DISABLED).
+	State string
+	// Expiration is when the secret version expires.
+	Expiration *time.Time
+}
+
+// AzureKeyVaultMeta contains Azure Key Vault-specific metadata.
+type AzureKeyVaultMeta struct {
+	// ContentType is the content type of the secret.
+	ContentType string
+	// Enabled indicates if the secret is enabled.
+	Enabled bool
+	// NotBefore is the earliest time the secret can be used.
+	NotBefore *time.Time
+	// Expiration is when the secret expires.
+	Expiration *time.Time
+	// RecoveryLevel is the deletion recovery level.
+	RecoveryLevel string
+}
+
+// ============================================================================
+// Type Aliases
+// ============================================================================
+
+// AWSSecret is a Secret with AWS-specific metadata.
+type AWSSecret = TypedSecret[AWSSecretMeta]
+
+// GCPSecret is a Secret with GCP-specific metadata.
+type GCPSecret = TypedSecret[GCPSecretMeta]
+
+// AzureSecret is a Secret with Azure-specific metadata.
+type AzureSecret = TypedSecret[AzureKeyVaultMeta]
+
+// ============================================================================
+// Version Types
+// ============================================================================
+
+// TypedSecretVersion represents a version of a typed secret.
+type TypedSecretVersion[M any] struct {
+	Version   string
+	CreatedAt *time.Time
+	Metadata  M
+}
+
+// ToBase converts to a UseCase layer type.
+func (v *TypedSecretVersion[M]) ToBase() *SecretVersion {
+	return &SecretVersion{
+		Version:   v.Version,
+		CreatedAt: v.CreatedAt,
+		Metadata:  v.Metadata,
+	}
+}
+
+// SecretVersion represents a version of a secret.
+type SecretVersion struct {
+	Version   string
+	CreatedAt *time.Time
+	Metadata  any // Provider-specific metadata
+}
+
+// AWSSecretVersionMeta contains AWS-specific version metadata.
+type AWSSecretVersionMeta struct {
+	VersionStages []string
+}
+
+// AWSSecretVersion is a SecretVersion with AWS-specific metadata.
+type AWSSecretVersion = TypedSecretVersion[AWSSecretVersionMeta]
+
+// ============================================================================
+// List Types
+// ============================================================================
+
+// SecretListItem represents a secret in a list (without value).
+type SecretListItem struct {
+	Name        string
+	Description string
+	CreatedAt   *time.Time
+	UpdatedAt   *time.Time
+	Tags        map[string]string
+	Metadata    any // Provider-specific metadata (e.g., AWSSecretListItemMeta)
+}
+
+// AWSMeta returns the AWS-specific metadata if available.
+func (s *SecretListItem) AWSMeta() *AWSSecretListItemMeta {
+	if meta, ok := s.Metadata.(AWSSecretListItemMeta); ok {
+		return &meta
+	}
+
+	if meta, ok := s.Metadata.(*AWSSecretListItemMeta); ok {
+		return meta
+	}
+
+	return nil
+}
+
+// AWSSecretListItemMeta contains AWS Secrets Manager-specific metadata for list items.
+type AWSSecretListItemMeta struct {
+	// ARN is the Amazon Resource Name of the secret.
+	ARN string
+	// DeletedDate is set if the secret is scheduled for deletion.
+	DeletedDate *time.Time
+}
+
+// ============================================================================
+// Write Result Types
+// ============================================================================
+
+// SecretWriteResult contains the result of a secret write operation.
+type SecretWriteResult struct {
+	Name    string
+	Version string
+	ARN     string
+}
+
+// SecretDeleteResult contains the result of a secret delete operation.
+type SecretDeleteResult struct {
+	Name         string
+	ARN          string
+	DeletionDate *time.Time
+}
+
+// SecretRestoreResult contains the result of a secret restore operation.
+type SecretRestoreResult struct {
+	Name string
+	ARN  string
+}
diff --git a/internal/model/secret_test.go b/internal/model/secret_test.go
new file mode 100644
index 00000000..73439e33
--- /dev/null
+++ b/internal/model/secret_test.go
@@ -0,0 +1,101 @@
+package model_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/mpyw/suve/internal/model"
+)
+
+func TestTypedSecret_ToBase(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	typed := &model.TypedSecret[model.AWSSecretMeta]{
+		Name:        "test-secret",
+		Value:       "test-value",
+		Version:     "v1",
+		Description: "test description",
+		CreatedAt:   &now,
+		UpdatedAt:   &now,
+		Tags:        map[string]string{"key": "value"},
+		Metadata: model.AWSSecretMeta{
+			ARN:             "arn:aws:secretsmanager:us-east-1:123456789012:secret:test-secret",
+			VersionStages:   []string{"AWSCURRENT"},
+			KmsKeyID:        "arn:aws:kms:us-east-1:123456789012:key/test",
+			RotationEnabled: true,
+		},
+	}
+
+	base := typed.ToBase()
+
+	assert.Equal(t, typed.Name, base.Name)
+	assert.Equal(t, typed.Value, base.Value)
+	assert.Equal(t, typed.Version, base.Version)
+	assert.Equal(t, typed.Description, base.Description)
+	assert.Equal(t, typed.CreatedAt, base.CreatedAt)
+	assert.Equal(t, typed.UpdatedAt, base.UpdatedAt)
+	assert.Equal(t, typed.Tags, base.Tags)
+	assert.IsType(t, model.AWSSecretMeta{}, base.Metadata)
+
+	// Verify ARN is in Metadata
+	meta := base.AWSMeta()
+	assert.NotNil(t, meta)
+	assert.Equal(t, "arn:aws:secretsmanager:us-east-1:123456789012:secret:test-secret", meta.ARN)
+}
+
+func TestTypedSecretMetadata(t *testing.T) {
+	t.Parallel()
+
+	t.Run("valid type cast", func(t *testing.T) {
+		t.Parallel()
+
+		secret := &model.Secret{
+			Name:  "test",
+			Value: "value",
+			Metadata: model.AWSSecretMeta{
+				VersionStages: []string{"AWSCURRENT", "AWSPREVIOUS"},
+				KmsKeyID:      "arn:aws:kms:us-east-1:123456789012:key/test",
+			},
+		}
+
+		meta, ok := model.TypedSecretMetadata[model.AWSSecretMeta](secret)
+		assert.True(t, ok)
+		assert.Equal(t, []string{"AWSCURRENT", "AWSPREVIOUS"}, meta.VersionStages)
+		assert.Equal(t, "arn:aws:kms:us-east-1:123456789012:key/test", meta.KmsKeyID)
+	})
+
+	t.Run("invalid type cast", func(t *testing.T) {
+		t.Parallel()
+
+		secret := &model.Secret{
+			Name:     "test",
+			Value:    "value",
+			Metadata: "not a struct",
+		}
+
+		_, ok := model.TypedSecretMetadata[model.AWSSecretMeta](secret)
+		assert.False(t, ok)
+	})
+}
+
+func TestTypedSecretVersion_ToBase(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	typed := &model.TypedSecretVersion[model.AWSSecretVersionMeta]{
+		Version:   "v1",
+		CreatedAt: &now,
+		Metadata: model.AWSSecretVersionMeta{
+			VersionStages: []string{"AWSCURRENT"},
+		},
+	}
+
+	base := typed.ToBase()
+
+	assert.Equal(t, typed.Version, base.Version)
+	assert.Equal(t, typed.CreatedAt, base.CreatedAt)
+	assert.IsType(t, model.AWSSecretVersionMeta{}, base.Metadata)
+}
diff --git a/internal/provider/aws/param/adapter.go b/internal/provider/aws/param/adapter.go
new file mode 100644
index 00000000..5289a115
--- /dev/null
+++ b/internal/provider/aws/param/adapter.go
@@ -0,0 +1,382 @@
+// Package param provides AWS SSM Parameter Store adapter implementing provider interfaces.
+package param
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/ssm"
+	"github.com/samber/lo"
+
+	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
+	"github.com/mpyw/suve/internal/provider"
+)
+
+// Client combines all AWS SSM API interfaces required by the adapter.
+type Client interface {
+	paramapi.GetParameterAPI
+	paramapi.GetParameterHistoryAPI
+	paramapi.DescribeParametersAPI
+	paramapi.PutParameterAPI
+	paramapi.DeleteParameterAPI
+	paramapi.AddTagsToResourceAPI
+	paramapi.RemoveTagsFromResourceAPI
+	paramapi.ListTagsForResourceAPI
+}
+
+// Adapter implements provider.ParameterService for AWS SSM.
+type Adapter struct {
+	client Client
+}
+
+// NewAdapter creates a new AWS SSM adapter using the default AWS configuration.
+func NewAdapter(ctx context.Context) (*Adapter, error) {
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load AWS config: %w", err)
+	}
+
+	return &Adapter{client: ssm.NewFromConfig(cfg)}, nil
+}
+
+// New creates a new AWS SSM adapter from an existing client.
+func New(client Client) *Adapter {
+	return &Adapter{client: client}
+}
+
+// ============================================================================
+// ParameterReader Implementation
+// ============================================================================
+
+// GetParameter retrieves a parameter by name and optional version.
+func (a *Adapter) GetParameter(
+	ctx context.Context, name string, version string,
+) (*model.Parameter, error) {
+	input := &paramapi.GetParameterInput{
+		Name:           lo.ToPtr(name),
+		WithDecryption: lo.ToPtr(true),
+	}
+
+	// Add version selector if specified
+	if version != "" {
+		input.Name = lo.ToPtr(fmt.Sprintf("%s:%s", name, version))
+	}
+
+	output, err := a.client.GetParameter(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get parameter: %w", err)
+	}
+
+	return convertParameter(output.Parameter), nil
+}
+
+// GetParameterHistory retrieves all versions of a parameter.
+func (a *Adapter) GetParameterHistory(
+	ctx context.Context, name string,
+) (*model.ParameterHistory, error) {
+	input := &paramapi.GetParameterHistoryInput{
+		Name:           lo.ToPtr(name),
+		WithDecryption: lo.ToPtr(true),
+	}
+
+	var allHistory []paramapi.ParameterHistory
+
+	// Paginate through all history
+	for {
+		output, err := a.client.GetParameterHistory(ctx, input)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get parameter history: %w", err)
+		}
+
+		allHistory = append(allHistory, output.Parameters...)
+
+		if output.NextToken == nil {
+			break
+		}
+
+		input.NextToken = output.NextToken
+	}
+
+	return convertParameterHistory(name, allHistory), nil
+}
+
+// ListParameters lists parameters matching the given path prefix.
+func (a *Adapter) ListParameters(
+	ctx context.Context, path string, recursive bool,
+) ([]*model.ParameterListItem, error) {
+	input := &paramapi.DescribeParametersInput{
+		ParameterFilters: []paramapi.ParameterStringFilter{
+			{
+				Key:    lo.ToPtr("Path"),
+				Values: []string{path},
+				Option: lo.If(recursive, lo.ToPtr("Recursive")).Else(lo.ToPtr("OneLevel")),
+			},
+		},
+	}
+
+	var items []*model.ParameterListItem
+
+	// Paginate through all parameters
+	paginator := paramapi.NewDescribeParametersPaginator(a.client, input)
+	for paginator.HasMorePages() {
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list parameters: %w", err)
+		}
+
+		for _, param := range output.Parameters {
+			items = append(items, convertParameterMetadata(&param))
+		}
+	}
+
+	return items, nil
+}
+
+// ============================================================================
+// ParameterWriter Implementation
+// ============================================================================
+
+// PutParameter creates or updates a parameter.
+func (a *Adapter) PutParameter(
+	ctx context.Context, param *model.Parameter, overwrite bool,
+) (*model.ParameterWriteResult, error) {
+	paramType := paramapi.ParameterTypeString
+
+	input := &paramapi.PutParameterInput{
+		Name:      lo.ToPtr(param.Name),
+		Value:     lo.ToPtr(param.Value),
+		Type:      paramType,
+		Overwrite: lo.ToPtr(overwrite),
+	}
+
+	if param.Description != "" {
+		input.Description = lo.ToPtr(param.Description)
+	}
+
+	// Add tags if present
+	if len(param.Tags) > 0 {
+		input.Tags = convertToAWSTags(param.Tags)
+	}
+
+	// Apply AWS-specific metadata if present
+	if meta := param.AWSMeta(); meta != nil {
+		if meta.Type != "" {
+			input.Type = paramapi.ParameterType(meta.Type)
+		}
+
+		if meta.Tier != "" {
+			input.Tier = paramapi.ParameterTier(meta.Tier)
+		}
+
+		if meta.DataType != "" {
+			input.DataType = lo.ToPtr(meta.DataType)
+		}
+
+		if meta.AllowedPattern != "" {
+			input.AllowedPattern = lo.ToPtr(meta.AllowedPattern)
+		}
+
+		if meta.Policies != "" {
+			input.Policies = lo.ToPtr(meta.Policies)
+		}
+	}
+
+	output, err := a.client.PutParameter(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to put parameter: %w", err)
+	}
+
+	return &model.ParameterWriteResult{
+		Name:    param.Name,
+		Version: strconv.FormatInt(output.Version, 10),
+	}, nil
+}
+
+// DeleteParameter deletes a parameter by name.
+func (a *Adapter) DeleteParameter(ctx context.Context, name string) error {
+	input := &paramapi.DeleteParameterInput{
+		Name: lo.ToPtr(name),
+	}
+
+	_, err := a.client.DeleteParameter(ctx, input)
+	if err != nil {
+		return fmt.Errorf("failed to delete parameter: %w", err)
+	}
+
+	return nil
+}
+
+// ============================================================================
+// ParameterTagger Implementation
+// ============================================================================
+
+// GetTags retrieves all tags for a parameter.
+func (a *Adapter) GetTags(ctx context.Context, name string) (map[string]string, error) {
+	input := &paramapi.ListTagsForResourceInput{
+		ResourceId:   lo.ToPtr(name),
+		ResourceType: paramapi.ResourceTypeForTaggingParameter,
+	}
+
+	output, err := a.client.ListTagsForResource(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list tags: %w", err)
+	}
+
+	return convertFromAWSTags(output.TagList), nil
+}
+
+// AddTags adds or updates tags on a parameter.
+func (a *Adapter) AddTags(
+	ctx context.Context, name string, tags map[string]string,
+) error {
+	input := &paramapi.AddTagsToResourceInput{
+		ResourceId:   lo.ToPtr(name),
+		ResourceType: paramapi.ResourceTypeForTaggingParameter,
+		Tags:         convertToAWSTags(tags),
+	}
+
+	_, err := a.client.AddTagsToResource(ctx, input)
+	if err != nil {
+		return fmt.Errorf("failed to add tags: %w", err)
+	}
+
+	return nil
+}
+
+// RemoveTags removes tags from a parameter by key names.
+func (a *Adapter) RemoveTags(
+	ctx context.Context, name string, keys []string,
+) error {
+	input := &paramapi.RemoveTagsFromResourceInput{
+		ResourceId:   lo.ToPtr(name),
+		ResourceType: paramapi.ResourceTypeForTaggingParameter,
+		TagKeys:      keys,
+	}
+
+	_, err := a.client.RemoveTagsFromResource(ctx, input)
+	if err != nil {
+		return fmt.Errorf("failed to remove tags: %w", err)
+	}
+
+	return nil
+}
+
+// ============================================================================
+// Compile-time Interface Checks
+// ============================================================================
+
+var (
+	_ provider.ParameterReader  = (*Adapter)(nil)
+	_ provider.ParameterWriter  = (*Adapter)(nil)
+	_ provider.ParameterTagger  = (*Adapter)(nil)
+	_ provider.ParameterService = (*Adapter)(nil)
+)
+
+// ============================================================================
+// Conversion Helpers (internal)
+// ============================================================================
+
+func convertParameter(p *paramapi.Parameter) *model.Parameter {
+	if p == nil {
+		return nil
+	}
+
+	version := ""
+	if p.Version != 0 {
+		version = strconv.FormatInt(p.Version, 10)
+	}
+
+	return &model.Parameter{
+		Name:      lo.FromPtr(p.Name),
+		Value:     lo.FromPtr(p.Value),
+		Version:   version,
+		UpdatedAt: p.LastModifiedDate,
+		Metadata: model.AWSParameterMeta{
+			Type:     string(p.Type),
+			ARN:      lo.FromPtr(p.ARN),
+			DataType: lo.FromPtr(p.DataType),
+		},
+	}
+}
+
+func convertParameterHistory(name string, history []paramapi.ParameterHistory) *model.ParameterHistory {
+	params := make([]*model.Parameter, len(history))
+	for i, h := range history {
+		version := ""
+		if h.Version != 0 {
+			version = strconv.FormatInt(h.Version, 10)
+		}
+
+		params[i] = &model.Parameter{
+			Name:        name,
+			Value:       lo.FromPtr(h.Value),
+			Version:     version,
+			Description: lo.FromPtr(h.Description),
+			UpdatedAt:   h.LastModifiedDate,
+			Metadata: model.AWSParameterMeta{
+				Type:           string(h.Type),
+				Tier:           string(h.Tier),
+				AllowedPattern: lo.FromPtr(h.AllowedPattern),
+				Policies:       policiesToString(h.Policies),
+			},
+		}
+	}
+
+	return &model.ParameterHistory{
+		Name:       name,
+		Parameters: params,
+	}
+}
+
+func convertParameterMetadata(m *paramapi.ParameterMetadata) *model.ParameterListItem {
+	if m == nil {
+		return nil
+	}
+
+	return &model.ParameterListItem{
+		Name:        lo.FromPtr(m.Name),
+		Description: lo.FromPtr(m.Description),
+		UpdatedAt:   m.LastModifiedDate,
+		Metadata: model.AWSParameterListItemMeta{
+			Type: string(m.Type),
+		},
+	}
+}
+
+func convertToAWSTags(tags map[string]string) []paramapi.Tag {
+	result := make([]paramapi.Tag, 0, len(tags))
+	for k, v := range tags {
+		result = append(result, paramapi.Tag{
+			Key:   lo.ToPtr(k),
+			Value: lo.ToPtr(v),
+		})
+	}
+
+	return result
+}
+
+func convertFromAWSTags(tags []paramapi.Tag) map[string]string {
+	result := make(map[string]string, len(tags))
+	for _, tag := range tags {
+		if tag.Key != nil && tag.Value != nil {
+			result[*tag.Key] = *tag.Value
+		}
+	}
+
+	return result
+}
+
+func policiesToString(policies []paramapi.ParameterInlinePolicy) string {
+	if len(policies) == 0 {
+		return ""
+	}
+	// For simplicity, just return the first policy's document
+	if policies[0].PolicyText != nil {
+		return *policies[0].PolicyText
+	}
+
+	return ""
+}
diff --git a/internal/provider/aws/secret/adapter.go b/internal/provider/aws/secret/adapter.go
new file mode 100644
index 00000000..5dcbbfdb
--- /dev/null
+++ b/internal/provider/aws/secret/adapter.go
@@ -0,0 +1,398 @@
+// Package secret provides AWS Secrets Manager adapter implementing provider interfaces.
+package secret
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
+	"github.com/samber/lo"
+
+	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
+	"github.com/mpyw/suve/internal/provider"
+)
+
+// Client combines all AWS Secrets Manager API interfaces required by the adapter.
+type Client interface {
+	secretapi.GetSecretValueAPI
+	secretapi.ListSecretVersionIDsAPI
+	secretapi.ListSecretsAPI
+	secretapi.CreateSecretAPI
+	secretapi.PutSecretValueAPI
+	secretapi.DeleteSecretAPI
+	secretapi.RestoreSecretAPI
+	secretapi.TagResourceAPI
+	secretapi.UntagResourceAPI
+	secretapi.DescribeSecretAPI
+}
+
+// Adapter implements provider.SecretService for AWS Secrets Manager.
+type Adapter struct {
+	client Client
+}
+
+// NewAdapter creates a new AWS Secrets Manager adapter using the default AWS configuration.
+func NewAdapter(ctx context.Context) (*Adapter, error) {
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load AWS config: %w", err)
+	}
+
+	return &Adapter{client: secretsmanager.NewFromConfig(cfg)}, nil
+}
+
+// New creates a new AWS Secrets Manager adapter from an existing client.
+func New(client Client) *Adapter {
+	return &Adapter{client: client}
+}
+
+// ============================================================================
+// SecretReader Implementation
+// ============================================================================
+
+// GetSecret retrieves a secret by name with optional version/stage specifier.
+func (a *Adapter) GetSecret(
+	ctx context.Context, name string, versionID string, versionStage string,
+) (*model.Secret, error) {
+	input := &secretapi.GetSecretValueInput{
+		SecretId: lo.ToPtr(name),
+	}
+
+	if versionID != "" {
+		input.VersionId = lo.ToPtr(versionID)
+	}
+
+	if versionStage != "" {
+		input.VersionStage = lo.ToPtr(versionStage)
+	}
+
+	output, err := a.client.GetSecretValue(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get secret: %w", err)
+	}
+
+	return convertGetSecretValueOutput(output), nil
+}
+
+// GetSecretVersions retrieves all versions of a secret.
+func (a *Adapter) GetSecretVersions(
+	ctx context.Context, name string,
+) ([]*model.SecretVersion, error) {
+	input := &secretapi.ListSecretVersionIDsInput{
+		SecretId: lo.ToPtr(name),
+	}
+
+	var versions []*model.SecretVersion
+
+	// Paginate through all versions
+	for {
+		output, err := a.client.ListSecretVersionIds(ctx, input)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list secret versions: %w", err)
+		}
+
+		for _, v := range output.Versions {
+			versions = append(versions, convertSecretVersion(&v))
+		}
+
+		if output.NextToken == nil {
+			break
+		}
+
+		input.NextToken = output.NextToken
+	}
+
+	return versions, nil
+}
+
+// ListSecrets lists all secrets.
+func (a *Adapter) ListSecrets(ctx context.Context) ([]*model.SecretListItem, error) {
+	var items []*model.SecretListItem
+
+	// Paginate through all secrets
+	paginator := secretapi.NewListSecretsPaginator(a.client, &secretapi.ListSecretsInput{})
+	for paginator.HasMorePages() {
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list secrets: %w", err)
+		}
+
+		for _, entry := range output.SecretList {
+			items = append(items, convertSecretListEntry(&entry))
+		}
+	}
+
+	return items, nil
+}
+
+// ============================================================================
+// SecretWriter Implementation
+// ============================================================================
+
+// CreateSecret creates a new secret.
+func (a *Adapter) CreateSecret(ctx context.Context, secret *model.Secret) (*model.SecretWriteResult, error) {
+	input := &secretapi.CreateSecretInput{
+		Name:         lo.ToPtr(secret.Name),
+		SecretString: lo.ToPtr(secret.Value),
+	}
+
+	if secret.Description != "" {
+		input.Description = lo.ToPtr(secret.Description)
+	}
+
+	if len(secret.Tags) > 0 {
+		input.Tags = convertToAWSTags(secret.Tags)
+	}
+
+	// Apply AWS-specific metadata if present
+	if meta, ok := model.TypedSecretMetadata[model.AWSSecretMeta](secret); ok {
+		if meta.KmsKeyID != "" {
+			input.KmsKeyId = lo.ToPtr(meta.KmsKeyID)
+		}
+	}
+
+	output, err := a.client.CreateSecret(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create secret: %w", err)
+	}
+
+	return &model.SecretWriteResult{
+		Name:    lo.FromPtr(output.Name),
+		Version: lo.FromPtr(output.VersionId),
+		ARN:     lo.FromPtr(output.ARN),
+	}, nil
+}
+
+// UpdateSecret updates the value of an existing secret.
+func (a *Adapter) UpdateSecret(ctx context.Context, name string, value string) (*model.SecretWriteResult, error) {
+	input := &secretapi.PutSecretValueInput{
+		SecretId:     lo.ToPtr(name),
+		SecretString: lo.ToPtr(value),
+	}
+
+	output, err := a.client.PutSecretValue(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update secret: %w", err)
+	}
+
+	return &model.SecretWriteResult{
+		Name:    lo.FromPtr(output.Name),
+		Version: lo.FromPtr(output.VersionId),
+		ARN:     lo.FromPtr(output.ARN),
+	}, nil
+}
+
+// DeleteSecret deletes a secret.
+func (a *Adapter) DeleteSecret(ctx context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error) {
+	input := &secretapi.DeleteSecretInput{
+		SecretId:                   lo.ToPtr(name),
+		ForceDeleteWithoutRecovery: lo.ToPtr(forceDelete),
+	}
+
+	output, err := a.client.DeleteSecret(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete secret: %w", err)
+	}
+
+	return &model.SecretDeleteResult{
+		Name:         lo.FromPtr(output.Name),
+		ARN:          lo.FromPtr(output.ARN),
+		DeletionDate: output.DeletionDate,
+	}, nil
+}
+
+// ============================================================================
+// SecretTagger Implementation
+// ============================================================================
+
+// GetTags retrieves all tags for a secret.
+func (a *Adapter) GetTags(ctx context.Context, name string) (map[string]string, error) {
+	input := &secretapi.DescribeSecretInput{
+		SecretId: lo.ToPtr(name),
+	}
+
+	output, err := a.client.DescribeSecret(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to describe secret: %w", err)
+	}
+
+	return convertFromAWSTags(output.Tags), nil
+}
+
+// AddTags adds or updates tags on a secret.
+func (a *Adapter) AddTags(ctx context.Context, name string, tags map[string]string) error {
+	input := &secretapi.TagResourceInput{
+		SecretId: lo.ToPtr(name),
+		Tags:     convertToAWSTags(tags),
+	}
+
+	_, err := a.client.TagResource(ctx, input)
+	if err != nil {
+		return fmt.Errorf("failed to add tags: %w", err)
+	}
+
+	return nil
+}
+
+// RemoveTags removes tags from a secret by key names.
+func (a *Adapter) RemoveTags(ctx context.Context, name string, keys []string) error {
+	input := &secretapi.UntagResourceInput{
+		SecretId: lo.ToPtr(name),
+		TagKeys:  keys,
+	}
+
+	_, err := a.client.UntagResource(ctx, input)
+	if err != nil {
+		return fmt.Errorf("failed to remove tags: %w", err)
+	}
+
+	return nil
+}
+
+// ============================================================================
+// SecretRestorer Implementation (Optional Interface)
+// ============================================================================
+
+// RestoreSecret restores a previously deleted secret.
+func (a *Adapter) RestoreSecret(ctx context.Context, name string) (*model.SecretRestoreResult, error) {
+	input := &secretapi.RestoreSecretInput{
+		SecretId: lo.ToPtr(name),
+	}
+
+	output, err := a.client.RestoreSecret(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to restore secret: %w", err)
+	}
+
+	return &model.SecretRestoreResult{
+		Name: lo.FromPtr(output.Name),
+		ARN:  lo.FromPtr(output.ARN),
+	}, nil
+}
+
+// ============================================================================
+// SecretDescriber Implementation (Optional Interface)
+// ============================================================================
+
+// DescribeSecret retrieves secret metadata without the value.
+func (a *Adapter) DescribeSecret(ctx context.Context, name string) (*model.SecretListItem, error) {
+	input := &secretapi.DescribeSecretInput{
+		SecretId: lo.ToPtr(name),
+	}
+
+	output, err := a.client.DescribeSecret(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("failed to describe secret: %w", err)
+	}
+
+	return convertDescribeSecretOutput(output), nil
+}
+
+// ============================================================================
+// Compile-time Interface Checks
+// ============================================================================
+
+var (
+	_ provider.SecretReader    = (*Adapter)(nil)
+	_ provider.SecretWriter    = (*Adapter)(nil)
+	_ provider.SecretTagger    = (*Adapter)(nil)
+	_ provider.SecretService   = (*Adapter)(nil)
+	_ provider.SecretRestorer  = (*Adapter)(nil)
+	_ provider.SecretDescriber = (*Adapter)(nil)
+)
+
+// ============================================================================
+// Conversion Helpers (internal)
+// ============================================================================
+
+func convertGetSecretValueOutput(o *secretapi.GetSecretValueOutput) *model.Secret {
+	if o == nil {
+		return nil
+	}
+
+	return &model.Secret{
+		Name:      lo.FromPtr(o.Name),
+		Value:     lo.FromPtr(o.SecretString),
+		Version:   lo.FromPtr(o.VersionId),
+		CreatedAt: o.CreatedDate,
+		Metadata: model.AWSSecretMeta{
+			ARN:           lo.FromPtr(o.ARN),
+			VersionStages: o.VersionStages,
+		},
+	}
+}
+
+func convertSecretVersion(v *secretapi.SecretVersionsListEntry) *model.SecretVersion {
+	if v == nil {
+		return nil
+	}
+
+	return &model.SecretVersion{
+		Version:   lo.FromPtr(v.VersionId),
+		CreatedAt: v.CreatedDate,
+		Metadata: model.AWSSecretVersionMeta{
+			VersionStages: v.VersionStages,
+		},
+	}
+}
+
+func convertSecretListEntry(e *secretapi.SecretListEntry) *model.SecretListItem {
+	if e == nil {
+		return nil
+	}
+
+	return &model.SecretListItem{
+		Name:        lo.FromPtr(e.Name),
+		Description: lo.FromPtr(e.Description),
+		CreatedAt:   e.CreatedDate,
+		UpdatedAt:   e.LastChangedDate,
+		Tags:        convertFromAWSTags(e.Tags),
+		Metadata: model.AWSSecretListItemMeta{
+			ARN:         lo.FromPtr(e.ARN),
+			DeletedDate: e.DeletedDate,
+		},
+	}
+}
+
+func convertDescribeSecretOutput(o *secretapi.DescribeSecretOutput) *model.SecretListItem {
+	if o == nil {
+		return nil
+	}
+
+	return &model.SecretListItem{
+		Name:        lo.FromPtr(o.Name),
+		Description: lo.FromPtr(o.Description),
+		CreatedAt:   o.CreatedDate,
+		UpdatedAt:   o.LastChangedDate,
+		Tags:        convertFromAWSTags(o.Tags),
+		Metadata: model.AWSSecretListItemMeta{
+			ARN:         lo.FromPtr(o.ARN),
+			DeletedDate: o.DeletedDate,
+		},
+	}
+}
+
+func convertToAWSTags(tags map[string]string) []secretapi.Tag {
+	result := make([]secretapi.Tag, 0, len(tags))
+	for k, v := range tags {
+		result = append(result, secretapi.Tag{
+			Key:   lo.ToPtr(k),
+			Value: lo.ToPtr(v),
+		})
+	}
+
+	return result
+}
+
+func convertFromAWSTags(tags []secretapi.Tag) map[string]string {
+	result := make(map[string]string, len(tags))
+	for _, tag := range tags {
+		if tag.Key != nil && tag.Value != nil {
+			result[*tag.Key] = *tag.Value
+		}
+	}
+
+	return result
+}
diff --git a/internal/provider/parameter.go b/internal/provider/parameter.go
new file mode 100644
index 00000000..c4ced122
--- /dev/null
+++ b/internal/provider/parameter.go
@@ -0,0 +1,115 @@
+// Package provider defines provider-agnostic interfaces for cloud services.
+package provider
+
+import (
+	"context"
+
+	"github.com/mpyw/suve/internal/model"
+)
+
+// ============================================================================
+// UseCase Layer Interfaces
+// ============================================================================
+
+// ParameterReader provides read access to parameters.
+type ParameterReader interface {
+	// GetParameter retrieves a parameter by name and optional version.
+	// If version is empty, returns the latest version.
+	GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error)
+
+	// GetParameterHistory retrieves all versions of a parameter.
+	GetParameterHistory(ctx context.Context, name string) (*model.ParameterHistory, error)
+
+	// ListParameters lists parameters matching the given path prefix.
+	// If recursive is true, includes parameters in nested paths.
+	ListParameters(ctx context.Context, path string, recursive bool) ([]*model.ParameterListItem, error)
+}
+
+// ParameterWriter provides write access to parameters.
+type ParameterWriter interface {
+	// PutParameter creates or updates a parameter.
+	// If overwrite is false and the parameter exists, returns an error.
+	PutParameter(ctx context.Context, param *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error)
+
+	// DeleteParameter deletes a parameter by name.
+	DeleteParameter(ctx context.Context, name string) error
+}
+
+// ParameterTagger provides tag management for parameters.
+//
+//nolint:iface // Intentionally similar to SecretTagger but separate for clarity.
+type ParameterTagger interface {
+	// GetTags retrieves all tags for a parameter.
+	GetTags(ctx context.Context, name string) (map[string]string, error)
+
+	// AddTags adds or updates tags on a parameter.
+	AddTags(ctx context.Context, name string, tags map[string]string) error
+
+	// RemoveTags removes tags from a parameter by key names.
+	RemoveTags(ctx context.Context, name string, keys []string) error
+}
+
+// ParameterService combines all parameter operations.
+type ParameterService interface {
+	ParameterReader
+	ParameterWriter
+	ParameterTagger
+}
+
+// ============================================================================
+// Provider Layer Interfaces (Generic)
+// ============================================================================
+
+// TypedParameterReader provides type-safe access to parameters with metadata.
+// This is used internally by provider adapters.
+type TypedParameterReader[M any] interface {
+	// GetTypedParameter retrieves a parameter with provider-specific metadata.
+	GetTypedParameter(ctx context.Context, name string, version string) (*model.TypedParameter[M], error)
+
+	// GetTypedParameterHistory retrieves all versions with provider-specific metadata.
+	GetTypedParameterHistory(ctx context.Context, name string) (*model.TypedParameterHistory[M], error)
+}
+
+// ============================================================================
+// Adapter Helpers
+// ============================================================================
+
+// WrapTypedParameterReader wraps a TypedParameterReader to implement ParameterReader.
+func WrapTypedParameterReader[M any](r TypedParameterReader[M]) ParameterReader {
+	return &typedParameterReaderAdapter[M]{inner: r}
+}
+
+type typedParameterReaderAdapter[M any] struct {
+	inner TypedParameterReader[M]
+}
+
+func (a *typedParameterReaderAdapter[M]) GetParameter(
+	ctx context.Context, name string, version string,
+) (*model.Parameter, error) {
+	p, err := a.inner.GetTypedParameter(ctx, name, version)
+	if err != nil {
+		return nil, err
+	}
+
+	return p.ToBase(), nil
+}
+
+func (a *typedParameterReaderAdapter[M]) GetParameterHistory(
+	ctx context.Context, name string,
+) (*model.ParameterHistory, error) {
+	h, err := a.inner.GetTypedParameterHistory(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+
+	return h.ToBase(), nil
+}
+
+func (a *typedParameterReaderAdapter[M]) ListParameters(
+	_ context.Context, _ string, _ bool,
+) ([]*model.ParameterListItem, error) {
+	// TypedParameterReader doesn't include list functionality,
+	// so this adapter cannot implement ListParameters.
+	// Concrete implementations should implement ParameterReader directly.
+	return nil, nil
+}
diff --git a/internal/provider/parameter_test.go b/internal/provider/parameter_test.go
new file mode 100644
index 00000000..f6c21d97
--- /dev/null
+++ b/internal/provider/parameter_test.go
@@ -0,0 +1,131 @@
+package provider_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mpyw/suve/internal/model"
+	"github.com/mpyw/suve/internal/provider"
+)
+
+// mockTypedParameterReader implements provider.TypedParameterReader for testing.
+type mockTypedParameterReader struct {
+	getTypedParameterFunc        func(ctx context.Context, name, version string) (*model.TypedParameter[model.AWSParameterMeta], error)
+	getTypedParameterHistoryFunc func(ctx context.Context, name string) (*model.TypedParameterHistory[model.AWSParameterMeta], error)
+}
+
+func (m *mockTypedParameterReader) GetTypedParameter(
+	ctx context.Context, name, version string,
+) (*model.TypedParameter[model.AWSParameterMeta], error) {
+	return m.getTypedParameterFunc(ctx, name, version)
+}
+
+func (m *mockTypedParameterReader) GetTypedParameterHistory(
+	ctx context.Context, name string,
+) (*model.TypedParameterHistory[model.AWSParameterMeta], error) {
+	return m.getTypedParameterHistoryFunc(ctx, name)
+}
+
+func TestWrapTypedParameterReader_GetParameter(t *testing.T) {
+	t.Parallel()
+
+	t.Run("success", func(t *testing.T) {
+		t.Parallel()
+
+		mock := &mockTypedParameterReader{
+			getTypedParameterFunc: func(_ context.Context, name, version string) (*model.TypedParameter[model.AWSParameterMeta], error) {
+				return &model.TypedParameter[model.AWSParameterMeta]{
+					Name:    name,
+					Value:   "test-value",
+					Version: version,
+					Metadata: model.AWSParameterMeta{
+						ARN: "test-arn",
+					},
+				}, nil
+			},
+		}
+
+		reader := provider.WrapTypedParameterReader[model.AWSParameterMeta](mock)
+		param, err := reader.GetParameter(context.Background(), "test-param", "1")
+
+		require.NoError(t, err)
+		assert.Equal(t, "test-param", param.Name)
+		assert.Equal(t, "test-value", param.Value)
+		assert.Equal(t, "1", param.Version)
+	})
+
+	t.Run("error", func(t *testing.T) {
+		t.Parallel()
+
+		mock := &mockTypedParameterReader{
+			getTypedParameterFunc: func(_ context.Context, _, _ string) (*model.TypedParameter[model.AWSParameterMeta], error) {
+				return nil, errors.New("not found")
+			},
+		}
+
+		reader := provider.WrapTypedParameterReader[model.AWSParameterMeta](mock)
+		_, err := reader.GetParameter(context.Background(), "test-param", "1")
+
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not found")
+	})
+}
+
+func TestWrapTypedParameterReader_GetParameterHistory(t *testing.T) {
+	t.Parallel()
+
+	t.Run("success", func(t *testing.T) {
+		t.Parallel()
+
+		mock := &mockTypedParameterReader{
+			getTypedParameterHistoryFunc: func(_ context.Context, name string) (*model.TypedParameterHistory[model.AWSParameterMeta], error) {
+				return &model.TypedParameterHistory[model.AWSParameterMeta]{
+					Name: name,
+					Parameters: []*model.TypedParameter[model.AWSParameterMeta]{
+						{Name: name, Value: "v1", Version: "1"},
+						{Name: name, Value: "v2", Version: "2"},
+					},
+				}, nil
+			},
+		}
+
+		reader := provider.WrapTypedParameterReader[model.AWSParameterMeta](mock)
+		history, err := reader.GetParameterHistory(context.Background(), "test-param")
+
+		require.NoError(t, err)
+		assert.Equal(t, "test-param", history.Name)
+		assert.Len(t, history.Parameters, 2)
+	})
+
+	t.Run("error", func(t *testing.T) {
+		t.Parallel()
+
+		mock := &mockTypedParameterReader{
+			getTypedParameterHistoryFunc: func(_ context.Context, _ string) (*model.TypedParameterHistory[model.AWSParameterMeta], error) {
+				return nil, errors.New("history error")
+			},
+		}
+
+		reader := provider.WrapTypedParameterReader[model.AWSParameterMeta](mock)
+		_, err := reader.GetParameterHistory(context.Background(), "test-param")
+
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "history error")
+	})
+}
+
+func TestWrapTypedParameterReader_ListParameters(t *testing.T) {
+	t.Parallel()
+
+	// ListParameters returns nil because TypedParameterReader doesn't include list functionality
+	mock := &mockTypedParameterReader{}
+	reader := provider.WrapTypedParameterReader[model.AWSParameterMeta](mock)
+	items, err := reader.ListParameters(context.Background(), "/", true)
+
+	require.NoError(t, err)
+	assert.Nil(t, items)
+}
diff --git a/internal/provider/secret.go b/internal/provider/secret.go
new file mode 100644
index 00000000..9e9ec35b
--- /dev/null
+++ b/internal/provider/secret.go
@@ -0,0 +1,114 @@
+package provider
+
+import (
+	"context"
+
+	"github.com/mpyw/suve/internal/model"
+)
+
+// ============================================================================
+// UseCase Layer Interfaces
+// ============================================================================
+
+// SecretReader provides read access to secrets.
+type SecretReader interface {
+	// GetSecret retrieves a secret by name with optional version/stage specifier.
+	// - versionID: specific version ID (empty for latest)
+	// - versionStage: staging label like "AWSCURRENT" (empty to ignore)
+	GetSecret(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error)
+
+	// GetSecretVersions retrieves all versions of a secret.
+	GetSecretVersions(ctx context.Context, name string) ([]*model.SecretVersion, error)
+
+	// ListSecrets lists all secrets.
+	ListSecrets(ctx context.Context) ([]*model.SecretListItem, error)
+}
+
+// SecretWriter provides write access to secrets.
+type SecretWriter interface {
+	// CreateSecret creates a new secret.
+	CreateSecret(ctx context.Context, secret *model.Secret) (*model.SecretWriteResult, error)
+
+	// UpdateSecret updates the value of an existing secret.
+	UpdateSecret(ctx context.Context, name string, value string) (*model.SecretWriteResult, error)
+
+	// DeleteSecret deletes a secret.
+	// If forceDelete is true, immediately deletes without recovery window.
+	DeleteSecret(ctx context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error)
+}
+
+// SecretTagger provides tag management for secrets.
+//
+//nolint:iface // Intentionally similar to ParameterTagger but separate for clarity.
+type SecretTagger interface {
+	// GetTags retrieves all tags for a secret.
+	GetTags(ctx context.Context, name string) (map[string]string, error)
+
+	// AddTags adds or updates tags on a secret.
+	AddTags(ctx context.Context, name string, tags map[string]string) error
+
+	// RemoveTags removes tags from a secret by key names.
+	RemoveTags(ctx context.Context, name string, keys []string) error
+}
+
+// SecretService combines all secret operations.
+type SecretService interface {
+	SecretReader
+	SecretWriter
+	SecretTagger
+}
+
+// ============================================================================
+// Provider-Specific Extensions (Optional Interfaces)
+// ============================================================================
+
+// SecretRestorer provides secret restoration capability.
+// This is an optional interface for providers that support restoring deleted secrets.
+type SecretRestorer interface {
+	// RestoreSecret restores a previously deleted secret.
+	RestoreSecret(ctx context.Context, name string) (*model.SecretRestoreResult, error)
+}
+
+// SecretDescriber provides secret metadata without the value.
+// This is an optional interface for providers that support separate describe operation.
+type SecretDescriber interface {
+	// DescribeSecret retrieves secret metadata without the value.
+	DescribeSecret(ctx context.Context, name string) (*model.SecretListItem, error)
+}
+
+// ============================================================================
+// Provider Layer Interfaces (Generic)
+// ============================================================================
+
+// TypedSecretReader provides type-safe access to secrets with metadata.
+// This is used internally by provider adapters.
+type TypedSecretReader[M any] interface {
+	// GetTypedSecret retrieves a secret with provider-specific metadata.
+	GetTypedSecret(ctx context.Context, name string, versionID string, versionStage string) (*model.TypedSecret[M], error)
+}
+
+// ============================================================================
+// Adapter Helpers
+// ============================================================================
+
+// PartialSecretReader wraps a TypedSecretReader to provide GetSecret method.
+type PartialSecretReader[M any] struct {
+	inner TypedSecretReader[M]
+}
+
+// WrapTypedSecretReader wraps a TypedSecretReader to implement partial SecretReader.
+func WrapTypedSecretReader[M any](r TypedSecretReader[M]) *PartialSecretReader[M] {
+	return &PartialSecretReader[M]{inner: r}
+}
+
+// GetSecret retrieves a secret and converts it to the base type.
+func (a *PartialSecretReader[M]) GetSecret(
+	ctx context.Context, name string, versionID string, versionStage string,
+) (*model.Secret, error) {
+	s, err := a.inner.GetTypedSecret(ctx, name, versionID, versionStage)
+	if err != nil {
+		return nil, err
+	}
+
+	return s.ToBase(), nil
+}
diff --git a/internal/provider/secret_test.go b/internal/provider/secret_test.go
new file mode 100644
index 00000000..16855121
--- /dev/null
+++ b/internal/provider/secret_test.go
@@ -0,0 +1,69 @@
+package provider_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mpyw/suve/internal/model"
+	"github.com/mpyw/suve/internal/provider"
+)
+
+// mockTypedSecretReader implements provider.TypedSecretReader for testing.
+type mockTypedSecretReader struct {
+	getTypedSecretFunc func(ctx context.Context, name, versionID, versionStage string) (*model.TypedSecret[model.AWSSecretMeta], error)
+}
+
+func (m *mockTypedSecretReader) GetTypedSecret(
+	ctx context.Context, name, versionID, versionStage string,
+) (*model.TypedSecret[model.AWSSecretMeta], error) {
+	return m.getTypedSecretFunc(ctx, name, versionID, versionStage)
+}
+
+func TestWrapTypedSecretReader_GetSecret(t *testing.T) {
+	t.Parallel()
+
+	t.Run("success", func(t *testing.T) {
+		t.Parallel()
+
+		mock := &mockTypedSecretReader{
+			getTypedSecretFunc: func(_ context.Context, name, versionID, _ string) (*model.TypedSecret[model.AWSSecretMeta], error) {
+				return &model.TypedSecret[model.AWSSecretMeta]{
+					Name:    name,
+					Value:   "test-value",
+					Version: versionID,
+					Metadata: model.AWSSecretMeta{
+						VersionStages: []string{"AWSCURRENT"},
+					},
+				}, nil
+			},
+		}
+
+		reader := provider.WrapTypedSecretReader[model.AWSSecretMeta](mock)
+		secret, err := reader.GetSecret(context.Background(), "test-secret", "v1", "AWSCURRENT")
+
+		require.NoError(t, err)
+		assert.Equal(t, "test-secret", secret.Name)
+		assert.Equal(t, "test-value", secret.Value)
+		assert.Equal(t, "v1", secret.Version)
+	})
+
+	t.Run("error", func(t *testing.T) {
+		t.Parallel()
+
+		mock := &mockTypedSecretReader{
+			getTypedSecretFunc: func(_ context.Context, _, _, _ string) (*model.TypedSecret[model.AWSSecretMeta], error) {
+				return nil, errors.New("not found")
+			},
+		}
+
+		reader := provider.WrapTypedSecretReader[model.AWSSecretMeta](mock)
+		_, err := reader.GetSecret(context.Background(), "test-secret", "v1", "AWSCURRENT")
+
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not found")
+	})
+}
diff --git a/internal/staging/cli/command.go b/internal/staging/cli/command.go
index dcc3d414..2de05862 100644
--- a/internal/staging/cli/command.go
+++ b/internal/staging/cli/command.go
@@ -68,7 +68,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 			opts := StatusOptions{
 				Verbose: cmd.Bool("verbose"),
@@ -155,7 +155,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 			opts := DiffOptions{
 				Name:      name,
@@ -245,7 +245,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 			strategy, err := cfg.Factory(ctx)
 			if err != nil {
@@ -322,7 +322,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 			strategy, err := cfg.Factory(ctx)
 			if err != nil {
@@ -398,7 +398,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 			parser := cfg.ParserFactory()
 
 			result, err := lifecycle.ExecuteRead0(ctx, store, lifecycle.CmdApply, func() error {
@@ -553,7 +553,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 			if hasVersion {
 				// Reset with version spec - write operation, auto-start the agent
@@ -689,7 +689,7 @@ EXAMPLES:
 				return fmt.Errorf("failed to get AWS identity: %w", err)
 			}
 
-			store := agent.NewStore(identity.AccountID, identity.Region)
+			store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 			strategy, err := cfg.Factory(ctx)
 			if err != nil {
@@ -742,7 +742,7 @@ func tagAction(cfg CommandConfig, usageMsg string, runner tagCommandRunner) func
 			return fmt.Errorf("failed to get AWS identity: %w", err)
 		}
 
-		store := agent.NewStore(identity.AccountID, identity.Region)
+		store := agent.NewStore(staging.AWSScope(identity.AccountID, identity.Region))
 
 		strategy, err := cfg.Factory(ctx)
 		if err != nil {
diff --git a/internal/staging/cli/stash.go b/internal/staging/cli/stash.go
index 94e65a43..33890947 100644
--- a/internal/staging/cli/stash.go
+++ b/internal/staging/cli/stash.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/mpyw/suve/internal/cli/passphrase"
 	"github.com/mpyw/suve/internal/cli/terminal"
+	"github.com/mpyw/suve/internal/staging"
 	"github.com/mpyw/suve/internal/staging/store/file"
 )
 
@@ -87,8 +88,8 @@ EXAMPLES:
 // fileStoreForReading creates a file store for reading operations.
 // It handles passphrase prompting if the file is encrypted.
 // If checkExists is true, returns an error if the file doesn't exist.
-func fileStoreForReading(cmd *cli.Command, accountID, region string, checkExists bool) (*file.Store, error) {
-	basicFileStore, err := file.NewStore(accountID, region)
+func fileStoreForReading(cmd *cli.Command, scope staging.Scope, checkExists bool) (*file.Store, error) {
+	basicFileStore, err := file.NewStore(scope)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create file store: %w", err)
 	}
@@ -134,5 +135,5 @@ func fileStoreForReading(cmd *cli.Command, accountID, region string, checkExists
 		}
 	}
 
-	return file.NewStoreWithPassphrase(accountID, region, pass)
+	return file.NewStoreWithPassphrase(scope, pass)
 }
diff --git a/internal/staging/cli/stash_drop.go b/internal/staging/cli/stash_drop.go
index 0c822e3e..b3c272bb 100644
--- a/internal/staging/cli/stash_drop.go
+++ b/internal/staging/cli/stash_drop.go
@@ -121,8 +121,10 @@ func globalStashDropAction() func(context.Context, *cli.Command) error {
 			return fmt.Errorf("failed to get AWS identity: %w", err)
 		}
 
+		scope := staging.AWSScope(identity.AccountID, identity.Region)
+
 		return lifecycle.ExecuteFile0(ctx, lifecycle.CmdStashDrop, func() error {
-			fileStore, err := file.NewStore(identity.AccountID, identity.Region)
+			fileStore, err := file.NewStore(scope)
 			if err != nil {
 				return fmt.Errorf("failed to create file store: %w", err)
 			}
@@ -200,9 +202,11 @@ func serviceStashDropAction(service staging.Service) func(context.Context, *cli.
 			return fmt.Errorf("failed to get AWS identity: %w", err)
 		}
 
+		scope := staging.AWSScope(identity.AccountID, identity.Region)
+
 		return lifecycle.ExecuteFile0(ctx, lifecycle.CmdStashDrop, func() error {
 			// Use fileStoreForReading which handles passphrase prompting for encrypted files
-			fileStore, err := fileStoreForReading(cmd, identity.AccountID, identity.Region, true)
+			fileStore, err := fileStoreForReading(cmd, scope, true)
 			if err != nil {
 				return err
 			}
diff --git a/internal/staging/cli/stash_drop_test.go b/internal/staging/cli/stash_drop_test.go
index cea436fb..917a0191 100644
--- a/internal/staging/cli/stash_drop_test.go
+++ b/internal/staging/cli/stash_drop_test.go
@@ -2,7 +2,7 @@ package cli_test
 
 import (
 	"bytes"
-	"encoding/json"
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
@@ -25,7 +25,6 @@ func TestGlobalDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data
 		state := staging.NewEmptyState()
@@ -39,11 +38,9 @@ func TestGlobalDropRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("secret-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.GlobalDropRunner{
@@ -51,12 +48,16 @@ func TestGlobalDropRunner_Run(t *testing.T) {
 			Stdout:    stdout,
 		}
 
-		err = runner.Run()
+		err := runner.Run()
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "All stashed changes dropped")
 
-		// File should be deleted
-		_, err = os.Stat(path)
+		// Files should be deleted
+		paramPath := filepath.Join(tmpDir, "param.json")
+		secretPath := filepath.Join(tmpDir, "secret.json")
+		_, err = os.Stat(paramPath)
+		assert.True(t, os.IsNotExist(err))
+		_, err = os.Stat(secretPath)
 		assert.True(t, os.IsNotExist(err))
 	})
 
@@ -64,10 +65,9 @@ func TestGlobalDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		// Don't create the file
+		// Don't create any files
 
-		fileStore := file.NewStoreWithPath(path)
+		fileStore := file.NewStoreWithDir(tmpDir)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.GlobalDropRunner{
@@ -89,7 +89,6 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with both services
 		state := staging.NewEmptyState()
@@ -103,11 +102,9 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("secret-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.ServiceDropRunner{
@@ -117,12 +114,16 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		}
 
 		// Drop only param service
-		err = runner.Run(t.Context())
+		err := runner.Run(t.Context())
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "Stashed param changes dropped")
 
-		// File should still exist with secret service
-		_, err = os.Stat(path)
+		// param.json should be deleted, secret.json should exist
+		paramPath := filepath.Join(tmpDir, "param.json")
+		secretPath := filepath.Join(tmpDir, "secret.json")
+		_, err = os.Stat(paramPath)
+		assert.True(t, os.IsNotExist(err))
+		_, err = os.Stat(secretPath)
 		require.NoError(t, err)
 
 		// Verify secret service is preserved
@@ -136,7 +137,6 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with tags
 		state := staging.NewEmptyState()
@@ -144,11 +144,9 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Add:    map[string]string{"env": "prod"},
 			Remove: maputil.NewSet("old-tag"),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.ServiceDropRunner{
@@ -157,12 +155,13 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Stdout:    stdout,
 		}
 
-		err = runner.Run(t.Context())
+		err := runner.Run(t.Context())
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "Stashed param changes dropped")
 
-		// File should be deleted (empty state)
-		_, err = os.Stat(path)
+		// param.json should be deleted (empty state)
+		paramPath := filepath.Join(tmpDir, "param.json")
+		_, err = os.Stat(paramPath)
 		assert.True(t, os.IsNotExist(err))
 	})
 
@@ -170,7 +169,6 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with only param service
 		state := staging.NewEmptyState()
@@ -179,11 +177,9 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("test-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.ServiceDropRunner{
@@ -193,7 +189,7 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		}
 
 		// Try to drop secret service which has no entries
-		err = runner.Run(t.Context())
+		err := runner.Run(t.Context())
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "no stashed changes for secret")
 	})
@@ -202,7 +198,6 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with only one service
 		state := staging.NewEmptyState()
@@ -211,11 +206,9 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("test-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.ServiceDropRunner{
@@ -225,11 +218,12 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		}
 
 		// Drop the only service
-		err = runner.Run(t.Context())
+		err := runner.Run(t.Context())
 		require.NoError(t, err)
 
 		// File should be deleted because state is now empty
-		_, err = os.Stat(path)
+		paramPath := filepath.Join(tmpDir, "param.json")
+		_, err = os.Stat(paramPath)
 		assert.True(t, os.IsNotExist(err))
 	})
 
@@ -237,7 +231,6 @@ func TestServiceDropRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with both services
 		state := staging.NewEmptyState()
@@ -251,11 +244,9 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("secret-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 
 		runner := &cli.ServiceDropRunner{
@@ -264,20 +255,20 @@ func TestServiceDropRunner_Run(t *testing.T) {
 			Stdout:    stdout,
 		}
 
-		err = runner.Run(t.Context())
+		err := runner.Run(t.Context())
 		require.NoError(t, err)
 
-		// File should still exist
-		_, err = os.Stat(path)
+		// secret.json should still exist, param.json should be deleted
+		paramPath := filepath.Join(tmpDir, "param.json")
+		secretPath := filepath.Join(tmpDir, "secret.json")
+		_, err = os.Stat(paramPath)
+		assert.True(t, os.IsNotExist(err))
+		_, err = os.Stat(secretPath)
 		require.NoError(t, err)
 
 		// Read and verify remaining data
-		//nolint:gosec // G304: path is from t.TempDir(), safe for test
-		remainingData, err := os.ReadFile(path)
+		remainingState, err := fileStore.Drain(t.Context(), staging.ServiceSecret, true)
 		require.NoError(t, err)
-
-		var remainingState staging.State
-		require.NoError(t, json.Unmarshal(remainingData, &remainingState))
 		assert.Empty(t, remainingState.Entries[staging.ServiceParam])
 		assert.Len(t, remainingState.Entries[staging.ServiceSecret], 1)
 	})
diff --git a/internal/staging/cli/stash_pop.go b/internal/staging/cli/stash_pop.go
index 00b2feb8..ed3df971 100644
--- a/internal/staging/cli/stash_pop.go
+++ b/internal/staging/cli/stash_pop.go
@@ -178,12 +178,14 @@ func stashPopAction(service staging.Service) func(context.Context, *cli.Command)
 			return fmt.Errorf("failed to get AWS identity: %w", err)
 		}
 
-		fileStore, err := fileStoreForReading(cmd, identity.AccountID, identity.Region, false)
+		scope := staging.AWSScope(identity.AccountID, identity.Region)
+
+		fileStore, err := fileStoreForReading(cmd, scope, false)
 		if err != nil {
 			return err
 		}
 
-		agentStore := agent.NewStore(identity.AccountID, identity.Region)
+		agentStore := agent.NewStore(scope)
 
 		err = lifecycle.ExecuteWrite0(ctx, agentStore, lifecycle.CmdStashPop, func() error {
 			// Check if agent has existing changes
diff --git a/internal/staging/cli/stash_push.go b/internal/staging/cli/stash_push.go
index 7f057a16..e4fb4e12 100644
--- a/internal/staging/cli/stash_push.go
+++ b/internal/staging/cli/stash_push.go
@@ -125,11 +125,12 @@ func stashPushAction(service staging.Service) func(context.Context, *cli.Command
 			return fmt.Errorf("failed to get AWS identity: %w", err)
 		}
 
-		agentStore := agent.NewStore(identity.AccountID, identity.Region)
+		scope := staging.AWSScope(identity.AccountID, identity.Region)
+		agentStore := agent.NewStore(scope)
 
 		result, err := lifecycle.ExecuteRead0(ctx, agentStore, lifecycle.CmdStashPush, func() error {
 			// Check if stash file already exists
-			basicFileStore, err := file.NewStore(identity.AccountID, identity.Region)
+			basicFileStore, err := file.NewStore(scope)
 			if err != nil {
 				return fmt.Errorf("failed to create file store: %w", err)
 			}
@@ -227,7 +228,7 @@ func stashPushAction(service staging.Service) func(context.Context, *cli.Command
 				// pass remains empty = plain text
 			}
 
-			fileStore, err := file.NewStoreWithPassphrase(identity.AccountID, identity.Region, pass)
+			fileStore, err := file.NewStoreWithPassphrase(scope, pass)
 			if err != nil {
 				return fmt.Errorf("failed to create file store: %w", err)
 			}
diff --git a/internal/staging/cli/stash_show.go b/internal/staging/cli/stash_show.go
index 597e7def..5c19ded2 100644
--- a/internal/staging/cli/stash_show.go
+++ b/internal/staging/cli/stash_show.go
@@ -129,8 +129,9 @@ func stashShowAction(service staging.Service) func(context.Context, *cli.Command
 			return fmt.Errorf("failed to get AWS identity: %w", err)
 		}
 
+		scope := staging.AWSScope(identity.AccountID, identity.Region)
 		err = lifecycle.ExecuteFile0(ctx, lifecycle.CmdStashShow, func() error {
-			fileStore, err := fileStoreForReading(cmd, identity.AccountID, identity.Region, true)
+			fileStore, err := fileStoreForReading(cmd, scope, true)
 			if err != nil {
 				return err
 			}
diff --git a/internal/staging/cli/stash_show_test.go b/internal/staging/cli/stash_show_test.go
index 299b2eaf..41f8308a 100644
--- a/internal/staging/cli/stash_show_test.go
+++ b/internal/staging/cli/stash_show_test.go
@@ -2,7 +2,7 @@ package cli_test
 
 import (
 	"bytes"
-	"encoding/json"
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
@@ -26,7 +26,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data
 		state := staging.NewEmptyState()
@@ -40,11 +39,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("secret-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -54,7 +51,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{})
+		err := runner.Run(t.Context(), cli.StashShowOptions{})
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "/app/config")
 		assert.Contains(t, stdout.String(), "my-secret")
@@ -65,7 +62,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with both services
 		state := staging.NewEmptyState()
@@ -79,11 +75,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("secret-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -93,7 +87,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{Service: staging.ServiceParam})
+		err := runner.Run(t.Context(), cli.StashShowOptions{Service: staging.ServiceParam})
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "/app/config")
 		assert.NotContains(t, stdout.String(), "my-secret")
@@ -104,7 +98,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with tags
 		state := staging.NewEmptyState()
@@ -112,11 +105,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Add:    map[string]string{"env": "prod"},
 			Remove: maputil.NewSet("old-tag"),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -126,7 +117,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{})
+		err := runner.Run(t.Context(), cli.StashShowOptions{})
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "/app/config")
 		assert.Contains(t, stdout.String(), "+1 tags")
@@ -137,7 +128,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with tags (add only)
 		state := staging.NewEmptyState()
@@ -145,11 +135,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Add:    map[string]string{"env": "prod", "team": "backend"},
 			Remove: maputil.NewSet[string](),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -159,7 +147,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{})
+		err := runner.Run(t.Context(), cli.StashShowOptions{})
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "/app/config")
 		assert.Contains(t, stdout.String(), "+2 tags")
@@ -170,7 +158,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with tags (remove only)
 		state := staging.NewEmptyState()
@@ -178,11 +165,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Add:    map[string]string{},
 			Remove: maputil.NewSet("deprecated", "obsolete"),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -192,7 +177,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{})
+		err := runner.Run(t.Context(), cli.StashShowOptions{})
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "/app/config")
 		assert.Contains(t, stdout.String(), "-2 tags")
@@ -203,10 +188,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		// Don't create the file
+		// Don't create any files
 
-		fileStore := file.NewStoreWithPath(path)
+		fileStore := file.NewStoreWithDir(tmpDir)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -225,7 +209,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data with only param service
 		state := staging.NewEmptyState()
@@ -234,11 +217,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("test-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -249,7 +230,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 		}
 
 		// Try to show secret service which has no entries
-		err = runner.Run(t.Context(), cli.StashShowOptions{Service: staging.ServiceSecret})
+		err := runner.Run(t.Context(), cli.StashShowOptions{Service: staging.ServiceSecret})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "no stashed changes for secret")
 	})
@@ -258,7 +239,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data
 		state := staging.NewEmptyState()
@@ -267,11 +247,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("test-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -281,7 +259,7 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{Verbose: true})
+		err := runner.Run(t.Context(), cli.StashShowOptions{Verbose: true})
 		require.NoError(t, err)
 		assert.Contains(t, stdout.String(), "/app/config")
 		// Verbose output includes the value
@@ -292,7 +270,6 @@ func TestStashShowRunner_Run(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
 		// Write test data
 		state := staging.NewEmptyState()
@@ -301,11 +278,9 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Value:     lo.ToPtr("test-value"),
 			StagedAt:  time.Now(),
 		}
-		data, err := json.MarshalIndent(state, "", "  ")
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(path, data, 0o600))
+		fileStore := file.NewStoreWithDir(tmpDir)
+		require.NoError(t, fileStore.WriteState(context.Background(), "", state))
 
-		fileStore := file.NewStoreWithPath(path)
 		stdout := &bytes.Buffer{}
 		stderr := &bytes.Buffer{}
 
@@ -315,11 +290,12 @@ func TestStashShowRunner_Run(t *testing.T) {
 			Stderr:    stderr,
 		}
 
-		err = runner.Run(t.Context(), cli.StashShowOptions{})
+		err := runner.Run(t.Context(), cli.StashShowOptions{})
 		require.NoError(t, err)
 
-		// File should still exist
-		_, err = os.Stat(path)
+		// File should still exist (param.json since we wrote param entries)
+		paramPath := filepath.Join(tmpDir, "param.json")
+		_, err = os.Stat(paramPath)
 		assert.NoError(t, err)
 	})
 }
diff --git a/internal/staging/param.go b/internal/staging/param.go
index 6fca4872..4eda7375 100644
--- a/internal/staging/param.go
+++ b/internal/staging/param.go
@@ -10,6 +10,8 @@ import (
 
 	"github.com/mpyw/suve/internal/api/paramapi"
 	"github.com/mpyw/suve/internal/infra"
+	"github.com/mpyw/suve/internal/provider"
+	awsparam "github.com/mpyw/suve/internal/provider/aws/param"
 	"github.com/mpyw/suve/internal/tagging"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
@@ -28,9 +30,11 @@ type ParamClient interface {
 // ParamStrategy implements ServiceStrategy for SSM Parameter Store.
 type ParamStrategy struct {
 	Client ParamClient
+	Reader provider.ParameterReader // for version resolution
 }
 
 // NewParamStrategy creates a new SSM Parameter Store strategy.
+// Note: Reader must be set separately for version resolution to work.
 func NewParamStrategy(client ParamClient) *ParamStrategy {
 	return &ParamStrategy{Client: client}
 }
@@ -189,14 +193,14 @@ func (s *ParamStrategy) FetchLastModified(ctx context.Context, name string) (tim
 func (s *ParamStrategy) FetchCurrent(ctx context.Context, name string) (*FetchResult, error) {
 	spec := &paramversion.Spec{Name: name}
 
-	param, err := paramversion.GetParameterWithVersion(ctx, s.Client, spec)
+	param, err := paramversion.GetParameterWithVersion(ctx, s.Reader, spec)
 	if err != nil {
 		return nil, err
 	}
 
 	return &FetchResult{
-		Value:      lo.FromPtr(param.Value),
-		Identifier: fmt.Sprintf("#%d", param.Version),
+		Value:      param.Value,
+		Identifier: "#" + param.Version,
 	}, nil
 }
 
@@ -248,7 +252,7 @@ func (s *ParamStrategy) ParseName(input string) (string, error) {
 func (s *ParamStrategy) FetchCurrentValue(ctx context.Context, name string) (*EditFetchResult, error) {
 	spec := &paramversion.Spec{Name: name}
 
-	param, err := paramversion.GetParameterWithVersion(ctx, s.Client, spec)
+	param, err := paramversion.GetParameterWithVersion(ctx, s.Reader, spec)
 	if err != nil {
 		if pnf := (*paramapi.ParameterNotFound)(nil); errors.As(err, &pnf) {
 			return nil, &ResourceNotFoundError{Err: err}
@@ -258,11 +262,11 @@ func (s *ParamStrategy) FetchCurrentValue(ctx context.Context, name string) (*Ed
 	}
 
 	result := &EditFetchResult{
-		Value: lo.FromPtr(param.Value),
+		Value: param.Value,
 	}
 
-	if param.LastModifiedDate != nil {
-		result.LastModified = *param.LastModifiedDate
+	if param.UpdatedAt != nil {
+		result.LastModified = *param.UpdatedAt
 	}
 
 	return result, nil
@@ -287,22 +291,29 @@ func (s *ParamStrategy) FetchVersion(ctx context.Context, input string) (value s
 		return "", "", err
 	}
 
-	param, err := paramversion.GetParameterWithVersion(ctx, s.Client, spec)
+	param, err := paramversion.GetParameterWithVersion(ctx, s.Reader, spec)
 	if err != nil {
 		return "", "", err
 	}
 
-	return lo.FromPtr(param.Value), fmt.Sprintf("#%d", param.Version), nil
+	return param.Value, "#" + param.Version, nil
 }
 
 // ParamFactory creates a FullStrategy with an initialized AWS client.
 func ParamFactory(ctx context.Context) (FullStrategy, error) {
+	// Create raw client for apply operations (paramapi interface)
 	client, err := infra.NewParamClient(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("failed to initialize AWS client: %w", err)
 	}
 
-	return NewParamStrategy(client), nil
+	// Create adapter for version resolution (provider interface)
+	adapter := awsparam.New(client)
+
+	return &ParamStrategy{
+		Client: client,
+		Reader: adapter,
+	}, nil
 }
 
 // ParamParserFactory creates a Parser without an AWS client.
diff --git a/internal/staging/param_test.go b/internal/staging/param_test.go
index c4aa4010..c99f0421 100644
--- a/internal/staging/param_test.go
+++ b/internal/staging/param_test.go
@@ -3,6 +3,7 @@ package staging_test
 import (
 	"context"
 	"errors"
+	"fmt"
 	"testing"
 	"time"
 
@@ -12,6 +13,7 @@ import (
 
 	"github.com/mpyw/suve/internal/api/paramapi"
 	"github.com/mpyw/suve/internal/maputil"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/staging"
 )
 
@@ -109,6 +111,32 @@ func (m *paramMockClient) ListTagsForResource(
 	return &paramapi.ListTagsForResourceOutput{}, nil
 }
 
+// paramReaderMock implements provider.ParameterReader for testing.
+type paramReaderMock struct {
+	getParameterFunc        func(ctx context.Context, name string, version string) (*model.Parameter, error)
+	getParameterHistoryFunc func(ctx context.Context, name string) (*model.ParameterHistory, error)
+}
+
+func (m *paramReaderMock) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
+	if m.getParameterFunc != nil {
+		return m.getParameterFunc(ctx, name, version)
+	}
+
+	return nil, fmt.Errorf("GetParameter not mocked")
+}
+
+func (m *paramReaderMock) GetParameterHistory(ctx context.Context, name string) (*model.ParameterHistory, error) {
+	if m.getParameterHistoryFunc != nil {
+		return m.getParameterHistoryFunc(ctx, name)
+	}
+
+	return nil, fmt.Errorf("GetParameterHistory not mocked")
+}
+
+func (m *paramReaderMock) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	return nil, fmt.Errorf("ListParameters not mocked")
+}
+
 func TestParamStrategy_BasicMethods(t *testing.T) {
 	t.Parallel()
 
@@ -326,19 +354,19 @@ func TestParamStrategy_FetchCurrent(t *testing.T) {
 	t.Run("success", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-				return &paramapi.GetParameterOutput{
-					Parameter: &paramapi.Parameter{
-						Name:    lo.ToPtr("/app/param"),
-						Value:   lo.ToPtr("current-value"),
-						Version: 5,
-					},
+		reader := &paramReaderMock{
+			getParameterFunc: func(_ context.Context, name string, _ string) (*model.Parameter, error) {
+				assert.Equal(t, "/app/param", name)
+
+				return &model.Parameter{
+					Name:    "/app/param",
+					Value:   "current-value",
+					Version: "5",
 				}, nil
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		result, err := s.FetchCurrent(t.Context(), "/app/param")
 		require.NoError(t, err)
 		assert.Equal(t, "current-value", result.Value)
@@ -348,13 +376,13 @@ func TestParamStrategy_FetchCurrent(t *testing.T) {
 	t.Run("error", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+		reader := &paramReaderMock{
+			getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 				return nil, errors.New("not found")
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		_, err := s.FetchCurrent(t.Context(), "/app/param")
 		require.Error(t, err)
 	})
@@ -413,18 +441,20 @@ func TestParamStrategy_FetchCurrentValue(t *testing.T) {
 	t.Run("success", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-				return &paramapi.GetParameterOutput{
-					Parameter: &paramapi.Parameter{
-						Value:            lo.ToPtr("fetched-value"),
-						LastModifiedDate: &now,
-					},
+		reader := &paramReaderMock{
+			getParameterFunc: func(_ context.Context, name string, _ string) (*model.Parameter, error) {
+				assert.Equal(t, "/app/param", name)
+
+				return &model.Parameter{
+					Name:      "/app/param",
+					Value:     "fetched-value",
+					Version:   "1",
+					UpdatedAt: &now,
 				}, nil
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		result, err := s.FetchCurrentValue(t.Context(), "/app/param")
 		require.NoError(t, err)
 		assert.Equal(t, "fetched-value", result.Value)
@@ -434,13 +464,13 @@ func TestParamStrategy_FetchCurrentValue(t *testing.T) {
 	t.Run("error", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+		reader := &paramReaderMock{
+			getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 				return nil, errors.New("fetch error")
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		_, err := s.FetchCurrentValue(t.Context(), "/app/param")
 		require.Error(t, err)
 	})
@@ -492,20 +522,20 @@ func TestParamStrategy_FetchVersion(t *testing.T) {
 	t.Run("success with version", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-				// Version selector uses GetParameter with name:version format
-				return &paramapi.GetParameterOutput{
-					Parameter: &paramapi.Parameter{
-						Name:    params.Name,
-						Value:   lo.ToPtr("v2"),
-						Version: 2,
-					},
+		reader := &paramReaderMock{
+			getParameterFunc: func(_ context.Context, name string, version string) (*model.Parameter, error) {
+				assert.Equal(t, "/app/param", name)
+				assert.Equal(t, "2", version)
+
+				return &model.Parameter{
+					Name:    "/app/param",
+					Value:   "v2",
+					Version: "2",
 				}, nil
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		value, label, err := s.FetchVersion(t.Context(), "/app/param#2")
 		require.NoError(t, err)
 		assert.Equal(t, "v2", value)
@@ -515,21 +545,22 @@ func TestParamStrategy_FetchVersion(t *testing.T) {
 	t.Run("success with shift", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterHistoryFunc: func(
-				_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options),
-			) (*paramapi.GetParameterHistoryOutput, error) {
-				return &paramapi.GetParameterHistoryOutput{
-					Parameters: []paramapi.ParameterHistory{
-						{Version: 1, Value: lo.ToPtr("v1")},
-						{Version: 2, Value: lo.ToPtr("v2")},
-						{Version: 3, Value: lo.ToPtr("v3")},
+		reader := &paramReaderMock{
+			getParameterHistoryFunc: func(_ context.Context, name string) (*model.ParameterHistory, error) {
+				assert.Equal(t, "/app/param", name)
+
+				return &model.ParameterHistory{
+					Name: "/app/param",
+					Parameters: []*model.Parameter{
+						{Name: "/app/param", Version: "1", Value: "v1"},
+						{Name: "/app/param", Version: "2", Value: "v2"},
+						{Name: "/app/param", Version: "3", Value: "v3"},
 					},
 				}, nil
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		value, label, err := s.FetchVersion(t.Context(), "/app/param~1")
 		require.NoError(t, err)
 		assert.Equal(t, "v2", value)
@@ -547,15 +578,13 @@ func TestParamStrategy_FetchVersion(t *testing.T) {
 	t.Run("fetch error", func(t *testing.T) {
 		t.Parallel()
 
-		mock := &paramMockClient{
-			getParameterHistoryFunc: func(
-				_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options),
-			) (*paramapi.GetParameterHistoryOutput, error) {
+		reader := &paramReaderMock{
+			getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 				return nil, errors.New("fetch error")
 			},
 		}
 
-		s := staging.NewParamStrategy(mock)
+		s := &staging.ParamStrategy{Reader: reader}
 		_, _, err := s.FetchVersion(t.Context(), "/app/param#2")
 		require.Error(t, err)
 	})
@@ -859,18 +888,20 @@ func TestParamStrategy_ApplyTags(t *testing.T) {
 func TestParamStrategy_FetchCurrentValue_NoLastModified(t *testing.T) {
 	t.Parallel()
 
-	mock := &paramMockClient{
-		getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			return &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Value:            lo.ToPtr("value"),
-					LastModifiedDate: nil,
-				},
+	reader := &paramReaderMock{
+		getParameterFunc: func(_ context.Context, name string, _ string) (*model.Parameter, error) {
+			assert.Equal(t, "/app/param", name)
+
+			return &model.Parameter{
+				Name:      "/app/param",
+				Value:     "value",
+				Version:   "1",
+				UpdatedAt: nil,
 			}, nil
 		},
 	}
 
-	s := staging.NewParamStrategy(mock)
+	s := &staging.ParamStrategy{Reader: reader}
 	result, err := s.FetchCurrentValue(t.Context(), "/app/param")
 	require.NoError(t, err)
 	assert.Equal(t, "value", result.Value)
diff --git a/internal/staging/scope.go b/internal/staging/scope.go
new file mode 100644
index 00000000..eb444953
--- /dev/null
+++ b/internal/staging/scope.go
@@ -0,0 +1,110 @@
+package staging
+
+import "fmt"
+
+// Provider represents a cloud provider.
+type Provider string
+
+const (
+	// ProviderAWS represents Amazon Web Services.
+	ProviderAWS Provider = "aws"
+	// ProviderGoogleCloud represents Google Cloud Platform.
+	ProviderGoogleCloud Provider = "googlecloud"
+	// ProviderAzure represents Microsoft Azure.
+	ProviderAzure Provider = "azure"
+)
+
+// Scope represents the staging scope.
+// Required fields vary by provider:
+//   - AWS: AccountID + Region (shared for param/secret)
+//   - GoogleCloud: ProjectID (secret only)
+//   - Azure: SubscriptionID + ResourceGroup + VaultName or StoreName
+type Scope struct {
+	Provider Provider `json:"provider"`
+
+	// AWS fields
+	AccountID string `json:"accountId,omitempty"`
+	Region    string `json:"region,omitempty"`
+
+	// GoogleCloud fields
+	ProjectID string `json:"projectId,omitempty"`
+
+	// Azure fields
+	SubscriptionID string `json:"subscriptionId,omitempty"`
+	ResourceGroup  string `json:"resourceGroup,omitempty"`
+	VaultName      string `json:"vaultName,omitempty"` // KeyVault (secret)
+	StoreName      string `json:"storeName,omitempty"` // AppConfig (param)
+}
+
+// Key returns a unique key for file paths.
+func (s Scope) Key() string {
+	switch s.Provider {
+	case ProviderAWS:
+		return fmt.Sprintf("aws/%s/%s", s.AccountID, s.Region)
+	case ProviderGoogleCloud:
+		return fmt.Sprintf("googlecloud/%s", s.ProjectID)
+	case ProviderAzure:
+		if s.VaultName != "" {
+			return fmt.Sprintf("azure/%s/%s/keyvault/%s", s.SubscriptionID, s.ResourceGroup, s.VaultName)
+		}
+
+		return fmt.Sprintf("azure/%s/%s/appconfig/%s", s.SubscriptionID, s.ResourceGroup, s.StoreName)
+	default:
+		return ""
+	}
+}
+
+// SupportsService returns true if the scope supports the given service type.
+func (s Scope) SupportsService(svc Service) bool {
+	switch s.Provider {
+	case ProviderAWS:
+		return true // supports both param and secret
+	case ProviderGoogleCloud:
+		return svc == ServiceSecret // Secret Manager only
+	case ProviderAzure:
+		if s.VaultName != "" {
+			return svc == ServiceSecret
+		}
+
+		return svc == ServiceParam
+	default:
+		return false
+	}
+}
+
+// AWSScope creates a Scope for AWS.
+func AWSScope(accountID, region string) Scope {
+	return Scope{
+		Provider:  ProviderAWS,
+		AccountID: accountID,
+		Region:    region,
+	}
+}
+
+// GoogleCloudScope creates a Scope for Google Cloud.
+func GoogleCloudScope(projectID string) Scope {
+	return Scope{
+		Provider:  ProviderGoogleCloud,
+		ProjectID: projectID,
+	}
+}
+
+// AzureKeyVaultScope creates a Scope for Azure Key Vault.
+func AzureKeyVaultScope(subscriptionID, resourceGroup, vaultName string) Scope {
+	return Scope{
+		Provider:       ProviderAzure,
+		SubscriptionID: subscriptionID,
+		ResourceGroup:  resourceGroup,
+		VaultName:      vaultName,
+	}
+}
+
+// AzureAppConfigScope creates a Scope for Azure App Configuration.
+func AzureAppConfigScope(subscriptionID, resourceGroup, storeName string) Scope {
+	return Scope{
+		Provider:       ProviderAzure,
+		SubscriptionID: subscriptionID,
+		ResourceGroup:  resourceGroup,
+		StoreName:      storeName,
+	}
+}
diff --git a/internal/staging/store/agent/daemon/internal/ipc/client.go b/internal/staging/store/agent/daemon/internal/ipc/client.go
index 08d146e6..0aa5ee13 100644
--- a/internal/staging/store/agent/daemon/internal/ipc/client.go
+++ b/internal/staging/store/agent/daemon/internal/ipc/client.go
@@ -23,15 +23,17 @@ const (
 var ErrNotConnected = errors.New("daemon not connected")
 
 // Client provides low-level IPC communication with the daemon.
+// A single client communicates with the scope-independent daemon.
 type Client struct {
 	socketPath string
 	mu         sync.Mutex
 }
 
-// NewClient creates a new IPC client for a specific AWS account and region.
-func NewClient(accountID, region string) *Client {
+// NewClient creates a new IPC client.
+// The client connects to the scope-independent daemon; scope is passed with each request.
+func NewClient() *Client {
 	return &Client{
-		socketPath: protocol.SocketPathForAccount(accountID, region),
+		socketPath: protocol.SocketPath(),
 	}
 }
 
diff --git a/internal/staging/store/agent/daemon/internal/ipc/client_internal_test.go b/internal/staging/store/agent/daemon/internal/ipc/client_internal_test.go
index be341db1..884497d7 100644
--- a/internal/staging/store/agent/daemon/internal/ipc/client_internal_test.go
+++ b/internal/staging/store/agent/daemon/internal/ipc/client_internal_test.go
@@ -17,17 +17,17 @@ import (
 func TestNewClient(t *testing.T) {
 	t.Parallel()
 
-	c := NewClient(testAccountID, testRegion)
+	c := NewClient()
 	require.NotNil(t, c)
 	assert.NotEmpty(t, c.socketPath)
-	assert.Contains(t, c.socketPath, testAccountID)
-	assert.Contains(t, c.socketPath, testRegion)
+	assert.Contains(t, c.socketPath, "agent.sock")
 }
 
 func TestClient_SendRequest_NotConnected(t *testing.T) {
 	t.Parallel()
 
-	c := NewClient("nonexistent", "nonexistent")
+	// Use a non-existent socket path
+	c := &Client{socketPath: "/nonexistent/path/to/socket.sock"}
 	resp, err := c.SendRequest(t.Context(), &protocol.Request{Method: protocol.MethodPing})
 
 	require.Error(t, err)
@@ -38,7 +38,8 @@ func TestClient_SendRequest_NotConnected(t *testing.T) {
 func TestClient_Ping_NotConnected(t *testing.T) {
 	t.Parallel()
 
-	c := NewClient("nonexistent", "nonexistent")
+	// Use a non-existent socket path
+	c := &Client{socketPath: "/nonexistent/path/to/socket.sock"}
 	err := c.Ping(t.Context())
 
 	require.Error(t, err)
diff --git a/internal/staging/store/agent/daemon/internal/ipc/server.go b/internal/staging/store/agent/daemon/internal/ipc/server.go
index b50688a7..0c02325d 100644
--- a/internal/staging/store/agent/daemon/internal/ipc/server.go
+++ b/internal/staging/store/agent/daemon/internal/ipc/server.go
@@ -36,9 +36,8 @@ type ResponseCallback func(*protocol.Request, *protocol.Response)
 type ShutdownCallback func()
 
 // Server provides low-level IPC server functionality.
+// A single server handles requests for all scopes.
 type Server struct {
-	accountID  string
-	region     string
 	listener   net.Listener
 	handler    RequestHandler
 	onResponse ResponseCallback
@@ -46,11 +45,10 @@ type Server struct {
 	wg         sync.WaitGroup
 }
 
-// NewServer creates a new IPC server for a specific AWS account and region.
-func NewServer(accountID, region string, handler RequestHandler, onResponse ResponseCallback, onShutdown ShutdownCallback) *Server {
+// NewServer creates a new IPC server.
+// The server is scope-independent; scope is passed with each request.
+func NewServer(handler RequestHandler, onResponse ResponseCallback, onShutdown ShutdownCallback) *Server {
 	return &Server{
-		accountID:  accountID,
-		region:     region,
 		handler:    handler,
 		onResponse: onResponse,
 		onShutdown: onShutdown,
@@ -63,7 +61,7 @@ func (s *Server) Start(ctx context.Context) error {
 		return fmt.Errorf("failed to setup process security: %w", err)
 	}
 
-	socketPath := protocol.SocketPathForAccount(s.accountID, s.region)
+	socketPath := protocol.SocketPath()
 
 	if err := s.createSocketDir(socketPath); err != nil {
 		return err
diff --git a/internal/staging/store/agent/daemon/internal/ipc/server_internal_test.go b/internal/staging/store/agent/daemon/internal/ipc/server_internal_test.go
index 87faad75..7992f847 100644
--- a/internal/staging/store/agent/daemon/internal/ipc/server_internal_test.go
+++ b/internal/staging/store/agent/daemon/internal/ipc/server_internal_test.go
@@ -16,11 +16,6 @@ import (
 	"github.com/mpyw/suve/internal/staging/store/agent/internal/protocol"
 )
 
-const (
-	testAccountID = "123456789012"
-	testRegion    = "us-east-1"
-)
-
 func TestNewServer(t *testing.T) {
 	t.Parallel()
 
@@ -30,10 +25,8 @@ func TestNewServer(t *testing.T) {
 	callback := func(_ *protocol.Request, _ *protocol.Response) {}
 	shutdownCb := func() {}
 
-	s := NewServer(testAccountID, testRegion, handler, callback, shutdownCb)
+	s := NewServer(handler, callback, shutdownCb)
 	require.NotNil(t, s)
-	assert.Equal(t, testAccountID, s.accountID)
-	assert.Equal(t, testRegion, s.region)
 	assert.NotNil(t, s.handler)
 	assert.NotNil(t, s.onResponse)
 	assert.NotNil(t, s.onShutdown)
@@ -46,7 +39,7 @@ func TestServer_ServeClosesListenerOnCancel(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	// Create a temporary listener using TCP for easier testing
 	// (Unix socket paths have length limits on some platforms)
@@ -86,7 +79,7 @@ func TestServer_sendError(t *testing.T) {
 	handler := func(_ *protocol.Request) *protocol.Response {
 		return &protocol.Response{Success: true}
 	}
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	// Use a pipe to capture the response
 	client, server := net.Pipe()
@@ -126,7 +119,7 @@ func TestServer_sendError_withMockConn(t *testing.T) {
 	handler := func(_ *protocol.Request) *protocol.Response {
 		return &protocol.Response{Success: true}
 	}
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	buf := &bytes.Buffer{}
 	conn := &mockConn{Buffer: buf}
@@ -162,10 +155,7 @@ func TestServer_handleConnection_validRequest(t *testing.T) {
 		callbackCalled = true
 	}
 
-	accountID := "hc-valid"
-	region := "r1"
-
-	s := NewServer(accountID, region, handler, callback, nil)
+	s := NewServer(handler, callback, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -175,7 +165,7 @@ func TestServer_handleConnection_validRequest(t *testing.T) {
 
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Connect and send a request
 	conn, err := (&net.Dialer{Timeout: time.Second}).DialContext(t.Context(), "unix", socketPath)
@@ -217,10 +207,7 @@ func TestServer_handleConnection_invalidJSON(t *testing.T) {
 		return nil
 	}
 
-	accountID := "hc-invalidjson"
-	region := "r1"
-
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -230,7 +217,7 @@ func TestServer_handleConnection_invalidJSON(t *testing.T) {
 
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Connect and send invalid JSON
 	conn, err := (&net.Dialer{Timeout: time.Second}).DialContext(t.Context(), "unix", socketPath)
@@ -279,10 +266,7 @@ func TestServer_handleConnection_shutdownCallback(t *testing.T) {
 		close(shutdownCalled)
 	}
 
-	accountID := "hc-shutdown"
-	region := "r1"
-
-	s := NewServer(accountID, region, handler, callback, shutdownCb)
+	s := NewServer(handler, callback, shutdownCb)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -292,7 +276,7 @@ func TestServer_handleConnection_shutdownCallback(t *testing.T) {
 
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Connect and send a request
 	conn, err := (&net.Dialer{Timeout: time.Second}).DialContext(t.Context(), "unix", socketPath)
@@ -338,11 +322,8 @@ func TestServer_handleConnection_nilCallbacks(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	accountID := "hc-nil"
-	region := "r1"
-
 	// Create server with nil callbacks
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -352,7 +333,7 @@ func TestServer_handleConnection_nilCallbacks(t *testing.T) {
 
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Connect and send a request
 	conn, err := (&net.Dialer{Timeout: time.Second}).DialContext(t.Context(), "unix", socketPath)
@@ -388,7 +369,7 @@ func TestServer_handleConnection_EOF(t *testing.T) {
 		return nil
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	client, server := net.Pipe()
 
@@ -413,14 +394,11 @@ func TestServer_Start(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "s1"
-	region := "r1"
-
 	handler := func(_ *protocol.Request) *protocol.Response {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -428,7 +406,7 @@ func TestServer_Start(t *testing.T) {
 	defer func() { _ = s.listener.Close() }()
 
 	// Verify socket file exists
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 	info, err := os.Stat(socketPath)
 	require.NoError(t, err)
 	assert.NotNil(t, info)
@@ -445,10 +423,7 @@ func TestServer_Start_RemovesExistingSocket(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "s2"
-	region := "r2"
-
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Create socket directory and a stale socket file
 	err = os.MkdirAll(filepath.Dir(socketPath), 0o700)
@@ -460,7 +435,7 @@ func TestServer_Start_RemovesExistingSocket(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -481,9 +456,6 @@ func TestServer_Serve(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "s3"
-	region := "r3"
-
 	requestsHandled := 0
 	handler := func(_ *protocol.Request) *protocol.Response {
 		requestsHandled++
@@ -491,7 +463,7 @@ func TestServer_Serve(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -502,7 +474,7 @@ func TestServer_Serve(t *testing.T) {
 	// Run Serve in background
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Connect and send a request
 	conn, err := (&net.Dialer{Timeout: time.Second}).DialContext(t.Context(), "unix", socketPath)
@@ -538,14 +510,11 @@ func TestServer_Serve_MultipleConnections(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "s4"
-	region := "r4"
-
 	handler := func(_ *protocol.Request) *protocol.Response {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -555,7 +524,7 @@ func TestServer_Serve_MultipleConnections(t *testing.T) {
 
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Send multiple concurrent requests
 	const numRequests = 5
@@ -627,7 +596,7 @@ func TestServer_createSocketDir(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	// Create a nested socket path
 	socketPath := filepath.Join(tmpDir, "nested", "deep", "socket.sock")
@@ -656,7 +625,7 @@ func TestServer_removeExistingSocket(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	t.Run("removes existing file", func(t *testing.T) {
 		t.Parallel()
@@ -694,7 +663,7 @@ func TestServer_setSocketPermissions(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	// Create a test file with loose permissions
 	socketPath := filepath.Join(tmpDir, "test.sock")
@@ -718,7 +687,7 @@ func TestServer_Serve_AcceptError(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	// Create a TCP listener for testing
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", "127.0.0.1:0")
@@ -762,7 +731,7 @@ func TestServer_createSocketDir_Error(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	t.Run("mkdir fails on invalid path", func(t *testing.T) {
 		t.Parallel()
@@ -797,7 +766,7 @@ func TestServer_removeExistingSocket_Error(t *testing.T) {
 	handler := func(_ *protocol.Request) *protocol.Response {
 		return &protocol.Response{Success: true}
 	}
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	t.Run("remove fails on read-only directory", func(t *testing.T) {
 		t.Parallel()
@@ -835,7 +804,7 @@ func TestServer_setSocketPermissions_Error(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	s := NewServer(testAccountID, testRegion, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	t.Run("chmod fails on non-existent file", func(t *testing.T) {
 		t.Parallel()
@@ -853,7 +822,7 @@ func TestServer_Start_CreateSocketDirError(t *testing.T) {
 	// /proc/1/root is only accessible by root, and creating directories there will fail
 	invalidPath := "/proc/1/root/nonexistent-suve-test"
 
-	// On Linux, socketPathForAccount uses XDG_RUNTIME_DIR first, then fallback to /tmp
+	// On Linux, socketPath uses XDG_RUNTIME_DIR first, then fallback to /tmp
 	// Set both to ensure the invalid path is used regardless of platform
 	t.Setenv("XDG_RUNTIME_DIR", invalidPath)
 	t.Setenv("TMPDIR", invalidPath)
@@ -862,10 +831,7 @@ func TestServer_Start_CreateSocketDirError(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	accountID := "start-mkdir-err"
-	region := "r1"
-
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err := s.Start(t.Context())
 	// On Linux with /proc/1/root, this should fail with permission denied or path error
@@ -879,19 +845,16 @@ func TestServer_Start_ListenError(t *testing.T) {
 	tmpDir, err := os.MkdirTemp("/tmp", "suve-listen-*")
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
-	// On Linux, socketPathForAccount uses XDG_RUNTIME_DIR first
+	// On Linux, socketPath uses XDG_RUNTIME_DIR first
 	t.Setenv("XDG_RUNTIME_DIR", tmpDir)
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "start-listen-err"
-	region := "r1"
-
 	handler := func(_ *protocol.Request) *protocol.Response {
 		return &protocol.Response{Success: true}
 	}
 
 	// First start a server on the socket
-	s1 := NewServer(accountID, region, handler, nil, nil)
+	s1 := NewServer(handler, nil, nil)
 	err = s1.Start(t.Context())
 	require.NoError(t, err)
 
@@ -918,8 +881,8 @@ func TestServer_Start_ListenErrorLongPath(t *testing.T) {
 		return &protocol.Response{Success: true}
 	}
 
-	// Use a very long account ID to make the socket path too long (Unix sockets have ~104-108 byte limit)
 	// Create nested directories to make the path very long
+	// (Unix sockets have ~104-108 byte limit)
 	longPath := tmpDir
 	for range 10 {
 		longPath = filepath.Join(longPath, "abcdefghij")
@@ -927,14 +890,11 @@ func TestServer_Start_ListenErrorLongPath(t *testing.T) {
 	//nolint:gosec // G302: standard directory permissions for test
 	err := os.MkdirAll(longPath, 0o755)
 	require.NoError(t, err)
-	// On Linux, socketPathForAccount uses XDG_RUNTIME_DIR first
+	// On Linux, socketPath uses XDG_RUNTIME_DIR first
 	t.Setenv("XDG_RUNTIME_DIR", longPath)
 	t.Setenv("TMPDIR", longPath)
 
-	accountID := "very-long-account-id-that-makes-path-too-long"
-	region := "very-long-region-name-for-testing"
-
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 	err = s.Start(t.Context())
 	// Either succeed (if path fits) or fail with listen error
 	if err != nil {
@@ -965,11 +925,8 @@ func TestServer_handleConnection_WillShutdownWithNilCallback(t *testing.T) {
 		return &protocol.Response{Success: true, WillShutdown: true}
 	}
 
-	accountID := "hc-willshutdown"
-	region := "r1"
-
 	// Create server with nil shutdown callback but non-nil response callback
-	s := NewServer(accountID, region, handler, nil, nil)
+	s := NewServer(handler, nil, nil)
 
 	err = s.Start(t.Context())
 	require.NoError(t, err)
@@ -979,7 +936,7 @@ func TestServer_handleConnection_WillShutdownWithNilCallback(t *testing.T) {
 
 	go s.Serve(ctx)
 
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Connect and send a request
 	conn, err := (&net.Dialer{Timeout: time.Second}).DialContext(t.Context(), "unix", socketPath)
diff --git a/internal/staging/store/agent/daemon/launcher.go b/internal/staging/store/agent/daemon/launcher.go
index 4b8f5bee..8219e34d 100644
--- a/internal/staging/store/agent/daemon/launcher.go
+++ b/internal/staging/store/agent/daemon/launcher.go
@@ -22,20 +22,20 @@ const (
 // processSpawner is an interface for spawning daemon processes.
 // This allows mocking in tests.
 type processSpawner interface {
-	Spawn(accountID, region string) error
+	Spawn() error
 }
 
 // defaultProcessSpawner spawns daemon processes using exec.Command.
 type defaultProcessSpawner struct{}
 
-func (s *defaultProcessSpawner) Spawn(accountID, region string) error {
+func (s *defaultProcessSpawner) Spawn() error {
 	executable, err := os.Executable()
 	if err != nil {
 		return fmt.Errorf("failed to get executable path: %w", err)
 	}
 
 	//nolint:gosec,noctx // G204: executable is from os.Executable(), not user input; noctx: intentionally no context for background daemon
-	cmd := exec.Command(executable, "stage", "agent", "start", "--foreground", "--account", accountID, "--region", region)
+	cmd := exec.Command(executable, "stage", "agent", "start", "--foreground")
 	cmd.Stdout = nil
 	cmd.Stderr = nil
 	cmd.Stdin = nil
@@ -69,22 +69,20 @@ func withSpawner(spawner processSpawner) LauncherOption {
 }
 
 // Launcher manages daemon startup and connectivity.
+// A single launcher communicates with the scope-independent daemon.
 type Launcher struct {
-	accountID         string
-	region            string
 	client            *ipc.Client
 	spawner           processSpawner
 	autoStartDisabled bool
 	mu                sync.Mutex // protects EnsureRunning from concurrent calls
 }
 
-// NewLauncher creates a new daemon launcher for a specific AWS account and region.
-func NewLauncher(accountID, region string, opts ...LauncherOption) *Launcher {
+// NewLauncher creates a new daemon launcher.
+// The launcher is scope-independent; scope is passed with each request.
+func NewLauncher(opts ...LauncherOption) *Launcher {
 	l := &Launcher{
-		accountID: accountID,
-		region:    region,
-		client:    ipc.NewClient(accountID, region),
-		spawner:   &defaultProcessSpawner{},
+		client:  ipc.NewClient(),
+		spawner: &defaultProcessSpawner{},
 	}
 	for _, opt := range opts {
 		opt(l)
@@ -125,7 +123,7 @@ func (l *Launcher) EnsureRunning(ctx context.Context) error {
 	deadline := time.Now().Add(connectTimeout)
 	for time.Now().Before(deadline) {
 		if err := l.client.Ping(ctx); err == nil {
-			output.Info(os.Stderr, "Staging agent started for account %s (%s)", l.accountID, l.region)
+			output.Info(os.Stderr, "Staging agent started")
 
 			return nil
 		}
@@ -150,11 +148,10 @@ func (l *Launcher) Shutdown(ctx context.Context) error {
 func (l *Launcher) startProcess() error {
 	if l.autoStartDisabled {
 		return fmt.Errorf(
-			"daemon not running and auto-start is disabled; "+
-				"run 'suve stage agent start --account %s --region %s' manually",
-			l.accountID, l.region,
+			"daemon not running and auto-start is disabled; " +
+				"start agent manually with 'suve stage agent start'",
 		)
 	}
 
-	return l.spawner.Spawn(l.accountID, l.region)
+	return l.spawner.Spawn()
 }
diff --git a/internal/staging/store/agent/daemon/launcher_internal_test.go b/internal/staging/store/agent/daemon/launcher_internal_test.go
index cabcd0ab..2a6d0e19 100644
--- a/internal/staging/store/agent/daemon/launcher_internal_test.go
+++ b/internal/staging/store/agent/daemon/launcher_internal_test.go
@@ -13,26 +13,20 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/staging/store/agent/daemon/internal/ipc"
 	"github.com/mpyw/suve/internal/staging/store/agent/internal/protocol"
 )
 
-const (
-	testAccountID = "123456789012"
-	testRegion    = "us-east-1"
-)
-
 // mockSpawner is a test mock for processSpawner.
 type mockSpawner struct {
-	spawnFunc  func(accountID, region string) error
+	spawnFunc  func() error
 	spawnCount atomic.Int32
 }
 
-func (m *mockSpawner) Spawn(accountID, region string) error {
+func (m *mockSpawner) Spawn() error {
 	m.spawnCount.Add(1)
 
 	if m.spawnFunc != nil {
-		return m.spawnFunc(accountID, region)
+		return m.spawnFunc()
 	}
 
 	return nil
@@ -44,18 +38,16 @@ func TestNewLauncher(t *testing.T) {
 	t.Run("default options", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion)
+		l := NewLauncher()
 		require.NotNil(t, l)
 		assert.NotNil(t, l.client)
-		assert.Equal(t, testAccountID, l.accountID)
-		assert.Equal(t, testRegion, l.region)
 		assert.False(t, l.autoStartDisabled)
 	})
 
 	t.Run("with auto start disabled", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion, WithAutoStartDisabled())
+		l := NewLauncher(WithAutoStartDisabled())
 		require.NotNil(t, l)
 		assert.True(t, l.autoStartDisabled)
 	})
@@ -67,14 +59,12 @@ func TestLauncher_startProcess(t *testing.T) {
 	t.Run("auto start disabled returns error", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion, WithAutoStartDisabled())
+		l := NewLauncher(WithAutoStartDisabled())
 
 		err := l.startProcess()
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "daemon not running and auto-start is disabled")
 		assert.Contains(t, err.Error(), "suve stage agent start")
-		assert.Contains(t, err.Error(), "--account")
-		assert.Contains(t, err.Error(), "--region")
 	})
 }
 
@@ -84,7 +74,7 @@ func TestLauncher_EnsureRunning(t *testing.T) {
 	t.Run("daemon not running and auto start disabled", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion, WithAutoStartDisabled())
+		l := NewLauncher(WithAutoStartDisabled())
 
 		// EnsureRunning should fail because daemon is not running
 		// and auto-start is disabled
@@ -100,7 +90,7 @@ func TestLauncher_Ping(t *testing.T) {
 	t.Run("daemon not running", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion, WithAutoStartDisabled())
+		l := NewLauncher(WithAutoStartDisabled())
 
 		err := l.Ping(t.Context())
 		require.Error(t, err)
@@ -115,7 +105,7 @@ func TestLauncher_Shutdown(t *testing.T) {
 	t.Run("daemon not running", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion, WithAutoStartDisabled())
+		l := NewLauncher(WithAutoStartDisabled())
 
 		err := l.Shutdown(t.Context())
 		require.Error(t, err)
@@ -129,7 +119,7 @@ func TestLauncher_SendRequest(t *testing.T) {
 	t.Run("daemon not running", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion, WithAutoStartDisabled())
+		l := NewLauncher(WithAutoStartDisabled())
 
 		resp, err := l.SendRequest(t.Context(), &protocol.Request{Method: protocol.MethodPing})
 		require.Error(t, err)
@@ -144,10 +134,7 @@ func TestLauncher_EnsureRunning_AlreadyRunning(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "b1"
-	region := "r1"
-
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Create socket directory
 	err = os.MkdirAll(filepath.Dir(socketPath), 0o700)
@@ -186,7 +173,7 @@ func TestLauncher_EnsureRunning_AlreadyRunning(t *testing.T) {
 	}()
 
 	// EnsureRunning should succeed immediately (daemon already running)
-	l := NewLauncher(accountID, region, WithAutoStartDisabled())
+	l := NewLauncher(WithAutoStartDisabled())
 	err = l.EnsureRunning(t.Context())
 	require.NoError(t, err)
 }
@@ -195,7 +182,7 @@ func TestLauncher_MultipleOptions(t *testing.T) {
 	t.Parallel()
 
 	// Test that options are applied in order
-	l := NewLauncher(testAccountID, testRegion,
+	l := NewLauncher(
 		WithAutoStartDisabled(),
 	)
 	require.NotNil(t, l)
@@ -209,10 +196,7 @@ func TestLauncher_PingWithRunningDaemon(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "b2"
-	region := "r2"
-
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Create socket directory
 	err = os.MkdirAll(filepath.Dir(socketPath), 0o700)
@@ -250,7 +234,7 @@ func TestLauncher_PingWithRunningDaemon(t *testing.T) {
 		}
 	}()
 
-	l := NewLauncher(accountID, region, WithAutoStartDisabled())
+	l := NewLauncher(WithAutoStartDisabled())
 	err = l.Ping(t.Context())
 	require.NoError(t, err)
 }
@@ -262,10 +246,7 @@ func TestLauncher_ShutdownWithRunningDaemon(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "b3"
-	region := "r3"
-
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Create socket directory
 	err = os.MkdirAll(filepath.Dir(socketPath), 0o700)
@@ -303,7 +284,7 @@ func TestLauncher_ShutdownWithRunningDaemon(t *testing.T) {
 		}
 	}()
 
-	l := NewLauncher(accountID, region, WithAutoStartDisabled())
+	l := NewLauncher(WithAutoStartDisabled())
 	err = l.Shutdown(t.Context())
 	require.NoError(t, err)
 }
@@ -315,10 +296,7 @@ func TestLauncher_ShutdownWithServerError(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "b4"
-	region := "r4"
-
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Create socket directory
 	err = os.MkdirAll(filepath.Dir(socketPath), 0o700)
@@ -356,7 +334,7 @@ func TestLauncher_ShutdownWithServerError(t *testing.T) {
 		}
 	}()
 
-	l := NewLauncher(accountID, region, WithAutoStartDisabled())
+	l := NewLauncher(WithAutoStartDisabled())
 	err = l.Shutdown(t.Context())
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "shutdown failed")
@@ -369,11 +347,8 @@ func TestLauncher_EnsureRunning_Timeout(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "b5"
-	region := "r5"
-
 	// Don't create a socket - let it timeout
-	l := NewLauncher(accountID, region, WithAutoStartDisabled())
+	l := NewLauncher(WithAutoStartDisabled())
 
 	// This should fail because daemon is not running and auto-start is disabled
 	start := time.Now()
@@ -391,11 +366,8 @@ func TestLauncher_EnsureRunning_Timeout(t *testing.T) {
 func TestLauncher_ClientIntegration(t *testing.T) {
 	t.Parallel()
 
-	l := NewLauncher(testAccountID, testRegion)
+	l := NewLauncher()
 	require.NotNil(t, l.client)
-
-	// Verify the client is an IPC client
-	_ = ipc.NewClient(testAccountID, testRegion) // Just verify the import works
 }
 
 // TestLauncher_EnsureRunning_WithMockSpawner tests EnsureRunning with a mock spawner.
@@ -406,10 +378,7 @@ func TestLauncher_EnsureRunning_WithMockSpawner(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "m1"
-	region := "r1"
-
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 
 	// Create socket directory
 	err = os.MkdirAll(filepath.Dir(socketPath), 0o700)
@@ -420,11 +389,7 @@ func TestLauncher_EnsureRunning_WithMockSpawner(t *testing.T) {
 
 	var listener net.Listener
 
-	spawner.spawnFunc = func(aid, reg string) error {
-		// Verify correct parameters
-		assert.Equal(t, accountID, aid)
-		assert.Equal(t, region, reg)
-
+	spawner.spawnFunc = func() error {
 		// Start mock server
 		var err error
 
@@ -468,7 +433,7 @@ func TestLauncher_EnsureRunning_WithMockSpawner(t *testing.T) {
 		}
 	}()
 
-	l := NewLauncher(accountID, region, withSpawner(spawner))
+	l := NewLauncher(withSpawner(spawner))
 
 	// EnsureRunning should start the daemon via spawner and then ping successfully
 	err = l.EnsureRunning(t.Context())
@@ -486,16 +451,13 @@ func TestLauncher_EnsureRunning_SpawnError(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "m2"
-	region := "r2"
-
 	spawner := &mockSpawner{
-		spawnFunc: func(_, _ string) error {
+		spawnFunc: func() error {
 			return errors.New("spawn failed")
 		},
 	}
 
-	l := NewLauncher(accountID, region, withSpawner(spawner))
+	l := NewLauncher(withSpawner(spawner))
 
 	err = l.EnsureRunning(t.Context())
 	require.Error(t, err)
@@ -511,18 +473,15 @@ func TestLauncher_EnsureRunning_TimeoutWithMockSpawner(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "m3"
-	region := "r3"
-
 	// Spawner that succeeds but doesn't start a server
 	spawner := &mockSpawner{
-		spawnFunc: func(_, _ string) error {
+		spawnFunc: func() error {
 			// Don't actually start anything - simulate daemon failing to start
 			return nil
 		},
 	}
 
-	l := NewLauncher(accountID, region, withSpawner(spawner))
+	l := NewLauncher(withSpawner(spawner))
 
 	// Should timeout since no daemon is listening
 	err = l.EnsureRunning(t.Context())
@@ -538,7 +497,7 @@ func TestLauncher_startProcess_WithMockSpawner(t *testing.T) {
 		t.Parallel()
 
 		spawner := &mockSpawner{}
-		l := NewLauncher(testAccountID, testRegion, withSpawner(spawner))
+		l := NewLauncher(withSpawner(spawner))
 
 		err := l.startProcess()
 		require.NoError(t, err)
@@ -549,11 +508,11 @@ func TestLauncher_startProcess_WithMockSpawner(t *testing.T) {
 		t.Parallel()
 
 		spawner := &mockSpawner{
-			spawnFunc: func(_, _ string) error {
+			spawnFunc: func() error {
 				return errors.New("failed to spawn")
 			},
 		}
-		l := NewLauncher(testAccountID, testRegion, withSpawner(spawner))
+		l := NewLauncher(withSpawner(spawner))
 
 		err := l.startProcess()
 		require.Error(t, err)
@@ -570,14 +529,14 @@ func TestDefaultProcessSpawner_Spawn(t *testing.T) {
 		// Since the test binary doesn't have "stage agent start" command, it will exit
 		// quickly, but the Spawn itself should succeed (process starts and releases).
 		spawner := &defaultProcessSpawner{}
-		err := spawner.Spawn(testAccountID, testRegion)
+		err := spawner.Spawn()
 		require.NoError(t, err)
 	})
 
 	t.Run("launcher uses default spawner", func(t *testing.T) {
 		t.Parallel()
 
-		l := NewLauncher(testAccountID, testRegion)
+		l := NewLauncher()
 		require.NotNil(t, l.spawner)
 		// Verify it's the default spawner type
 		_, ok := l.spawner.(*defaultProcessSpawner)
@@ -590,7 +549,7 @@ func TestWithSpawner(t *testing.T) {
 	t.Parallel()
 
 	spawner := &mockSpawner{}
-	l := NewLauncher(testAccountID, testRegion, withSpawner(spawner))
+	l := NewLauncher(withSpawner(spawner))
 
 	require.Same(t, spawner, l.spawner)
 }
diff --git a/internal/staging/store/agent/daemon/process_internal_test.go b/internal/staging/store/agent/daemon/process_internal_test.go
index c03279ea..d412bfa9 100644
--- a/internal/staging/store/agent/daemon/process_internal_test.go
+++ b/internal/staging/store/agent/daemon/process_internal_test.go
@@ -1,8 +1,8 @@
 package daemon
 
 import (
+	"encoding/json"
 	"os"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -14,40 +14,14 @@ import (
 	"github.com/mpyw/suve/internal/staging/store/agent/internal/protocol"
 )
 
-// TestDaemonProcess_AccountIsolation tests that daemons for different accounts are isolated.
-func TestDaemonProcess_AccountIsolation(t *testing.T) {
-	t.Parallel()
-
-	account1 := "111111111111"
-	account2 := "222222222222"
-	region := "us-east-1"
-
-	// Socket paths should be different for different accounts
-	path1 := protocol.SocketPathForAccount(account1, region)
-	path2 := protocol.SocketPathForAccount(account2, region)
-
-	assert.NotEqual(t, path1, path2, "different accounts should have different socket paths")
-	assert.Contains(t, path1, account1)
-	assert.Contains(t, path2, account2)
-}
-
-// TestDaemonProcess_RegionIsolation tests that daemons for different regions are isolated.
-func TestDaemonProcess_RegionIsolation(t *testing.T) {
-	t.Parallel()
-
-	account := "123456789012"
-	region1 := "us-east-1"
-	region2 := "us-west-2"
-
-	// Socket paths should be different for different regions
-	path1 := protocol.SocketPathForAccount(account, region1)
-	path2 := protocol.SocketPathForAccount(account, region2)
-
-	assert.NotEqual(t, path1, path2, "different regions should have different socket paths")
-	assert.Contains(t, path1, region1)
-	assert.Contains(t, path1, region1)
-	assert.Contains(t, path2, region2)
-}
+// testProcessScope1 and testProcessScope2 are used in tests that need to verify
+// a single daemon can handle multiple scopes.
+//
+//nolint:gochecknoglobals // Test-only constants
+var (
+	testProcessScope1 = staging.AWSScope("111111111111", "us-east-1")
+	testProcessScope2 = staging.AWSScope("222222222222", "us-west-2")
+)
 
 // TestDaemonProcess_StartupAndShutdown tests daemon startup and shutdown.
 // Note: This test cannot run in parallel because it modifies TMPDIR.
@@ -58,11 +32,8 @@ func TestDaemonProcess_StartupAndShutdown(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a1"
-	region := "r1"
-
 	// Create daemon with auto-shutdown disabled for controlled testing
-	runner := NewRunner(accountID, region, WithAutoShutdownDisabled())
+	runner := NewRunner(WithAutoShutdownDisabled())
 
 	// Start in background
 	errCh := make(chan error, 1)
@@ -72,7 +43,7 @@ func TestDaemonProcess_StartupAndShutdown(t *testing.T) {
 	}()
 
 	// Wait for daemon to be ready
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 	deadline := time.Now().Add(5 * time.Second)
 
 	var ready bool
@@ -90,7 +61,7 @@ func TestDaemonProcess_StartupAndShutdown(t *testing.T) {
 	require.True(t, ready, "daemon should be ready within timeout")
 
 	// Verify socket file exists
-	socketPath := protocol.SocketPathForAccount(accountID, region)
+	socketPath := protocol.SocketPath()
 	_, statErr := os.Stat(socketPath)
 	require.NoError(t, statErr, "socket file should exist")
 
@@ -107,74 +78,122 @@ func TestDaemonProcess_StartupAndShutdown(t *testing.T) {
 	}
 }
 
-// TestDaemonProcess_MultipleAccountsSimultaneous tests running daemons for different accounts simultaneously.
+// TestDaemonProcess_MultipleScopes tests that a single daemon can handle multiple scopes.
 // Note: This test cannot run in parallel because it modifies TMPDIR.
-func TestDaemonProcess_MultipleAccountsSimultaneous(t *testing.T) {
+func TestDaemonProcess_MultipleScopes(t *testing.T) {
 	// Create temp directory for socket (use /tmp to keep path short on macOS)
-	tmpDir, err := os.MkdirTemp("/tmp", "suve-multi-*")
+	tmpDir, err := os.MkdirTemp("/tmp", "suve-multi-scope-*")
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	// Two different accounts
-	account1 := "a1"
-	account2 := "a2"
-	region := "r1"
-
-	// Start daemon for account1
-	runner1 := NewRunner(account1, region, WithAutoShutdownDisabled())
-	errCh1 := make(chan error, 1)
-
-	go func() {
-		errCh1 <- runner1.Run(t.Context())
-	}()
-
-	// Start daemon for account2
-	runner2 := NewRunner(account2, region, WithAutoShutdownDisabled())
-	errCh2 := make(chan error, 1)
+	// Start a single daemon
+	runner := NewRunner(WithAutoShutdownDisabled())
+	errCh := make(chan error, 1)
 
 	go func() {
-		errCh2 <- runner2.Run(t.Context())
+		errCh <- runner.Run(t.Context())
 	}()
 
-	// Wait for both daemons to be ready
-	launcher1 := NewLauncher(account1, region, WithAutoStartDisabled())
-	launcher2 := NewLauncher(account2, region, WithAutoStartDisabled())
+	// Wait for daemon to be ready
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if err := launcher.Ping(t.Context()); err == nil {
+			break
+		}
 
-	var ready1, ready2 bool
+		time.Sleep(50 * time.Millisecond)
+	}
 
-	for time.Now().Before(deadline) && (!ready1 || !ready2) {
-		if !ready1 && launcher1.Ping(t.Context()) == nil {
-			ready1 = true
-		}
+	require.NoError(t, launcher.Ping(t.Context()), "daemon should be ready")
 
-		if !ready2 && launcher2.Ping(t.Context()) == nil {
-			ready2 = true
-		}
+	// Stage entries for two different scopes
+	stageReq1 := &protocol.Request{
+		Method:  protocol.MethodStageEntry,
+		Scope:   testProcessScope1,
+		Service: staging.ServiceParam,
+		Name:    "/scope1/param",
+		Entry: &staging.Entry{
+			Value:     lo.ToPtr("value1"),
+			Operation: staging.OperationCreate,
+		},
+	}
+	resp, err := launcher.SendRequest(t.Context(), stageReq1)
+	require.NoError(t, err)
+	require.True(t, resp.Success)
 
-		time.Sleep(50 * time.Millisecond)
+	stageReq2 := &protocol.Request{
+		Method:  protocol.MethodStageEntry,
+		Scope:   testProcessScope2,
+		Service: staging.ServiceParam,
+		Name:    "/scope2/param",
+		Entry: &staging.Entry{
+			Value:     lo.ToPtr("value2"),
+			Operation: staging.OperationCreate,
+		},
 	}
+	resp, err = launcher.SendRequest(t.Context(), stageReq2)
+	require.NoError(t, err)
+	require.True(t, resp.Success)
 
-	require.True(t, ready1, "daemon for account1 should be ready")
-	require.True(t, ready2, "daemon for account2 should be ready")
+	// Verify both entries can be retrieved
+	getReq1 := &protocol.Request{
+		Method:  protocol.MethodGetEntry,
+		Scope:   testProcessScope1,
+		Service: staging.ServiceParam,
+		Name:    "/scope1/param",
+	}
+	resp, err = launcher.SendRequest(t.Context(), getReq1)
+	require.NoError(t, err)
+	require.True(t, resp.Success)
 
-	// Both should respond independently
-	require.NoError(t, launcher1.Ping(t.Context()))
-	require.NoError(t, launcher2.Ping(t.Context()))
+	var result1 protocol.EntryResponse
 
-	// Cleanup
-	runner1.Shutdown()
-	runner2.Shutdown()
+	err = json.Unmarshal(resp.Data, &result1)
+	require.NoError(t, err)
+	require.NotNil(t, result1.Entry)
+	assert.Equal(t, "value1", *result1.Entry.Value)
+
+	getReq2 := &protocol.Request{
+		Method:  protocol.MethodGetEntry,
+		Scope:   testProcessScope2,
+		Service: staging.ServiceParam,
+		Name:    "/scope2/param",
+	}
+	resp, err = launcher.SendRequest(t.Context(), getReq2)
+	require.NoError(t, err)
+	require.True(t, resp.Success)
 
-	select {
-	case <-errCh1:
-	case <-time.After(5 * time.Second):
+	var result2 protocol.EntryResponse
+
+	err = json.Unmarshal(resp.Data, &result2)
+	require.NoError(t, err)
+	require.NotNil(t, result2.Entry)
+	assert.Equal(t, "value2", *result2.Entry.Value)
+
+	// Verify scope isolation - entry from scope1 should not exist in scope2
+	getReqWrong := &protocol.Request{
+		Method:  protocol.MethodGetEntry,
+		Scope:   testProcessScope2,
+		Service: staging.ServiceParam,
+		Name:    "/scope1/param",
 	}
+	resp, err = launcher.SendRequest(t.Context(), getReqWrong)
+	require.NoError(t, err)
+	require.True(t, resp.Success)
+
+	var resultWrong protocol.EntryResponse
+
+	_ = json.Unmarshal(resp.Data, &resultWrong)
+	assert.Nil(t, resultWrong.Entry, "entry from scope1 should not exist in scope2")
+
+	// Cleanup
+	runner.Shutdown()
 
 	select {
-	case <-errCh2:
+	case <-errCh:
 	case <-time.After(5 * time.Second):
 	}
 }
@@ -188,11 +207,10 @@ func TestDaemonProcess_AutoShutdown(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a3"
-	region := "r3"
+	scope := staging.AWSScope("a3", "r3")
 
 	// Create daemon WITHOUT disabling auto-shutdown
-	runner := NewRunner(accountID, region)
+	runner := NewRunner()
 
 	// Start in background
 	errCh := make(chan error, 1)
@@ -202,7 +220,7 @@ func TestDaemonProcess_AutoShutdown(t *testing.T) {
 	}()
 
 	// Wait for daemon to be ready
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -215,11 +233,10 @@ func TestDaemonProcess_AutoShutdown(t *testing.T) {
 
 	// Stage an entry
 	stageReq := &protocol.Request{
-		Method:    protocol.MethodStageEntry,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodStageEntry,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 		Entry: &staging.Entry{
 			Value:     lo.ToPtr("test-value"),
 			Operation: staging.OperationCreate,
@@ -231,11 +248,10 @@ func TestDaemonProcess_AutoShutdown(t *testing.T) {
 
 	// Unstage the entry - this should trigger auto-shutdown because state becomes empty
 	unstageReq := &protocol.Request{
-		Method:    protocol.MethodUnstageEntry,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodUnstageEntry,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 	}
 	resp, err = launcher.SendRequest(t.Context(), unstageReq)
 	require.NoError(t, err)
@@ -262,11 +278,10 @@ func TestDaemonProcess_ManualModeDisablesAutoShutdown(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a4"
-	region := "r4"
+	scope := staging.AWSScope("a4", "r4")
 
 	// Create daemon with auto-shutdown DISABLED (manual mode)
-	runner := NewRunner(accountID, region, WithAutoShutdownDisabled())
+	runner := NewRunner(WithAutoShutdownDisabled())
 
 	// Start in background
 	errCh := make(chan error, 1)
@@ -276,7 +291,7 @@ func TestDaemonProcess_ManualModeDisablesAutoShutdown(t *testing.T) {
 	}()
 
 	// Wait for daemon to be ready
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -289,11 +304,10 @@ func TestDaemonProcess_ManualModeDisablesAutoShutdown(t *testing.T) {
 
 	// Stage and unstage an entry
 	stageReq := &protocol.Request{
-		Method:    protocol.MethodStageEntry,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodStageEntry,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 		Entry: &staging.Entry{
 			Value:     lo.ToPtr("test-value"),
 			Operation: staging.OperationCreate,
@@ -304,11 +318,10 @@ func TestDaemonProcess_ManualModeDisablesAutoShutdown(t *testing.T) {
 	require.True(t, resp.Success)
 
 	unstageReq := &protocol.Request{
-		Method:    protocol.MethodUnstageEntry,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodUnstageEntry,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 	}
 	resp, err = launcher.SendRequest(t.Context(), unstageReq)
 	require.NoError(t, err)
@@ -343,17 +356,16 @@ func TestDaemonProcess_AutoShutdown_UnstageAll(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a5"
-	region := "r5"
+	scope := staging.AWSScope("a5", "r5")
 
-	runner := NewRunner(accountID, region)
+	runner := NewRunner()
 	errCh := make(chan error, 1)
 
 	go func() {
 		errCh <- runner.Run(t.Context())
 	}()
 
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -367,11 +379,10 @@ func TestDaemonProcess_AutoShutdown_UnstageAll(t *testing.T) {
 	// Stage entries for both services
 	for _, svc := range []staging.Service{staging.ServiceParam, staging.ServiceSecret} {
 		stageReq := &protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: accountID,
-			Region:    region,
-			Service:   svc,
-			Name:      "/test/param",
+			Method:  protocol.MethodStageEntry,
+			Scope:   scope,
+			Service: svc,
+			Name:    "/test/param",
 			Entry: &staging.Entry{
 				Value:     lo.ToPtr("test-value"),
 				Operation: staging.OperationCreate,
@@ -384,10 +395,9 @@ func TestDaemonProcess_AutoShutdown_UnstageAll(t *testing.T) {
 
 	// UnstageAll with empty service clears both services and triggers auto-shutdown
 	unstageReq := &protocol.Request{
-		Method:    protocol.MethodUnstageAll,
-		AccountID: accountID,
-		Region:    region,
-		Service:   "", // Empty clears all services
+		Method:  protocol.MethodUnstageAll,
+		Scope:   scope,
+		Service: "", // Empty clears all services
 	}
 	resp, err := launcher.SendRequest(t.Context(), unstageReq)
 	require.NoError(t, err)
@@ -411,17 +421,16 @@ func TestDaemonProcess_AutoShutdown_UnstageTag(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a6"
-	region := "r6"
+	scope := staging.AWSScope("a6", "r6")
 
-	runner := NewRunner(accountID, region)
+	runner := NewRunner()
 	errCh := make(chan error, 1)
 
 	go func() {
 		errCh <- runner.Run(t.Context())
 	}()
 
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -434,11 +443,10 @@ func TestDaemonProcess_AutoShutdown_UnstageTag(t *testing.T) {
 
 	// Stage only a tag (no entry)
 	stageReq := &protocol.Request{
-		Method:    protocol.MethodStageTag,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodStageTag,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 		TagEntry: &staging.TagEntry{
 			Add: map[string]string{"key": "value"},
 		},
@@ -449,11 +457,10 @@ func TestDaemonProcess_AutoShutdown_UnstageTag(t *testing.T) {
 
 	// UnstageTag should trigger auto-shutdown when state becomes empty
 	unstageReq := &protocol.Request{
-		Method:    protocol.MethodUnstageTag,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodUnstageTag,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 	}
 	resp, err = launcher.SendRequest(t.Context(), unstageReq)
 	require.NoError(t, err)
@@ -477,17 +484,16 @@ func TestDaemonProcess_AutoShutdown_SetState(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a7"
-	region := "r7"
+	scope := staging.AWSScope("a7", "r7")
 
-	runner := NewRunner(accountID, region)
+	runner := NewRunner()
 	errCh := make(chan error, 1)
 
 	go func() {
 		errCh <- runner.Run(t.Context())
 	}()
 
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -500,11 +506,10 @@ func TestDaemonProcess_AutoShutdown_SetState(t *testing.T) {
 
 	// Stage an entry
 	stageReq := &protocol.Request{
-		Method:    protocol.MethodStageEntry,
-		AccountID: accountID,
-		Region:    region,
-		Service:   staging.ServiceParam,
-		Name:      "/test/param",
+		Method:  protocol.MethodStageEntry,
+		Scope:   scope,
+		Service: staging.ServiceParam,
+		Name:    "/test/param",
 		Entry: &staging.Entry{
 			Value:     lo.ToPtr("test-value"),
 			Operation: staging.OperationCreate,
@@ -516,10 +521,9 @@ func TestDaemonProcess_AutoShutdown_SetState(t *testing.T) {
 
 	// SetState with empty state should trigger auto-shutdown
 	setStateReq := &protocol.Request{
-		Method:    protocol.MethodSetState,
-		AccountID: accountID,
-		Region:    region,
-		State:     staging.NewEmptyState(),
+		Method: protocol.MethodSetState,
+		Scope:  scope,
+		State:  staging.NewEmptyState(),
 	}
 	resp, err = launcher.SendRequest(t.Context(), setStateReq)
 	require.NoError(t, err)
@@ -543,17 +547,16 @@ func TestDaemonProcess_AutoShutdown_UnstageAllEmpty(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "a8"
-	region := "r8"
+	scope := staging.AWSScope("a8", "r8")
 
-	runner := NewRunner(accountID, region)
+	runner := NewRunner()
 	errCh := make(chan error, 1)
 
 	go func() {
 		errCh <- runner.Run(t.Context())
 	}()
 
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -567,10 +570,9 @@ func TestDaemonProcess_AutoShutdown_UnstageAllEmpty(t *testing.T) {
 	// Don't stage anything - state is already empty
 	// UnstageAll on empty state should still trigger auto-shutdown check
 	unstageReq := &protocol.Request{
-		Method:    protocol.MethodUnstageAll,
-		AccountID: accountID,
-		Region:    region,
-		Service:   "", // Empty clears all services
+		Method:  protocol.MethodUnstageAll,
+		Scope:   scope,
+		Service: "", // Empty clears all services
 	}
 	resp, err := launcher.SendRequest(t.Context(), unstageReq)
 	require.NoError(t, err)
@@ -586,22 +588,12 @@ func TestDaemonProcess_AutoShutdown_UnstageAllEmpty(t *testing.T) {
 	}
 }
 
-// TestDaemonProcess_SocketPathStructure tests the socket path structure includes account and region.
-func TestDaemonProcess_SocketPathStructure(t *testing.T) {
+// TestDaemonProcess_SocketPath tests the socket path structure.
+func TestDaemonProcess_SocketPath(t *testing.T) {
 	t.Parallel()
 
-	accountID := "123456789012"
-	region := "ap-northeast-1"
-
-	path := protocol.SocketPathForAccount(accountID, region)
+	path := protocol.SocketPath()
 
-	// Path should contain account ID and region as directory components
-	assert.Contains(t, path, accountID)
-	assert.Contains(t, path, region)
+	// Path should end with agent.sock
 	assert.Contains(t, path, "agent.sock")
-
-	// Path should have proper structure
-	dir := filepath.Dir(path)
-	assert.Contains(t, dir, accountID)
-	assert.Contains(t, dir, region)
 }
diff --git a/internal/staging/store/agent/daemon/runner.go b/internal/staging/store/agent/daemon/runner.go
index df5c99d3..698c9929 100644
--- a/internal/staging/store/agent/daemon/runner.go
+++ b/internal/staging/store/agent/daemon/runner.go
@@ -22,27 +22,25 @@ func WithAutoShutdownDisabled() RunnerOption {
 }
 
 // Runner represents the staging agent daemon process.
+// A single daemon handles requests for all scopes.
 type Runner struct {
-	accountID            string
-	region               string
 	server               *ipc.Server
 	handler              *server.Handler
 	autoShutdownDisabled bool
 	cancel               context.CancelFunc
 }
 
-// NewRunner creates a new daemon runner for a specific AWS account and region.
-func NewRunner(accountID, region string, opts ...RunnerOption) *Runner {
+// NewRunner creates a new daemon runner.
+// The runner is scope-independent; scope is passed with each request.
+func NewRunner(opts ...RunnerOption) *Runner {
 	r := &Runner{
-		accountID: accountID,
-		region:    region,
-		handler:   server.NewHandler(),
+		handler: server.NewHandler(),
 	}
 	for _, opt := range opts {
 		opt(r)
 	}
 
-	r.server = ipc.NewServer(accountID, region, r.handler.HandleRequest, r.checkAutoShutdown, r.Shutdown)
+	r.server = ipc.NewServer(r.handler.HandleRequest, r.checkAutoShutdown, r.Shutdown)
 
 	return r
 }
diff --git a/internal/staging/store/agent/daemon/runner_internal_test.go b/internal/staging/store/agent/daemon/runner_internal_test.go
index 7a94bf44..93f7333b 100644
--- a/internal/staging/store/agent/daemon/runner_internal_test.go
+++ b/internal/staging/store/agent/daemon/runner_internal_test.go
@@ -14,10 +14,10 @@ import (
 	"github.com/mpyw/suve/internal/staging/store/agent/internal/protocol"
 )
 
-const (
-	testRunnerAccountID = "123456789012"
-	testRunnerRegion    = "us-east-1"
-)
+// testScope is used in protocol requests that need a scope.
+//
+//nolint:gochecknoglobals // Test-only constant
+var testScope = staging.AWSScope("123456789012", "us-east-1")
 
 func TestNewRunner(t *testing.T) {
 	t.Parallel()
@@ -25,19 +25,17 @@ func TestNewRunner(t *testing.T) {
 	t.Run("default options", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 		require.NotNil(t, r)
 		assert.NotNil(t, r.server)
 		assert.NotNil(t, r.handler)
-		assert.Equal(t, testRunnerAccountID, r.accountID)
-		assert.Equal(t, testRunnerRegion, r.region)
 		assert.False(t, r.autoShutdownDisabled)
 	})
 
 	t.Run("with auto shutdown disabled", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion, WithAutoShutdownDisabled())
+		r := NewRunner(WithAutoShutdownDisabled())
 		require.NotNil(t, r)
 		assert.True(t, r.autoShutdownDisabled)
 	})
@@ -49,7 +47,7 @@ func TestRunner_Shutdown(t *testing.T) {
 	t.Run("shutdown without running server", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 		// This should not panic
 		r.Shutdown()
 	})
@@ -61,7 +59,7 @@ func TestRunner_checkAutoShutdown(t *testing.T) {
 	t.Run("does not set WillShutdown when auto shutdown disabled", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion, WithAutoShutdownDisabled())
+		r := NewRunner(WithAutoShutdownDisabled())
 
 		req := &protocol.Request{Method: protocol.MethodUnstageAll}
 		resp := &protocol.Response{Success: true}
@@ -74,7 +72,7 @@ func TestRunner_checkAutoShutdown(t *testing.T) {
 	t.Run("does not set WillShutdown on non-unstage methods", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodPing}
 		resp := &protocol.Response{Success: true}
@@ -87,7 +85,7 @@ func TestRunner_checkAutoShutdown(t *testing.T) {
 	t.Run("does not set WillShutdown on failed response", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageAll}
 		resp := &protocol.Response{Success: false}
@@ -106,7 +104,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageEntry with no hint returns empty reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageEntry}
 		resp := &protocol.Response{Success: true}
@@ -119,7 +117,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageEntry with apply hint returns applied reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageEntry, Hint: protocol.HintApply}
 		resp := &protocol.Response{Success: true}
@@ -132,7 +130,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageEntry with reset hint returns unstaged reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageEntry, Hint: protocol.HintReset}
 		resp := &protocol.Response{Success: true}
@@ -145,7 +143,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageEntry with persist hint returns persisted reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageEntry, Hint: protocol.HintPersist}
 		resp := &protocol.Response{Success: true}
@@ -159,7 +157,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageTag with no hint returns empty reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageTag}
 		resp := &protocol.Response{Success: true}
@@ -172,7 +170,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageTag with apply hint returns applied reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageTag, Hint: protocol.HintApply}
 		resp := &protocol.Response{Success: true}
@@ -185,7 +183,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageTag with reset hint returns unstaged reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageTag, Hint: protocol.HintReset}
 		resp := &protocol.Response{Success: true}
@@ -198,7 +196,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageTag with persist hint returns persisted reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageTag, Hint: protocol.HintPersist}
 		resp := &protocol.Response{Success: true}
@@ -212,7 +210,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageAll with no hint returns unstaged reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageAll}
 		resp := &protocol.Response{Success: true}
@@ -225,7 +223,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageAll with apply hint returns applied reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageAll, Hint: protocol.HintApply}
 		resp := &protocol.Response{Success: true}
@@ -238,7 +236,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageAll with reset hint returns unstaged reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageAll, Hint: protocol.HintReset}
 		resp := &protocol.Response{Success: true}
@@ -251,7 +249,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("UnstageAll with persist hint returns persisted reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodUnstageAll, Hint: protocol.HintPersist}
 		resp := &protocol.Response{Success: true}
@@ -265,7 +263,7 @@ func TestRunner_checkAutoShutdown_ShutdownReasons(t *testing.T) {
 	t.Run("SetState returns cleared reason", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		req := &protocol.Request{Method: protocol.MethodSetState}
 		resp := &protocol.Response{Success: true}
@@ -284,15 +282,14 @@ func TestRunner_checkAutoShutdown_NonEmptyState(t *testing.T) {
 	t.Run("UnstageEntry does not shutdown when state not empty", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		// Stage an entry to make state non-empty
 		stageReq := protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: testRunnerAccountID,
-			Region:    testRunnerRegion,
-			Service:   staging.ServiceParam,
-			Name:      "/test/param",
+			Method:  protocol.MethodStageEntry,
+			Scope:   testScope,
+			Service: staging.ServiceParam,
+			Name:    "/test/param",
 			Entry: &staging.Entry{
 				Value:     lo.ToPtr("value"),
 				Operation: staging.OperationCreate,
@@ -303,11 +300,10 @@ func TestRunner_checkAutoShutdown_NonEmptyState(t *testing.T) {
 
 		// Stage another entry
 		stageReq2 := protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: testRunnerAccountID,
-			Region:    testRunnerRegion,
-			Service:   staging.ServiceParam,
-			Name:      "/test/param2",
+			Method:  protocol.MethodStageEntry,
+			Scope:   testScope,
+			Service: staging.ServiceParam,
+			Name:    "/test/param2",
 			Entry: &staging.Entry{
 				Value:     lo.ToPtr("value2"),
 				Operation: staging.OperationCreate,
@@ -318,11 +314,10 @@ func TestRunner_checkAutoShutdown_NonEmptyState(t *testing.T) {
 
 		// Unstage one entry - state should not be empty
 		unstageReq := protocol.Request{
-			Method:    protocol.MethodUnstageEntry,
-			AccountID: testRunnerAccountID,
-			Region:    testRunnerRegion,
-			Service:   staging.ServiceParam,
-			Name:      "/test/param",
+			Method:  protocol.MethodUnstageEntry,
+			Scope:   testScope,
+			Service: staging.ServiceParam,
+			Name:    "/test/param",
 		}
 		resp = r.handler.HandleRequest(&unstageReq)
 		require.True(t, resp.Success)
@@ -336,15 +331,14 @@ func TestRunner_checkAutoShutdown_NonEmptyState(t *testing.T) {
 	t.Run("UnstageTag does not shutdown when state not empty", func(t *testing.T) {
 		t.Parallel()
 
-		r := NewRunner(testRunnerAccountID, testRunnerRegion)
+		r := NewRunner()
 
 		// Stage an entry
 		stageReq := protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: testRunnerAccountID,
-			Region:    testRunnerRegion,
-			Service:   staging.ServiceParam,
-			Name:      "/test/param",
+			Method:  protocol.MethodStageEntry,
+			Scope:   testScope,
+			Service: staging.ServiceParam,
+			Name:    "/test/param",
 			Entry: &staging.Entry{
 				Value:     lo.ToPtr("value"),
 				Operation: staging.OperationCreate,
@@ -355,11 +349,10 @@ func TestRunner_checkAutoShutdown_NonEmptyState(t *testing.T) {
 
 		// UnstageTag should not trigger shutdown since there's still an entry
 		unstageReq := protocol.Request{
-			Method:    protocol.MethodUnstageTag,
-			AccountID: testRunnerAccountID,
-			Region:    testRunnerRegion,
-			Service:   staging.ServiceParam,
-			Name:      "/test/another",
+			Method:  protocol.MethodUnstageTag,
+			Scope:   testScope,
+			Service: staging.ServiceParam,
+			Name:    "/test/another",
 		}
 		checkResp := &protocol.Response{Success: true}
 		r.checkAutoShutdown(&unstageReq, checkResp)
@@ -377,10 +370,7 @@ func TestRunner_Run_ContextCancellation(t *testing.T) {
 	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
 	t.Setenv("TMPDIR", tmpDir)
 
-	accountID := "c1"
-	region := "r1"
-
-	runner := NewRunner(accountID, region, WithAutoShutdownDisabled())
+	runner := NewRunner(WithAutoShutdownDisabled())
 
 	// Create a cancellable context
 	ctx, cancel := context.WithCancel(t.Context())
@@ -392,7 +382,7 @@ func TestRunner_Run_ContextCancellation(t *testing.T) {
 	}()
 
 	// Wait for daemon to be ready
-	launcher := NewLauncher(accountID, region, WithAutoStartDisabled())
+	launcher := NewLauncher(WithAutoStartDisabled())
 
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
@@ -421,9 +411,7 @@ func TestRunner_Run_ContextCancellation(t *testing.T) {
 func TestRunner_MultipleOptions(t *testing.T) {
 	t.Parallel()
 
-	r := NewRunner(testRunnerAccountID, testRunnerRegion,
-		WithAutoShutdownDisabled(),
-	)
+	r := NewRunner(WithAutoShutdownDisabled())
 	require.NotNil(t, r)
 	assert.True(t, r.autoShutdownDisabled)
 }
@@ -450,7 +438,7 @@ func TestRunner_checkAutoShutdown_AllMethods(t *testing.T) {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
-			r := NewRunner(testRunnerAccountID, testRunnerRegion)
+			r := NewRunner()
 
 			req := &protocol.Request{Method: method}
 			resp := &protocol.Response{Success: true}
@@ -469,10 +457,7 @@ func TestRunner_Run_StartError(t *testing.T) {
 	// /proc/1/root is typically not writable on Linux
 	t.Setenv("TMPDIR", "/proc/1/root/nonexistent")
 
-	accountID := "run-start-err"
-	region := "r1"
-
-	runner := NewRunner(accountID, region)
+	runner := NewRunner()
 
 	// Use a short timeout context in case the server unexpectedly starts
 	ctx, cancel := context.WithTimeout(t.Context(), 2*time.Second)
diff --git a/internal/staging/store/agent/internal/client/store.go b/internal/staging/store/agent/internal/client/store.go
index 8b6b4b70..2d1f7668 100644
--- a/internal/staging/store/agent/internal/client/store.go
+++ b/internal/staging/store/agent/internal/client/store.go
@@ -27,16 +27,14 @@ func WithAutoStartDisabled() StoreOption {
 // Store implements store.ReadWriteOperator using the daemon.
 type Store struct {
 	launcher          *daemon.Launcher
-	accountID         string
-	region            string
+	scope             staging.Scope
 	autoStartDisabled bool
 }
 
 // NewStore creates a new Store.
-func NewStore(accountID, region string, opts ...StoreOption) *Store {
+func NewStore(scope staging.Scope, opts ...StoreOption) *Store {
 	s := &Store{
-		accountID: accountID,
-		region:    region,
+		scope: scope,
 	}
 	for _, opt := range opts {
 		opt(s)
@@ -48,7 +46,7 @@ func NewStore(accountID, region string, opts ...StoreOption) *Store {
 		launcherOpts = append(launcherOpts, daemon.WithAutoStartDisabled())
 	}
 
-	s.launcher = daemon.NewLauncher(accountID, region, launcherOpts...)
+	s.launcher = daemon.NewLauncher(launcherOpts...)
 
 	return s
 }
@@ -56,11 +54,10 @@ func NewStore(accountID, region string, opts ...StoreOption) *Store {
 // GetEntry retrieves a staged entry.
 func (s *Store) GetEntry(ctx context.Context, service staging.Service, name string) (*staging.Entry, error) {
 	entry, err := doRequestWithResultEnsuringDaemon(ctx, s, &protocol.Request{
-		Method:    protocol.MethodGetEntry,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Name:      name,
+		Method:  protocol.MethodGetEntry,
+		Scope:   s.scope,
+		Service: service,
+		Name:    name,
 	}, func(r *protocol.EntryResponse) *staging.Entry { return r.Entry })
 	if err != nil {
 		return nil, err
@@ -76,11 +73,10 @@ func (s *Store) GetEntry(ctx context.Context, service staging.Service, name stri
 // GetTag retrieves staged tag changes.
 func (s *Store) GetTag(ctx context.Context, service staging.Service, name string) (*staging.TagEntry, error) {
 	tagEntry, err := doRequestWithResultEnsuringDaemon(ctx, s, &protocol.Request{
-		Method:    protocol.MethodGetTag,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Name:      name,
+		Method:  protocol.MethodGetTag,
+		Scope:   s.scope,
+		Service: service,
+		Name:    name,
 	}, func(r *protocol.TagResponse) *staging.TagEntry { return r.TagEntry })
 	if err != nil {
 		return nil, err
@@ -96,53 +92,48 @@ func (s *Store) GetTag(ctx context.Context, service staging.Service, name string
 // ListEntries returns all staged entries for a service.
 func (s *Store) ListEntries(ctx context.Context, service staging.Service) (map[staging.Service]map[string]staging.Entry, error) {
 	return doRequestWithResultEnsuringDaemon(ctx, s, &protocol.Request{
-		Method:    protocol.MethodListEntries,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
+		Method:  protocol.MethodListEntries,
+		Scope:   s.scope,
+		Service: service,
 	}, func(r *protocol.ListEntriesResponse) map[staging.Service]map[string]staging.Entry { return r.Entries })
 }
 
 // ListTags returns all staged tag changes for a service.
 func (s *Store) ListTags(ctx context.Context, service staging.Service) (map[staging.Service]map[string]staging.TagEntry, error) {
 	return doRequestWithResultEnsuringDaemon(ctx, s, &protocol.Request{
-		Method:    protocol.MethodListTags,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
+		Method:  protocol.MethodListTags,
+		Scope:   s.scope,
+		Service: service,
 	}, func(r *protocol.ListTagsResponse) map[staging.Service]map[string]staging.TagEntry { return r.Tags })
 }
 
 // Load loads the current staging state.
 func (s *Store) Load(ctx context.Context) (*staging.State, error) {
 	return doRequestWithResultEnsuringDaemon(ctx, s, &protocol.Request{
-		Method:    protocol.MethodLoad,
-		AccountID: s.accountID,
-		Region:    s.region,
+		Method: protocol.MethodLoad,
+		Scope:  s.scope,
 	}, func(r *protocol.StateResponse) *staging.State { return r.State })
 }
 
 // StageEntry adds or updates a staged entry.
 func (s *Store) StageEntry(ctx context.Context, service staging.Service, name string, entry staging.Entry) error {
 	return s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-		Method:    protocol.MethodStageEntry,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Name:      name,
-		Entry:     &entry,
+		Method:  protocol.MethodStageEntry,
+		Scope:   s.scope,
+		Service: service,
+		Name:    name,
+		Entry:   &entry,
 	})
 }
 
 // StageTag adds or updates staged tag changes.
 func (s *Store) StageTag(ctx context.Context, service staging.Service, name string, tagEntry staging.TagEntry) error {
 	return s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-		Method:    protocol.MethodStageTag,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Name:      name,
-		TagEntry:  &tagEntry,
+		Method:   protocol.MethodStageTag,
+		Scope:    s.scope,
+		Service:  service,
+		Name:     name,
+		TagEntry: &tagEntry,
 	})
 }
 
@@ -154,12 +145,11 @@ func (s *Store) UnstageEntry(ctx context.Context, service staging.Service, name
 // UnstageEntryWithHint removes a staged entry with an operation hint for shutdown messages.
 func (s *Store) UnstageEntryWithHint(ctx context.Context, service staging.Service, name string, hint string) error {
 	return s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-		Method:    protocol.MethodUnstageEntry,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Name:      name,
-		Hint:      hint,
+		Method:  protocol.MethodUnstageEntry,
+		Scope:   s.scope,
+		Service: service,
+		Name:    name,
+		Hint:    hint,
 	})
 }
 
@@ -171,12 +161,11 @@ func (s *Store) UnstageTag(ctx context.Context, service staging.Service, name st
 // UnstageTagWithHint removes staged tag changes with an operation hint for shutdown messages.
 func (s *Store) UnstageTagWithHint(ctx context.Context, service staging.Service, name string, hint string) error {
 	return s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-		Method:    protocol.MethodUnstageTag,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Name:      name,
-		Hint:      hint,
+		Method:  protocol.MethodUnstageTag,
+		Scope:   s.scope,
+		Service: service,
+		Name:    name,
+		Hint:    hint,
 	})
 }
 
@@ -188,11 +177,10 @@ func (s *Store) UnstageAll(ctx context.Context, service staging.Service) error {
 // UnstageAllWithHint removes all staged changes for a service with an operation hint for shutdown messages.
 func (s *Store) UnstageAllWithHint(ctx context.Context, service staging.Service, hint string) error {
 	return s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-		Method:    protocol.MethodUnstageAll,
-		AccountID: s.accountID,
-		Region:    s.region,
-		Service:   service,
-		Hint:      hint,
+		Method:  protocol.MethodUnstageAll,
+		Scope:   s.scope,
+		Service: service,
+		Hint:    hint,
 	})
 }
 
@@ -200,9 +188,8 @@ func (s *Store) UnstageAllWithHint(ctx context.Context, service staging.Service,
 // If service is empty, returns all services; otherwise filters to the specified service.
 func (s *Store) Drain(ctx context.Context, service staging.Service, keep bool) (*staging.State, error) {
 	state, err := doRequestWithResult(ctx, s, &protocol.Request{
-		Method:    protocol.MethodGetState,
-		AccountID: s.accountID,
-		Region:    s.region,
+		Method: protocol.MethodGetState,
+		Scope:  s.scope,
 	}, func(r *protocol.StateResponse) *staging.State { return r.State })
 	if err != nil {
 		return nil, err
@@ -214,10 +201,9 @@ func (s *Store) Drain(ctx context.Context, service staging.Service, keep bool) (
 
 	if !keep {
 		if err := s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-			Method:    protocol.MethodUnstageAll,
-			AccountID: s.accountID,
-			Region:    s.region,
-			Service:   "",
+			Method:  protocol.MethodUnstageAll,
+			Scope:   s.scope,
+			Service: "",
 		}); err != nil {
 			return nil, err
 		}
@@ -240,10 +226,9 @@ func (s *Store) WriteState(ctx context.Context, service staging.Service, state *
 	}
 
 	return s.doSimpleRequestEnsuringDaemon(ctx, &protocol.Request{
-		Method:    protocol.MethodSetState,
-		AccountID: s.accountID,
-		Region:    s.region,
-		State:     state,
+		Method: protocol.MethodSetState,
+		Scope:  s.scope,
+		State:  state,
 	})
 }
 
diff --git a/internal/staging/store/agent/internal/protocol/protocol.go b/internal/staging/store/agent/internal/protocol/protocol.go
index 4d68a9c9..f33a5d0b 100644
--- a/internal/staging/store/agent/internal/protocol/protocol.go
+++ b/internal/staging/store/agent/internal/protocol/protocol.go
@@ -47,15 +47,14 @@ const (
 //
 //nolint:tagliatelle // JSON field names use snake_case for consistency with IPC protocol
 type Request struct {
-	Method    string            `json:"method"`
-	AccountID string            `json:"account_id"`
-	Region    string            `json:"region"`
-	Service   staging.Service   `json:"service,omitempty"`
-	Name      string            `json:"name,omitempty"`
-	Entry     *staging.Entry    `json:"entry,omitempty"`
-	TagEntry  *staging.TagEntry `json:"tag_entry,omitempty"`
-	State     *staging.State    `json:"state,omitempty"`
-	Hint      string            `json:"hint,omitempty"` // Optional context hint for shutdown messages (HintApply, HintReset, HintPersist)
+	Method   string            `json:"method"`
+	Scope    staging.Scope     `json:"scope"`
+	Service  staging.Service   `json:"service,omitempty"`
+	Name     string            `json:"name,omitempty"`
+	Entry    *staging.Entry    `json:"entry,omitempty"`
+	TagEntry *staging.TagEntry `json:"tag_entry,omitempty"`
+	State    *staging.State    `json:"state,omitempty"`
+	Hint     string            `json:"hint,omitempty"` // Optional context hint for shutdown messages (HintApply, HintReset, HintPersist)
 }
 
 // Response represents a JSON-RPC response from the daemon.
diff --git a/internal/staging/store/agent/internal/protocol/protocol_test.go b/internal/staging/store/agent/internal/protocol/protocol_test.go
index af1c126e..c7495ddf 100644
--- a/internal/staging/store/agent/internal/protocol/protocol_test.go
+++ b/internal/staging/store/agent/internal/protocol/protocol_test.go
@@ -46,45 +46,22 @@ func TestResponse_Err(t *testing.T) {
 	})
 }
 
-func TestSocketPathForAccount(t *testing.T) {
+func TestSocketPath(t *testing.T) {
 	t.Parallel()
 
-	const (
-		testAccountID = "123456789012"
-		testRegion    = "us-east-1"
-	)
-
-	t.Run("returns valid path with account and region", func(t *testing.T) {
+	t.Run("returns valid path", func(t *testing.T) {
 		t.Parallel()
 
-		path := protocol.SocketPathForAccount(testAccountID, testRegion)
+		path := protocol.SocketPath()
 		assert.NotEmpty(t, path)
-		assert.Contains(t, path, testAccountID)
-		assert.Contains(t, path, testRegion)
 		assert.Contains(t, path, "agent.sock")
 	})
 
-	t.Run("different accounts have different paths", func(t *testing.T) {
-		t.Parallel()
-
-		path1 := protocol.SocketPathForAccount("111111111111", "us-east-1")
-		path2 := protocol.SocketPathForAccount("222222222222", "us-east-1")
-		assert.NotEqual(t, path1, path2)
-	})
-
-	t.Run("different regions have different paths", func(t *testing.T) {
-		t.Parallel()
-
-		path1 := protocol.SocketPathForAccount(testAccountID, "us-east-1")
-		path2 := protocol.SocketPathForAccount(testAccountID, "us-west-2")
-		assert.NotEqual(t, path1, path2)
-	})
-
 	//nolint:paralleltest // Reads TMPDIR environment variable which should not be modified by parallel tests
 	t.Run("uses TMPDIR on darwin when set", func(t *testing.T) {
 		// This test only runs on darwin - on other platforms TMPDIR may not be used
 		if tmpdir := os.Getenv("TMPDIR"); tmpdir != "" {
-			path := protocol.SocketPathForAccount(testAccountID, testRegion)
+			path := protocol.SocketPath()
 			// On darwin with TMPDIR set, the path should contain the TMPDIR
 			assert.True(t, strings.HasPrefix(path, tmpdir) || strings.Contains(path, "suve"))
 		}
diff --git a/internal/staging/store/agent/internal/protocol/socket.go b/internal/staging/store/agent/internal/protocol/socket.go
index cac126c3..e6d23174 100644
--- a/internal/staging/store/agent/internal/protocol/socket.go
+++ b/internal/staging/store/agent/internal/protocol/socket.go
@@ -7,8 +7,8 @@ const (
 	socketFileName = "agent.sock"
 )
 
-// SocketPathForAccount returns the socket path for a specific AWS account and region.
-// This ensures each account/region combination has its own daemon instance.
-func SocketPathForAccount(accountID, region string) string {
-	return socketPathForAccount(accountID, region)
+// SocketPath returns the socket path for the agent daemon.
+// A single daemon handles all scopes, so the path is scope-independent.
+func SocketPath() string {
+	return socketPath()
 }
diff --git a/internal/staging/store/agent/internal/protocol/socket_darwin.go b/internal/staging/store/agent/internal/protocol/socket_darwin.go
index c7c9b20d..f8ecace0 100644
--- a/internal/staging/store/agent/internal/protocol/socket_darwin.go
+++ b/internal/staging/store/agent/internal/protocol/socket_darwin.go
@@ -7,11 +7,11 @@ import (
 	"path/filepath"
 )
 
-// socketPathForAccount returns the path for the daemon socket on macOS for a specific account/region.
-func socketPathForAccount(accountID, region string) string {
+// socketPath returns the path for the daemon socket on macOS.
+func socketPath() string {
 	if tmpdir := os.Getenv("TMPDIR"); tmpdir != "" {
-		return filepath.Join(tmpdir, socketDirName, accountID, region, socketFileName)
+		return filepath.Join(tmpdir, socketDirName, socketFileName)
 	}
 
-	return socketPathFallback(accountID, region)
+	return socketPathFallback()
 }
diff --git a/internal/staging/store/agent/internal/protocol/socket_linux.go b/internal/staging/store/agent/internal/protocol/socket_linux.go
index a209df8e..ff4267fc 100644
--- a/internal/staging/store/agent/internal/protocol/socket_linux.go
+++ b/internal/staging/store/agent/internal/protocol/socket_linux.go
@@ -7,11 +7,11 @@ import (
 	"path/filepath"
 )
 
-// socketPathForAccount returns the path for the daemon socket on Linux for a specific account/region.
-func socketPathForAccount(accountID, region string) string {
+// socketPath returns the path for the daemon socket on Linux.
+func socketPath() string {
 	if xdgRuntime := os.Getenv("XDG_RUNTIME_DIR"); xdgRuntime != "" {
-		return filepath.Join(xdgRuntime, socketDirName, accountID, region, socketFileName)
+		return filepath.Join(xdgRuntime, socketDirName, socketFileName)
 	}
 
-	return socketPathFallback(accountID, region)
+	return socketPathFallback()
 }
diff --git a/internal/staging/store/agent/internal/protocol/socket_other.go b/internal/staging/store/agent/internal/protocol/socket_other.go
index 79e79c57..fec7b017 100644
--- a/internal/staging/store/agent/internal/protocol/socket_other.go
+++ b/internal/staging/store/agent/internal/protocol/socket_other.go
@@ -2,7 +2,7 @@
 
 package protocol
 
-// socketPathForAccount returns the path for the daemon socket for a specific account/region.
-func socketPathForAccount(accountID, region string) string {
-	return socketPathFallback(accountID, region)
+// socketPath returns the path for the daemon socket.
+func socketPath() string {
+	return socketPathFallback()
 }
diff --git a/internal/staging/store/agent/internal/protocol/socket_unix.go b/internal/staging/store/agent/internal/protocol/socket_unix.go
index 8b4b6fa9..fee8b872 100644
--- a/internal/staging/store/agent/internal/protocol/socket_unix.go
+++ b/internal/staging/store/agent/internal/protocol/socket_unix.go
@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 )
 
-// socketPathFallback returns the fallback socket path for a specific account/region.
+// socketPathFallback returns the fallback socket path.
 // Used by darwin, linux, and other Unix-like platforms when preferred paths are unavailable.
-func socketPathFallback(accountID, region string) string {
-	return filepath.Join(fmt.Sprintf("/tmp/%s-%d", socketDirName, os.Getuid()), accountID, region, socketFileName)
+func socketPathFallback() string {
+	return filepath.Join(fmt.Sprintf("/tmp/%s-%d", socketDirName, os.Getuid()), socketFileName)
 }
diff --git a/internal/staging/store/agent/internal/protocol/socket_windows.go b/internal/staging/store/agent/internal/protocol/socket_windows.go
index 532b243d..a1d06946 100644
--- a/internal/staging/store/agent/internal/protocol/socket_windows.go
+++ b/internal/staging/store/agent/internal/protocol/socket_windows.go
@@ -7,17 +7,17 @@ import (
 	"path/filepath"
 )
 
-// socketPathForAccount returns the path for the daemon socket on Windows for a specific account/region.
-func socketPathForAccount(accountID, region string) string {
+// socketPath returns the path for the daemon socket on Windows.
+func socketPath() string {
 	if localAppData := os.Getenv("LOCALAPPDATA"); localAppData != "" {
-		return filepath.Join(localAppData, socketDirName, accountID, region, socketFileName)
+		return filepath.Join(localAppData, socketDirName, socketFileName)
 	}
 
 	// Fallback to user's home directory
 	if home, err := os.UserHomeDir(); err == nil {
-		return filepath.Join(home, "."+socketDirName, accountID, region, socketFileName)
+		return filepath.Join(home, "."+socketDirName, socketFileName)
 	}
 
 	// Last resort: use temp directory
-	return filepath.Join(os.TempDir(), socketDirName, accountID, region, socketFileName)
+	return filepath.Join(os.TempDir(), socketDirName, socketFileName)
 }
diff --git a/internal/staging/store/agent/internal/server/handler.go b/internal/staging/store/agent/internal/server/handler.go
index 7c2c6e4c..c4797095 100644
--- a/internal/staging/store/agent/internal/server/handler.go
+++ b/internal/staging/store/agent/internal/server/handler.go
@@ -101,7 +101,7 @@ func (h *Handler) handlePing() *protocol.Response {
 
 // handleGetEntry handles the GetEntry method.
 func (h *Handler) handleGetEntry(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -119,7 +119,7 @@ func (h *Handler) handleGetEntry(req *protocol.Request) *protocol.Response {
 
 // handleGetTag handles the GetTag method.
 func (h *Handler) handleGetTag(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -137,7 +137,7 @@ func (h *Handler) handleGetTag(req *protocol.Request) *protocol.Response {
 
 // handleListEntries handles the ListEntries method.
 func (h *Handler) handleListEntries(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -157,7 +157,7 @@ func (h *Handler) handleListEntries(req *protocol.Request) *protocol.Response {
 
 // handleListTags handles the ListTags method.
 func (h *Handler) handleListTags(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -182,7 +182,7 @@ func (h *Handler) handleLoad(req *protocol.Request) *protocol.Response {
 
 // handleStageEntry handles the StageEntry method.
 func (h *Handler) handleStageEntry(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -193,7 +193,7 @@ func (h *Handler) handleStageEntry(req *protocol.Request) *protocol.Response {
 
 	state.Entries[req.Service][req.Name] = *req.Entry
 
-	if err := h.state.set(req.AccountID, req.Region, state); err != nil {
+	if err := h.state.set(req.Scope, state); err != nil {
 		return errorResponse(err)
 	}
 
@@ -202,7 +202,7 @@ func (h *Handler) handleStageEntry(req *protocol.Request) *protocol.Response {
 
 // handleStageTag handles the StageTag method.
 func (h *Handler) handleStageTag(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -213,7 +213,7 @@ func (h *Handler) handleStageTag(req *protocol.Request) *protocol.Response {
 
 	state.Tags[req.Service][req.Name] = *req.TagEntry
 
-	if err := h.state.set(req.AccountID, req.Region, state); err != nil {
+	if err := h.state.set(req.Scope, state); err != nil {
 		return errorResponse(err)
 	}
 
@@ -222,7 +222,7 @@ func (h *Handler) handleStageTag(req *protocol.Request) *protocol.Response {
 
 // handleUnstageEntry handles the UnstageEntry method.
 func (h *Handler) handleUnstageEntry(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -231,7 +231,7 @@ func (h *Handler) handleUnstageEntry(req *protocol.Request) *protocol.Response {
 		if _, ok := entries[req.Name]; ok {
 			delete(entries, req.Name)
 
-			if err := h.state.set(req.AccountID, req.Region, state); err != nil {
+			if err := h.state.set(req.Scope, state); err != nil {
 				return errorResponse(err)
 			}
 
@@ -244,7 +244,7 @@ func (h *Handler) handleUnstageEntry(req *protocol.Request) *protocol.Response {
 
 // handleUnstageTag handles the UnstageTag method.
 func (h *Handler) handleUnstageTag(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -253,7 +253,7 @@ func (h *Handler) handleUnstageTag(req *protocol.Request) *protocol.Response {
 		if _, ok := tags[req.Name]; ok {
 			delete(tags, req.Name)
 
-			if err := h.state.set(req.AccountID, req.Region, state); err != nil {
+			if err := h.state.set(req.Scope, state); err != nil {
 				return errorResponse(err)
 			}
 
@@ -266,7 +266,7 @@ func (h *Handler) handleUnstageTag(req *protocol.Request) *protocol.Response {
 
 // handleUnstageAll handles the UnstageAll method.
 func (h *Handler) handleUnstageAll(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -287,7 +287,7 @@ func (h *Handler) handleUnstageAll(req *protocol.Request) *protocol.Response {
 		state.Tags[req.Service] = make(map[string]staging.TagEntry)
 	}
 
-	if err := h.state.set(req.AccountID, req.Region, state); err != nil {
+	if err := h.state.set(req.Scope, state); err != nil {
 		return errorResponse(err)
 	}
 
@@ -296,7 +296,7 @@ func (h *Handler) handleUnstageAll(req *protocol.Request) *protocol.Response {
 
 // handleGetState handles the GetState method (for persist).
 func (h *Handler) handleGetState(req *protocol.Request) *protocol.Response {
-	state, err := h.state.get(req.AccountID, req.Region)
+	state, err := h.state.get(req.Scope)
 	if err != nil {
 		return errorResponse(err)
 	}
@@ -310,7 +310,7 @@ func (h *Handler) handleSetState(req *protocol.Request) *protocol.Response {
 		return errorMessageResponse("state is required")
 	}
 
-	if err := h.state.set(req.AccountID, req.Region, req.State); err != nil {
+	if err := h.state.set(req.Scope, req.State); err != nil {
 		return errorResponse(err)
 	}
 
diff --git a/internal/staging/store/agent/internal/server/handler_test.go b/internal/staging/store/agent/internal/server/handler_test.go
index b629b026..ad16e100 100644
--- a/internal/staging/store/agent/internal/server/handler_test.go
+++ b/internal/staging/store/agent/internal/server/handler_test.go
@@ -63,22 +63,20 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entry
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &entry,
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &entry,
 		})
 		assert.True(t, resp.Success)
 
 		// Get entry
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodGetEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 		assert.True(t, resp.Success)
 
@@ -97,11 +95,10 @@ func TestHandler_HandleRequest(t *testing.T) {
 		defer h.Destroy()
 
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/nonexistent",
+			Method:  protocol.MethodGetEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/nonexistent",
 		})
 		assert.True(t, resp.Success)
 
@@ -125,22 +122,20 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage tag
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			TagEntry:  &tagEntry,
+			Method:   protocol.MethodStageTag,
+			Scope:    staging.AWSScope("123456789012", "us-east-1"),
+			Service:  staging.ServiceParam,
+			Name:     "/app/config",
+			TagEntry: &tagEntry,
 		})
 		assert.True(t, resp.Success)
 
 		// Get tag
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodGetTag,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 		assert.True(t, resp.Success)
 
@@ -159,11 +154,10 @@ func TestHandler_HandleRequest(t *testing.T) {
 		defer h.Destroy()
 
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/nonexistent",
+			Method:  protocol.MethodGetTag,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/nonexistent",
 		})
 		assert.True(t, resp.Success)
 
@@ -182,27 +176,24 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entries
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config1",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value1"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config1",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value1"), StagedAt: time.Now()},
 		})
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config2",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value2"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config2",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value2"), StagedAt: time.Now()},
 		})
 
 		// List all entries
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodListEntries,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
+			Method: protocol.MethodListEntries,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
 		})
 		assert.True(t, resp.Success)
 
@@ -221,28 +212,25 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entries in different services
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("param-value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("param-value"), StagedAt: time.Now()},
 		})
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceSecret,
-			Name:      "my-secret",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("secret-value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceSecret,
+			Name:    "my-secret",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("secret-value"), StagedAt: time.Now()},
 		})
 
 		// List param entries only
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodListEntries,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
+			Method:  protocol.MethodListEntries,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
 		})
 		assert.True(t, resp.Success)
 
@@ -262,19 +250,17 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage tags
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			TagEntry:  &staging.TagEntry{Add: map[string]string{"env": "prod"}, StagedAt: time.Now()},
+			Method:   protocol.MethodStageTag,
+			Scope:    staging.AWSScope("123456789012", "us-east-1"),
+			Service:  staging.ServiceParam,
+			Name:     "/app/config",
+			TagEntry: &staging.TagEntry{Add: map[string]string{"env": "prod"}, StagedAt: time.Now()},
 		})
 
 		// List tags
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodListTags,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
+			Method: protocol.MethodListTags,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
 		})
 		assert.True(t, resp.Success)
 
@@ -293,28 +279,25 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage tags in different services
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			TagEntry:  &staging.TagEntry{Add: map[string]string{"env": "prod"}, StagedAt: time.Now()},
+			Method:   protocol.MethodStageTag,
+			Scope:    staging.AWSScope("123456789012", "us-east-1"),
+			Service:  staging.ServiceParam,
+			Name:     "/app/config",
+			TagEntry: &staging.TagEntry{Add: map[string]string{"env": "prod"}, StagedAt: time.Now()},
 		})
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceSecret,
-			Name:      "my-secret",
-			TagEntry:  &staging.TagEntry{Add: map[string]string{"team": "backend"}, StagedAt: time.Now()},
+			Method:   protocol.MethodStageTag,
+			Scope:    staging.AWSScope("123456789012", "us-east-1"),
+			Service:  staging.ServiceSecret,
+			Name:     "my-secret",
+			TagEntry: &staging.TagEntry{Add: map[string]string{"team": "backend"}, StagedAt: time.Now()},
 		})
 
 		// List secret tags only
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodListTags,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceSecret,
+			Method:  protocol.MethodListTags,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceSecret,
 		})
 		assert.True(t, resp.Success)
 
@@ -334,31 +317,28 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entry
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 
 		// Unstage entry
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodUnstageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodUnstageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 		assert.True(t, resp.Success)
 
 		// Verify entry is gone
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodGetEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 
 		var result protocol.EntryResponse
@@ -374,11 +354,10 @@ func TestHandler_HandleRequest(t *testing.T) {
 		defer h.Destroy()
 
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodUnstageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/nonexistent",
+			Method:  protocol.MethodUnstageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/nonexistent",
 		})
 		assert.False(t, resp.Success)
 		assert.Equal(t, staging.ErrNotStaged.Error(), resp.Error)
@@ -392,31 +371,28 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage tag
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			TagEntry:  &staging.TagEntry{Add: map[string]string{"env": "prod"}, StagedAt: time.Now()},
+			Method:   protocol.MethodStageTag,
+			Scope:    staging.AWSScope("123456789012", "us-east-1"),
+			Service:  staging.ServiceParam,
+			Name:     "/app/config",
+			TagEntry: &staging.TagEntry{Add: map[string]string{"env": "prod"}, StagedAt: time.Now()},
 		})
 
 		// Unstage tag
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodUnstageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodUnstageTag,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 		assert.True(t, resp.Success)
 
 		// Verify tag is gone
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodGetTag,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 
 		var result protocol.TagResponse
@@ -432,11 +408,10 @@ func TestHandler_HandleRequest(t *testing.T) {
 		defer h.Destroy()
 
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodUnstageTag,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/nonexistent",
+			Method:  protocol.MethodUnstageTag,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/nonexistent",
 		})
 		assert.False(t, resp.Success)
 		assert.Equal(t, staging.ErrNotStaged.Error(), resp.Error)
@@ -450,36 +425,32 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entries in both services
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceSecret,
-			Name:      "my-secret",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceSecret,
+			Name:    "my-secret",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 
 		// Unstage all
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodUnstageAll,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   "",
+			Method:  protocol.MethodUnstageAll,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: "",
 		})
 		assert.True(t, resp.Success)
 
 		// Verify all entries are gone
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodListEntries,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
+			Method: protocol.MethodListEntries,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
 		})
 
 		var result protocol.ListEntriesResponse
@@ -497,36 +468,32 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entries in both services
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceSecret,
-			Name:      "my-secret",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceSecret,
+			Name:    "my-secret",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 
 		// Unstage only param service
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodUnstageAll,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
+			Method:  protocol.MethodUnstageAll,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
 		})
 		assert.True(t, resp.Success)
 
 		// Verify param is empty but secret still exists
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodListEntries,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
+			Method: protocol.MethodListEntries,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
 		})
 
 		var result protocol.ListEntriesResponse
@@ -551,18 +518,16 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Set state
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodSetState,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			State:     state,
+			Method: protocol.MethodSetState,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
+			State:  state,
 		})
 		assert.True(t, resp.Success)
 
 		// Get state
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetState,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
+			Method: protocol.MethodGetState,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
 		})
 		assert.True(t, resp.Success)
 
@@ -581,10 +546,9 @@ func TestHandler_HandleRequest(t *testing.T) {
 		defer h.Destroy()
 
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodSetState,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			State:     nil,
+			Method: protocol.MethodSetState,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
+			State:  nil,
 		})
 		assert.False(t, resp.Success)
 		assert.Contains(t, resp.Error, "state is required")
@@ -598,19 +562,17 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage an entry
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 
 		// Load
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodLoad,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
+			Method: protocol.MethodLoad,
+			Scope:  staging.AWSScope("123456789012", "us-east-1"),
 		})
 		assert.True(t, resp.Success)
 
@@ -648,12 +610,11 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage an entry
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "123456789012",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("123456789012", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("value"), StagedAt: time.Now()},
 		})
 
 		assert.False(t, h.IsEmpty())
@@ -674,31 +635,28 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Stage entry in account 1
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "111111111111",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("account1-value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("111111111111", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("account1-value"), StagedAt: time.Now()},
 		})
 
 		// Stage entry in account 2
 		h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodStageEntry,
-			AccountID: "222222222222",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
-			Entry:     &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("account2-value"), StagedAt: time.Now()},
+			Method:  protocol.MethodStageEntry,
+			Scope:   staging.AWSScope("222222222222", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
+			Entry:   &staging.Entry{Operation: staging.OperationUpdate, Value: lo.ToPtr("account2-value"), StagedAt: time.Now()},
 		})
 
 		// Get entry from account 1
 		resp := h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetEntry,
-			AccountID: "111111111111",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodGetEntry,
+			Scope:   staging.AWSScope("111111111111", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 
 		var result1 protocol.EntryResponse
@@ -708,11 +666,10 @@ func TestHandler_HandleRequest(t *testing.T) {
 
 		// Get entry from account 2
 		resp = h.HandleRequest(&protocol.Request{
-			Method:    protocol.MethodGetEntry,
-			AccountID: "222222222222",
-			Region:    "us-east-1",
-			Service:   staging.ServiceParam,
-			Name:      "/app/config",
+			Method:  protocol.MethodGetEntry,
+			Scope:   staging.AWSScope("222222222222", "us-east-1"),
+			Service: staging.ServiceParam,
+			Name:    "/app/config",
 		})
 
 		var result2 protocol.EntryResponse
diff --git a/internal/staging/store/agent/internal/server/state.go b/internal/staging/store/agent/internal/server/state.go
index 6ce30762..c30571a7 100644
--- a/internal/staging/store/agent/internal/server/state.go
+++ b/internal/staging/store/agent/internal/server/state.go
@@ -8,33 +8,25 @@ import (
 	"github.com/mpyw/suve/internal/staging/store/agent/internal/server/security"
 )
 
-// stateKey uniquely identifies a staging state by account and region.
-type stateKey struct {
-	AccountID string
-	Region    string
-}
-
 // secureState holds the staging state in secure memory.
 type secureState struct {
 	mu     sync.RWMutex
-	states map[stateKey]*security.Buffer
+	states map[staging.Scope]*security.Buffer
 }
 
 // newSecureState creates a new secure state store.
 func newSecureState() *secureState {
 	return &secureState{
-		states: make(map[stateKey]*security.Buffer),
+		states: make(map[staging.Scope]*security.Buffer),
 	}
 }
 
-// get retrieves the state for the given account/region.
-func (s *secureState) get(accountID, region string) (*staging.State, error) {
+// get retrieves the state for the given scope.
+func (s *secureState) get(scope staging.Scope) (*staging.State, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
-	key := stateKey{AccountID: accountID, Region: region}
-
-	buf, ok := s.states[key]
+	buf, ok := s.states[scope]
 	if !ok || buf.IsEmpty() {
 		return staging.NewEmptyState(), nil
 	}
@@ -53,21 +45,19 @@ func (s *secureState) get(accountID, region string) (*staging.State, error) {
 	return &state, nil
 }
 
-// set stores the state for the given account/region.
-func (s *secureState) set(accountID, region string, state *staging.State) error {
+// set stores the state for the given scope.
+func (s *secureState) set(scope staging.Scope, state *staging.State) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	key := stateKey{AccountID: accountID, Region: region}
-
 	// Destroy old buffer if exists
-	if old, ok := s.states[key]; ok {
+	if old, ok := s.states[scope]; ok {
 		old.Destroy()
 	}
 
 	// Check if state is empty
 	if state.IsEmpty() {
-		delete(s.states, key)
+		delete(s.states, scope)
 
 		return nil
 	}
@@ -77,7 +67,7 @@ func (s *secureState) set(accountID, region string, state *staging.State) error
 		return err
 	}
 	// NewBuffer zeros the input data
-	s.states[key] = security.NewBuffer(data)
+	s.states[scope] = security.NewBuffer(data)
 
 	return nil
 }
@@ -99,7 +89,7 @@ func (s *secureState) destroy() {
 		buf.Destroy()
 	}
 
-	s.states = make(map[stateKey]*security.Buffer)
+	s.states = make(map[staging.Scope]*security.Buffer)
 }
 
 // zeroBytes securely zeros a byte slice.
diff --git a/internal/staging/store/agent/store.go b/internal/staging/store/agent/store.go
index 305c6f93..b26288c8 100644
--- a/internal/staging/store/agent/store.go
+++ b/internal/staging/store/agent/store.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"github.com/mpyw/suve/internal/staging"
 	"github.com/mpyw/suve/internal/staging/store"
 	"github.com/mpyw/suve/internal/staging/store/agent/internal/client"
 )
@@ -11,8 +12,8 @@ type StoreOption = client.StoreOption
 // NewStore creates an AgentStore using the agent daemon.
 // The agent daemon is started automatically if not running, unless
 // manual mode is enabled (see [EnvDaemonManualMode]).
-func NewStore(accountID, region string, opts ...StoreOption) store.AgentStore {
+func NewStore(scope staging.Scope, opts ...StoreOption) store.AgentStore {
 	opts = append(ClientOptions(), opts...)
 
-	return client.NewStore(accountID, region, opts...)
+	return client.NewStore(scope, opts...)
 }
diff --git a/internal/staging/store/file/store.go b/internal/staging/store/file/store.go
index 20c113c7..2f8c301b 100644
--- a/internal/staging/store/file/store.go
+++ b/internal/staging/store/file/store.go
@@ -5,6 +5,7 @@ package file
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -16,11 +17,13 @@ import (
 )
 
 const (
-	stateFileName = "stage.json"
-	stateDirName  = ".suve"
+	paramFileName  = "param.json"
+	secretFileName = "secret.json"
+	baseDirName    = ".suve"
+	stagingDir     = "staging"
 )
 
-// fileMu protects concurrent access to the state file within a process.
+// fileMu protects concurrent access to the state files within a process.
 //
 //nolint:gochecknoglobals // process-wide mutex for file access synchronization
 var fileMu sync.Mutex
@@ -32,46 +35,47 @@ var userHomeDirFunc = os.UserHomeDir
 
 // Store manages the staging state using the filesystem.
 // It implements StateIO interface for drain/persist operations.
+// State is split into param.json and secret.json files.
 type Store struct {
-	stateFilePath string
-	passphrase    string
+	stateDir   string
+	passphrase string
 }
 
-// NewStore creates a new file Store with the default state file path.
-// The state file is stored under ~/.suve/{accountID}/{region}/stage.json
-// to isolate staging state per AWS account and region.
-func NewStore(accountID, region string) (*Store, error) {
+// NewStore creates a new file Store with the default state directory.
+// The state files are stored under ~/.suve/staging/{scope.Key()}/
+// with param.json and secret.json for respective services.
+func NewStore(scope staging.Scope) (*Store, error) {
 	homeDir, err := userHomeDirFunc()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get home directory: %w", err)
 	}
 
-	stateDir := filepath.Join(homeDir, stateDirName, accountID, region)
+	stateDir := filepath.Join(homeDir, baseDirName, stagingDir, scope.Key())
 
 	return &Store{
-		stateFilePath: filepath.Join(stateDir, stateFileName),
+		stateDir: stateDir,
 	}, nil
 }
 
-// NewStoreWithPath creates a new file Store with a custom state file path.
+// NewStoreWithDir creates a new file Store with a custom state directory.
 // This is primarily for testing.
-func NewStoreWithPath(path string) *Store {
+func NewStoreWithDir(dir string) *Store {
 	return &Store{
-		stateFilePath: path,
+		stateDir: dir,
 	}
 }
 
 // NewStoreWithPassphrase creates a new file Store with a passphrase for encryption.
 // This is used by drain/persist commands that need StateIO interface.
-func NewStoreWithPassphrase(accountID, region, passphrase string) (*Store, error) {
-	store, err := NewStore(accountID, region)
+func NewStoreWithPassphrase(scope staging.Scope, passphrase string) (*Store, error) {
+	s, err := NewStore(scope)
 	if err != nil {
 		return nil, err
 	}
 
-	store.passphrase = passphrase
+	s.passphrase = passphrase
 
-	return store, nil
+	return s, nil
 }
 
 // SetPassphrase sets the passphrase for encryption/decryption.
@@ -80,49 +84,134 @@ func (s *Store) SetPassphrase(passphrase string) {
 	s.passphrase = passphrase
 }
 
-// Exists checks if the state file exists.
+// paramPath returns the path to the param.json file.
+func (s *Store) paramPath() string {
+	return filepath.Join(s.stateDir, paramFileName)
+}
+
+// secretPath returns the path to the secret.json file.
+func (s *Store) secretPath() string {
+	return filepath.Join(s.stateDir, secretFileName)
+}
+
+// pathForService returns the file path for the given service.
+func (s *Store) pathForService(service staging.Service) string {
+	switch service {
+	case staging.ServiceParam:
+		return s.paramPath()
+	case staging.ServiceSecret:
+		return s.secretPath()
+	default:
+		return ""
+	}
+}
+
+// Exists checks if any state file exists.
 func (s *Store) Exists() (bool, error) {
-	_, err := os.Stat(s.stateFilePath)
+	paramExists, err := fileExists(s.paramPath())
+	if err != nil {
+		return false, err
+	}
+
+	if paramExists {
+		return true, nil
+	}
+
+	return fileExists(s.secretPath())
+}
+
+// fileExists checks if a file exists.
+func fileExists(path string) (bool, error) {
+	_, err := os.Stat(path)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return false, nil
 		}
 
-		return false, fmt.Errorf("failed to check state file: %w", err)
+		return false, fmt.Errorf("failed to check file: %w", err)
 	}
 
 	return true, nil
 }
 
-// IsEncrypted checks if the stored file is encrypted.
+// IsEncrypted checks if any stored file is encrypted.
+// Returns true if at least one file exists and is encrypted.
 func (s *Store) IsEncrypted() (bool, error) {
-	data, err := os.ReadFile(s.stateFilePath)
+	// Check param file
+	paramEncrypted, err := isFileEncrypted(s.paramPath())
+	if err != nil {
+		return false, err
+	}
+
+	if paramEncrypted {
+		return true, nil
+	}
+
+	// Check secret file
+	return isFileEncrypted(s.secretPath())
+}
+
+// isFileEncrypted checks if a specific file is encrypted.
+func isFileEncrypted(path string) (bool, error) {
+	data, err := os.ReadFile(path) //nolint:gosec // path is from internal methods, not user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return false, nil
 		}
 
-		return false, fmt.Errorf("failed to read state file: %w", err)
+		return false, fmt.Errorf("failed to read file: %w", err)
 	}
 
 	return crypt.IsEncrypted(data), nil
 }
 
-// Drain reads the state from file, optionally deleting the file.
+// Drain reads the state from file(s), optionally deleting the file(s).
 // This implements StateDrainer for file-based storage.
 // If service is empty, returns all services; otherwise filters to the specified service.
-// If keep is false, the file is deleted after reading.
+// If keep is false, the file(s) is deleted after reading.
 func (s *Store) Drain(_ context.Context, service staging.Service, keep bool) (*staging.State, error) {
 	fileMu.Lock()
 	defer fileMu.Unlock()
 
-	data, err := os.ReadFile(s.stateFilePath)
+	if service != "" {
+		// Read specific service file
+		return s.drainService(service, keep)
+	}
+
+	// Read both files and merge
+	paramState, err := s.drainService(staging.ServiceParam, keep)
+	if err != nil {
+		return nil, err
+	}
+
+	secretState, err := s.drainService(staging.ServiceSecret, keep)
+	if err != nil {
+		return nil, err
+	}
+
+	// Merge states
+	merged := staging.NewEmptyState()
+	merged.Merge(paramState)
+	merged.Merge(secretState)
+
+	return merged, nil
+}
+
+// drainService reads state for a specific service.
+// Must be called with fileMu held.
+func (s *Store) drainService(service staging.Service, keep bool) (*staging.State, error) {
+	path := s.pathForService(service)
+	if path == "" {
+		return staging.NewEmptyState(), nil
+	}
+
+	data, err := os.ReadFile(path) //nolint:gosec // path is from pathForService, not user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return staging.NewEmptyState(), nil
 		}
 
-		return nil, fmt.Errorf("failed to read state file: %w", err)
+		return nil, fmt.Errorf("failed to read %s file: %w", service, err)
 	}
 
 	// Decrypt if encrypted
@@ -139,7 +228,7 @@ func (s *Store) Drain(_ context.Context, service staging.Service, keep bool) (*s
 
 	var state staging.State
 	if err := json.Unmarshal(data, &state); err != nil {
-		return nil, fmt.Errorf("failed to parse state file: %w", err)
+		return nil, fmt.Errorf("failed to parse %s file: %w", service, err)
 	}
 
 	// Initialize maps if nil
@@ -147,62 +236,80 @@ func (s *Store) Drain(_ context.Context, service staging.Service, keep bool) (*s
 
 	// Delete file if keep is false
 	if !keep {
-		if err := os.Remove(s.stateFilePath); err != nil && !os.IsNotExist(err) {
-			return nil, fmt.Errorf("failed to remove state file: %w", err)
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return nil, fmt.Errorf("failed to remove %s file: %w", service, err)
 		}
 	}
 
-	// Filter by service if specified
-	if service != "" {
-		return state.ExtractService(service), nil
-	}
-
-	return &state, nil
+	// Return only the requested service's data
+	return state.ExtractService(service), nil
 }
 
-// WriteState saves the state to file.
+// WriteState saves the state to file(s).
 // This implements StateWriter for file-based storage.
-// If service is empty, writes all services; otherwise writes only the specified service.
+// If service is empty, writes to both files; otherwise writes only to the specified service's file.
 func (s *Store) WriteState(_ context.Context, service staging.Service, state *staging.State) error {
 	fileMu.Lock()
 	defer fileMu.Unlock()
 
-	// Filter by service if specified
+	// Ensure directory exists
+	if err := os.MkdirAll(s.stateDir, 0o700); err != nil { //nolint:mnd // owner-only directory permissions
+		return fmt.Errorf("failed to create state directory: %w", err)
+	}
+
 	if service != "" {
-		state = state.ExtractService(service)
+		// Write specific service file
+		return s.writeService(service, state.ExtractService(service))
 	}
 
-	// Ensure directory exists
-	dir := filepath.Dir(s.stateFilePath)
-	if err := os.MkdirAll(dir, 0o700); err != nil { //nolint:mnd // owner-only directory permissions
-		return fmt.Errorf("failed to create state directory: %w", err)
+	// Write both files
+	var err error
+
+	if e := s.writeService(staging.ServiceParam, state.ExtractService(staging.ServiceParam)); e != nil {
+		err = errors.Join(err, fmt.Errorf("param: %w", e))
+	}
+
+	if e := s.writeService(staging.ServiceSecret, state.ExtractService(staging.ServiceSecret)); e != nil {
+		err = errors.Join(err, fmt.Errorf("secret: %w", e))
+	}
+
+	return err
+}
+
+// writeService writes state for a specific service.
+// Must be called with fileMu held.
+func (s *Store) writeService(service staging.Service, state *staging.State) error {
+	path := s.pathForService(service)
+	if path == "" {
+		return nil
 	}
 
-	// Check if there are any staged changes
-	if state.IsEmpty() {
+	// Check if there are any staged changes for this service
+	serviceState := state.ExtractService(service)
+	if serviceState.IsEmpty() {
 		// Remove file if no staged changes
-		if err := os.Remove(s.stateFilePath); err != nil && !os.IsNotExist(err) {
-			return fmt.Errorf("failed to remove empty state file: %w", err)
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("failed to remove empty %s file: %w", service, err)
 		}
 
 		return nil
 	}
 
-	data, err := json.MarshalIndent(state, "", "  ")
+	data, err := json.MarshalIndent(serviceState, "", "  ")
 	if err != nil {
-		return fmt.Errorf("failed to marshal state: %w", err)
+		return fmt.Errorf("failed to marshal %s state: %w", service, err)
 	}
 
 	// Encrypt if passphrase is provided
 	if s.passphrase != "" {
 		data, err = crypt.Encrypt(data, s.passphrase)
 		if err != nil {
-			return fmt.Errorf("failed to encrypt state: %w", err)
+			return fmt.Errorf("failed to encrypt %s state: %w", service, err)
 		}
 	}
 
-	if err := os.WriteFile(s.stateFilePath, data, 0o600); err != nil { //nolint:mnd // owner-only file permissions
-		return fmt.Errorf("failed to write state file: %w", err)
+	if err := os.WriteFile(path, data, 0o600); err != nil { //nolint:mnd // owner-only file permissions
+		return fmt.Errorf("failed to write %s file: %w", service, err)
 	}
 
 	return nil
@@ -235,17 +342,23 @@ func initializeStateMaps(state *staging.State) {
 	}
 }
 
-// Delete removes the state file without reading its contents.
+// Delete removes all state files without reading their contents.
 // This is useful for dropping stash when decryption is not needed.
 func (s *Store) Delete() error {
 	fileMu.Lock()
 	defer fileMu.Unlock()
 
-	if err := os.Remove(s.stateFilePath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to remove state file: %w", err)
+	var err error
+
+	if e := os.Remove(s.paramPath()); e != nil && !os.IsNotExist(e) {
+		err = errors.Join(err, fmt.Errorf("failed to remove param file: %w", e))
 	}
 
-	return nil
+	if e := os.Remove(s.secretPath()); e != nil && !os.IsNotExist(e) {
+		err = errors.Join(err, fmt.Errorf("failed to remove secret file: %w", e))
+	}
+
+	return err
 }
 
 // Compile-time check that Store implements FileStore.
diff --git a/internal/staging/store/file/store_internal_test.go b/internal/staging/store/file/store_internal_test.go
index 79b92f0d..5aaad6b0 100644
--- a/internal/staging/store/file/store_internal_test.go
+++ b/internal/staging/store/file/store_internal_test.go
@@ -4,8 +4,10 @@ import (
 	"errors"
 	"io"
 	"os"
+	"path/filepath"
 	"testing"
 
+	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -102,7 +104,7 @@ func TestNewStore_UserHomeDirError(t *testing.T) {
 		return "", errors.New("home directory not available")
 	}
 
-	store, err := NewStore("123456789012", "ap-northeast-1")
+	store, err := NewStore(staging.AWSScope("123456789012", "ap-northeast-1"))
 	assert.Nil(t, store)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to get home directory")
@@ -122,7 +124,7 @@ func TestNewStoreWithPassphrase_UserHomeDirError(t *testing.T) {
 		return "", errors.New("home directory not available")
 	}
 
-	store, err := NewStoreWithPassphrase("123456789012", "ap-northeast-1", "secret")
+	store, err := NewStoreWithPassphrase(staging.AWSScope("123456789012", "ap-northeast-1"), "secret")
 	assert.Nil(t, store)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to get home directory")
@@ -132,14 +134,14 @@ func TestDrain_RemoveFileError(t *testing.T) {
 	t.Parallel()
 
 	// This test validates the error path when os.Remove fails in Drain
-	// We can trigger this by making the file unremovable
 	tmpDir := t.TempDir()
-	dirPath := tmpDir + "/subdir"
+	dirPath := filepath.Join(tmpDir, "subdir")
 	err := os.MkdirAll(dirPath, 0o750)
 	require.NoError(t, err)
 
-	path := dirPath + "/stage.json"
-	err = os.WriteFile(path, []byte(`{"version":2,"entries":{"param":{},"secret":{}},"tags":{"param":{},"secret":{}}}`), 0o600)
+	// Write param file
+	paramPath := filepath.Join(dirPath, "param.json")
+	err = os.WriteFile(paramPath, []byte(`{"version":2,"entries":{"param":{},"secret":{}},"tags":{"param":{},"secret":{}}}`), 0o600)
 	require.NoError(t, err)
 
 	// Make directory read-only so file can't be removed
@@ -149,11 +151,11 @@ func TestDrain_RemoveFileError(t *testing.T) {
 	//nolint:gosec // G302: restore permissions for cleanup
 	defer func() { _ = os.Chmod(dirPath, 0o755) }()
 
-	store := NewStoreWithPath(path)
+	store := NewStoreWithDir(dirPath)
 
-	_, err = store.Drain(t.Context(), "", false) // keep=false triggers remove
+	_, err = store.Drain(t.Context(), staging.ServiceParam, false) // keep=false triggers remove
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to remove state file")
+	assert.Contains(t, err.Error(), "failed to remove param file")
 }
 
 func TestWriteState_RemoveEmptyStateError(t *testing.T) {
@@ -161,12 +163,13 @@ func TestWriteState_RemoveEmptyStateError(t *testing.T) {
 
 	// Create a directory structure where we can't remove the file
 	tmpDir := t.TempDir()
-	dirPath := tmpDir + "/subdir"
+	dirPath := filepath.Join(tmpDir, "subdir")
 	err := os.MkdirAll(dirPath, 0o750)
 	require.NoError(t, err)
 
-	path := dirPath + "/stage.json"
-	err = os.WriteFile(path, []byte(`{}`), 0o600)
+	// Write param file
+	paramPath := filepath.Join(dirPath, "param.json")
+	err = os.WriteFile(paramPath, []byte(`{}`), 0o600)
 	require.NoError(t, err)
 
 	// Make directory read-only so file can't be removed
@@ -176,13 +179,13 @@ func TestWriteState_RemoveEmptyStateError(t *testing.T) {
 	//nolint:gosec // G302: restore permissions for cleanup
 	defer func() { _ = os.Chmod(dirPath, 0o755) }()
 
-	store := NewStoreWithPath(path)
+	store := NewStoreWithDir(dirPath)
 
 	// Empty state should trigger file removal, which should fail
 	emptyState := staging.NewEmptyState()
 	err = store.WriteState(t.Context(), "", emptyState)
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to remove empty state file")
+	assert.Contains(t, err.Error(), "failed to remove empty param file")
 }
 
 // Note: This test cannot use t.Parallel() because it modifies the global randReader variable in crypt package.
@@ -195,19 +198,18 @@ func TestWriteState_EncryptionError(t *testing.T) {
 	defer crypt.ResetRandReader()
 
 	tmpDir := t.TempDir()
-	path := tmpDir + "/stage.json"
-	store := NewStoreWithPath(path)
+	store := NewStoreWithDir(tmpDir)
 	store.SetPassphrase("secret") // Enable encryption
 
 	state := staging.NewEmptyState()
 	state.Entries[staging.ServiceParam]["/test"] = staging.Entry{
 		Operation: staging.OperationCreate,
-		Value:     strPtr("value"),
+		Value:     lo.ToPtr("value"),
 	}
 
 	err := store.WriteState(t.Context(), "", state)
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to encrypt state")
+	assert.Contains(t, err.Error(), "failed to encrypt param state")
 }
 
 // errorReader is an io.Reader that returns an error.
@@ -221,6 +223,175 @@ func (r *errorReader) Read(_ []byte) (n int, err error) {
 
 var _ io.Reader = (*errorReader)(nil)
 
-func strPtr(s string) *string {
-	return &s
+func TestPathForService_UnknownService(t *testing.T) {
+	t.Parallel()
+
+	store := NewStoreWithDir(t.TempDir())
+
+	// Unknown service should return empty string
+	path := store.pathForService(staging.Service("unknown"))
+	assert.Empty(t, path)
+}
+
+func TestDrainService_UnknownService(t *testing.T) {
+	t.Parallel()
+
+	store := NewStoreWithDir(t.TempDir())
+
+	// Unknown service should return empty state (path == "")
+	state, err := store.drainService(staging.Service("unknown"), true)
+	require.NoError(t, err)
+	assert.True(t, state.IsEmpty())
+}
+
+func TestWriteService_UnknownService(t *testing.T) {
+	t.Parallel()
+
+	store := NewStoreWithDir(t.TempDir())
+
+	// Unknown service should return nil (path == "")
+	err := store.writeService(staging.Service("unknown"), staging.NewEmptyState())
+	assert.NoError(t, err)
+}
+
+func TestDelete_RemoveError(t *testing.T) {
+	t.Parallel()
+
+	// Create a directory with files that can't be removed
+	tmpDir := t.TempDir()
+	dirPath := filepath.Join(tmpDir, "subdir")
+	err := os.MkdirAll(dirPath, 0o750)
+	require.NoError(t, err)
+
+	// Write both files
+	paramPath := filepath.Join(dirPath, "param.json")
+	secretPath := filepath.Join(dirPath, "secret.json")
+	err = os.WriteFile(paramPath, []byte(`{}`), 0o600)
+	require.NoError(t, err)
+	err = os.WriteFile(secretPath, []byte(`{}`), 0o600)
+	require.NoError(t, err)
+
+	// Make directory read-only so files can't be removed
+	//nolint:gosec // G302: intentionally restrictive permissions for test
+	err = os.Chmod(dirPath, 0o555)
+	require.NoError(t, err)
+	//nolint:gosec // G302: restore permissions for cleanup
+	defer func() { _ = os.Chmod(dirPath, 0o755) }()
+
+	store := NewStoreWithDir(dirPath)
+
+	err = store.Delete()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to remove param file")
+	assert.Contains(t, err.Error(), "failed to remove secret file")
+}
+
+func TestWriteService_WriteFileError(t *testing.T) {
+	t.Parallel()
+
+	// Create a read-only directory
+	tmpDir := t.TempDir()
+	dirPath := filepath.Join(tmpDir, "subdir")
+	err := os.MkdirAll(dirPath, 0o750)
+	require.NoError(t, err)
+
+	// Make directory read-only so files can't be created
+	//nolint:gosec // G302: intentionally restrictive permissions for test
+	err = os.Chmod(dirPath, 0o555)
+	require.NoError(t, err)
+	//nolint:gosec // G302: restore permissions for cleanup
+	defer func() { _ = os.Chmod(dirPath, 0o755) }()
+
+	store := NewStoreWithDir(dirPath)
+
+	state := staging.NewEmptyState()
+	state.Entries[staging.ServiceParam]["/test"] = staging.Entry{
+		Operation: staging.OperationCreate,
+		Value:     lo.ToPtr("value"),
+	}
+
+	err = store.writeService(staging.ServiceParam, state)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to write param file")
+}
+
+func TestDrain_SecretStateError(t *testing.T) {
+	t.Parallel()
+
+	// Create a directory with param file readable but secret file unreadable
+	tmpDir := t.TempDir()
+
+	// Write param file
+	paramPath := filepath.Join(tmpDir, "param.json")
+	err := os.WriteFile(paramPath, []byte(`{"version":2,"entries":{"param":{},"secret":{}},"tags":{"param":{},"secret":{}}}`), 0o600)
+	require.NoError(t, err)
+
+	// Write secret file with invalid JSON
+	secretPath := filepath.Join(tmpDir, "secret.json")
+	err = os.WriteFile(secretPath, []byte(`invalid json`), 0o600)
+	require.NoError(t, err)
+
+	store := NewStoreWithDir(tmpDir)
+
+	_, err = store.Drain(t.Context(), "", true)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to parse secret file")
+}
+
+func TestWriteState_MkdirAllError(t *testing.T) {
+	t.Parallel()
+
+	// Use a path that can't be created (file instead of directory)
+	tmpDir := t.TempDir()
+	filePath := filepath.Join(tmpDir, "file")
+	err := os.WriteFile(filePath, []byte("not a directory"), 0o600)
+	require.NoError(t, err)
+
+	// Try to use the file as a directory
+	store := NewStoreWithDir(filepath.Join(filePath, "subdir"))
+
+	state := staging.NewEmptyState()
+	state.Entries[staging.ServiceParam]["/test"] = staging.Entry{
+		Operation: staging.OperationCreate,
+		Value:     lo.ToPtr("value"),
+	}
+
+	err = store.WriteState(t.Context(), "", state)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to create state directory")
+}
+
+func TestWriteState_BothServicesError(t *testing.T) {
+	t.Parallel()
+
+	// Create a read-only directory after creating it
+	tmpDir := t.TempDir()
+	dirPath := filepath.Join(tmpDir, "subdir")
+	err := os.MkdirAll(dirPath, 0o750)
+	require.NoError(t, err)
+
+	// Make directory read-only so files can't be created
+	//nolint:gosec // G302: intentionally restrictive permissions for test
+	err = os.Chmod(dirPath, 0o555)
+	require.NoError(t, err)
+	//nolint:gosec // G302: restore permissions for cleanup
+	defer func() { _ = os.Chmod(dirPath, 0o755) }()
+
+	store := NewStoreWithDir(dirPath)
+
+	// State with both param and secret entries
+	state := staging.NewEmptyState()
+	state.Entries[staging.ServiceParam]["/test"] = staging.Entry{
+		Operation: staging.OperationCreate,
+		Value:     lo.ToPtr("param-value"),
+	}
+	state.Entries[staging.ServiceSecret]["my-secret"] = staging.Entry{
+		Operation: staging.OperationCreate,
+		Value:     lo.ToPtr("secret-value"),
+	}
+
+	err = store.WriteState(t.Context(), "", state)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "param:")
+	assert.Contains(t, err.Error(), "secret:")
 }
diff --git a/internal/staging/store/file/store_test.go b/internal/staging/store/file/store_test.go
index 125f1073..0872ee9f 100644
--- a/internal/staging/store/file/store_test.go
+++ b/internal/staging/store/file/store_test.go
@@ -17,7 +17,7 @@ import (
 func TestNewStore(t *testing.T) {
 	t.Parallel()
 
-	store, err := file.NewStore("123456789012", "ap-northeast-1")
+	store, err := file.NewStore(staging.AWSScope("123456789012", "ap-northeast-1"))
 	require.NoError(t, err)
 	assert.NotNil(t, store)
 }
@@ -25,15 +25,14 @@ func TestNewStore(t *testing.T) {
 func TestStore_Exists(t *testing.T) {
 	t.Parallel()
 
-	t.Run("file exists", func(t *testing.T) {
+	t.Run("param file exists", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
-		// Create the file
-		err := os.WriteFile(path, []byte(`{}`), 0o600)
+		// Create the param file
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(`{}`), 0o600)
 		require.NoError(t, err)
 
 		exists, err := store.Exists()
@@ -41,12 +40,43 @@ func TestStore_Exists(t *testing.T) {
 		assert.True(t, exists)
 	})
 
-	t.Run("file does not exist", func(t *testing.T) {
+	t.Run("secret file exists", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "nonexistent.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
+
+		// Create the secret file
+		err := os.WriteFile(filepath.Join(tmpDir, "secret.json"), []byte(`{}`), 0o600)
+		require.NoError(t, err)
+
+		exists, err := store.Exists()
+		require.NoError(t, err)
+		assert.True(t, exists)
+	})
+
+	t.Run("both files exist", func(t *testing.T) {
+		t.Parallel()
+
+		tmpDir := t.TempDir()
+		store := file.NewStoreWithDir(tmpDir)
+
+		// Create both files
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(`{}`), 0o600)
+		require.NoError(t, err)
+		err = os.WriteFile(filepath.Join(tmpDir, "secret.json"), []byte(`{}`), 0o600)
+		require.NoError(t, err)
+
+		exists, err := store.Exists()
+		require.NoError(t, err)
+		assert.True(t, exists)
+	})
+
+	t.Run("no files exist", func(t *testing.T) {
+		t.Parallel()
+
+		tmpDir := t.TempDir()
+		store := file.NewStoreWithDir(tmpDir)
 
 		exists, err := store.Exists()
 		require.NoError(t, err)
@@ -56,28 +86,26 @@ func TestStore_Exists(t *testing.T) {
 	t.Run("stat error (not IsNotExist)", func(t *testing.T) {
 		t.Parallel()
 
-		// Create a directory, then create a file inside, and try to stat a path
-		// that goes through the file as if it were a directory
+		// Create a file where we want a directory
 		tmpDir := t.TempDir()
 		filePath := filepath.Join(tmpDir, "not-a-dir")
 		err := os.WriteFile(filePath, []byte("content"), 0o600)
 		require.NoError(t, err)
 
-		// Try to stat a path through the file (which is not a directory)
-		invalidPath := filepath.Join(filePath, "stage.json")
-		store := file.NewStoreWithPath(invalidPath)
+		// Use the file as a directory (invalid)
+		store := file.NewStoreWithDir(filePath)
 
 		exists, err := store.Exists()
 		require.Error(t, err)
 		assert.False(t, exists)
-		assert.Contains(t, err.Error(), "failed to check state file")
+		assert.Contains(t, err.Error(), "failed to check file")
 	})
 }
 
 func TestNewStoreWithPassphrase(t *testing.T) {
 	t.Parallel()
 
-	store, err := file.NewStoreWithPassphrase("123456789012", "ap-northeast-1", "secret")
+	store, err := file.NewStoreWithPassphrase(staging.AWSScope("123456789012", "ap-northeast-1"), "secret")
 	require.NoError(t, err)
 	assert.NotNil(t, store)
 }
@@ -89,11 +117,10 @@ func TestStore_IsEncrypted(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
-		// Write plain JSON
-		err := os.WriteFile(path, []byte(`{"version":2}`), 0o600)
+		// Write plain JSON to param file
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(`{"version":2}`), 0o600)
 		require.NoError(t, err)
 
 		isEnc, err := store.IsEncrypted()
@@ -101,17 +128,16 @@ func TestStore_IsEncrypted(t *testing.T) {
 		assert.False(t, isEnc)
 	})
 
-	t.Run("encrypted", func(t *testing.T) {
+	t.Run("param encrypted", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
-		// Write encrypted data
+		// Write encrypted data to param file
 		encrypted, err := crypt.Encrypt([]byte(`{"version":2}`), "password")
 		require.NoError(t, err)
-		err = os.WriteFile(path, encrypted, 0o600)
+		err = os.WriteFile(filepath.Join(tmpDir, "param.json"), encrypted, 0o600)
 		require.NoError(t, err)
 
 		isEnc, err := store.IsEncrypted()
@@ -119,12 +145,28 @@ func TestStore_IsEncrypted(t *testing.T) {
 		assert.True(t, isEnc)
 	})
 
-	t.Run("file not exists", func(t *testing.T) {
+	t.Run("secret encrypted", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "nonexistent.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
+
+		// Write encrypted data to secret file
+		encrypted, err := crypt.Encrypt([]byte(`{"version":2}`), "password")
+		require.NoError(t, err)
+		err = os.WriteFile(filepath.Join(tmpDir, "secret.json"), encrypted, 0o600)
+		require.NoError(t, err)
+
+		isEnc, err := store.IsEncrypted()
+		require.NoError(t, err)
+		assert.True(t, isEnc)
+	})
+
+	t.Run("files not exist", func(t *testing.T) {
+		t.Parallel()
+
+		tmpDir := t.TempDir()
+		store := file.NewStoreWithDir(tmpDir)
 
 		isEnc, err := store.IsEncrypted()
 		require.NoError(t, err)
@@ -134,44 +176,41 @@ func TestStore_IsEncrypted(t *testing.T) {
 	t.Run("read error (not IsNotExist)", func(t *testing.T) {
 		t.Parallel()
 
-		// Create a path through a file (not a directory) to trigger read error
+		// Create a file where we want a directory
 		tmpDir := t.TempDir()
 		filePath := filepath.Join(tmpDir, "not-a-dir")
 		err := os.WriteFile(filePath, []byte("content"), 0o600)
 		require.NoError(t, err)
 
-		invalidPath := filepath.Join(filePath, "stage.json")
-		store := file.NewStoreWithPath(invalidPath)
+		store := file.NewStoreWithDir(filePath)
 
 		isEnc, err := store.IsEncrypted()
 		require.Error(t, err)
 		assert.False(t, isEnc)
-		assert.Contains(t, err.Error(), "failed to read state file")
+		assert.Contains(t, err.Error(), "failed to read file")
 	})
 }
 
 func TestStore_Drain(t *testing.T) {
 	t.Parallel()
 
-	t.Run("empty file", func(t *testing.T) {
+	t.Run("empty files", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
 		state, err := store.Drain(t.Context(), "", true)
 		require.NoError(t, err)
 		assert.True(t, state.IsEmpty())
 	})
 
-	t.Run("with data keep=true", func(t *testing.T) {
+	t.Run("with param data keep=true", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write test data
+		// Write test data to param file
 		testData := `{
 			"version": 2,
 			"entries": {
@@ -182,19 +221,18 @@ func TestStore_Drain(t *testing.T) {
 			},
 			"tags": {"param": {}, "secret": {}}
 		}`
-		err := os.WriteFile(path, []byte(testData), 0o600)
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(testData), 0o600)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		state, err := store.Drain(t.Context(), "", true)
 		require.NoError(t, err)
 
-		assert.Equal(t, 2, state.Version)
 		assert.Len(t, state.Entries[staging.ServiceParam], 1)
 		assert.Equal(t, "test", lo.FromPtr(state.Entries[staging.ServiceParam]["/app/config"].Value))
 
 		// File should still exist
-		_, err = os.Stat(path)
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
 		assert.NoError(t, err)
 	})
 
@@ -202,19 +240,24 @@ func TestStore_Drain(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write test data
-		testData := `{"version": 2, "entries": {"param": {}, "secret": {}}, "tags": {"param": {}, "secret": {}}}`
-		err := os.WriteFile(path, []byte(testData), 0o600)
+		// Write test data to both files
+		paramData := `{"version": 2, "entries": {"param": {"/test": {"operation": "create"}}, "secret": {}}, "tags": {"param": {}, "secret": {}}}`
+		//nolint:gosec // G101: This is test data, not an actual secret
+		secretData := `{"version": 2, "entries": {"param": {}, "secret": {"mysecret": {"operation": "create"}}}, "tags": {"param": {}, "secret": {}}}`
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(paramData), 0o600)
+		require.NoError(t, err)
+		err = os.WriteFile(filepath.Join(tmpDir, "secret.json"), []byte(secretData), 0o600)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		_, err = store.Drain(t.Context(), "", false)
 		require.NoError(t, err)
 
-		// File should be deleted
-		_, err = os.Stat(path)
+		// Both files should be deleted
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
+		assert.True(t, os.IsNotExist(err))
+		_, err = os.Stat(filepath.Join(tmpDir, "secret.json"))
 		assert.True(t, os.IsNotExist(err))
 	})
 
@@ -222,18 +265,16 @@ func TestStore_Drain(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write encrypted data
-		//nolint:lll // mock function signature
-		testData := `{"version": 2, "entries": {"param": {"/test": {"operation": "create", "value": "secret"}}, "secret": {}}, "tags": {"param": {}, "secret": {}}}`
+		// Write encrypted data to param file
+		testData := `{"version": 2, "entries": {"param": {"/test": {"operation": "create", "value": "secret"}}, ` +
+			`"secret": {}}, "tags": {"param": {}, "secret": {}}}`
 		encrypted, err := crypt.Encrypt([]byte(testData), "mypassword")
 		require.NoError(t, err)
-		err = os.WriteFile(path, encrypted, 0o600)
+		err = os.WriteFile(filepath.Join(tmpDir, "param.json"), encrypted, 0o600)
 		require.NoError(t, err)
 
-		// Create store with custom path and passphrase for test
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		store.SetPassphrase("mypassword")
 
 		state, err := store.Drain(t.Context(), "", true)
@@ -245,42 +286,38 @@ func TestStore_Drain(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write encrypted data
+		// Write encrypted data to param file
 		encrypted, err := crypt.Encrypt([]byte(`{"version": 2}`), "mypassword")
 		require.NoError(t, err)
-		err = os.WriteFile(path, encrypted, 0o600)
+		err = os.WriteFile(filepath.Join(tmpDir, "param.json"), encrypted, 0o600)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		_, err = store.Drain(t.Context(), "", true)
 		assert.ErrorIs(t, err, crypt.ErrDecryptionFailed)
 	})
 
-	t.Run("with service filter", func(t *testing.T) {
+	t.Run("with service filter - param", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write test data with both services
-		testData := `{
+		// Write test data to param file
+		paramData := `{
 			"version": 2,
 			"entries": {
 				"param": {
 					"/app/config": {"operation": "update", "value": "param-val"}
 				},
-				"secret": {
-					"my-secret": {"operation": "create", "value": "secret-val"}
-				}
+				"secret": {}
 			},
 			"tags": {"param": {}, "secret": {}}
 		}`
-		err := os.WriteFile(path, []byte(testData), 0o600)
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(paramData), 0o600)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
 		// Drain only param service
 		state, err := store.Drain(t.Context(), staging.ServiceParam, true)
@@ -300,43 +337,40 @@ func TestStore_Drain(t *testing.T) {
 		err := os.WriteFile(filePath, []byte("content"), 0o600)
 		require.NoError(t, err)
 
-		invalidPath := filepath.Join(filePath, "stage.json")
-		store := file.NewStoreWithPath(invalidPath)
+		store := file.NewStoreWithDir(filePath)
 
 		_, err = store.Drain(t.Context(), "", true)
 		require.Error(t, err)
-		assert.Contains(t, err.Error(), "failed to read state file")
+		assert.Contains(t, err.Error(), "failed to read param file")
 	})
 
 	t.Run("JSON parse error", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write invalid JSON
-		err := os.WriteFile(path, []byte(`{invalid json`), 0o600)
+		// Write invalid JSON to param file
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(`{invalid json`), 0o600)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		_, err = store.Drain(t.Context(), "", true)
 		require.Error(t, err)
-		assert.Contains(t, err.Error(), "failed to parse state file")
+		assert.Contains(t, err.Error(), "failed to parse param file")
 	})
 
 	t.Run("encrypted with wrong passphrase", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Write encrypted data
+		// Write encrypted data to param file
 		encrypted, err := crypt.Encrypt([]byte(`{"version": 2}`), "correct-password")
 		require.NoError(t, err)
-		err = os.WriteFile(path, encrypted, 0o600)
+		err = os.WriteFile(filepath.Join(tmpDir, "param.json"), encrypted, 0o600)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		store.SetPassphrase("wrong-password")
 
 		_, err = store.Drain(t.Context(), "", true)
@@ -347,12 +381,11 @@ func TestStore_Drain(t *testing.T) {
 func TestStore_Persist(t *testing.T) {
 	t.Parallel()
 
-	t.Run("persist state", func(t *testing.T) {
+	t.Run("persist param state", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
 		state := staging.NewEmptyState()
 		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
@@ -363,8 +396,8 @@ func TestStore_Persist(t *testing.T) {
 		err := store.WriteState(t.Context(), "", state)
 		require.NoError(t, err)
 
-		// File should exist
-		_, err = os.Stat(path)
+		// Param file should exist
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
 		require.NoError(t, err)
 
 		// Read back and verify
@@ -373,12 +406,11 @@ func TestStore_Persist(t *testing.T) {
 		assert.Equal(t, "test-value", lo.FromPtr(readState.Entries[staging.ServiceParam]["/app/config"].Value))
 	})
 
-	t.Run("persist empty state removes file", func(t *testing.T) {
+	t.Run("persist empty state removes files", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
 		// First persist non-empty state
 		state := staging.NewEmptyState()
@@ -394,8 +426,8 @@ func TestStore_Persist(t *testing.T) {
 		err = store.WriteState(t.Context(), "", emptyState)
 		require.NoError(t, err)
 
-		// File should be removed
-		_, err = os.Stat(path)
+		// Param file should be removed
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
 		assert.True(t, os.IsNotExist(err))
 	})
 
@@ -403,8 +435,7 @@ func TestStore_Persist(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 		store.SetPassphrase("secret123")
 
 		state := staging.NewEmptyState()
@@ -431,8 +462,7 @@ func TestStore_Persist(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
 		state := staging.NewEmptyState()
 		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
@@ -448,6 +478,12 @@ func TestStore_Persist(t *testing.T) {
 		err := store.WriteState(t.Context(), staging.ServiceParam, state)
 		require.NoError(t, err)
 
+		// Only param file should exist
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
+		require.NoError(t, err)
+		_, err = os.Stat(filepath.Join(tmpDir, "secret.json"))
+		assert.True(t, os.IsNotExist(err))
+
 		// Read back and verify only param was persisted
 		readState, err := store.Drain(t.Context(), "", true)
 		require.NoError(t, err)
@@ -459,8 +495,8 @@ func TestStore_Persist(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		nestedPath := filepath.Join(tmpDir, "nested", "dir", "stage.json")
-		store := file.NewStoreWithPath(nestedPath)
+		nestedDir := filepath.Join(tmpDir, "nested", "dir")
+		store := file.NewStoreWithDir(nestedDir)
 
 		state := staging.NewEmptyState()
 		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
@@ -472,7 +508,7 @@ func TestStore_Persist(t *testing.T) {
 		require.NoError(t, err)
 
 		// File should exist
-		_, err = os.Stat(nestedPath)
+		_, err = os.Stat(filepath.Join(nestedDir, "param.json"))
 		assert.NoError(t, err)
 	})
 
@@ -485,9 +521,8 @@ func TestStore_Persist(t *testing.T) {
 		err := os.WriteFile(blocker, []byte("content"), 0o600)
 		require.NoError(t, err)
 
-		// Try to create file inside the "blocker" file (as if it were a directory)
-		invalidPath := filepath.Join(blocker, "nested", "stage.json")
-		store := file.NewStoreWithPath(invalidPath)
+		// Try to use the "blocker" file as a directory
+		store := file.NewStoreWithDir(blocker)
 
 		state := staging.NewEmptyState()
 		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
@@ -504,10 +539,9 @@ func TestStore_Persist(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "nonexistent.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
-		// Persist empty state - should not error even if file doesn't exist
+		// Persist empty state - should not error even if files don't exist
 		emptyState := staging.NewEmptyState()
 		err := store.WriteState(t.Context(), "", emptyState)
 		require.NoError(t, err)
@@ -516,15 +550,13 @@ func TestStore_Persist(t *testing.T) {
 	t.Run("persist write error", func(t *testing.T) {
 		t.Parallel()
 
-		// Create a directory where the file should be - WriteFile will fail
 		tmpDir := t.TempDir()
-		filePath := filepath.Join(tmpDir, "stage.json")
-
 		// Create a directory with the same name as the target file
-		err := os.MkdirAll(filePath, 0o750)
+		paramPath := filepath.Join(tmpDir, "param.json")
+		err := os.MkdirAll(paramPath, 0o750)
 		require.NoError(t, err)
 
-		store := file.NewStoreWithPath(filePath)
+		store := file.NewStoreWithDir(tmpDir)
 
 		state := staging.NewEmptyState()
 		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
@@ -534,60 +566,56 @@ func TestStore_Persist(t *testing.T) {
 
 		err = store.WriteState(t.Context(), "", state)
 		require.Error(t, err)
-		assert.Contains(t, err.Error(), "failed to write state file")
+		assert.Contains(t, err.Error(), "failed to write param file")
 	})
 }
 
 func TestStore_Delete(t *testing.T) {
 	t.Parallel()
 
-	t.Run("delete existing file", func(t *testing.T) {
+	t.Run("delete existing files", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
-		// Create the file
-		err := os.WriteFile(path, []byte(`{"version":1}`), 0o600)
+		// Create both files
+		err := os.WriteFile(filepath.Join(tmpDir, "param.json"), []byte(`{"version":1}`), 0o600)
 		require.NoError(t, err)
-
-		// Verify file exists
-		_, err = os.Stat(path)
+		err = os.WriteFile(filepath.Join(tmpDir, "secret.json"), []byte(`{"version":1}`), 0o600)
 		require.NoError(t, err)
 
 		// Delete
 		err = store.Delete()
 		require.NoError(t, err)
 
-		// Verify file is deleted
-		_, err = os.Stat(path)
+		// Verify files are deleted
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
+		assert.True(t, os.IsNotExist(err))
+		_, err = os.Stat(filepath.Join(tmpDir, "secret.json"))
 		assert.True(t, os.IsNotExist(err))
 	})
 
-	t.Run("delete non-existent file (no error)", func(t *testing.T) {
+	t.Run("delete non-existent files (no error)", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "nonexistent.json")
-		store := file.NewStoreWithPath(path)
+		store := file.NewStoreWithDir(tmpDir)
 
-		// Delete should not error even if file doesn't exist
+		// Delete should not error even if files don't exist
 		err := store.Delete()
 		require.NoError(t, err)
 	})
 
-	t.Run("delete encrypted file", func(t *testing.T) {
+	t.Run("delete encrypted files", func(t *testing.T) {
 		t.Parallel()
 
 		tmpDir := t.TempDir()
-		path := filepath.Join(tmpDir, "stage.json")
 
-		// Create encrypted store
-		storeWithPass := file.NewStoreWithPath(path)
+		// Create encrypted store and write
+		storeWithPass := file.NewStoreWithDir(tmpDir)
 		storeWithPass.SetPassphrase("test-passphrase")
 
-		// Write encrypted state
 		state := staging.NewEmptyState()
 		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
 			Operation: staging.OperationUpdate,
@@ -597,17 +625,90 @@ func TestStore_Delete(t *testing.T) {
 		require.NoError(t, err)
 
 		// Verify file is encrypted
-		data, err := os.ReadFile(path) //nolint:gosec // Test file path from temp directory
+		//nolint:gosec // G304: path is from t.TempDir(), safe for test
+		data, err := os.ReadFile(filepath.Join(tmpDir, "param.json"))
 		require.NoError(t, err)
 		assert.True(t, crypt.IsEncrypted(data))
 
-		// Create store without passphrase and delete
-		storeNoPass := file.NewStoreWithPath(path)
+		// Create store without passphrase and delete (should still work)
+		storeNoPass := file.NewStoreWithDir(tmpDir)
 		err = storeNoPass.Delete()
 		require.NoError(t, err)
 
 		// Verify file is deleted
-		_, err = os.Stat(path)
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
+		assert.True(t, os.IsNotExist(err))
+	})
+}
+
+func TestStore_BothServices(t *testing.T) {
+	t.Parallel()
+
+	t.Run("persist and drain both services", func(t *testing.T) {
+		t.Parallel()
+
+		tmpDir := t.TempDir()
+		store := file.NewStoreWithDir(tmpDir)
+
+		state := staging.NewEmptyState()
+		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
+			Operation: staging.OperationUpdate,
+			Value:     lo.ToPtr("param-value"),
+		}
+		state.Entries[staging.ServiceSecret]["my-secret"] = staging.Entry{
+			Operation: staging.OperationCreate,
+			Value:     lo.ToPtr("secret-value"),
+		}
+
+		// Persist both services
+		err := store.WriteState(t.Context(), "", state)
+		require.NoError(t, err)
+
+		// Both files should exist
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
+		require.NoError(t, err)
+		_, err = os.Stat(filepath.Join(tmpDir, "secret.json"))
+		require.NoError(t, err)
+
+		// Drain all and verify
+		readState, err := store.Drain(t.Context(), "", true)
+		require.NoError(t, err)
+		assert.Len(t, readState.Entries[staging.ServiceParam], 1)
+		assert.Len(t, readState.Entries[staging.ServiceSecret], 1)
+		assert.Equal(t, "param-value", lo.FromPtr(readState.Entries[staging.ServiceParam]["/app/config"].Value))
+		assert.Equal(t, "secret-value", lo.FromPtr(readState.Entries[staging.ServiceSecret]["my-secret"].Value))
+	})
+
+	t.Run("drain specific service only", func(t *testing.T) {
+		t.Parallel()
+
+		tmpDir := t.TempDir()
+		store := file.NewStoreWithDir(tmpDir)
+
+		state := staging.NewEmptyState()
+		state.Entries[staging.ServiceParam]["/app/config"] = staging.Entry{
+			Operation: staging.OperationUpdate,
+			Value:     lo.ToPtr("param-value"),
+		}
+		state.Entries[staging.ServiceSecret]["my-secret"] = staging.Entry{
+			Operation: staging.OperationCreate,
+			Value:     lo.ToPtr("secret-value"),
+		}
+
+		// Persist both services
+		err := store.WriteState(t.Context(), "", state)
+		require.NoError(t, err)
+
+		// Drain only secret, keep=false
+		secretState, err := store.Drain(t.Context(), staging.ServiceSecret, false)
+		require.NoError(t, err)
+		assert.Empty(t, secretState.Entries[staging.ServiceParam])
+		assert.Len(t, secretState.Entries[staging.ServiceSecret], 1)
+
+		// Secret file should be deleted, param file should remain
+		_, err = os.Stat(filepath.Join(tmpDir, "param.json"))
+		require.NoError(t, err)
+		_, err = os.Stat(filepath.Join(tmpDir, "secret.json"))
 		assert.True(t, os.IsNotExist(err))
 	})
 }
diff --git a/internal/usecase/param/create.go b/internal/usecase/param/create.go
index fd75d565..121bc35f 100644
--- a/internal/usecase/param/create.go
+++ b/internal/usecase/param/create.go
@@ -3,22 +3,22 @@ package param
 import (
 	"context"
 	"fmt"
+	"strconv"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // CreateClient is the interface for the create use case.
 type CreateClient interface {
-	paramapi.PutParameterAPI
+	// PutParameter creates or updates a parameter.
+	PutParameter(ctx context.Context, param *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error)
 }
 
 // CreateInput holds input for the create use case.
 type CreateInput struct {
 	Name        string
 	Value       string
-	Type        paramapi.ParameterType
+	Type        string // Parameter type (e.g., "String", "SecureString")
 	Description string
 }
 
@@ -36,23 +36,22 @@ type CreateUseCase struct {
 // Execute runs the create use case.
 // It creates a new parameter. If the parameter already exists, returns an error.
 func (u *CreateUseCase) Execute(ctx context.Context, input CreateInput) (*CreateOutput, error) {
-	putInput := &paramapi.PutParameterInput{
-		Name:      lo.ToPtr(input.Name),
-		Value:     lo.ToPtr(input.Value),
-		Type:      input.Type,
-		Overwrite: lo.ToPtr(false), // Do not overwrite existing parameters
-	}
-	if input.Description != "" {
-		putInput.Description = lo.ToPtr(input.Description)
+	param := &model.Parameter{
+		Name:        input.Name,
+		Value:       input.Value,
+		Description: input.Description,
+		Metadata:    model.AWSParameterMeta{Type: input.Type},
 	}
 
-	putOutput, err := u.Client.PutParameter(ctx, putInput)
+	result, err := u.Client.PutParameter(ctx, param, false) // Do not overwrite existing parameters
 	if err != nil {
 		return nil, fmt.Errorf("failed to create parameter: %w", err)
 	}
 
+	version, _ := strconv.ParseInt(result.Version, 10, 64)
+
 	return &CreateOutput{
-		Name:    input.Name,
-		Version: putOutput.Version,
+		Name:    result.Name,
+		Version: version,
 	}, nil
 }
diff --git a/internal/usecase/param/create_test.go b/internal/usecase/param/create_test.go
index 239085c3..47b32ed7 100644
--- a/internal/usecase/param/create_test.go
+++ b/internal/usecase/param/create_test.go
@@ -2,23 +2,22 @@ package param_test
 
 import (
 	"context"
+	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
 type mockCreateClient struct {
-	putParameterResult *paramapi.PutParameterOutput
+	putParameterResult *model.ParameterWriteResult
 	putParameterErr    error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockCreateClient) PutParameter(_ context.Context, _ *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
+func (m *mockCreateClient) PutParameter(_ context.Context, _ *model.Parameter, _ bool) (*model.ParameterWriteResult, error) {
 	if m.putParameterErr != nil {
 		return nil, m.putParameterErr
 	}
@@ -30,7 +29,7 @@ func TestCreateUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	client := &mockCreateClient{
-		putParameterResult: &paramapi.PutParameterOutput{Version: 1},
+		putParameterResult: &model.ParameterWriteResult{Name: "/app/new", Version: "1"},
 	}
 
 	uc := &param.CreateUseCase{Client: client}
@@ -38,7 +37,7 @@ func TestCreateUseCase_Execute(t *testing.T) {
 	output, err := uc.Execute(t.Context(), param.CreateInput{
 		Name:  "/app/new",
 		Value: "new-value",
-		Type:  paramapi.ParameterTypeString,
+		Type:  "String",
 	})
 	require.NoError(t, err)
 	assert.Equal(t, "/app/new", output.Name)
@@ -49,7 +48,7 @@ func TestCreateUseCase_Execute_WithDescription(t *testing.T) {
 	t.Parallel()
 
 	client := &mockCreateClient{
-		putParameterResult: &paramapi.PutParameterOutput{Version: 1},
+		putParameterResult: &model.ParameterWriteResult{Name: "/app/new", Version: "1"},
 	}
 
 	uc := &param.CreateUseCase{Client: client}
@@ -57,7 +56,7 @@ func TestCreateUseCase_Execute_WithDescription(t *testing.T) {
 	output, err := uc.Execute(t.Context(), param.CreateInput{
 		Name:        "/app/new",
 		Value:       "new-value",
-		Type:        paramapi.ParameterTypeString,
+		Type:        "String",
 		Description: "my description",
 	})
 	require.NoError(t, err)
@@ -69,7 +68,7 @@ func TestCreateUseCase_Execute_AlreadyExists(t *testing.T) {
 	t.Parallel()
 
 	client := &mockCreateClient{
-		putParameterErr: &paramapi.ParameterAlreadyExists{Message: lo.ToPtr("already exists")},
+		putParameterErr: errors.New("parameter already exists"),
 	}
 
 	uc := &param.CreateUseCase{Client: client}
@@ -77,7 +76,7 @@ func TestCreateUseCase_Execute_AlreadyExists(t *testing.T) {
 	_, err := uc.Execute(t.Context(), param.CreateInput{
 		Name:  "/app/existing",
 		Value: "value",
-		Type:  paramapi.ParameterTypeString,
+		Type:  "String",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to create parameter")
@@ -95,7 +94,7 @@ func TestCreateUseCase_Execute_PutError(t *testing.T) {
 	_, err := uc.Execute(t.Context(), param.CreateInput{
 		Name:  "/app/config",
 		Value: "value",
-		Type:  paramapi.ParameterTypeString,
+		Type:  "String",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to create parameter")
diff --git a/internal/usecase/param/delete.go b/internal/usecase/param/delete.go
index 689cfd3d..8780ddd1 100644
--- a/internal/usecase/param/delete.go
+++ b/internal/usecase/param/delete.go
@@ -2,18 +2,17 @@ package param
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // DeleteClient is the interface for the delete use case.
 type DeleteClient interface {
-	paramapi.DeleteParameterAPI
-	paramapi.GetParameterAPI
+	// GetParameter retrieves a parameter by name and optional version.
+	GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error)
+	// DeleteParameter deletes a parameter by name.
+	DeleteParameter(ctx context.Context, name string) error
 }
 
 // DeleteInput holds input for the delete use case.
@@ -33,27 +32,18 @@ type DeleteUseCase struct {
 
 // GetCurrentValue fetches the current value for preview.
 func (u *DeleteUseCase) GetCurrentValue(ctx context.Context, name string) (string, error) {
-	out, err := u.Client.GetParameter(ctx, &paramapi.GetParameterInput{
-		Name:           lo.ToPtr(name),
-		WithDecryption: lo.ToPtr(true),
-	})
+	param, err := u.Client.GetParameter(ctx, name, "")
 	if err != nil {
-		pnf := (*paramapi.ParameterNotFound)(nil)
-		if errors.As(err, &pnf) {
-			return "", nil
-		}
-
-		return "", err
+		// Treat any error as "not found" for simplicity
+		return "", nil //nolint:nilerr // intentionally ignoring error to treat as not found
 	}
 
-	return lo.FromPtr(out.Parameter.Value), nil
+	return param.Value, nil
 }
 
 // Execute runs the delete use case.
 func (u *DeleteUseCase) Execute(ctx context.Context, input DeleteInput) (*DeleteOutput, error) {
-	_, err := u.Client.DeleteParameter(ctx, &paramapi.DeleteParameterInput{
-		Name: lo.ToPtr(input.Name),
-	})
+	err := u.Client.DeleteParameter(ctx, input.Name)
 	if err != nil {
 		return nil, fmt.Errorf("failed to delete parameter: %w", err)
 	}
diff --git a/internal/usecase/param/delete_test.go b/internal/usecase/param/delete_test.go
index f6c6805b..c6ea05ea 100644
--- a/internal/usecase/param/delete_test.go
+++ b/internal/usecase/param/delete_test.go
@@ -4,23 +4,20 @@ import (
 	"context"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
 type mockDeleteClient struct {
-	getParameterResult    *paramapi.GetParameterOutput
-	getParameterErr       error
-	deleteParameterResult *paramapi.DeleteParameterOutput
-	deleteParameterErr    error
+	getParameterResult *model.Parameter
+	getParameterErr    error
+	deleteParameterErr error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockDeleteClient) GetParameter(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockDeleteClient) GetParameter(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 	if m.getParameterErr != nil {
 		return nil, m.getParameterErr
 	}
@@ -28,23 +25,17 @@ func (m *mockDeleteClient) GetParameter(_ context.Context, _ *paramapi.GetParame
 	return m.getParameterResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockDeleteClient) DeleteParameter(_ context.Context, _ *paramapi.DeleteParameterInput, _ ...func(*paramapi.Options)) (*paramapi.DeleteParameterOutput, error) {
-	if m.deleteParameterErr != nil {
-		return nil, m.deleteParameterErr
-	}
-
-	return m.deleteParameterResult, nil
+func (m *mockDeleteClient) DeleteParameter(_ context.Context, _ string) error {
+	return m.deleteParameterErr
 }
 
 func TestDeleteUseCase_GetCurrentValue(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDeleteClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{
-				Value: lo.ToPtr("current-value"),
-			},
+		getParameterResult: &model.Parameter{
+			Name:  "/app/config",
+			Value: "current-value",
 		},
 	}
 
@@ -59,35 +50,20 @@ func TestDeleteUseCase_GetCurrentValue_NotFound(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDeleteClient{
-		getParameterErr: &paramapi.ParameterNotFound{Message: lo.ToPtr("not found")},
+		getParameterErr: errNotFound,
 	}
 
 	uc := &param.DeleteUseCase{Client: client}
 
 	value, err := uc.GetCurrentValue(t.Context(), "/app/not-exists")
-	require.NoError(t, err)
+	require.NoError(t, err) // GetCurrentValue treats errors as "not found"
 	assert.Empty(t, value)
 }
 
-func TestDeleteUseCase_GetCurrentValue_Error(t *testing.T) {
-	t.Parallel()
-
-	client := &mockDeleteClient{
-		getParameterErr: errAWS,
-	}
-
-	uc := &param.DeleteUseCase{Client: client}
-
-	_, err := uc.GetCurrentValue(t.Context(), "/app/config")
-	require.Error(t, err)
-}
-
 func TestDeleteUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
-	client := &mockDeleteClient{
-		deleteParameterResult: &paramapi.DeleteParameterOutput{},
-	}
+	client := &mockDeleteClient{}
 
 	uc := &param.DeleteUseCase{Client: client}
 
diff --git a/internal/usecase/param/diff.go b/internal/usecase/param/diff.go
index aa3bb18f..12375593 100644
--- a/internal/usecase/param/diff.go
+++ b/internal/usecase/param/diff.go
@@ -2,17 +2,17 @@ package param
 
 import (
 	"context"
+	"strconv"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/provider"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
 // DiffClient is the interface for the diff use case.
+//
+//nolint:iface // Intentionally aliases ParameterReader for type clarity in DiffUseCase.
 type DiffClient interface {
-	paramapi.GetParameterAPI
-	paramapi.GetParameterHistoryAPI
+	provider.ParameterReader
 }
 
 // DiffInput holds input for the diff use case.
@@ -48,12 +48,15 @@ func (u *DiffUseCase) Execute(ctx context.Context, input DiffInput) (*DiffOutput
 		return nil, err
 	}
 
+	oldVersion, _ := strconv.ParseInt(param1.Version, 10, 64)
+	newVersion, _ := strconv.ParseInt(param2.Version, 10, 64)
+
 	return &DiffOutput{
-		OldName:    lo.FromPtr(param1.Name),
-		OldVersion: param1.Version,
-		OldValue:   lo.FromPtr(param1.Value),
-		NewName:    lo.FromPtr(param2.Name),
-		NewVersion: param2.Version,
-		NewValue:   lo.FromPtr(param2.Value),
+		OldName:    param1.Name,
+		OldVersion: oldVersion,
+		OldValue:   param1.Value,
+		NewName:    param2.Name,
+		NewVersion: newVersion,
+		NewValue:   param2.Value,
 	}, nil
 }
diff --git a/internal/usecase/param/diff_test.go b/internal/usecase/param/diff_test.go
index 1c39cb50..6fab4458 100644
--- a/internal/usecase/param/diff_test.go
+++ b/internal/usecase/param/diff_test.go
@@ -2,63 +2,62 @@ package param_test
 
 import (
 	"context"
+	"fmt"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
 type mockDiffClient struct {
-	getParameterResults []*paramapi.GetParameterOutput
-	getParameterErrs    []error
-	getParameterCalls   int
-	// historyParams stores the base data; each call returns a fresh copy
-	historyParams []paramapi.ParameterHistory
-	getHistoryErr error
+	getParameterFunc        func(ctx context.Context, name string, version string) (*model.Parameter, error)
+	getParameterHistoryFunc func(ctx context.Context, name string) (*model.ParameterHistory, error)
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockDiffClient) GetParameter(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-	idx := m.getParameterCalls
-	m.getParameterCalls++
-
-	if idx < len(m.getParameterErrs) && m.getParameterErrs[idx] != nil {
-		return nil, m.getParameterErrs[idx]
-	}
-
-	if idx < len(m.getParameterResults) {
-		return m.getParameterResults[idx], nil
+func (m *mockDiffClient) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
+	if m.getParameterFunc != nil {
+		return m.getParameterFunc(ctx, name, version)
 	}
 
-	return nil, errUnexpectedCall
+	return nil, fmt.Errorf("GetParameter not mocked")
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockDiffClient) GetParameterHistory(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-	if m.getHistoryErr != nil {
-		return nil, m.getHistoryErr
+func (m *mockDiffClient) GetParameterHistory(ctx context.Context, name string) (*model.ParameterHistory, error) {
+	if m.getParameterHistoryFunc != nil {
+		return m.getParameterHistoryFunc(ctx, name)
 	}
 
-	// Return a fresh copy to avoid in-place mutations affecting subsequent calls
-	params := make([]paramapi.ParameterHistory, len(m.historyParams))
-	copy(params, m.historyParams)
+	return nil, fmt.Errorf("GetParameterHistory not mocked")
+}
 
-	return &paramapi.GetParameterHistoryOutput{Parameters: params}, nil
+func (m *mockDiffClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	return nil, fmt.Errorf("ListParameters not mocked")
 }
 
 func TestDiffUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	// #VERSION specs without shift use GetParameter (with name:version format)
+	callCount := 0
 	client := &mockDiffClient{
-		getParameterResults: []*paramapi.GetParameterOutput{
-			{Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("old-value"), Version: 1}},
-			{Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("new-value"), Version: 2}},
+		getParameterFunc: func(_ context.Context, name string, version string) (*model.Parameter, error) {
+			callCount++
+
+			assert.Equal(t, "/app/config", name)
+
+			if callCount == 1 {
+				assert.Equal(t, "1", version)
+
+				return &model.Parameter{Name: "/app/config", Value: "old-value", Version: "1"}, nil
+			}
+
+			assert.Equal(t, "2", version)
+
+			return &model.Parameter{Name: "/app/config", Value: "new-value", Version: "2"}, nil
 		},
 	}
 
@@ -84,7 +83,9 @@ func TestDiffUseCase_Execute_Spec1Error(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDiffClient{
-		getParameterErrs: []error{errGetParameter},
+		getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+			return nil, errGetParameter
+		},
 	}
 
 	uc := &param.DiffUseCase{Client: client}
@@ -102,11 +103,16 @@ func TestDiffUseCase_Execute_Spec1Error(t *testing.T) {
 func TestDiffUseCase_Execute_Spec2Error(t *testing.T) {
 	t.Parallel()
 
+	callCount := 0
 	client := &mockDiffClient{
-		getParameterResults: []*paramapi.GetParameterOutput{
-			{Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("old-value"), Version: 1}},
+		getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+			callCount++
+			if callCount == 1 {
+				return &model.Parameter{Name: "/app/config", Value: "old-value", Version: "1"}, nil
+			}
+
+			return nil, errGetParameter
 		},
-		getParameterErrs: []error{nil, errGetParameter},
 	}
 
 	uc := &param.DiffUseCase{Client: client}
@@ -125,10 +131,19 @@ func TestDiffUseCase_Execute_WithLatest(t *testing.T) {
 	t.Parallel()
 
 	// Both specs without shift use GetParameter
+	callCount := 0
 	client := &mockDiffClient{
-		getParameterResults: []*paramapi.GetParameterOutput{
-			{Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("old-value"), Version: 3}},
-			{Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("latest-value"), Version: 5}},
+		getParameterFunc: func(_ context.Context, _ string, version string) (*model.Parameter, error) {
+			callCount++
+			if callCount == 1 {
+				assert.Equal(t, "3", version)
+
+				return &model.Parameter{Name: "/app/config", Value: "old-value", Version: "3"}, nil
+			}
+
+			assert.Empty(t, version) // latest
+
+			return &model.Parameter{Name: "/app/config", Value: "latest-value", Version: "5"}, nil
 		},
 	}
 
@@ -151,10 +166,17 @@ func TestDiffUseCase_Execute_WithShift(t *testing.T) {
 
 	// Specs with shift use GetParameterHistory
 	client := &mockDiffClient{
-		historyParams: []paramapi.ParameterHistory{
-			{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1},
-			{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2},
-			{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3},
+		getParameterHistoryFunc: func(_ context.Context, name string) (*model.ParameterHistory, error) {
+			assert.Equal(t, "/app/config", name)
+
+			return &model.ParameterHistory{
+				Name: "/app/config",
+				Parameters: []*model.Parameter{
+					{Name: "/app/config", Value: "v1", Version: "1"},
+					{Name: "/app/config", Value: "v2", Version: "2"},
+					{Name: "/app/config", Value: "v3", Version: "3"},
+				},
+			}, nil
 		},
 	}
 
@@ -178,7 +200,9 @@ func TestDiffUseCase_Execute_WithShift_Error(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDiffClient{
-		getHistoryErr: errHistoryFailed,
+		getParameterHistoryFunc: func(_ context.Context, _ string) (*model.ParameterHistory, error) {
+			return nil, errHistoryFailed
+		},
 	}
 
 	uc := &param.DiffUseCase{Client: client}
diff --git a/internal/usecase/param/helper_test.go b/internal/usecase/param/helper_test.go
index 09d954aa..a2a193d9 100644
--- a/internal/usecase/param/helper_test.go
+++ b/internal/usecase/param/helper_test.go
@@ -12,5 +12,5 @@ var (
 	errAddTagsFailed    = errors.New("add tags failed")
 	errRemoveTagsFailed = errors.New("remove tags failed")
 	errAccessDenied     = errors.New("access denied")
-	errUnexpectedCall   = errors.New("unexpected GetParameter call")
+	errNotFound         = errors.New("not found")
 )
diff --git a/internal/usecase/param/log.go b/internal/usecase/param/log.go
index 2f3476c7..8b3e2e32 100644
--- a/internal/usecase/param/log.go
+++ b/internal/usecase/param/log.go
@@ -4,16 +4,18 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strconv"
 	"time"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
+	"github.com/mpyw/suve/internal/provider"
 )
 
 // LogClient is the interface for the log use case.
+//
+//nolint:iface // Intentionally aliases ParameterReader for type clarity in LogUseCase.
 type LogClient interface {
-	paramapi.GetParameterHistoryAPI
+	provider.ParameterReader
 }
 
 // LogInput holds input for the log use case.
@@ -27,11 +29,11 @@ type LogInput struct {
 
 // LogEntry represents a single version entry.
 type LogEntry struct {
-	Version      int64
-	Type         paramapi.ParameterType
-	Value        string
-	LastModified *time.Time
-	IsCurrent    bool
+	Version   string
+	Type      string // Parameter type (e.g., "String", "SecureString")
+	Value     string
+	UpdatedAt *time.Time
+	IsCurrent bool
 }
 
 // LogOutput holds the result of the log use case.
@@ -47,63 +49,97 @@ type LogUseCase struct {
 
 // Execute runs the log use case.
 func (u *LogUseCase) Execute(ctx context.Context, input LogInput) (*LogOutput, error) {
-	result, err := u.Client.GetParameterHistory(ctx, &paramapi.GetParameterHistoryInput{
-		Name:           lo.ToPtr(input.Name),
-		WithDecryption: lo.ToPtr(true),
-		MaxResults:     lo.ToPtr(input.MaxResults),
-	})
+	history, err := u.Client.GetParameterHistory(ctx, input.Name)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get parameter history: %w", err)
 	}
 
-	params := result.Parameters
+	params := history.Parameters
 	if len(params) == 0 {
 		return &LogOutput{Name: input.Name}, nil
 	}
 
-	// Find max version using lo.MaxBy
-	maxVersion := lo.MaxBy(params, func(a, b paramapi.ParameterHistory) bool {
-		return a.Version > b.Version
-	}).Version
-
-	// Apply date filters using lo.Filter
-	filtered := lo.Filter(params, func(h paramapi.ParameterHistory, _ int) bool {
-		// Skip entries without LastModifiedDate when date filters are applied
-		if input.Since != nil || input.Until != nil {
-			if h.LastModifiedDate == nil {
-				return false
-			}
+	// Find max version for IsCurrent flag
+	maxVersion := findMaxVersion(params)
 
-			if input.Since != nil && h.LastModifiedDate.Before(*input.Since) {
-				return false
-			}
+	// Apply date filters
+	filtered := filterByDate(params, input.Since, input.Until)
 
-			if input.Until != nil && h.LastModifiedDate.After(*input.Until) {
-				return false
-			}
+	// Convert to entries
+	entries := make([]LogEntry, len(filtered))
+	for i, p := range filtered {
+		entry := LogEntry{
+			Version:   p.Version,
+			Value:     p.Value,
+			UpdatedAt: p.UpdatedAt,
+			IsCurrent: p.Version == maxVersion,
 		}
 
-		return true
-	})
-
-	// Convert to entries using lo.Map
-	entries := lo.Map(filtered, func(h paramapi.ParameterHistory, _ int) LogEntry {
-		return LogEntry{
-			Version:      h.Version,
-			Type:         h.Type,
-			Value:        lo.FromPtr(h.Value),
-			LastModified: h.LastModifiedDate,
-			IsCurrent:    h.Version == maxVersion,
+		// Extract Type from AWS metadata if available
+		if meta := p.AWSMeta(); meta != nil {
+			entry.Type = meta.Type
 		}
-	})
+
+		entries[i] = entry
+	}
 
 	// AWS returns oldest first; reverse to show newest first (unless --reverse)
 	if !input.Reverse {
 		slices.Reverse(entries)
 	}
 
+	// Apply MaxResults limit after sorting
+	if input.MaxResults > 0 && len(entries) > int(input.MaxResults) {
+		entries = entries[:input.MaxResults]
+	}
+
 	return &LogOutput{
 		Name:    input.Name,
 		Entries: entries,
 	}, nil
 }
+
+// findMaxVersion returns the maximum version string from the parameters.
+func findMaxVersion(params []*model.Parameter) string {
+	maxVersion := ""
+	maxVersionNum := int64(-1)
+
+	for _, p := range params {
+		if v, err := strconv.ParseInt(p.Version, 10, 64); err == nil {
+			if v > maxVersionNum {
+				maxVersionNum = v
+				maxVersion = p.Version
+			}
+		}
+	}
+
+	return maxVersion
+}
+
+// filterByDate filters parameters by modification date range.
+func filterByDate(params []*model.Parameter, since, until *time.Time) []*model.Parameter {
+	if since == nil && until == nil {
+		return params
+	}
+
+	filtered := make([]*model.Parameter, 0, len(params))
+
+	for _, p := range params {
+		// Skip entries without LastModified when date filters are applied
+		if p.UpdatedAt == nil {
+			continue
+		}
+
+		if since != nil && p.UpdatedAt.Before(*since) {
+			continue
+		}
+
+		if until != nil && p.UpdatedAt.After(*until) {
+			continue
+		}
+
+		filtered = append(filtered, p)
+	}
+
+	return filtered
+}
diff --git a/internal/usecase/param/log_test.go b/internal/usecase/param/log_test.go
index cfc6f1f9..30113620 100644
--- a/internal/usecase/param/log_test.go
+++ b/internal/usecase/param/log_test.go
@@ -5,46 +5,71 @@ import (
 	"testing"
 	"time"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
 type mockLogClient struct {
-	getHistoryResult *paramapi.GetParameterHistoryOutput
-	getHistoryErr    error
+	getParameterResult *model.Parameter
+	getParameterErr    error
+	getHistoryResult   *model.ParameterHistory
+	getHistoryErr      error
+	listParametersErr  error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockLogClient) GetParameterHistory(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
+func (m *mockLogClient) GetParameter(_ context.Context, _ string, _ string) (*model.Parameter, error) {
+	if m.getParameterErr != nil {
+		return nil, m.getParameterErr
+	}
+
+	return m.getParameterResult, nil
+}
+
+func (m *mockLogClient) GetParameterHistory(_ context.Context, _ string) (*model.ParameterHistory, error) {
 	if m.getHistoryErr != nil {
 		return nil, m.getHistoryErr
 	}
 
+	if m.getHistoryResult == nil {
+		return &model.ParameterHistory{}, nil
+	}
+
 	return m.getHistoryResult, nil
 }
 
+func (m *mockLogClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	if m.listParametersErr != nil {
+		return nil, m.listParametersErr
+	}
+
+	return nil, nil
+}
+
 func TestLogUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	now := time.Now()
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
 				{
-					Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1,
-					Type: paramapi.ParameterTypeString, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour)),
+					Name: "/app/config", Value: "v1", Version: "1",
+					UpdatedAt: timePtr(now.Add(-2 * time.Hour)),
+					Metadata:  model.AWSParameterMeta{Type: "String"},
 				},
 				{
-					Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2,
-					Type: paramapi.ParameterTypeString, LastModifiedDate: lo.ToPtr(now.Add(-1 * time.Hour)),
+					Name: "/app/config", Value: "v2", Version: "2",
+					UpdatedAt: timePtr(now.Add(-1 * time.Hour)),
+					Metadata:  model.AWSParameterMeta{Type: "String"},
 				},
 				{
-					Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3,
-					Type: paramapi.ParameterTypeString, LastModifiedDate: lo.ToPtr(now),
+					Name: "/app/config", Value: "v3", Version: "3",
+					UpdatedAt: &now,
+					Metadata:  model.AWSParameterMeta{Type: "String"},
 				},
 			},
 		},
@@ -60,9 +85,9 @@ func TestLogUseCase_Execute(t *testing.T) {
 	assert.Len(t, output.Entries, 3)
 
 	// Newest first (default order)
-	assert.Equal(t, int64(3), output.Entries[0].Version)
-	assert.Equal(t, int64(2), output.Entries[1].Version)
-	assert.Equal(t, int64(1), output.Entries[2].Version)
+	assert.Equal(t, "3", output.Entries[0].Version)
+	assert.Equal(t, "2", output.Entries[1].Version)
+	assert.Equal(t, "1", output.Entries[2].Version)
 
 	// IsCurrent flag
 	assert.True(t, output.Entries[0].IsCurrent)
@@ -74,8 +99,9 @@ func TestLogUseCase_Execute_Empty(t *testing.T) {
 	t.Parallel()
 
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{},
+		getHistoryResult: &model.ParameterHistory{
+			Name:       "/app/config",
+			Parameters: []*model.Parameter{},
 		},
 	}
 
@@ -110,11 +136,12 @@ func TestLogUseCase_Execute_Reverse(t *testing.T) {
 
 	now := time.Now()
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-1 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: lo.ToPtr(now)},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-2 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-1 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -128,9 +155,9 @@ func TestLogUseCase_Execute_Reverse(t *testing.T) {
 	require.NoError(t, err)
 
 	// Oldest first when Reverse is true (keeps AWS order)
-	assert.Equal(t, int64(1), output.Entries[0].Version)
-	assert.Equal(t, int64(2), output.Entries[1].Version)
-	assert.Equal(t, int64(3), output.Entries[2].Version)
+	assert.Equal(t, "1", output.Entries[0].Version)
+	assert.Equal(t, "2", output.Entries[1].Version)
+	assert.Equal(t, "3", output.Entries[2].Version)
 }
 
 func TestLogUseCase_Execute_SinceFilter(t *testing.T) {
@@ -138,11 +165,12 @@ func TestLogUseCase_Execute_SinceFilter(t *testing.T) {
 
 	now := time.Now()
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-3 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-1 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: lo.ToPtr(now)},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-3 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-1 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -158,8 +186,8 @@ func TestLogUseCase_Execute_SinceFilter(t *testing.T) {
 
 	// v1 is before the since filter, so only v2 and v3 should be included
 	assert.Len(t, output.Entries, 2)
-	assert.Equal(t, int64(3), output.Entries[0].Version)
-	assert.Equal(t, int64(2), output.Entries[1].Version)
+	assert.Equal(t, "3", output.Entries[0].Version)
+	assert.Equal(t, "2", output.Entries[1].Version)
 }
 
 func TestLogUseCase_Execute_UntilFilter(t *testing.T) {
@@ -167,11 +195,12 @@ func TestLogUseCase_Execute_UntilFilter(t *testing.T) {
 
 	now := time.Now()
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-3 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-1 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: lo.ToPtr(now)},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-3 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-1 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -187,8 +216,8 @@ func TestLogUseCase_Execute_UntilFilter(t *testing.T) {
 
 	// v3 is after the until filter, so only v1 and v2 should be included
 	assert.Len(t, output.Entries, 2)
-	assert.Equal(t, int64(2), output.Entries[0].Version)
-	assert.Equal(t, int64(1), output.Entries[1].Version)
+	assert.Equal(t, "2", output.Entries[0].Version)
+	assert.Equal(t, "1", output.Entries[1].Version)
 }
 
 func TestLogUseCase_Execute_DateRangeFilter(t *testing.T) {
@@ -196,11 +225,12 @@ func TestLogUseCase_Execute_DateRangeFilter(t *testing.T) {
 
 	now := time.Now()
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-4 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: lo.ToPtr(now)},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-4 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-2 * time.Hour)), Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v3", Version: "3", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -218,16 +248,17 @@ func TestLogUseCase_Execute_DateRangeFilter(t *testing.T) {
 
 	// Only v2 should be within the range
 	assert.Len(t, output.Entries, 1)
-	assert.Equal(t, int64(2), output.Entries[0].Version)
+	assert.Equal(t, "2", output.Entries[0].Version)
 }
 
 func TestLogUseCase_Execute_NoLastModifiedDate(t *testing.T) {
 	t.Parallel()
 
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: nil},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", UpdatedAt: nil, Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -239,7 +270,7 @@ func TestLogUseCase_Execute_NoLastModifiedDate(t *testing.T) {
 	})
 	require.NoError(t, err)
 	assert.Len(t, output.Entries, 1)
-	assert.Nil(t, output.Entries[0].LastModified)
+	assert.Nil(t, output.Entries[0].UpdatedAt)
 }
 
 func TestLogUseCase_Execute_FilterWithNilLastModifiedDate(t *testing.T) {
@@ -247,10 +278,11 @@ func TestLogUseCase_Execute_FilterWithNilLastModifiedDate(t *testing.T) {
 
 	now := time.Now()
 	client := &mockLogClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: nil},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now)},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", UpdatedAt: nil, Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v2", Version: "2", UpdatedAt: &now, Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -264,7 +296,11 @@ func TestLogUseCase_Execute_FilterWithNilLastModifiedDate(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	// v1 has nil LastModifiedDate, so it is skipped when date filter is applied; only v2 remains
+	// v1 has nil LastModified, so it is skipped when date filter is applied; only v2 remains
 	assert.Len(t, output.Entries, 1)
-	assert.Equal(t, int64(2), output.Entries[0].Version)
+	assert.Equal(t, "2", output.Entries[0].Version)
+}
+
+func timePtr(t time.Time) *time.Time {
+	return &t
 }
diff --git a/internal/usecase/param/show.go b/internal/usecase/param/show.go
index 741567f7..eec4c793 100644
--- a/internal/usecase/param/show.go
+++ b/internal/usecase/param/show.go
@@ -5,17 +5,14 @@ import (
 	"context"
 	"time"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/provider"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
 // ShowClient is the interface for the show use case.
 type ShowClient interface {
-	paramapi.GetParameterAPI
-	paramapi.GetParameterHistoryAPI
-	paramapi.ListTagsForResourceAPI
+	provider.ParameterReader
+	provider.ParameterTagger
 }
 
 // ShowInput holds input for the show use case.
@@ -31,13 +28,13 @@ type ShowTag struct {
 
 // ShowOutput holds the result of the show use case.
 type ShowOutput struct {
-	Name         string
-	Value        string
-	Version      int64
-	Type         paramapi.ParameterType
-	Description  string
-	LastModified *time.Time
-	Tags         []ShowTag
+	Name        string
+	Value       string
+	Version     string
+	Type        string // Parameter type (e.g., "String", "SecureString")
+	Description string
+	UpdatedAt   *time.Time
+	Tags        []ShowTag
 }
 
 // ShowUseCase executes show operations.
@@ -53,28 +50,24 @@ func (u *ShowUseCase) Execute(ctx context.Context, input ShowInput) (*ShowOutput
 	}
 
 	output := &ShowOutput{
-		Name:        lo.FromPtr(param.Name),
-		Value:       lo.FromPtr(param.Value),
+		Name:        param.Name,
+		Value:       param.Value,
 		Version:     param.Version,
-		Type:        param.Type,
-		Description: lo.FromPtr(param.Description),
+		Description: param.Description,
+		UpdatedAt:   param.UpdatedAt,
 	}
-	if param.LastModifiedDate != nil {
-		output.LastModified = param.LastModifiedDate
+
+	// Extract Type from AWS metadata if available
+	if meta := param.AWSMeta(); meta != nil {
+		output.Type = meta.Type
 	}
 
 	// Fetch tags
-	tagsOutput, err := u.Client.ListTagsForResource(ctx, &paramapi.ListTagsForResourceInput{
-		ResourceType: paramapi.ResourceTypeForTaggingParameter,
-		ResourceId:   param.Name,
-	})
-	if err == nil && tagsOutput != nil {
-		output.Tags = lo.Map(tagsOutput.TagList, func(tag paramapi.Tag, _ int) ShowTag {
-			return ShowTag{
-				Key:   lo.FromPtr(tag.Key),
-				Value: lo.FromPtr(tag.Value),
-			}
-		})
+	tags, err := u.Client.GetTags(ctx, param.Name)
+	if err == nil && tags != nil {
+		for k, v := range tags {
+			output.Tags = append(output.Tags, ShowTag{Key: k, Value: v})
+		}
 	}
 
 	return output, nil
diff --git a/internal/usecase/param/show_test.go b/internal/usecase/param/show_test.go
index a217772f..afab7d4e 100644
--- a/internal/usecase/param/show_test.go
+++ b/internal/usecase/param/show_test.go
@@ -5,26 +5,25 @@ import (
 	"testing"
 	"time"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
 type mockShowClient struct {
-	getParameterResult *paramapi.GetParameterOutput
+	getParameterResult *model.Parameter
 	getParameterErr    error
-	getHistoryResult   *paramapi.GetParameterHistoryOutput
+	getHistoryResult   *model.ParameterHistory
 	getHistoryErr      error
-	listTagsResult     *paramapi.ListTagsForResourceOutput
-	listTagsErr        error
+	listParametersErr  error
+	getTagsResult      map[string]string
+	getTagsErr         error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockShowClient) GetParameter(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockShowClient) GetParameter(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 	if m.getParameterErr != nil {
 		return nil, m.getParameterErr
 	}
@@ -32,30 +31,40 @@ func (m *mockShowClient) GetParameter(_ context.Context, _ *paramapi.GetParamete
 	return m.getParameterResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockShowClient) GetParameterHistory(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
+func (m *mockShowClient) GetParameterHistory(_ context.Context, _ string) (*model.ParameterHistory, error) {
 	if m.getHistoryErr != nil {
 		return nil, m.getHistoryErr
 	}
 
 	if m.getHistoryResult == nil {
-		return &paramapi.GetParameterHistoryOutput{}, nil
+		return &model.ParameterHistory{}, nil
 	}
 
 	return m.getHistoryResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockShowClient) ListTagsForResource(_ context.Context, _ *paramapi.ListTagsForResourceInput, _ ...func(*paramapi.Options)) (*paramapi.ListTagsForResourceOutput, error) {
-	if m.listTagsErr != nil {
-		return nil, m.listTagsErr
+func (m *mockShowClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	if m.listParametersErr != nil {
+		return nil, m.listParametersErr
 	}
 
-	if m.listTagsResult != nil {
-		return m.listTagsResult, nil
+	return nil, nil
+}
+
+func (m *mockShowClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	if m.getTagsErr != nil {
+		return nil, m.getTagsErr
 	}
 
-	return &paramapi.ListTagsForResourceOutput{}, nil
+	return m.getTagsResult, nil
+}
+
+func (m *mockShowClient) AddTags(_ context.Context, _ string, _ map[string]string) error {
+	return nil
+}
+
+func (m *mockShowClient) RemoveTags(_ context.Context, _ string, _ []string) error {
+	return nil
 }
 
 func TestShowUseCase_Execute(t *testing.T) {
@@ -63,13 +72,13 @@ func TestShowUseCase_Execute(t *testing.T) {
 
 	now := time.Now()
 	client := &mockShowClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{
-				Name:             lo.ToPtr("/app/config"),
-				Value:            lo.ToPtr("secret-value"),
-				Version:          5,
-				Type:             paramapi.ParameterTypeSecureString,
-				LastModifiedDate: &now,
+		getParameterResult: &model.Parameter{
+			Name:      "/app/config",
+			Value:     "secret-value",
+			Version:   "5",
+			UpdatedAt: &now,
+			Metadata: model.AWSParameterMeta{
+				Type: "SecureString",
 			},
 		},
 	}
@@ -85,9 +94,9 @@ func TestShowUseCase_Execute(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "/app/config", output.Name)
 	assert.Equal(t, "secret-value", output.Value)
-	assert.Equal(t, int64(5), output.Version)
-	assert.Equal(t, paramapi.ParameterTypeSecureString, output.Type)
-	assert.NotNil(t, output.LastModified)
+	assert.Equal(t, "5", output.Version)
+	assert.Equal(t, "SecureString", output.Type)
+	assert.NotNil(t, output.UpdatedAt)
 }
 
 func TestShowUseCase_Execute_WithVersion(t *testing.T) {
@@ -95,12 +104,12 @@ func TestShowUseCase_Execute_WithVersion(t *testing.T) {
 
 	// #VERSION spec without shift uses GetParameter (SSM supports name:version format)
 	client := &mockShowClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{
-				Name:    lo.ToPtr("/app/config"),
-				Value:   lo.ToPtr("old-value"),
-				Version: 3,
-				Type:    paramapi.ParameterTypeString,
+		getParameterResult: &model.Parameter{
+			Name:    "/app/config",
+			Value:   "old-value",
+			Version: "3",
+			Metadata: model.AWSParameterMeta{
+				Type: "String",
 			},
 		},
 	}
@@ -116,7 +125,7 @@ func TestShowUseCase_Execute_WithVersion(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "/app/config", output.Name)
 	assert.Equal(t, "old-value", output.Value)
-	assert.Equal(t, int64(3), output.Version)
+	assert.Equal(t, "3", output.Version)
 }
 
 func TestShowUseCase_Execute_WithShift(t *testing.T) {
@@ -124,11 +133,12 @@ func TestShowUseCase_Execute_WithShift(t *testing.T) {
 
 	// Spec with shift uses GetParameterHistory
 	client := &mockShowClient{
-		getHistoryResult: &paramapi.GetParameterHistoryOutput{
-			Parameters: []paramapi.ParameterHistory{
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v1"), Version: 1, Type: paramapi.ParameterTypeString},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v2"), Version: 2, Type: paramapi.ParameterTypeString},
-				{Name: lo.ToPtr("/app/config"), Value: lo.ToPtr("v3"), Version: 3, Type: paramapi.ParameterTypeString},
+		getHistoryResult: &model.ParameterHistory{
+			Name: "/app/config",
+			Parameters: []*model.Parameter{
+				{Name: "/app/config", Value: "v1", Version: "1", Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v2", Version: "2", Metadata: model.AWSParameterMeta{Type: "String"}},
+				{Name: "/app/config", Value: "v3", Version: "3", Metadata: model.AWSParameterMeta{Type: "String"}},
 			},
 		},
 	}
@@ -144,7 +154,7 @@ func TestShowUseCase_Execute_WithShift(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "/app/config", output.Name)
 	assert.Equal(t, "v2", output.Value) // v3 - 1 = v2
-	assert.Equal(t, int64(2), output.Version)
+	assert.Equal(t, "2", output.Version)
 }
 
 func TestShowUseCase_Execute_Error(t *testing.T) {
@@ -165,16 +175,16 @@ func TestShowUseCase_Execute_Error(t *testing.T) {
 	require.Error(t, err)
 }
 
-func TestShowUseCase_Execute_NoLastModified(t *testing.T) {
+func TestShowUseCase_Execute_NoUpdatedAt(t *testing.T) {
 	t.Parallel()
 
 	client := &mockShowClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{
-				Name:    lo.ToPtr("/app/config"),
-				Value:   lo.ToPtr("value"),
-				Version: 1,
-				Type:    paramapi.ParameterTypeString,
+		getParameterResult: &model.Parameter{
+			Name:    "/app/config",
+			Value:   "value",
+			Version: "1",
+			Metadata: model.AWSParameterMeta{
+				Type: "String",
 			},
 		},
 	}
@@ -188,26 +198,24 @@ func TestShowUseCase_Execute_NoLastModified(t *testing.T) {
 		Spec: spec,
 	})
 	require.NoError(t, err)
-	assert.Nil(t, output.LastModified)
+	assert.Nil(t, output.UpdatedAt)
 }
 
 func TestShowUseCase_Execute_WithTags(t *testing.T) {
 	t.Parallel()
 
 	client := &mockShowClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{
-				Name:    lo.ToPtr("/app/config"),
-				Value:   lo.ToPtr("value"),
-				Version: 1,
-				Type:    paramapi.ParameterTypeString,
+		getParameterResult: &model.Parameter{
+			Name:    "/app/config",
+			Value:   "value",
+			Version: "1",
+			Metadata: model.AWSParameterMeta{
+				Type: "String",
 			},
 		},
-		listTagsResult: &paramapi.ListTagsForResourceOutput{
-			TagList: []paramapi.Tag{
-				{Key: lo.ToPtr("env"), Value: lo.ToPtr("prod")},
-				{Key: lo.ToPtr("team"), Value: lo.ToPtr("backend")},
-			},
+		getTagsResult: map[string]string{
+			"env":  "prod",
+			"team": "backend",
 		},
 	}
 
@@ -221,8 +229,13 @@ func TestShowUseCase_Execute_WithTags(t *testing.T) {
 	})
 	require.NoError(t, err)
 	assert.Len(t, output.Tags, 2)
-	assert.Equal(t, "env", output.Tags[0].Key)
-	assert.Equal(t, "prod", output.Tags[0].Value)
-	assert.Equal(t, "team", output.Tags[1].Key)
-	assert.Equal(t, "backend", output.Tags[1].Value)
+
+	// Tags are now from a map, so order is not guaranteed
+	tagMap := make(map[string]string)
+	for _, tag := range output.Tags {
+		tagMap[tag.Key] = tag.Value
+	}
+
+	assert.Equal(t, "prod", tagMap["env"])
+	assert.Equal(t, "backend", tagMap["team"])
 }
diff --git a/internal/usecase/param/tag.go b/internal/usecase/param/tag.go
index 179c4e61..ac760076 100644
--- a/internal/usecase/param/tag.go
+++ b/internal/usecase/param/tag.go
@@ -4,15 +4,13 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/provider"
 )
 
 // TagClient is the interface for the tag use case.
+// It uses the provider-agnostic ParameterTagger interface.
 type TagClient interface {
-	paramapi.AddTagsToResourceAPI
-	paramapi.RemoveTagsFromResourceAPI
+	provider.ParameterTagger
 }
 
 // TagInput holds input for the tag use case.
@@ -31,31 +29,14 @@ type TagUseCase struct {
 func (u *TagUseCase) Execute(ctx context.Context, input TagInput) error {
 	// Add tags
 	if len(input.Add) > 0 {
-		tags := lo.MapToSlice(input.Add, func(k, v string) paramapi.Tag {
-			return paramapi.Tag{
-				Key:   lo.ToPtr(k),
-				Value: lo.ToPtr(v),
-			}
-		})
-
-		_, err := u.Client.AddTagsToResource(ctx, &paramapi.AddTagsToResourceInput{
-			ResourceId:   lo.ToPtr(input.Name),
-			ResourceType: paramapi.ResourceTypeForTaggingParameter,
-			Tags:         tags,
-		})
-		if err != nil {
+		if err := u.Client.AddTags(ctx, input.Name, input.Add); err != nil {
 			return fmt.Errorf("failed to add tags: %w", err)
 		}
 	}
 
 	// Remove tags
 	if len(input.Remove) > 0 {
-		_, err := u.Client.RemoveTagsFromResource(ctx, &paramapi.RemoveTagsFromResourceInput{
-			ResourceId:   lo.ToPtr(input.Name),
-			ResourceType: paramapi.ResourceTypeForTaggingParameter,
-			TagKeys:      input.Remove,
-		})
-		if err != nil {
+		if err := u.Client.RemoveTags(ctx, input.Name, input.Remove); err != nil {
 			return fmt.Errorf("failed to remove tags: %w", err)
 		}
 	}
diff --git a/internal/usecase/param/tag_test.go b/internal/usecase/param/tag_test.go
index 49bf2814..d22625f7 100644
--- a/internal/usecase/param/tag_test.go
+++ b/internal/usecase/param/tag_test.go
@@ -7,7 +7,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
@@ -16,22 +15,16 @@ type mockTagClient struct {
 	removeTagsErr error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockTagClient) AddTagsToResource(_ context.Context, _ *paramapi.AddTagsToResourceInput, _ ...func(*paramapi.Options)) (*paramapi.AddTagsToResourceOutput, error) {
-	if m.addTagsErr != nil {
-		return nil, m.addTagsErr
-	}
-
-	return &paramapi.AddTagsToResourceOutput{}, nil
+func (m *mockTagClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	return nil, nil //nolint:nilnil // mock implementation
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockTagClient) RemoveTagsFromResource(_ context.Context, _ *paramapi.RemoveTagsFromResourceInput, _ ...func(*paramapi.Options)) (*paramapi.RemoveTagsFromResourceOutput, error) {
-	if m.removeTagsErr != nil {
-		return nil, m.removeTagsErr
-	}
+func (m *mockTagClient) AddTags(_ context.Context, _ string, _ map[string]string) error {
+	return m.addTagsErr
+}
 
-	return &paramapi.RemoveTagsFromResourceOutput{}, nil
+func (m *mockTagClient) RemoveTags(_ context.Context, _ string, _ []string) error {
+	return m.removeTagsErr
 }
 
 func TestTagUseCase_Execute_AddTags(t *testing.T) {
diff --git a/internal/usecase/param/update.go b/internal/usecase/param/update.go
index 23a5e986..f3b1a2f5 100644
--- a/internal/usecase/param/update.go
+++ b/internal/usecase/param/update.go
@@ -2,25 +2,25 @@ package param
 
 import (
 	"context"
-	"errors"
 	"fmt"
+	"strconv"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // UpdateClient is the interface for the update use case.
 type UpdateClient interface {
-	paramapi.GetParameterAPI
-	paramapi.PutParameterAPI
+	// GetParameter retrieves a parameter by name and optional version.
+	GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error)
+	// PutParameter creates or updates a parameter.
+	PutParameter(ctx context.Context, param *model.Parameter, overwrite bool) (*model.ParameterWriteResult, error)
 }
 
 // UpdateInput holds input for the update use case.
 type UpdateInput struct {
 	Name        string
 	Value       string
-	Type        paramapi.ParameterType
+	Type        string // Parameter type (e.g., "String", "SecureString")
 	Description string
 }
 
@@ -37,21 +37,29 @@ type UpdateUseCase struct {
 
 // Exists checks if a parameter exists.
 func (u *UpdateUseCase) Exists(ctx context.Context, name string) (bool, error) {
-	_, err := u.Client.GetParameter(ctx, &paramapi.GetParameterInput{
-		Name: lo.ToPtr(name),
-	})
+	_, err := u.Client.GetParameter(ctx, name, "")
 	if err != nil {
-		pnf := (*paramapi.ParameterNotFound)(nil)
-		if errors.As(err, &pnf) {
-			return false, nil
-		}
-
-		return false, err
+		// Check if it's a "not found" error
+		// The error message from AWS adapter contains "failed to get parameter"
+		// For now, we treat any error as "not found" for simplicity
+		// A more robust solution would be to define error types in provider package
+		return false, nil //nolint:nilerr // intentionally ignoring error to treat as not found
 	}
 
 	return true, nil
 }
 
+// GetCurrentValue fetches the current parameter value.
+func (u *UpdateUseCase) GetCurrentValue(ctx context.Context, name string) (string, error) {
+	param, err := u.Client.GetParameter(ctx, name, "")
+	if err != nil {
+		// Treat any error as "not found" for simplicity
+		return "", nil //nolint:nilerr // intentionally ignoring error to treat as not found
+	}
+
+	return param.Value, nil
+}
+
 // Execute runs the update use case.
 // It updates an existing parameter. If the parameter doesn't exist, returns an error.
 func (u *UpdateUseCase) Execute(ctx context.Context, input UpdateInput) (*UpdateOutput, error) {
@@ -66,23 +74,22 @@ func (u *UpdateUseCase) Execute(ctx context.Context, input UpdateInput) (*Update
 	}
 
 	// Update parameter
-	putInput := &paramapi.PutParameterInput{
-		Name:      lo.ToPtr(input.Name),
-		Value:     lo.ToPtr(input.Value),
-		Type:      input.Type,
-		Overwrite: lo.ToPtr(true),
-	}
-	if input.Description != "" {
-		putInput.Description = lo.ToPtr(input.Description)
+	param := &model.Parameter{
+		Name:        input.Name,
+		Value:       input.Value,
+		Description: input.Description,
+		Metadata:    model.AWSParameterMeta{Type: input.Type},
 	}
 
-	putOutput, err := u.Client.PutParameter(ctx, putInput)
+	result, err := u.Client.PutParameter(ctx, param, true) // Overwrite existing
 	if err != nil {
 		return nil, fmt.Errorf("failed to update parameter: %w", err)
 	}
 
+	version, _ := strconv.ParseInt(result.Version, 10, 64)
+
 	return &UpdateOutput{
-		Name:    input.Name,
-		Version: putOutput.Version,
+		Name:    result.Name,
+		Version: version,
 	}, nil
 }
diff --git a/internal/usecase/param/update_test.go b/internal/usecase/param/update_test.go
index 2ccb4b57..2d53f564 100644
--- a/internal/usecase/param/update_test.go
+++ b/internal/usecase/param/update_test.go
@@ -4,23 +4,21 @@ import (
 	"context"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/param"
 )
 
 type mockUpdateClient struct {
-	getParameterResult *paramapi.GetParameterOutput
+	getParameterResult *model.Parameter
 	getParameterErr    error
-	putParameterResult *paramapi.PutParameterOutput
+	putParameterResult *model.ParameterWriteResult
 	putParameterErr    error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockUpdateClient) GetParameter(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockUpdateClient) GetParameter(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 	if m.getParameterErr != nil {
 		return nil, m.getParameterErr
 	}
@@ -28,8 +26,7 @@ func (m *mockUpdateClient) GetParameter(_ context.Context, _ *paramapi.GetParame
 	return m.getParameterResult, nil
 }
 
-//nolint:lll // mock function signature
-func (m *mockUpdateClient) PutParameter(_ context.Context, _ *paramapi.PutParameterInput, _ ...func(*paramapi.Options)) (*paramapi.PutParameterOutput, error) {
+func (m *mockUpdateClient) PutParameter(_ context.Context, _ *model.Parameter, _ bool) (*model.ParameterWriteResult, error) {
 	if m.putParameterErr != nil {
 		return nil, m.putParameterErr
 	}
@@ -41,9 +38,7 @@ func TestUpdateUseCase_Exists(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config")},
-		},
+		getParameterResult: &model.Parameter{Name: "/app/config"},
 	}
 
 	uc := &param.UpdateUseCase{Client: client}
@@ -57,7 +52,7 @@ func TestUpdateUseCase_Exists_NotFound(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getParameterErr: &paramapi.ParameterNotFound{Message: lo.ToPtr("not found")},
+		getParameterErr: errNotFound,
 	}
 
 	uc := &param.UpdateUseCase{Client: client}
@@ -67,27 +62,27 @@ func TestUpdateUseCase_Exists_NotFound(t *testing.T) {
 	assert.False(t, exists)
 }
 
-func TestUpdateUseCase_Exists_Error(t *testing.T) {
+func TestUpdateUseCase_Exists_AnyError(t *testing.T) {
 	t.Parallel()
 
+	// The implementation treats any error as "not found" for simplicity
 	client := &mockUpdateClient{
 		getParameterErr: errAWS,
 	}
 
 	uc := &param.UpdateUseCase{Client: client}
 
-	_, err := uc.Exists(t.Context(), "/app/config")
-	require.Error(t, err)
+	exists, err := uc.Exists(t.Context(), "/app/config")
+	require.NoError(t, err)
+	assert.False(t, exists)
 }
 
 func TestUpdateUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config")},
-		},
-		putParameterResult: &paramapi.PutParameterOutput{Version: 5},
+		getParameterResult: &model.Parameter{Name: "/app/config"},
+		putParameterResult: &model.ParameterWriteResult{Name: "/app/config", Version: "5"},
 	}
 
 	uc := &param.UpdateUseCase{Client: client}
@@ -95,7 +90,7 @@ func TestUpdateUseCase_Execute(t *testing.T) {
 	output, err := uc.Execute(t.Context(), param.UpdateInput{
 		Name:        "/app/config",
 		Value:       "updated-value",
-		Type:        paramapi.ParameterTypeString,
+		Type:        "String",
 		Description: "updated description",
 	})
 	require.NoError(t, err)
@@ -107,7 +102,7 @@ func TestUpdateUseCase_Execute_NotFound(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getParameterErr: &paramapi.ParameterNotFound{Message: lo.ToPtr("not found")},
+		getParameterErr: errNotFound,
 	}
 
 	uc := &param.UpdateUseCase{Client: client}
@@ -115,37 +110,18 @@ func TestUpdateUseCase_Execute_NotFound(t *testing.T) {
 	_, err := uc.Execute(t.Context(), param.UpdateInput{
 		Name:  "/app/not-exists",
 		Value: "value",
-		Type:  paramapi.ParameterTypeString,
+		Type:  "String",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "parameter not found")
 }
 
-func TestUpdateUseCase_Execute_ExistsError(t *testing.T) {
-	t.Parallel()
-
-	client := &mockUpdateClient{
-		getParameterErr: errAWS,
-	}
-
-	uc := &param.UpdateUseCase{Client: client}
-
-	_, err := uc.Execute(t.Context(), param.UpdateInput{
-		Name:  "/app/config",
-		Value: "value",
-		Type:  paramapi.ParameterTypeString,
-	})
-	require.Error(t, err)
-}
-
 func TestUpdateUseCase_Execute_PutError(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getParameterResult: &paramapi.GetParameterOutput{
-			Parameter: &paramapi.Parameter{Name: lo.ToPtr("/app/config")},
-		},
-		putParameterErr: errPutFailed,
+		getParameterResult: &model.Parameter{Name: "/app/config"},
+		putParameterErr:    errPutFailed,
 	}
 
 	uc := &param.UpdateUseCase{Client: client}
@@ -153,7 +129,7 @@ func TestUpdateUseCase_Execute_PutError(t *testing.T) {
 	_, err := uc.Execute(t.Context(), param.UpdateInput{
 		Name:  "/app/config",
 		Value: "value",
-		Type:  paramapi.ParameterTypeString,
+		Type:  "String",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to update parameter")
diff --git a/internal/usecase/secret/create.go b/internal/usecase/secret/create.go
index fb2a1b55..499ce407 100644
--- a/internal/usecase/secret/create.go
+++ b/internal/usecase/secret/create.go
@@ -4,14 +4,13 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // CreateClient is the interface for the create use case.
 type CreateClient interface {
-	secretapi.CreateSecretAPI
+	// CreateSecret creates a new secret.
+	CreateSecret(ctx context.Context, secret *model.Secret) (*model.SecretWriteResult, error)
 }
 
 // CreateInput holds input for the create use case.
@@ -35,22 +34,20 @@ type CreateUseCase struct {
 
 // Execute runs the create use case.
 func (u *CreateUseCase) Execute(ctx context.Context, input CreateInput) (*CreateOutput, error) {
-	createInput := &secretapi.CreateSecretInput{
-		Name:         lo.ToPtr(input.Name),
-		SecretString: lo.ToPtr(input.Value),
-	}
-	if input.Description != "" {
-		createInput.Description = lo.ToPtr(input.Description)
+	secret := &model.Secret{
+		Name:        input.Name,
+		Value:       input.Value,
+		Description: input.Description,
 	}
 
-	result, err := u.Client.CreateSecret(ctx, createInput)
+	result, err := u.Client.CreateSecret(ctx, secret)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create secret: %w", err)
 	}
 
 	return &CreateOutput{
-		Name:      lo.FromPtr(result.Name),
-		VersionID: lo.FromPtr(result.VersionId),
-		ARN:       lo.FromPtr(result.ARN),
+		Name:      result.Name,
+		VersionID: result.Version,
+		ARN:       result.ARN,
 	}, nil
 }
diff --git a/internal/usecase/secret/create_test.go b/internal/usecase/secret/create_test.go
index fc1e4cd8..462ecec6 100644
--- a/internal/usecase/secret/create_test.go
+++ b/internal/usecase/secret/create_test.go
@@ -5,21 +5,19 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
 type mockCreateClient struct {
-	createResult *secretapi.CreateSecretOutput
+	createResult *model.SecretWriteResult
 	createErr    error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockCreateClient) CreateSecret(_ context.Context, _ *secretapi.CreateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.CreateSecretOutput, error) {
+func (m *mockCreateClient) CreateSecret(_ context.Context, _ *model.Secret) (*model.SecretWriteResult, error) {
 	if m.createErr != nil {
 		return nil, m.createErr
 	}
@@ -31,10 +29,10 @@ func TestCreateUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	client := &mockCreateClient{
-		createResult: &secretapi.CreateSecretOutput{
-			Name:      lo.ToPtr("my-secret"),
-			VersionId: lo.ToPtr("abc123"),
-			ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+		createResult: &model.SecretWriteResult{
+			Name:    "my-secret",
+			Version: "abc123",
+			ARN:     "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 		},
 	}
 
@@ -54,10 +52,10 @@ func TestCreateUseCase_Execute_WithDescription(t *testing.T) {
 	t.Parallel()
 
 	client := &mockCreateClient{
-		createResult: &secretapi.CreateSecretOutput{
-			Name:      lo.ToPtr("my-secret"),
-			VersionId: lo.ToPtr("abc123"),
-			ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+		createResult: &model.SecretWriteResult{
+			Name:    "my-secret",
+			Version: "abc123",
+			ARN:     "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 		},
 	}
 
diff --git a/internal/usecase/secret/delete.go b/internal/usecase/secret/delete.go
index 98920cc5..6a77d48d 100644
--- a/internal/usecase/secret/delete.go
+++ b/internal/usecase/secret/delete.go
@@ -2,26 +2,26 @@ package secret
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"time"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // DeleteClient is the interface for the delete use case.
 type DeleteClient interface {
-	secretapi.DeleteSecretAPI
-	secretapi.GetSecretValueAPI
+	// GetSecret retrieves a secret by name with optional version specifier.
+	GetSecret(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error)
+	// DeleteSecret deletes a secret.
+	DeleteSecret(ctx context.Context, name string, forceDelete bool) (*model.SecretDeleteResult, error)
 }
 
 // DeleteInput holds input for the delete use case.
 type DeleteInput struct {
-	Name           string
-	Force          bool  // Force immediate deletion
-	RecoveryWindow int64 // Days before permanent deletion (7-30)
+	Name  string
+	Force bool // Force immediate deletion
+	// RecoveryWindow is not supported through the provider interface.
+	// AWS-specific recovery window should be handled at the CLI/adapter level.
 }
 
 // DeleteOutput holds the result of the delete use case.
@@ -38,39 +38,25 @@ type DeleteUseCase struct {
 
 // GetCurrentValue fetches the current secret value for preview.
 func (u *DeleteUseCase) GetCurrentValue(ctx context.Context, name string) (string, error) {
-	out, err := u.Client.GetSecretValue(ctx, &secretapi.GetSecretValueInput{
-		SecretId: lo.ToPtr(name),
-	})
+	secret, err := u.Client.GetSecret(ctx, name, "", "")
 	if err != nil {
-		if rnf := (*secretapi.ResourceNotFoundException)(nil); errors.As(err, &rnf) {
-			return "", nil
-		}
-
-		return "", err
+		// Treat any error as "not found" for simplicity
+		return "", nil //nolint:nilerr // intentionally ignoring error to treat as not found
 	}
 
-	return lo.FromPtr(out.SecretString), nil
+	return secret.Value, nil
 }
 
 // Execute runs the delete use case.
 func (u *DeleteUseCase) Execute(ctx context.Context, input DeleteInput) (*DeleteOutput, error) {
-	deleteInput := &secretapi.DeleteSecretInput{
-		SecretId: lo.ToPtr(input.Name),
-	}
-	if input.Force {
-		deleteInput.ForceDeleteWithoutRecovery = lo.ToPtr(true)
-	} else if input.RecoveryWindow > 0 {
-		deleteInput.RecoveryWindowInDays = lo.ToPtr(input.RecoveryWindow)
-	}
-
-	result, err := u.Client.DeleteSecret(ctx, deleteInput)
+	result, err := u.Client.DeleteSecret(ctx, input.Name, input.Force)
 	if err != nil {
 		return nil, fmt.Errorf("failed to delete secret: %w", err)
 	}
 
 	return &DeleteOutput{
-		Name:         lo.FromPtr(result.Name),
+		Name:         result.Name,
 		DeletionDate: result.DeletionDate,
-		ARN:          lo.FromPtr(result.ARN),
+		ARN:          result.ARN,
 	}, nil
 }
diff --git a/internal/usecase/secret/delete_test.go b/internal/usecase/secret/delete_test.go
index 790bedab..cadfbec7 100644
--- a/internal/usecase/secret/delete_test.go
+++ b/internal/usecase/secret/delete_test.go
@@ -6,32 +6,29 @@ import (
 	"testing"
 	"time"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
 type mockDeleteClient struct {
-	getSecretValueResult *secretapi.GetSecretValueOutput
-	getSecretValueErr    error
-	deleteSecretResult   *secretapi.DeleteSecretOutput
-	deleteSecretErr      error
+	getSecretResult    *model.Secret
+	getSecretErr       error
+	deleteSecretResult *model.SecretDeleteResult
+	deleteSecretErr    error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockDeleteClient) GetSecretValue(_ context.Context, _ *secretapi.GetSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.GetSecretValueOutput, error) {
-	if m.getSecretValueErr != nil {
-		return nil, m.getSecretValueErr
+func (m *mockDeleteClient) GetSecret(_ context.Context, _ string, _ string, _ string) (*model.Secret, error) {
+	if m.getSecretErr != nil {
+		return nil, m.getSecretErr
 	}
 
-	return m.getSecretValueResult, nil
+	return m.getSecretResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockDeleteClient) DeleteSecret(_ context.Context, _ *secretapi.DeleteSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DeleteSecretOutput, error) {
+func (m *mockDeleteClient) DeleteSecret(_ context.Context, _ string, _ bool) (*model.SecretDeleteResult, error) {
 	if m.deleteSecretErr != nil {
 		return nil, m.deleteSecretErr
 	}
@@ -43,8 +40,9 @@ func TestDeleteUseCase_GetCurrentValue(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDeleteClient{
-		getSecretValueResult: &secretapi.GetSecretValueOutput{
-			SecretString: lo.ToPtr("current-value"),
+		getSecretResult: &model.Secret{
+			Name:  "my-secret",
+			Value: "current-value",
 		},
 	}
 
@@ -59,38 +57,25 @@ func TestDeleteUseCase_GetCurrentValue_NotFound(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDeleteClient{
-		getSecretValueErr: &secretapi.ResourceNotFoundException{Message: lo.ToPtr("not found")},
+		getSecretErr: errors.New("not found"),
 	}
 
 	uc := &secret.DeleteUseCase{Client: client}
 
 	value, err := uc.GetCurrentValue(t.Context(), "not-exists")
-	require.NoError(t, err)
+	require.NoError(t, err) // GetCurrentValue treats errors as "not found"
 	assert.Empty(t, value)
 }
 
-func TestDeleteUseCase_GetCurrentValue_Error(t *testing.T) {
-	t.Parallel()
-
-	client := &mockDeleteClient{
-		getSecretValueErr: errors.New("aws error"),
-	}
-
-	uc := &secret.DeleteUseCase{Client: client}
-
-	_, err := uc.GetCurrentValue(t.Context(), "my-secret")
-	assert.Error(t, err)
-}
-
 func TestDeleteUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	deletionDate := time.Now().Add(7 * 24 * time.Hour)
 	client := &mockDeleteClient{
-		deleteSecretResult: &secretapi.DeleteSecretOutput{
-			Name:         lo.ToPtr("my-secret"),
+		deleteSecretResult: &model.SecretDeleteResult{
+			Name:         "my-secret",
 			DeletionDate: &deletionDate,
-			ARN:          lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+			ARN:          "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 		},
 	}
 
@@ -108,9 +93,9 @@ func TestDeleteUseCase_Execute_Force(t *testing.T) {
 	t.Parallel()
 
 	client := &mockDeleteClient{
-		deleteSecretResult: &secretapi.DeleteSecretOutput{
-			Name: lo.ToPtr("my-secret"),
-			ARN:  lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+		deleteSecretResult: &model.SecretDeleteResult{
+			Name: "my-secret",
+			ARN:  "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 		},
 	}
 
@@ -124,29 +109,6 @@ func TestDeleteUseCase_Execute_Force(t *testing.T) {
 	assert.Equal(t, "my-secret", output.Name)
 }
 
-func TestDeleteUseCase_Execute_RecoveryWindow(t *testing.T) {
-	t.Parallel()
-
-	deletionDate := time.Now().Add(30 * 24 * time.Hour)
-	client := &mockDeleteClient{
-		deleteSecretResult: &secretapi.DeleteSecretOutput{
-			Name:         lo.ToPtr("my-secret"),
-			DeletionDate: &deletionDate,
-			ARN:          lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
-
-	uc := &secret.DeleteUseCase{Client: client}
-
-	output, err := uc.Execute(t.Context(), secret.DeleteInput{
-		Name:           "my-secret",
-		RecoveryWindow: 30,
-	})
-	require.NoError(t, err)
-	assert.Equal(t, "my-secret", output.Name)
-	assert.NotNil(t, output.DeletionDate)
-}
-
 func TestDeleteUseCase_Execute_Error(t *testing.T) {
 	t.Parallel()
 
diff --git a/internal/usecase/secret/restore.go b/internal/usecase/secret/restore.go
index 44ab0a62..6aa2550d 100644
--- a/internal/usecase/secret/restore.go
+++ b/internal/usecase/secret/restore.go
@@ -4,14 +4,13 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // RestoreClient is the interface for the restore use case.
 type RestoreClient interface {
-	secretapi.RestoreSecretAPI
+	// RestoreSecret restores a previously deleted secret.
+	RestoreSecret(ctx context.Context, name string) (*model.SecretRestoreResult, error)
 }
 
 // RestoreInput holds input for the restore use case.
@@ -32,15 +31,13 @@ type RestoreUseCase struct {
 
 // Execute runs the restore use case.
 func (u *RestoreUseCase) Execute(ctx context.Context, input RestoreInput) (*RestoreOutput, error) {
-	result, err := u.Client.RestoreSecret(ctx, &secretapi.RestoreSecretInput{
-		SecretId: lo.ToPtr(input.Name),
-	})
+	result, err := u.Client.RestoreSecret(ctx, input.Name)
 	if err != nil {
 		return nil, fmt.Errorf("failed to restore secret: %w", err)
 	}
 
 	return &RestoreOutput{
-		Name: lo.FromPtr(result.Name),
-		ARN:  lo.FromPtr(result.ARN),
+		Name: result.Name,
+		ARN:  result.ARN,
 	}, nil
 }
diff --git a/internal/usecase/secret/restore_test.go b/internal/usecase/secret/restore_test.go
index fca25365..0ea00484 100644
--- a/internal/usecase/secret/restore_test.go
+++ b/internal/usecase/secret/restore_test.go
@@ -5,21 +5,19 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
 type mockRestoreClient struct {
-	restoreResult *secretapi.RestoreSecretOutput
+	restoreResult *model.SecretRestoreResult
 	restoreErr    error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockRestoreClient) RestoreSecret(_ context.Context, _ *secretapi.RestoreSecretInput, _ ...func(*secretapi.Options)) (*secretapi.RestoreSecretOutput, error) {
+func (m *mockRestoreClient) RestoreSecret(_ context.Context, _ string) (*model.SecretRestoreResult, error) {
 	if m.restoreErr != nil {
 		return nil, m.restoreErr
 	}
@@ -31,9 +29,9 @@ func TestRestoreUseCase_Execute(t *testing.T) {
 	t.Parallel()
 
 	client := &mockRestoreClient{
-		restoreResult: &secretapi.RestoreSecretOutput{
-			Name: lo.ToPtr("my-secret"),
-			ARN:  lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+		restoreResult: &model.SecretRestoreResult{
+			Name: "my-secret",
+			ARN:  "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 		},
 	}
 
diff --git a/internal/usecase/secret/tag.go b/internal/usecase/secret/tag.go
index 4f2e63ab..bed24446 100644
--- a/internal/usecase/secret/tag.go
+++ b/internal/usecase/secret/tag.go
@@ -4,16 +4,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/provider"
 )
 
 // TagClient is the interface for the tag use case.
 type TagClient interface {
-	secretapi.DescribeSecretAPI
-	secretapi.TagResourceAPI
-	secretapi.UntagResourceAPI
+	provider.SecretTagger
 }
 
 // TagInput holds input for the tag use case.
@@ -30,42 +26,16 @@ type TagUseCase struct {
 
 // Execute runs the tag use case.
 func (u *TagUseCase) Execute(ctx context.Context, input TagInput) error {
-	// Get ARN first (required for tagging)
-	desc, err := u.Client.DescribeSecret(ctx, &secretapi.DescribeSecretInput{
-		SecretId: lo.ToPtr(input.Name),
-	})
-	if err != nil {
-		return fmt.Errorf("failed to describe secret: %w", err)
-	}
-
-	arn := lo.FromPtr(desc.ARN)
-
 	// Add tags
 	if len(input.Add) > 0 {
-		tags := make([]secretapi.Tag, 0, len(input.Add))
-		for k, v := range input.Add {
-			tags = append(tags, secretapi.Tag{
-				Key:   lo.ToPtr(k),
-				Value: lo.ToPtr(v),
-			})
-		}
-
-		_, err := u.Client.TagResource(ctx, &secretapi.TagResourceInput{
-			SecretId: lo.ToPtr(arn),
-			Tags:     tags,
-		})
-		if err != nil {
+		if err := u.Client.AddTags(ctx, input.Name, input.Add); err != nil {
 			return fmt.Errorf("failed to add tags: %w", err)
 		}
 	}
 
 	// Remove tags
 	if len(input.Remove) > 0 {
-		_, err := u.Client.UntagResource(ctx, &secretapi.UntagResourceInput{
-			SecretId: lo.ToPtr(arn),
-			TagKeys:  input.Remove,
-		})
-		if err != nil {
+		if err := u.Client.RemoveTags(ctx, input.Name, input.Remove); err != nil {
 			return fmt.Errorf("failed to remove tags: %w", err)
 		}
 	}
diff --git a/internal/usecase/secret/tag_test.go b/internal/usecase/secret/tag_test.go
index b785aa3d..b93679f1 100644
--- a/internal/usecase/secret/tag_test.go
+++ b/internal/usecase/secret/tag_test.go
@@ -5,56 +5,33 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
 type mockTagClient struct {
-	describeResult *secretapi.DescribeSecretOutput
-	describeErr    error
-	tagErr         error
-	untagErr       error
+	addTagsErr    error
+	removeTagsErr error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockTagClient) DescribeSecret(_ context.Context, _ *secretapi.DescribeSecretInput, _ ...func(*secretapi.Options)) (*secretapi.DescribeSecretOutput, error) {
-	if m.describeErr != nil {
-		return nil, m.describeErr
-	}
-
-	return m.describeResult, nil
+func (m *mockTagClient) GetTags(_ context.Context, _ string) (map[string]string, error) {
+	return nil, nil //nolint:nilnil // mock implementation
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockTagClient) TagResource(_ context.Context, _ *secretapi.TagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.TagResourceOutput, error) {
-	if m.tagErr != nil {
-		return nil, m.tagErr
-	}
-
-	return &secretapi.TagResourceOutput{}, nil
+func (m *mockTagClient) AddTags(_ context.Context, _ string, _ map[string]string) error {
+	return m.addTagsErr
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockTagClient) UntagResource(_ context.Context, _ *secretapi.UntagResourceInput, _ ...func(*secretapi.Options)) (*secretapi.UntagResourceOutput, error) {
-	if m.untagErr != nil {
-		return nil, m.untagErr
-	}
-
-	return &secretapi.UntagResourceOutput{}, nil
+func (m *mockTagClient) RemoveTags(_ context.Context, _ string, _ []string) error {
+	return m.removeTagsErr
 }
 
 func TestTagUseCase_Execute_AddTags(t *testing.T) {
 	t.Parallel()
 
-	client := &mockTagClient{
-		describeResult: &secretapi.DescribeSecretOutput{
-			ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
+	client := &mockTagClient{}
 	uc := &secret.TagUseCase{Client: client}
 
 	err := uc.Execute(t.Context(), secret.TagInput{
@@ -67,11 +44,7 @@ func TestTagUseCase_Execute_AddTags(t *testing.T) {
 func TestTagUseCase_Execute_RemoveTags(t *testing.T) {
 	t.Parallel()
 
-	client := &mockTagClient{
-		describeResult: &secretapi.DescribeSecretOutput{
-			ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
+	client := &mockTagClient{}
 	uc := &secret.TagUseCase{Client: client}
 
 	err := uc.Execute(t.Context(), secret.TagInput{
@@ -84,11 +57,7 @@ func TestTagUseCase_Execute_RemoveTags(t *testing.T) {
 func TestTagUseCase_Execute_AddAndRemoveTags(t *testing.T) {
 	t.Parallel()
 
-	client := &mockTagClient{
-		describeResult: &secretapi.DescribeSecretOutput{
-			ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
+	client := &mockTagClient{}
 	uc := &secret.TagUseCase{Client: client}
 
 	err := uc.Execute(t.Context(), secret.TagInput{
@@ -102,11 +71,7 @@ func TestTagUseCase_Execute_AddAndRemoveTags(t *testing.T) {
 func TestTagUseCase_Execute_NoTags(t *testing.T) {
 	t.Parallel()
 
-	client := &mockTagClient{
-		describeResult: &secretapi.DescribeSecretOutput{
-			ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
+	client := &mockTagClient{}
 	uc := &secret.TagUseCase{Client: client}
 
 	err := uc.Execute(t.Context(), secret.TagInput{
@@ -115,30 +80,11 @@ func TestTagUseCase_Execute_NoTags(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func TestTagUseCase_Execute_DescribeError(t *testing.T) {
-	t.Parallel()
-
-	client := &mockTagClient{
-		describeErr: errors.New("describe failed"),
-	}
-	uc := &secret.TagUseCase{Client: client}
-
-	err := uc.Execute(t.Context(), secret.TagInput{
-		Name: "my-secret",
-		Add:  map[string]string{"env": "prod"},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to describe secret")
-}
-
 func TestTagUseCase_Execute_AddTagsError(t *testing.T) {
 	t.Parallel()
 
 	client := &mockTagClient{
-		describeResult: &secretapi.DescribeSecretOutput{
-			ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-		tagErr: errors.New("tag failed"),
+		addTagsErr: errors.New("add tags failed"),
 	}
 	uc := &secret.TagUseCase{Client: client}
 
@@ -154,10 +100,7 @@ func TestTagUseCase_Execute_RemoveTagsError(t *testing.T) {
 	t.Parallel()
 
 	client := &mockTagClient{
-		describeResult: &secretapi.DescribeSecretOutput{
-			ARN: lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-		untagErr: errors.New("untag failed"),
+		removeTagsErr: errors.New("remove tags failed"),
 	}
 	uc := &secret.TagUseCase{Client: client}
 
diff --git a/internal/usecase/secret/update.go b/internal/usecase/secret/update.go
index 7a9c9c1b..96c12908 100644
--- a/internal/usecase/secret/update.go
+++ b/internal/usecase/secret/update.go
@@ -4,23 +4,23 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 )
 
 // UpdateClient is the interface for the update use case.
 type UpdateClient interface {
-	secretapi.GetSecretValueAPI
-	secretapi.UpdateSecretAPI
-	secretapi.PutSecretValueAPI
+	// GetSecret retrieves a secret by name with optional version specifier.
+	GetSecret(ctx context.Context, name string, versionID string, versionStage string) (*model.Secret, error)
+	// UpdateSecret updates the value of an existing secret.
+	UpdateSecret(ctx context.Context, name string, value string) (*model.SecretWriteResult, error)
 }
 
 // UpdateInput holds input for the update use case.
 type UpdateInput struct {
-	Name        string
-	Value       string
-	Description string
+	Name  string
+	Value string
+	// Description is currently not supported through the provider interface.
+	// AWS-specific description updates should be handled separately.
 }
 
 // UpdateOutput holds the result of the update use case.
@@ -37,54 +37,24 @@ type UpdateUseCase struct {
 
 // GetCurrentValue fetches the current secret value.
 func (u *UpdateUseCase) GetCurrentValue(ctx context.Context, name string) (string, error) {
-	out, err := u.Client.GetSecretValue(ctx, &secretapi.GetSecretValueInput{
-		SecretId: lo.ToPtr(name),
-	})
+	secret, err := u.Client.GetSecret(ctx, name, "", "")
 	if err != nil {
 		return "", err
 	}
 
-	return lo.FromPtr(out.SecretString), nil
+	return secret.Value, nil
 }
 
 // Execute runs the update use case.
 func (u *UpdateUseCase) Execute(ctx context.Context, input UpdateInput) (*UpdateOutput, error) {
-	var versionID, arn string
-
-	// Update value
-	if input.Value != "" {
-		result, err := u.Client.PutSecretValue(ctx, &secretapi.PutSecretValueInput{
-			SecretId:     lo.ToPtr(input.Name),
-			SecretString: lo.ToPtr(input.Value),
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to update secret value: %w", err)
-		}
-
-		versionID = lo.FromPtr(result.VersionId)
-		arn = lo.FromPtr(result.ARN)
-	}
-
-	// Update description if provided
-	if input.Description != "" {
-		result, err := u.Client.UpdateSecret(ctx, &secretapi.UpdateSecretInput{
-			SecretId:    lo.ToPtr(input.Name),
-			Description: lo.ToPtr(input.Description),
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to update secret description: %w", err)
-		}
-
-		if versionID == "" {
-			versionID = lo.FromPtr(result.VersionId)
-		}
-
-		arn = lo.FromPtr(result.ARN)
+	result, err := u.Client.UpdateSecret(ctx, input.Name, input.Value)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update secret: %w", err)
 	}
 
 	return &UpdateOutput{
-		Name:      input.Name,
-		VersionID: versionID,
-		ARN:       arn,
+		Name:      result.Name,
+		VersionID: result.Version,
+		ARN:       result.ARN,
 	}, nil
 }
diff --git a/internal/usecase/secret/update_test.go b/internal/usecase/secret/update_test.go
index 2eef46b3..3ae20bf9 100644
--- a/internal/usecase/secret/update_test.go
+++ b/internal/usecase/secret/update_test.go
@@ -5,34 +5,29 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/secretapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/usecase/secret"
 )
 
 type mockUpdateClient struct {
-	getSecretValueResult *secretapi.GetSecretValueOutput
-	getSecretValueErr    error
-	updateSecretResult   *secretapi.UpdateSecretOutput
-	updateSecretErr      error
-	putSecretValueResult *secretapi.PutSecretValueOutput
-	putSecretValueErr    error
+	getSecretResult    *model.Secret
+	getSecretErr       error
+	updateSecretResult *model.SecretWriteResult
+	updateSecretErr    error
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockUpdateClient) GetSecretValue(_ context.Context, _ *secretapi.GetSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.GetSecretValueOutput, error) {
-	if m.getSecretValueErr != nil {
-		return nil, m.getSecretValueErr
+func (m *mockUpdateClient) GetSecret(_ context.Context, _ string, _ string, _ string) (*model.Secret, error) {
+	if m.getSecretErr != nil {
+		return nil, m.getSecretErr
 	}
 
-	return m.getSecretValueResult, nil
+	return m.getSecretResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockUpdateClient) UpdateSecret(_ context.Context, _ *secretapi.UpdateSecretInput, _ ...func(*secretapi.Options)) (*secretapi.UpdateSecretOutput, error) {
+func (m *mockUpdateClient) UpdateSecret(_ context.Context, _ string, _ string) (*model.SecretWriteResult, error) {
 	if m.updateSecretErr != nil {
 		return nil, m.updateSecretErr
 	}
@@ -40,21 +35,13 @@ func (m *mockUpdateClient) UpdateSecret(_ context.Context, _ *secretapi.UpdateSe
 	return m.updateSecretResult, nil
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockUpdateClient) PutSecretValue(_ context.Context, _ *secretapi.PutSecretValueInput, _ ...func(*secretapi.Options)) (*secretapi.PutSecretValueOutput, error) {
-	if m.putSecretValueErr != nil {
-		return nil, m.putSecretValueErr
-	}
-
-	return m.putSecretValueResult, nil
-}
-
 func TestUpdateUseCase_GetCurrentValue(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getSecretValueResult: &secretapi.GetSecretValueOutput{
-			SecretString: lo.ToPtr("current-value"),
+		getSecretResult: &model.Secret{
+			Name:  "my-secret",
+			Value: "current-value",
 		},
 	}
 
@@ -69,7 +56,7 @@ func TestUpdateUseCase_GetCurrentValue_Error(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		getSecretValueErr: errors.New("aws error"),
+		getSecretErr: errors.New("aws error"),
 	}
 
 	uc := &secret.UpdateUseCase{Client: client}
@@ -82,9 +69,10 @@ func TestUpdateUseCase_Execute_UpdateValue(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		putSecretValueResult: &secretapi.PutSecretValueOutput{
-			VersionId: lo.ToPtr("new-version-id"),
-			ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
+		updateSecretResult: &model.SecretWriteResult{
+			Name:    "my-secret",
+			Version: "new-version-id",
+			ARN:     "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
 		},
 	}
 
@@ -99,58 +87,11 @@ func TestUpdateUseCase_Execute_UpdateValue(t *testing.T) {
 	assert.Equal(t, "new-version-id", output.VersionID)
 }
 
-func TestUpdateUseCase_Execute_UpdateDescription(t *testing.T) {
-	t.Parallel()
-
-	client := &mockUpdateClient{
-		updateSecretResult: &secretapi.UpdateSecretOutput{
-			VersionId: lo.ToPtr("version-id"),
-			ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
-
-	uc := &secret.UpdateUseCase{Client: client}
-
-	output, err := uc.Execute(t.Context(), secret.UpdateInput{
-		Name:        "my-secret",
-		Description: "new description",
-	})
-	require.NoError(t, err)
-	assert.Equal(t, "my-secret", output.Name)
-	assert.Equal(t, "version-id", output.VersionID)
-}
-
-func TestUpdateUseCase_Execute_UpdateValueAndDescription(t *testing.T) {
+func TestUpdateUseCase_Execute_UpdateValueError(t *testing.T) {
 	t.Parallel()
 
 	client := &mockUpdateClient{
-		putSecretValueResult: &secretapi.PutSecretValueOutput{
-			VersionId: lo.ToPtr("new-version-id"),
-			ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-		updateSecretResult: &secretapi.UpdateSecretOutput{
-			VersionId: lo.ToPtr("desc-version-id"),
-			ARN:       lo.ToPtr("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret"),
-		},
-	}
-
-	uc := &secret.UpdateUseCase{Client: client}
-
-	output, err := uc.Execute(t.Context(), secret.UpdateInput{
-		Name:        "my-secret",
-		Value:       "new-value",
-		Description: "new description",
-	})
-	require.NoError(t, err)
-	// VersionID from PutSecretValue takes precedence
-	assert.Equal(t, "new-version-id", output.VersionID)
-}
-
-func TestUpdateUseCase_Execute_PutValueError(t *testing.T) {
-	t.Parallel()
-
-	client := &mockUpdateClient{
-		putSecretValueErr: errors.New("put value failed"),
+		updateSecretErr: errors.New("update failed"),
 	}
 
 	uc := &secret.UpdateUseCase{Client: client}
@@ -160,22 +101,5 @@ func TestUpdateUseCase_Execute_PutValueError(t *testing.T) {
 		Value: "new-value",
 	})
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to update secret value")
-}
-
-func TestUpdateUseCase_Execute_UpdateDescriptionError(t *testing.T) {
-	t.Parallel()
-
-	client := &mockUpdateClient{
-		updateSecretErr: errors.New("update failed"),
-	}
-
-	uc := &secret.UpdateUseCase{Client: client}
-
-	_, err := uc.Execute(t.Context(), secret.UpdateInput{
-		Name:        "my-secret",
-		Description: "new description",
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to update secret description")
+	assert.Contains(t, err.Error(), "failed to update secret")
 }
diff --git a/internal/version/paramversion/version.go b/internal/version/paramversion/version.go
index 1d0940de..56493efc 100644
--- a/internal/version/paramversion/version.go
+++ b/internal/version/paramversion/version.go
@@ -5,21 +5,15 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strconv"
 
-	"github.com/samber/lo"
-
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
+	"github.com/mpyw/suve/internal/provider"
 )
 
-// Client is the interface for GetParameterWithVersion.
-type Client interface {
-	paramapi.GetParameterAPI
-	paramapi.GetParameterHistoryAPI
-}
-
 // GetParameterWithVersion retrieves a parameter with version/shift support.
 // SecureString values are always decrypted.
-func GetParameterWithVersion(ctx context.Context, client Client, spec *Spec) (*paramapi.ParameterHistory, error) {
+func GetParameterWithVersion(ctx context.Context, client provider.ParameterReader, spec *Spec) (*model.Parameter, error) {
 	if spec.HasShift() {
 		return getParameterWithShift(ctx, client, spec)
 	}
@@ -27,11 +21,8 @@ func GetParameterWithVersion(ctx context.Context, client Client, spec *Spec) (*p
 	return getParameterDirect(ctx, client, spec)
 }
 
-func getParameterWithShift(ctx context.Context, client paramapi.GetParameterHistoryAPI, spec *Spec) (*paramapi.ParameterHistory, error) {
-	history, err := client.GetParameterHistory(ctx, &paramapi.GetParameterHistoryInput{
-		Name:           lo.ToPtr(spec.Name),
-		WithDecryption: lo.ToPtr(true),
-	})
+func getParameterWithShift(ctx context.Context, client provider.ParameterReader, spec *Spec) (*model.Parameter, error) {
+	history, err := client.GetParameterHistory(ctx, spec.Name)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get parameter history: %w", err)
 	}
@@ -40,18 +31,26 @@ func getParameterWithShift(ctx context.Context, client paramapi.GetParameterHist
 		return nil, fmt.Errorf("parameter not found: %s", spec.Name)
 	}
 
-	// Reverse to get newest first
-	params := history.Parameters
+	// Copy and reverse to get newest first
+	params := make([]*model.Parameter, len(history.Parameters))
+	copy(params, history.Parameters)
 	slices.Reverse(params)
 
 	baseIdx := 0
 
 	if spec.Absolute.Version != nil {
-		var found bool
+		targetVersion := strconv.FormatInt(*spec.Absolute.Version, 10)
+		found := false
+
+		for i, p := range params {
+			if p.Version == targetVersion {
+				baseIdx = i
+				found = true
+
+				break
+			}
+		}
 
-		_, baseIdx, found = lo.FindIndexOf(params, func(p paramapi.ParameterHistory) bool {
-			return p.Version == *spec.Absolute.Version
-		})
 		if !found {
 			return nil, fmt.Errorf("version %d not found", *spec.Absolute.Version)
 		}
@@ -62,32 +61,19 @@ func getParameterWithShift(ctx context.Context, client paramapi.GetParameterHist
 		return nil, fmt.Errorf("version shift out of range: ~%d", spec.Shift)
 	}
 
-	return &params[targetIdx], nil
+	return params[targetIdx], nil
 }
 
-func getParameterDirect(ctx context.Context, client paramapi.GetParameterAPI, spec *Spec) (*paramapi.ParameterHistory, error) {
-	var nameWithVersion string
+func getParameterDirect(ctx context.Context, client provider.ParameterReader, spec *Spec) (*model.Parameter, error) {
+	version := ""
 	if spec.Absolute.Version != nil {
-		nameWithVersion = fmt.Sprintf("%s:%d", spec.Name, *spec.Absolute.Version)
-	} else {
-		nameWithVersion = spec.Name
+		version = strconv.FormatInt(*spec.Absolute.Version, 10)
 	}
 
-	result, err := client.GetParameter(ctx, &paramapi.GetParameterInput{
-		Name:           lo.ToPtr(nameWithVersion),
-		WithDecryption: lo.ToPtr(true),
-	})
+	param, err := client.GetParameter(ctx, spec.Name, version)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get parameter: %w", err)
 	}
 
-	param := result.Parameter
-
-	return &paramapi.ParameterHistory{
-		Name:             param.Name,
-		Value:            param.Value,
-		Type:             param.Type,
-		Version:          param.Version,
-		LastModifiedDate: param.LastModifiedDate,
-	}, nil
+	return param, nil
 }
diff --git a/internal/version/paramversion/version_test.go b/internal/version/paramversion/version_test.go
index 68f28a88..e3793150 100644
--- a/internal/version/paramversion/version_test.go
+++ b/internal/version/paramversion/version_test.go
@@ -6,54 +6,53 @@ import (
 	"testing"
 	"time"
 
-	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mpyw/suve/internal/api/paramapi"
+	"github.com/mpyw/suve/internal/model"
 	"github.com/mpyw/suve/internal/version/paramversion"
 )
 
-//nolint:lll // mock struct fields match AWS SDK interface signatures
 type mockClient struct {
-	getParameterFunc        func(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error)
-	getParameterHistoryFunc func(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error)
+	getParameterFunc        func(ctx context.Context, name string, version string) (*model.Parameter, error)
+	getParameterHistoryFunc func(ctx context.Context, name string) (*model.ParameterHistory, error)
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameter(ctx context.Context, params *paramapi.GetParameterInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+func (m *mockClient) GetParameter(ctx context.Context, name string, version string) (*model.Parameter, error) {
 	if m.getParameterFunc != nil {
-		return m.getParameterFunc(ctx, params, optFns...)
+		return m.getParameterFunc(ctx, name, version)
 	}
 
 	return nil, fmt.Errorf("GetParameter not mocked")
 }
 
-//nolint:lll // mock function signature must match AWS SDK interface
-func (m *mockClient) GetParameterHistory(ctx context.Context, params *paramapi.GetParameterHistoryInput, optFns ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
+func (m *mockClient) GetParameterHistory(ctx context.Context, name string) (*model.ParameterHistory, error) {
 	if m.getParameterHistoryFunc != nil {
-		return m.getParameterHistoryFunc(ctx, params, optFns...)
+		return m.getParameterHistoryFunc(ctx, name)
 	}
 
 	return nil, fmt.Errorf("GetParameterHistory not mocked")
 }
 
+func (m *mockClient) ListParameters(_ context.Context, _ string, _ bool) ([]*model.ParameterListItem, error) {
+	return nil, fmt.Errorf("ListParameters not mocked")
+}
+
 func TestGetParameterWithVersion_Latest(t *testing.T) {
 	t.Parallel()
 
 	now := time.Now()
 	mock := &mockClient{
-		getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			assert.Equal(t, "/my/param", lo.FromPtr(params.Name))
-
-			return &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Name:             lo.ToPtr("/my/param"),
-					Value:            lo.ToPtr("test-value"),
-					Version:          3,
-					Type:             paramapi.ParameterTypeString,
-					LastModifiedDate: &now,
-				},
+		getParameterFunc: func(_ context.Context, name string, version string) (*model.Parameter, error) {
+			assert.Equal(t, "/my/param", name)
+			assert.Empty(t, version)
+
+			return &model.Parameter{
+				Name:      "/my/param",
+				Value:     "test-value",
+				Version:   "3",
+				UpdatedAt: &now,
+				Metadata:  model.AWSParameterMeta{Type: "String"},
 			}, nil
 		},
 	}
@@ -62,25 +61,24 @@ func TestGetParameterWithVersion_Latest(t *testing.T) {
 	result, err := paramversion.GetParameterWithVersion(t.Context(), mock, spec)
 
 	require.NoError(t, err)
-	assert.Equal(t, "/my/param", lo.FromPtr(result.Name))
-	assert.Equal(t, "test-value", lo.FromPtr(result.Value))
-	assert.Equal(t, int64(3), result.Version)
+	assert.Equal(t, "/my/param", result.Name)
+	assert.Equal(t, "test-value", result.Value)
+	assert.Equal(t, "3", result.Version)
 }
 
 func TestGetParameterWithVersion_SpecificVersion(t *testing.T) {
 	t.Parallel()
 
 	mock := &mockClient{
-		getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			assert.Equal(t, "/my/param:2", lo.FromPtr(params.Name))
-
-			return &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Name:    lo.ToPtr("/my/param"),
-					Value:   lo.ToPtr("old-value"),
-					Version: 2,
-					Type:    paramapi.ParameterTypeString,
-				},
+		getParameterFunc: func(_ context.Context, name string, version string) (*model.Parameter, error) {
+			assert.Equal(t, "/my/param", name)
+			assert.Equal(t, "2", version)
+
+			return &model.Parameter{
+				Name:     "/my/param",
+				Value:    "old-value",
+				Version:  "2",
+				Metadata: model.AWSParameterMeta{Type: "String"},
 			}, nil
 		},
 	}
@@ -90,8 +88,8 @@ func TestGetParameterWithVersion_SpecificVersion(t *testing.T) {
 	result, err := paramversion.GetParameterWithVersion(t.Context(), mock, spec)
 
 	require.NoError(t, err)
-	assert.Equal(t, "old-value", lo.FromPtr(result.Value))
-	assert.Equal(t, int64(2), result.Version)
+	assert.Equal(t, "old-value", result.Value)
+	assert.Equal(t, "2", result.Version)
 }
 
 func TestGetParameterWithVersion_Shift(t *testing.T) {
@@ -99,15 +97,15 @@ func TestGetParameterWithVersion_Shift(t *testing.T) {
 
 	now := time.Now()
 	mock := &mockClient{
-		//nolint:lll // inline mock function
-		getParameterHistoryFunc: func(_ context.Context, params *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-			assert.Equal(t, "/my/param", lo.FromPtr(params.Name))
+		getParameterHistoryFunc: func(_ context.Context, name string) (*model.ParameterHistory, error) {
+			assert.Equal(t, "/my/param", name)
 			// History is returned oldest first by AWS
-			return &paramapi.GetParameterHistoryOutput{
-				Parameters: []paramapi.ParameterHistory{
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: &now},
+			return &model.ParameterHistory{
+				Name: "/my/param",
+				Parameters: []*model.Parameter{
+					{Name: "/my/param", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-2 * time.Hour))},
+					{Name: "/my/param", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-time.Hour))},
+					{Name: "/my/param", Value: "v3", Version: "3", UpdatedAt: &now},
 				},
 			}, nil
 		},
@@ -118,8 +116,8 @@ func TestGetParameterWithVersion_Shift(t *testing.T) {
 
 	require.NoError(t, err)
 	// Shift 1 means one version back from latest (v3), so v2
-	assert.Equal(t, "v2", lo.FromPtr(result.Value))
-	assert.Equal(t, int64(2), result.Version)
+	assert.Equal(t, "v2", result.Value)
+	assert.Equal(t, "2", result.Version)
 }
 
 func TestGetParameterWithVersion_ShiftFromSpecificVersion(t *testing.T) {
@@ -127,13 +125,13 @@ func TestGetParameterWithVersion_ShiftFromSpecificVersion(t *testing.T) {
 
 	now := time.Now()
 	mock := &mockClient{
-		//nolint:lll // inline mock function
-		getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-			return &paramapi.GetParameterHistoryOutput{
-				Parameters: []paramapi.ParameterHistory{
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: lo.ToPtr(now.Add(-2 * time.Hour))},
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v2"), Version: 2, LastModifiedDate: lo.ToPtr(now.Add(-time.Hour))},
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v3"), Version: 3, LastModifiedDate: &now},
+		getParameterHistoryFunc: func(_ context.Context, _ string) (*model.ParameterHistory, error) {
+			return &model.ParameterHistory{
+				Name: "/my/param",
+				Parameters: []*model.Parameter{
+					{Name: "/my/param", Value: "v1", Version: "1", UpdatedAt: timePtr(now.Add(-2 * time.Hour))},
+					{Name: "/my/param", Value: "v2", Version: "2", UpdatedAt: timePtr(now.Add(-time.Hour))},
+					{Name: "/my/param", Value: "v3", Version: "3", UpdatedAt: &now},
 				},
 			}, nil
 		},
@@ -145,7 +143,7 @@ func TestGetParameterWithVersion_ShiftFromSpecificVersion(t *testing.T) {
 
 	require.NoError(t, err)
 	// Version 3, shift 2 means v3 -> v2 -> v1
-	assert.Equal(t, "v1", lo.FromPtr(result.Value))
+	assert.Equal(t, "v1", result.Value)
 }
 
 func TestGetParameterWithVersion_ShiftOutOfRange(t *testing.T) {
@@ -153,11 +151,11 @@ func TestGetParameterWithVersion_ShiftOutOfRange(t *testing.T) {
 
 	now := time.Now()
 	mock := &mockClient{
-		//nolint:lll // mock function signature
-		getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-			return &paramapi.GetParameterHistoryOutput{
-				Parameters: []paramapi.ParameterHistory{
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: &now},
+		getParameterHistoryFunc: func(_ context.Context, _ string) (*model.ParameterHistory, error) {
+			return &model.ParameterHistory{
+				Name: "/my/param",
+				Parameters: []*model.Parameter{
+					{Name: "/my/param", Value: "v1", Version: "1", UpdatedAt: &now},
 				},
 			}, nil
 		},
@@ -175,11 +173,11 @@ func TestGetParameterWithVersion_VersionNotFound(t *testing.T) {
 
 	now := time.Now()
 	mock := &mockClient{
-		//nolint:lll // mock function signature
-		getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-			return &paramapi.GetParameterHistoryOutput{
-				Parameters: []paramapi.ParameterHistory{
-					{Name: lo.ToPtr("/my/param"), Value: lo.ToPtr("v1"), Version: 1, LastModifiedDate: &now},
+		getParameterHistoryFunc: func(_ context.Context, _ string) (*model.ParameterHistory, error) {
+			return &model.ParameterHistory{
+				Name: "/my/param",
+				Parameters: []*model.Parameter{
+					{Name: "/my/param", Value: "v1", Version: "1", UpdatedAt: &now},
 				},
 			}, nil
 		},
@@ -197,10 +195,10 @@ func TestGetParameterWithVersion_EmptyHistory(t *testing.T) {
 	t.Parallel()
 
 	mock := &mockClient{
-		//nolint:lll // mock function signature
-		getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
-			return &paramapi.GetParameterHistoryOutput{
-				Parameters: []paramapi.ParameterHistory{},
+		getParameterHistoryFunc: func(_ context.Context, _ string) (*model.ParameterHistory, error) {
+			return &model.ParameterHistory{
+				Name:       "/my/param",
+				Parameters: []*model.Parameter{},
 			}, nil
 		},
 	}
@@ -216,7 +214,7 @@ func TestGetParameterWithVersion_GetParameterError(t *testing.T) {
 	t.Parallel()
 
 	mock := &mockClient{
-		getParameterFunc: func(_ context.Context, _ *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
+		getParameterFunc: func(_ context.Context, _ string, _ string) (*model.Parameter, error) {
 			return nil, fmt.Errorf("AWS error")
 		},
 	}
@@ -232,8 +230,7 @@ func TestGetParameterWithVersion_GetParameterHistoryError(t *testing.T) {
 	t.Parallel()
 
 	mock := &mockClient{
-		//nolint:lll // mock function signature
-		getParameterHistoryFunc: func(_ context.Context, _ *paramapi.GetParameterHistoryInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterHistoryOutput, error) {
+		getParameterHistoryFunc: func(_ context.Context, _ string) (*model.ParameterHistory, error) {
 			return nil, fmt.Errorf("AWS error")
 		},
 	}
@@ -245,28 +242,6 @@ func TestGetParameterWithVersion_GetParameterHistoryError(t *testing.T) {
 	assert.Equal(t, "failed to get parameter history: AWS error", err.Error())
 }
 
-func TestGetParameterWithVersion_AlwaysDecrypts(t *testing.T) {
-	t.Parallel()
-
-	mock := &mockClient{
-		getParameterFunc: func(_ context.Context, params *paramapi.GetParameterInput, _ ...func(*paramapi.Options)) (*paramapi.GetParameterOutput, error) {
-			// Verify that WithDecryption is always true
-			assert.True(t, lo.FromPtr(params.WithDecryption))
-
-			return &paramapi.GetParameterOutput{
-				Parameter: &paramapi.Parameter{
-					Name:    lo.ToPtr("/my/param"),
-					Value:   lo.ToPtr("decrypted-value"),
-					Version: 1,
-					Type:    paramapi.ParameterTypeSecureString,
-				},
-			}, nil
-		},
-	}
-
-	spec := &paramversion.Spec{Name: "/my/param"}
-	result, err := paramversion.GetParameterWithVersion(t.Context(), mock, spec)
-
-	require.NoError(t, err)
-	assert.Equal(t, "decrypted-value", lo.FromPtr(result.Value))
+func timePtr(t time.Time) *time.Time {
+	return &t
 }