@clef-sh/cli 0.1.0

package/dist/commands/recipients.js

@@ -0,0 +1,316 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitForEnter = waitForEnter;
+exports.registerRecipientsCommand = registerRecipientsCommand;
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const core_1 = require("@clef-sh/core");
+const formatter_1 = require("../output/formatter");
+const symbols_1 = require("../output/symbols");
+function waitForEnter(message) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        rl.question(message, () => {
+            rl.close();
+            resolve();
+        });
+    });
+}
+function registerRecipientsCommand(program, deps) {
+    const recipientsCmd = program
+        .command("recipients")
+        .description("Manage age recipients that can decrypt this repository.");
+    // --- list ---
+    recipientsCmd
+        .command("list")
+        .description("List all age recipients configured for this repository.")
+        .option("-e, --environment <env>", "List recipients for a specific environment")
+        .action(async (opts) => {
+        try {
+            const repoRoot = program.opts().repo || process.cwd();
+            const parser = new core_1.ManifestParser();
+            const manifest = parser.parse(path.join(repoRoot, "clef.yaml"));
+            if (opts.environment) {
+                const env = manifest.environments.find((e) => e.name === opts.environment);
+                if (!env) {
+                    formatter_1.formatter.error(`Environment '${opts.environment}' not found. Available: ${manifest.environments.map((e) => e.name).join(", ")}`);
+                    process.exit(2);
+                    return;
+                }
+            }
+            const matrixManager = new core_1.MatrixManager();
+            const sopsClient = new core_1.SopsClient(deps.runner);
+            const recipientManager = new core_1.RecipientManager(sopsClient, matrixManager);
+            const recipients = await recipientManager.list(manifest, repoRoot, opts.environment);
+            if (recipients.length === 0) {
+                const scope = opts.environment ? ` for environment '${opts.environment}'` : "";
+                formatter_1.formatter.info(`No recipients configured${scope}.`);
+                return;
+            }
+            const count = recipients.length;
+            const scope = opts.environment ? ` (${opts.environment})` : "";
+            formatter_1.formatter.print(`${(0, symbols_1.sym)("recipient")}  ${count} recipient${count !== 1 ? "s" : ""}${scope}\n`);
+            for (const r of recipients) {
+                formatter_1.formatter.recipientItem(r.label || r.preview, r.label ? r.preview : "");
+            }
+        }
+        catch (err) {
+            if (err instanceof core_1.SopsMissingError || err instanceof core_1.SopsVersionError) {
+                formatter_1.formatter.formatDependencyError(err);
+                process.exit(1);
+                return;
+            }
+            formatter_1.formatter.error(err.message);
+            process.exit(1);
+        }
+    });
+    // --- add ---
+    recipientsCmd
+        .command("add <key>")
+        .description("Add an age recipient and re-encrypt all files in the matrix.")
+        .option("--label <name>", "Human-readable label for this recipient")
+        .option("-e, --environment <env>", "Scope recipient to a specific environment")
+        .action(async (key, opts) => {
+        try {
+            const repoRoot = program.opts().repo || process.cwd();
+            // Validate key format before anything else
+            const validation = (0, core_1.validateAgePublicKey)(key);
+            if (!validation.valid) {
+                formatter_1.formatter.error(validation.error);
+                process.exit(2);
+                return;
+            }
+            const parser = new core_1.ManifestParser();
+            const manifest = parser.parse(path.join(repoRoot, "clef.yaml"));
+            if (opts.environment) {
+                const env = manifest.environments.find((e) => e.name === opts.environment);
+                if (!env) {
+                    formatter_1.formatter.error(`Environment '${opts.environment}' not found. Available: ${manifest.environments.map((e) => e.name).join(", ")}`);
+                    process.exit(2);
+                    return;
+                }
+            }
+            const matrixManager = new core_1.MatrixManager();
+            const sopsClient = new core_1.SopsClient(deps.runner);
+            const recipientManager = new core_1.RecipientManager(sopsClient, matrixManager);
+            // Check for duplicate before prompting
+            const existing = await recipientManager.list(manifest, repoRoot, opts.environment);
+            const normalizedKey = validation.key;
+            if (existing.some((r) => r.key === normalizedKey)) {
+                formatter_1.formatter.error(`Recipient '${(0, core_1.keyPreview)(normalizedKey)}' is already present.`);
+                process.exit(2);
+                return;
+            }
+            // Count files for the confirmation message
+            const allCells = matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists);
+            const cells = opts.environment
+                ? allCells.filter((c) => c.environment === opts.environment)
+                : allCells;
+            const fileCount = cells.length;
+            // Show confirmation prompt
+            const scope = opts.environment ? ` for environment '${opts.environment}'` : "";
+            formatter_1.formatter.print(`Add recipient to this repository${scope}?\n`);
+            formatter_1.formatter.print(`  Key:    ${(0, core_1.keyPreview)(normalizedKey)}`);
+            if (opts.label) {
+                formatter_1.formatter.print(`  Label:  ${opts.label}`);
+            }
+            formatter_1.formatter.print(`\nThis will re-encrypt ${fileCount} files in the matrix.`);
+            if (opts.environment) {
+                formatter_1.formatter.print(`The new recipient will be able to decrypt '${opts.environment}' secrets.\n`);
+            }
+            else {
+                formatter_1.formatter.print("The new recipient will be able to decrypt all secrets.\n");
+            }
+            const confirmed = await formatter_1.formatter.confirm("Proceed?");
+            if (!confirmed) {
+                formatter_1.formatter.info("Aborted.");
+                process.exit(0);
+                return;
+            }
+            // Show progress
+            formatter_1.formatter.print(`\n${(0, symbols_1.sym)("working")}  Re-encrypting matrix...`);
+            const result = await recipientManager.add(normalizedKey, opts.label, manifest, repoRoot, opts.environment);
+            // Check for rollback (failedFiles indicates failure)
+            if (result.failedFiles.length > 0) {
+                const failedFile = result.failedFiles[0];
+                formatter_1.formatter.print(`\n${(0, symbols_1.sym)("failure")} Re-encryption failed on ${path.basename(failedFile)}`);
+                formatter_1.formatter.print(`   Error: re-encryption failed`);
+                formatter_1.formatter.print("\nRolling back...");
+                formatter_1.formatter.print(`  ${(0, symbols_1.sym)("success")} clef.yaml restored`);
+                formatter_1.formatter.print(`  ${(0, symbols_1.sym)("success")} ${result.reEncryptedFiles.length} re-encrypted files restored from backup`);
+                formatter_1.formatter.print("\nNo changes were applied. Investigate the error above and retry.");
+                process.exit(1);
+                return;
+            }
+            // Show success progress
+            for (const file of result.reEncryptedFiles) {
+                const relative = path.relative(repoRoot, file);
+                formatter_1.formatter.print(`   ${(0, symbols_1.sym)("success")}  ${relative}`);
+            }
+            const label = opts.label || (0, core_1.keyPreview)(normalizedKey);
+            const envSuffix = opts.environment ? ` [${opts.environment}]` : "";
+            formatter_1.formatter.success(`${label} added. ${result.reEncryptedFiles.length} files re-encrypted. ${(0, symbols_1.sym)("locked")}`);
+            formatter_1.formatter.hint(`git add clef.yaml && git add -A && git commit -m "add recipient: ${label}${envSuffix}"`);
+        }
+        catch (err) {
+            if (err instanceof core_1.SopsMissingError || err instanceof core_1.SopsVersionError) {
+                formatter_1.formatter.formatDependencyError(err);
+                process.exit(1);
+                return;
+            }
+            formatter_1.formatter.error(err.message);
+            process.exit(1);
+        }
+    });
+    // --- remove ---
+    recipientsCmd
+        .command("remove <key>")
+        .description("Remove an age recipient and re-encrypt all files in the matrix.")
+        .option("-e, --environment <env>", "Scope removal to a specific environment")
+        .action(async (key, opts) => {
+        try {
+            // Non-TTY check — must be interactive
+            if (!process.stdin.isTTY) {
+                formatter_1.formatter.error("clef recipients remove requires interactive input.\n" +
+                    "Recipient management should not be automated in CI.");
+                process.exit(2);
+                return;
+            }
+            const repoRoot = program.opts().repo || process.cwd();
+            const parser = new core_1.ManifestParser();
+            const manifest = parser.parse(path.join(repoRoot, "clef.yaml"));
+            if (opts.environment) {
+                const env = manifest.environments.find((e) => e.name === opts.environment);
+                if (!env) {
+                    formatter_1.formatter.error(`Environment '${opts.environment}' not found. Available: ${manifest.environments.map((e) => e.name).join(", ")}`);
+                    process.exit(2);
+                    return;
+                }
+            }
+            const matrixManager = new core_1.MatrixManager();
+            const sopsClient = new core_1.SopsClient(deps.runner);
+            const recipientManager = new core_1.RecipientManager(sopsClient, matrixManager);
+            // Verify recipient exists
+            const existing = await recipientManager.list(manifest, repoRoot, opts.environment);
+            const trimmedKey = key.trim();
+            const target = existing.find((r) => r.key === trimmedKey);
+            if (!target) {
+                formatter_1.formatter.error(`Recipient '${(0, core_1.keyPreview)(trimmedKey)}' is not in the manifest.`);
+                process.exit(2);
+                return;
+            }
+            // Mandatory re-encryption warning — cannot be bypassed
+            formatter_1.formatter.warn("Important: re-encryption is not full revocation.\n\n" +
+                "   Removing a recipient re-encrypts all files so the\n" +
+                "   removed key cannot decrypt future versions. However,\n" +
+                "   if the removed recipient previously had access, they\n" +
+                "   may have decrypted values cached locally.\n\n" +
+                "   To fully revoke access, you must also rotate the\n" +
+                "   secret values themselves using clef rotate.\n");
+            await waitForEnter("   Press Enter to continue, or Ctrl+C to cancel.\n");
+            // Count files for confirmation
+            const allCells = matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists);
+            const cells = opts.environment
+                ? allCells.filter((c) => c.environment === opts.environment)
+                : allCells;
+            const fileCount = cells.length;
+            const label = target.label || (0, core_1.keyPreview)(trimmedKey);
+            // Show confirmation prompt
+            const scope = opts.environment ? ` for environment '${opts.environment}'` : "";
+            formatter_1.formatter.print(`Remove recipient from this repository${scope}?\n`);
+            formatter_1.formatter.print(`  Key:    ${target.preview}`);
+            if (target.label) {
+                formatter_1.formatter.print(`  Label:  ${target.label}`);
+            }
+            formatter_1.formatter.print(`\nThis will re-encrypt ${fileCount} files in the matrix.`);
+            formatter_1.formatter.print(`${label} will not be able to decrypt new versions of these files.\n`);
+            formatter_1.formatter.warn("Remember: rotate secrets after removing a recipient.\n" +
+                `   Run: clef rotate <namespace>/<environment>`);
+            const confirmed = await formatter_1.formatter.confirm("\nProceed?");
+            if (!confirmed) {
+                formatter_1.formatter.info("Aborted.");
+                process.exit(0);
+                return;
+            }
+            // Show progress
+            formatter_1.formatter.print(`\n${(0, symbols_1.sym)("working")}  Re-encrypting matrix...`);
+            const result = await recipientManager.remove(trimmedKey, manifest, repoRoot, opts.environment);
+            // Check for rollback
+            if (result.failedFiles.length > 0) {
+                const failedFile = result.failedFiles[0];
+                formatter_1.formatter.print(`\n${(0, symbols_1.sym)("failure")} Re-encryption failed on ${path.basename(failedFile)}`);
+                formatter_1.formatter.print(`   Error: re-encryption failed`);
+                formatter_1.formatter.print("\nRolling back...");
+                formatter_1.formatter.print(`  ${(0, symbols_1.sym)("success")} clef.yaml restored`);
+                formatter_1.formatter.print(`  ${(0, symbols_1.sym)("success")} ${result.reEncryptedFiles.length} re-encrypted files restored from backup`);
+                formatter_1.formatter.print("\nNo changes were applied. Investigate the error above and retry.");
+                process.exit(1);
+                return;
+            }
+            // Show success progress
+            for (const file of result.reEncryptedFiles) {
+                const relative = path.relative(repoRoot, file);
+                formatter_1.formatter.print(`   ${(0, symbols_1.sym)("success")}  ${relative}`);
+            }
+            formatter_1.formatter.success(`${label} removed. ${result.reEncryptedFiles.length} files re-encrypted. ${(0, symbols_1.sym)("locked")}`);
+            // Rotation reminder — scope to affected environments
+            formatter_1.formatter.warn("Rotate secrets to complete revocation:");
+            const targetEnvs = opts.environment
+                ? manifest.environments.filter((e) => e.name === opts.environment)
+                : manifest.environments;
+            for (const ns of manifest.namespaces) {
+                for (const env of targetEnvs) {
+                    formatter_1.formatter.hint(`clef rotate ${ns.name}/${env.name}`);
+                }
+            }
+            const envSuffix = opts.environment ? ` [${opts.environment}]` : "";
+            formatter_1.formatter.hint(`git add clef.yaml && git add -A && git commit -m "remove recipient: ${label}${envSuffix}"`);
+        }
+        catch (err) {
+            if (err instanceof core_1.SopsMissingError || err instanceof core_1.SopsVersionError) {
+                formatter_1.formatter.formatDependencyError(err);
+                process.exit(1);
+                return;
+            }
+            formatter_1.formatter.error(err.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=recipients.js.map

package/dist/commands/recipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/commands/recipients.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,oCAWC;AAED,8DAmVC;AAjXD,2CAA6B;AAC7B,mDAAqC;AAErC,wCAUuB;AACvB,mDAAgD;AAChD,+CAAwC;AAExC,SAAgB,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAAgB,EAChB,IAAkC;IAElC,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,yDAAyD,CAAC,CAAC;IAE1E,eAAe;IACf,aAAa;SACV,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,yBAAyB,EAAE,4CAA4C,CAAC;SAC/E,MAAM,CAAC,KAAK,EAAE,IAA8B,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAe,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,qBAAc,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YAEhE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,qBAAS,CAAC,KAAK,CACb,gBAAgB,IAAI,CAAC,WAAW,2BAA2B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjH,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,oBAAa,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,iBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,gBAAgB,GAAG,IAAI,uBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEzE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAErF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,qBAAS,CAAC,IAAI,CAAC,2BAA2B,KAAK,GAAG,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,qBAAS,CAAC,KAAK,CACb,GAAG,IAAA,aAAG,EAAC,WAAW,CAAC,KAAK,KAAK,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAC7E,CAAC;YAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,qBAAS,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAgB,IAAI,GAAG,YAAY,uBAAgB,EAAE,CAAC;gBACvE,qBAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,qBAAS,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,cAAc;IACd,aAAa;SACV,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,gBAAgB,EAAE,yCAAyC,CAAC;SACnE,MAAM,CAAC,yBAAyB,EAAE,2CAA2C,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,IAA8C,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAe,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAElE,2CAA2C;YAC3C,MAAM,UAAU,GAAG,IAAA,2BAAoB,EAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,qBAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,qBAAc,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YAEhE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,qBAAS,CAAC,KAAK,CACb,gBAAgB,IAAI,CAAC,WAAW,2BAA2B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjH,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,oBAAa,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,iBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,gBAAgB,GAAG,IAAI,uBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEzE,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnF,MAAM,aAAa,GAAG,UAAU,CAAC,GAAI,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,EAAE,CAAC;gBAClD,qBAAS,CAAC,KAAK,CAAC,cAAc,IAAA,iBAAU,EAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW;gBAC5B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC;gBAC5D,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;YAE/B,2BAA2B;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,qBAAS,CAAC,KAAK,CAAC,mCAAmC,KAAK,KAAK,CAAC,CAAC;YAC/D,qBAAS,CAAC,KAAK,CAAC,aAAa,IAAA,iBAAU,EAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,qBAAS,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,qBAAS,CAAC,KAAK,CAAC,0BAA0B,SAAS,uBAAuB,CAAC,CAAC;YAC5E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,qBAAS,CAAC,KAAK,CACb,8CAA8C,IAAI,CAAC,WAAW,cAAc,CAC7E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,qBAAS,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,qBAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,qBAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,gBAAgB;YAChB,qBAAS,CAAC,KAAK,CAAC,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CACvC,aAAa,EACb,IAAI,CAAC,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,WAAW,CACjB,CAAC;YAEF,qDAAqD;YACrD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACzC,qBAAS,CAAC,KAAK,CACb,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,4BAA4B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAC3E,CAAC;gBACF,qBAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAClD,qBAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACrC,qBAAS,CAAC,KAAK,CAAC,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAC1D,qBAAS,CAAC,KAAK,CACb,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,0CAA0C,CAChG,CAAC;gBACF,qBAAS,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,wBAAwB;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC/C,qBAAS,CAAC,KAAK,CAAC,MAAM,IAAA,aAAG,EAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,qBAAS,CAAC,OAAO,CACf,GAAG,KAAK,WAAW,MAAM,CAAC,gBAAgB,CAAC,MAAM,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,CACzF,CAAC;YACF,qBAAS,CAAC,IAAI,CACZ,oEAAoE,KAAK,GAAG,SAAS,GAAG,CACzF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAgB,IAAI,GAAG,YAAY,uBAAgB,EAAE,CAAC;gBACvE,qBAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,qBAAS,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,iBAAiB;IACjB,aAAa;SACV,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,IAA8B,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,sCAAsC;YACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,qBAAS,CAAC,KAAK,CACb,sDAAsD;oBACpD,qDAAqD,CACxD,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAe,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,qBAAc,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YAEhE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,qBAAS,CAAC,KAAK,CACb,gBAAgB,IAAI,CAAC,WAAW,2BAA2B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjH,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,oBAAa,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,iBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,gBAAgB,GAAG,IAAI,uBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEzE,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,qBAAS,CAAC,KAAK,CAAC,cAAc,IAAA,iBAAU,EAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;gBACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,uDAAuD;YACvD,qBAAS,CAAC,IAAI,CACZ,sDAAsD;gBACpD,wDAAwD;gBACxD,2DAA2D;gBAC3D,2DAA2D;gBAC3D,kDAAkD;gBAClD,uDAAuD;gBACvD,kDAAkD,CACrD,CAAC;YAEF,MAAM,YAAY,CAAC,oDAAoD,CAAC,CAAC;YAEzE,+BAA+B;YAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW;gBAC5B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC;gBAC5D,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAA,iBAAU,EAAC,UAAU,CAAC,CAAC;YAErD,2BAA2B;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,qBAAS,CAAC,KAAK,CAAC,wCAAwC,KAAK,KAAK,CAAC,CAAC;YACpE,qBAAS,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,qBAAS,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,qBAAS,CAAC,KAAK,CAAC,0BAA0B,SAAS,uBAAuB,CAAC,CAAC;YAC5E,qBAAS,CAAC,KAAK,CAAC,GAAG,KAAK,6DAA6D,CAAC,CAAC;YACvF,qBAAS,CAAC,IAAI,CACZ,wDAAwD;gBACtD,+CAA+C,CAClD,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,qBAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,qBAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,gBAAgB;YAChB,qBAAS,CAAC,KAAK,CAAC,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC1C,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,WAAW,CACjB,CAAC;YAEF,qBAAqB;YACrB,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACzC,qBAAS,CAAC,KAAK,CACb,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,4BAA4B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAC3E,CAAC;gBACF,qBAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAClD,qBAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACrC,qBAAS,CAAC,KAAK,CAAC,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAC1D,qBAAS,CAAC,KAAK,CACb,KAAK,IAAA,aAAG,EAAC,SAAS,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,0CAA0C,CAChG,CAAC;gBACF,qBAAS,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,wBAAwB;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC/C,qBAAS,CAAC,KAAK,CAAC,MAAM,IAAA,aAAG,EAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,qBAAS,CAAC,OAAO,CACf,GAAG,KAAK,aAAa,MAAM,CAAC,gBAAgB,CAAC,MAAM,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,CAC3F,CAAC;YAEF,qDAAqD;YACrD,qBAAS,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW;gBACjC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC;gBAClE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC1B,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACrC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,qBAAS,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,qBAAS,CAAC,IAAI,CACZ,uEAAuE,KAAK,GAAG,SAAS,GAAG,CAC5F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAgB,IAAI,GAAG,YAAY,uBAAgB,EAAE,CAAC;gBACvE,qBAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,qBAAS,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/rotate.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { SubprocessRunner } from "@clef-sh/core";
+export declare function registerRotateCommand(program: Command, deps: {
+    runner: SubprocessRunner;
+}): void;
+//# sourceMappingURL=rotate.d.ts.map

package/dist/commands/rotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.d.ts","sourceRoot":"","sources":["../../src/commands/rotate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAML,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAIvB,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAgEhG"}

package/dist/commands/rotate.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRotateCommand = registerRotateCommand;
+const path = __importStar(require("path"));
+const core_1 = require("@clef-sh/core");
+const formatter_1 = require("../output/formatter");
+const symbols_1 = require("../output/symbols");
+function registerRotateCommand(program, deps) {
+    program
+        .command("rotate <target>")
+        .description("Rotate encryption key for a namespace/environment file.\n\n" +
+        "  target:     namespace/environment (e.g. payments/production)\n" +
+        "  --new-key:  the new age public key to add (required)\n\n" +
+        "Exit codes:\n" +
+        "  0  key rotated successfully\n" +
+        "  1  operation failed")
+        .requiredOption("--new-key <key>", "New age public key to rotate to")
+        .action(async (target, options) => {
+        try {
+            const [namespace, environment] = parseTarget(target);
+            const repoRoot = program.opts().repo || process.cwd();
+            const parser = new core_1.ManifestParser();
+            const manifest = parser.parse(path.join(repoRoot, "clef.yaml"));
+            // Check for protected environment
+            const matrixManager = new core_1.MatrixManager();
+            if (matrixManager.isProtectedEnvironment(manifest, environment)) {
+                const confirmed = await formatter_1.formatter.confirm(`${environment} is a protected environment. Rotate key anyway?`);
+                if (!confirmed) {
+                    formatter_1.formatter.info("Rotation cancelled.");
+                    process.exit(0);
+                    return;
+                }
+            }
+            const filePath = path.join(repoRoot, manifest.file_pattern
+                .replace("{namespace}", namespace)
+                .replace("{environment}", environment));
+            const sopsClient = new core_1.SopsClient(deps.runner);
+            const relativeFile = manifest.file_pattern
+                .replace("{namespace}", namespace)
+                .replace("{environment}", environment);
+            formatter_1.formatter.print(`${(0, symbols_1.sym)("working")}  Rotating ${namespace}/${environment}...`);
+            await sopsClient.reEncrypt(filePath, options.newKey);
+            formatter_1.formatter.success(`Rotated. New values encrypted. ${(0, symbols_1.sym)("locked")}`);
+            formatter_1.formatter.hint(`git add ${relativeFile} && git commit -m "rotate: ${namespace}/${environment}"`);
+        }
+        catch (err) {
+            if (err instanceof core_1.SopsMissingError || err instanceof core_1.SopsVersionError) {
+                formatter_1.formatter.formatDependencyError(err);
+                process.exit(1);
+                return;
+            }
+            formatter_1.formatter.error(err.message);
+            process.exit(1);
+        }
+    });
+}
+function parseTarget(target) {
+    const parts = target.split("/");
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        throw new Error(`Invalid target "${target}". Expected format: namespace/environment`);
+    }
+    return [parts[0], parts[1]];
+}
+//# sourceMappingURL=rotate.js.map

package/dist/commands/rotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.js","sourceRoot":"","sources":["../../src/commands/rotate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,sDAgEC;AA7ED,2CAA6B;AAE7B,wCAOuB;AACvB,mDAAgD;AAChD,+CAAwC;AAExC,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,IAAkC;IACxF,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,6DAA6D;QAC3D,kEAAkE;QAClE,4DAA4D;QAC5D,eAAe;QACf,iCAAiC;QACjC,uBAAuB,CAC1B;SACA,cAAc,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,OAA2B,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAe,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAElE,MAAM,MAAM,GAAG,IAAI,qBAAc,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YAEhE,kCAAkC;YAClC,MAAM,aAAa,GAAG,IAAI,oBAAa,EAAE,CAAC;YAC1C,IAAI,aAAa,CAAC,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;gBAChE,MAAM,SAAS,GAAG,MAAM,qBAAS,CAAC,OAAO,CACvC,GAAG,WAAW,iDAAiD,CAChE,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,qBAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,QAAQ,EACR,QAAQ,CAAC,YAAY;iBAClB,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;iBACjC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CACzC,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,iBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAE/C,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY;iBACvC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;iBACjC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YAEzC,qBAAS,CAAC,KAAK,CAAC,GAAG,IAAA,aAAG,EAAC,SAAS,CAAC,cAAc,SAAS,IAAI,WAAW,KAAK,CAAC,CAAC;YAE9E,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAErD,qBAAS,CAAC,OAAO,CAAC,kCAAkC,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrE,qBAAS,CAAC,IAAI,CACZ,WAAW,YAAY,8BAA8B,SAAS,IAAI,WAAW,GAAG,CACjF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAgB,IAAI,GAAG,YAAY,uBAAgB,EAAE,CAAC;gBACvE,qBAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,qBAAS,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,2CAA2C,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/dist/commands/scan.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { SubprocessRunner } from "@clef-sh/core";
+export declare function registerScanCommand(program: Command, deps: {
+    runner: SubprocessRunner;
+}): void;
+//# sourceMappingURL=scan.d.ts.map

package/dist/commands/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAIL,gBAAgB,EAEjB,MAAM,eAAe,CAAC;AAIvB,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAqF9F"}

package/dist/commands/scan.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerScanCommand = registerScanCommand;
+const path = __importStar(require("path"));
+const picocolors_1 = __importDefault(require("picocolors"));
+const core_1 = require("@clef-sh/core");
+const formatter_1 = require("../output/formatter");
+const symbols_1 = require("../output/symbols");
+function registerScanCommand(program, deps) {
+    program
+        .command("scan [paths...]")
+        .description("Scan the repository for secrets that have escaped the Clef matrix.\n\n" +
+        "Exit codes:\n" +
+        "  0  No issues found\n" +
+        "  1  Issues found\n" +
+        "  2  Scan could not complete (manifest missing, permission error)")
+        .option("--staged", "Only scan files staged for commit")
+        .option("--severity <level>", "Detection level: all (patterns+entropy) or high (patterns only)", "all")
+        .option("--json", "Output machine-readable JSON")
+        .action(async (paths, options) => {
+        const repoRoot = program.opts().repo || process.cwd();
+        let manifest;
+        try {
+            const parser = new core_1.ManifestParser();
+            manifest = parser.parse(path.join(repoRoot, "clef.yaml"));
+        }
+        catch (err) {
+            if (err instanceof core_1.ManifestValidationError ||
+                err.message?.includes("clef.yaml")) {
+                formatter_1.formatter.error("No clef.yaml found. Run 'clef init' to set up this repository.");
+            }
+            else {
+                formatter_1.formatter.error(err.message);
+            }
+            process.exit(2);
+            return;
+        }
+        const severity = options.severity === "high" ? "high" : "all";
+        const scanRunner = new core_1.ScanRunner(deps.runner);
+        if (!options.json) {
+            formatter_1.formatter.print(picocolors_1.default.dim("Scanning repository for unencrypted secrets..."));
+        }
+        let result;
+        try {
+            result = await scanRunner.scan(repoRoot, manifest, {
+                stagedOnly: options.staged,
+                paths: paths.length > 0 ? paths : undefined,
+                severity,
+            });
+        }
+        catch (err) {
+            formatter_1.formatter.error(`Scan failed: ${err.message}`);
+            process.exit(2);
+            return;
+        }
+        if (options.json) {
+            const totalIssues = result.matches.length + result.unencryptedMatrixFiles.length;
+            formatter_1.formatter.raw(JSON.stringify({
+                matches: result.matches,
+                unencryptedMatrixFiles: result.unencryptedMatrixFiles,
+                filesScanned: result.filesScanned,
+                filesSkipped: result.filesSkipped,
+                durationMs: result.durationMs,
+                summary: `${totalIssues} issue${totalIssues !== 1 ? "s" : ""} found`,
+            }, null, 2) + "\n");
+            const hasIssues = result.matches.length > 0 || result.unencryptedMatrixFiles.length > 0;
+            process.exit(hasIssues ? 1 : 0);
+            return;
+        }
+        formatScanOutput(result);
+        const hasIssues = result.matches.length > 0 || result.unencryptedMatrixFiles.length > 0;
+        process.exit(hasIssues ? 1 : 0);
+    });
+}
+function formatScanOutput(result) {
+    const totalIssues = result.matches.length + result.unencryptedMatrixFiles.length;
+    const durationSec = (result.durationMs / 1000).toFixed(1);
+    formatter_1.formatter.print("");
+    // Unencrypted matrix files (errors)
+    for (const file of result.unencryptedMatrixFiles) {
+        formatter_1.formatter.print(picocolors_1.default.red(`${(0, symbols_1.sym)("failure")} Unencrypted matrix file`));
+        formatter_1.formatter.print(`  ${picocolors_1.default.white(file)} \u2014 missing ${(0, symbols_1.sym)("locked")}`);
+        const base = file.replace(/\.enc\.(yaml|json)$/, "").replace(/\//g, "/");
+        formatter_1.formatter.hint(`clef encrypt ${base}`);
+        formatter_1.formatter.print("");
+    }
+    // Pattern and entropy matches (warnings)
+    for (const match of result.matches) {
+        if (match.matchType === "pattern") {
+            formatter_1.formatter.print(picocolors_1.default.yellow(`${(0, symbols_1.sym)("warning")} Pattern match: ${match.patternName}`));
+        }
+        else {
+            formatter_1.formatter.print(picocolors_1.default.yellow(`${(0, symbols_1.sym)("warning")} High entropy value (entropy: ${match.entropy?.toFixed(1)})`));
+        }
+        formatter_1.formatter.print(`  ${picocolors_1.default.white(match.file)}:${match.line}`);
+        formatter_1.formatter.print(`  ${picocolors_1.default.dim(match.preview)}`);
+        if (match.matchType === "pattern") {
+            formatter_1.formatter.hint("clef set <namespace>/<env> <KEY>");
+        }
+        else {
+            const varName = match.preview.split("=")[0] ?? "KEY";
+            formatter_1.formatter.hint(`clef set <namespace>/<env> ${varName}`);
+            formatter_1.formatter.print(`  ${picocolors_1.default.dim("or suppress: add '# clef-ignore' to line")} ${match.line} ${picocolors_1.default.dim("of")} ${match.file}`);
+        }
+        formatter_1.formatter.print("");
+    }
+    // Summary
+    if (totalIssues === 0) {
+        formatter_1.formatter.success(`No issues found \u2014 ${result.filesScanned} files scanned in ${durationSec}s`);
+    }
+    else {
+        formatter_1.formatter.print(`${picocolors_1.default.yellow(`${totalIssues} issue${totalIssues !== 1 ? "s" : ""} found`)} in ${result.filesScanned} files (${durationSec}s)`);
+        formatter_1.formatter.hint("Add false positives to .clefignore");
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,kDAqFC;AAlGD,2CAA6B;AAC7B,4DAA4B;AAE5B,wCAMuB;AACvB,mDAAgD;AAChD,+CAAwC;AAExC,SAAgB,mBAAmB,CAAC,OAAgB,EAAE,IAAkC;IACtF,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,wEAAwE;QACtE,eAAe;QACf,wBAAwB;QACxB,qBAAqB;QACrB,mEAAmE,CACtE;SACA,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;SACvD,MAAM,CACL,oBAAoB,EACpB,iEAAiE,EACjE,KAAK,CACN;SACA,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;SAChD,MAAM,CACL,KAAK,EAAE,KAAe,EAAE,OAAgE,EAAE,EAAE;QAC1F,MAAM,QAAQ,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAe,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAElE,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,qBAAc,EAAE,CAAC;YACpC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG,YAAY,8BAAuB;gBACrC,GAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,qBAAS,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,qBAAS,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,iBAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,qBAAS,CAAC,KAAK,CAAC,oBAAE,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE;gBACjD,UAAU,EAAE,OAAO,CAAC,MAAM;gBAC1B,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC3C,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qBAAS,CAAC,KAAK,CAAC,gBAAiB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACjF,qBAAS,CAAC,GAAG,CACX,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;gBACrD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,GAAG,WAAW,SAAS,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ;aACrE,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC;IACjF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAE1D,qBAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEpB,oCAAoC;IACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACjD,qBAAS,CAAC,KAAK,CAAC,oBAAE,CAAC,GAAG,CAAC,GAAG,IAAA,aAAG,EAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACrE,qBAAS,CAAC,KAAK,CAAC,KAAK,oBAAE,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzE,qBAAS,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACvC,qBAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,yCAAyC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,qBAAS,CAAC,KAAK,CAAC,oBAAE,CAAC,MAAM,CAAC,GAAG,IAAA,aAAG,EAAC,SAAS,CAAC,mBAAmB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,qBAAS,CAAC,KAAK,CACb,oBAAE,CAAC,MAAM,CAAC,GAAG,IAAA,aAAG,EAAC,SAAS,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAC1F,CAAC;QACJ,CAAC;QAED,qBAAS,CAAC,KAAK,CAAC,KAAK,oBAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,qBAAS,CAAC,KAAK,CAAC,KAAK,oBAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE9C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,qBAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;YACrD,qBAAS,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACxD,qBAAS,CAAC,KAAK,CACb,KAAK,oBAAE,CAAC,GAAG,CAAC,0CAA0C,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,qBAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,UAAU;IACV,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,qBAAS,CAAC,OAAO,CACf,0BAA0B,MAAM,CAAC,YAAY,qBAAqB,WAAW,GAAG,CACjF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,qBAAS,CAAC,KAAK,CACb,GAAG,oBAAE,CAAC,MAAM,CAAC,GAAG,WAAW,SAAS,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,MAAM,CAAC,YAAY,WAAW,WAAW,IAAI,CAC9H,CAAC;QACF,qBAAS,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/commands/set.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { SubprocessRunner } from "@clef-sh/core";
+export declare function registerSetCommand(program: Command, deps: {
+    runner: SubprocessRunner;
+}): void;
+//# sourceMappingURL=set.d.ts.map

package/dist/commands/set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAML,gBAAgB,EAIjB,MAAM,eAAe,CAAC;AAIvB,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAuH7F"}