@clef-sh/cli 0.1.11-beta.62 → 0.1.11-beta.66

package/dist/index.cjs

@@ -10228,7 +10228,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse16(src, reviver, options) {
+    function parse15(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -10269,7 +10269,7 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports2.parse = parse16;
+    exports2.parse = parse15;
     exports2.parseAllDocuments = parseAllDocuments;
     exports2.parseDocument = parseDocument;
     exports2.stringify = stringify8;
@@ -10801,8 +10801,26 @@ var init_parser = __esm({
             "sops.default_backend"
           );
         }
+        const ageObj = sopsObj.age;
+        const ageRecipients = ageObj && Array.isArray(ageObj.recipients) ? ageObj.recipients : void 0;
+        const parsedAge = ageRecipients ? {
+          age: {
+            recipients: ageRecipients.map((r) => {
+              if (typeof r === "string") return r;
+              if (typeof r === "object" && r !== null) {
+                const obj2 = r;
+                return {
+                  key: String(obj2.key ?? ""),
+                  ...typeof obj2.label === "string" ? { label: obj2.label } : {}
+                };
+              }
+              return String(r);
+            })
+          }
+        } : {};
         const sopsConfig = {
           default_backend: sopsObj.default_backend,
+          ...parsedAge,
           ...typeof sopsObj.aws_kms_arn === "string" ? { aws_kms_arn: sopsObj.aws_kms_arn } : {},
           ...typeof sopsObj.gcp_kms_resource_id === "string" ? { gcp_kms_resource_id: sopsObj.gcp_kms_resource_id } : {},
           ...typeof sopsObj.azure_kv_url === "string" ? { azure_kv_url: sopsObj.azure_kv_url } : {},
@@ -11195,8 +11213,8 @@ var init_scanner = __esm({
     ALWAYS_SKIP_EXTENSIONS = [".enc.yaml", ".enc.json"];
     ALWAYS_SKIP_NAMES = [
       ".clef-meta.yaml",
-      ".sops.yaml"
-      // contains age public keys and KMS ARNs — configuration, not secrets
+      "clef.yaml"
+      // manifest — contains public keys and config, not secrets
     ];
     ALWAYS_SKIP_DIRS = ["node_modules", ".git"];
     MAX_FILE_SIZE = 1024 * 1024;
@@ -19483,9 +19501,12 @@ var init_client = __esm({
         }
         let result;
         try {
+          const configPath = process.platform === "win32" ? "NUL" : "/dev/null";
           result = await this.runner.run(
             this.sopsCommand,
             [
+              "--config",
+              configPath,
               "encrypt",
               ...args,
               "--input-type",
@@ -19722,8 +19743,15 @@ var init_client = __esm({
           pgp_fingerprint: manifest.sops.pgp_fingerprint
         };
         switch (config.backend) {
-          case "age":
+          case "age": {
+            const envRecipients = environment ? resolveRecipientsForEnvironment(manifest, environment) : void 0;
+            const recipients = envRecipients ?? manifest.sops.age?.recipients ?? [];
+            const keys = recipients.map((r) => typeof r === "string" ? r : r.key);
+            if (keys.length > 0) {
+              args.push("--age", keys.join(","));
+            }
             break;
+          }
           case "awskms":
             if (config.aws_kms_arn) {
               args.push("--kms", config.aws_kms_arn);
@@ -21870,14 +21898,13 @@ var init_resolve = __esm({
 // ../core/src/artifact/signer.ts
 function buildSigningPayload(artifact) {
   const fields = [
-    "clef-sig-v2",
+    "clef-sig-v3",
     String(artifact.version),
     artifact.identity,
     artifact.environment,
     artifact.revision,
     artifact.packedAt,
     artifact.ciphertextHash,
-    [...artifact.keys].sort().join(","),
     artifact.expiresAt ?? "",
     artifact.envelope?.provider ?? "",
     artifact.envelope?.keyId ?? "",
@@ -22017,7 +22044,6 @@ var init_packer = __esm({
               revision,
               ciphertextHash,
               ciphertext,
-              keys: Object.keys(resolved.values),
               envelope: {
                 provider: kmsConfig.provider,
                 keyId: kmsConfig.keyId,
@@ -22051,8 +22077,7 @@ var init_packer = __esm({
             packedAt: (/* @__PURE__ */ new Date()).toISOString(),
             revision,
             ciphertextHash,
-            ciphertext,
-            keys: Object.keys(resolved.values)
+            ciphertext
           };
         }
         const outputDir = path19.dirname(config.outputPath);
@@ -22137,7 +22162,7 @@ var init_backend = __esm({
         this.encryption = encryption;
         this.matrixManager = matrixManager;
       }
-      async migrate(manifest, repoRoot, options, callbacks, onProgress) {
+      async migrate(manifest, repoRoot, options, onProgress) {
         const { target, environment, dryRun, skipVerify } = options;
         if (environment) {
           const env = manifest.environments.find((e) => e.name === environment);
@@ -22207,14 +22232,11 @@ var init_backend = __esm({
         }
         const manifestPath = path20.join(repoRoot, CLEF_MANIFEST_FILENAME);
         const manifestBackup = fs17.readFileSync(manifestPath, "utf-8");
-        const sopsYamlPath = path20.join(repoRoot, ".sops.yaml");
-        const sopsYamlBackup = fs17.existsSync(sopsYamlPath) ? fs17.readFileSync(sopsYamlPath, "utf-8") : void 0;
         const fileBackups = /* @__PURE__ */ new Map();
         const doc = readManifestYaml(repoRoot);
         this.updateManifestDoc(doc, target, environment);
         writeManifestYaml(repoRoot, doc);
         const updatedManifest = YAML11.parse(YAML11.stringify(doc));
-        callbacks.regenerateSopsConfig();
         const migratedFiles = [];
         for (const cell of toMigrate) {
           try {
@@ -22233,7 +22255,7 @@ var init_backend = __esm({
             );
             migratedFiles.push(cell.filePath);
           } catch (err) {
-            this.rollback(manifestPath, manifestBackup, sopsYamlPath, sopsYamlBackup, fileBackups);
+            this.rollback(manifestPath, manifestBackup, fileBackups);
             const errorMsg = err instanceof Error ? err.message : String(err);
             onProgress?.({
               type: "warn",
@@ -22297,15 +22319,10 @@ var init_backend = __esm({
           }
         }
       }
-      rollback(manifestPath, manifestBackup, sopsYamlPath, sopsYamlBackup, fileBackups) {
+      rollback(manifestPath, manifestBackup, fileBackups) {
         for (const [filePath, backup] of fileBackups) {
           fs17.writeFileSync(filePath, backup, "utf-8");
         }
-        if (sopsYamlBackup !== void 0) {
-          fs17.writeFileSync(sopsYamlPath, sopsYamlBackup, "utf-8");
-        } else if (fs17.existsSync(sopsYamlPath)) {
-          fs17.unlinkSync(sopsYamlPath);
-        }
         fs17.writeFileSync(manifestPath, manifestBackup, "utf-8");
       }
       checkAgeRecipientsWarning(manifest, target, environment, warnings) {
@@ -22535,7 +22552,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse16(val);
+        return parse15(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -22543,7 +22560,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse16(str2) {
+    function parse15(str2) {
       str2 = String(str2);
       if (str2.length > 100) {
         return;
@@ -23982,7 +23999,7 @@ var require_bytes = __commonJS({
     "use strict";
     module2.exports = bytes;
     module2.exports.format = format;
-    module2.exports.parse = parse16;
+    module2.exports.parse = parse15;
     var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g;
     var formatDecimalsRegExp = /(?:\.0*|(\.[^0]+)0+)$/;
     var map = {
@@ -23996,7 +24013,7 @@ var require_bytes = __commonJS({
     var parseRegExp = /^((-|\+)?(\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i;
     function bytes(value, options) {
       if (typeof value === "string") {
-        return parse16(value);
+        return parse15(value);
       }
       if (typeof value === "number") {
         return format(value, options);
@@ -24040,7 +24057,7 @@ var require_bytes = __commonJS({
       }
       return str2 + unitSeparator + unit;
     }
-    function parse16(val) {
+    function parse15(val) {
       if (typeof val === "number" && !isNaN(val)) {
         return val;
       }
@@ -28245,7 +28262,7 @@ var require_content_type = __commonJS({
     var QUOTE_REGEXP = /([\\"])/g;
     var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
     exports2.format = format;
-    exports2.parse = parse16;
+    exports2.parse = parse15;
     function format(obj) {
       if (!obj || typeof obj !== "object") {
         throw new TypeError("argument obj is required");
@@ -28269,7 +28286,7 @@ var require_content_type = __commonJS({
       }
       return string;
     }
-    function parse16(string) {
+    function parse15(string) {
       if (!string) {
         throw new TypeError("argument string is required");
       }
@@ -37851,7 +37868,7 @@ var require_media_typer = __commonJS({
     var TYPE_NAME_REGEXP = /^[A-Za-z0-9][A-Za-z0-9!#$&^_-]{0,126}$/;
     var TYPE_REGEXP = /^ *([A-Za-z0-9][A-Za-z0-9!#$&^_-]{0,126})\/([A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}) *$/;
     exports2.format = format;
-    exports2.parse = parse16;
+    exports2.parse = parse15;
     exports2.test = test;
     function format(obj) {
       if (!obj || typeof obj !== "object") {
@@ -37884,7 +37901,7 @@ var require_media_typer = __commonJS({
       }
       return TYPE_REGEXP.test(string.toLowerCase());
     }
-    function parse16(string) {
+    function parse15(string) {
       if (!string) {
         throw new TypeError("argument string is required");
       }
@@ -38070,7 +38087,7 @@ var require_read = __commonJS({
     var hasBody = require_type_is().hasBody;
     var { getCharset } = require_utils();
     module2.exports = read;
-    function read(req, res, next, parse16, debug, options) {
+    function read(req, res, next, parse15, debug, options) {
       if (onFinished.isFinished(req)) {
         debug("body already parsed");
         next();
@@ -38158,7 +38175,7 @@ var require_read = __commonJS({
         try {
           debug("parse body");
           str2 = typeof body !== "string" && encoding !== null ? iconv.decode(body, encoding) : body;
-          req.body = parse16(str2, encoding);
+          req.body = parse15(str2, encoding);
         } catch (err) {
           next(createError(400, err, {
             body: str2,
@@ -38231,7 +38248,7 @@ var require_json = __commonJS({
       const normalizedOptions = normalizeOptions(options, "application/json");
       var reviver = options?.reviver;
       var strict = options?.strict !== false;
-      function parse16(body) {
+      function parse15(body) {
         if (body.length === 0) {
           return {};
         }
@@ -38258,7 +38275,7 @@ var require_json = __commonJS({
         isValidCharset: (charset) => charset.slice(0, 4) === "utf-"
       };
       return function jsonParser(req, res, next) {
-        read(req, res, next, parse16, debug, readOptions);
+        read(req, res, next, parse15, debug, readOptions);
       };
     }
     function createStrictSyntaxError(str2, char) {
@@ -40836,11 +40853,11 @@ var require_lib2 = __commonJS({
   "../../node_modules/qs/lib/index.js"(exports2, module2) {
     "use strict";
     var stringify8 = require_stringify2();
-    var parse16 = require_parse();
+    var parse15 = require_parse();
     var formats = require_formats();
     module2.exports = {
       formats,
-      parse: parse16,
+      parse: parse15,
       stringify: stringify8
     };
   }
@@ -40862,7 +40879,7 @@ var require_urlencoded = __commonJS({
         throw new TypeError("option defaultCharset must be either utf-8 or iso-8859-1");
       }
       var queryparse = createQueryParser(options);
-      function parse16(body, encoding) {
+      function parse15(body, encoding) {
         return body.length ? queryparse(body, encoding) : {};
       }
       const readOptions = {
@@ -40871,7 +40888,7 @@ var require_urlencoded = __commonJS({
         isValidCharset: (charset) => charset === "utf-8" || charset === "iso-8859-1"
       };
       return function urlencodedParser(req, res, next) {
-        read(req, res, next, parse16, debug, readOptions);
+        read(req, res, next, parse15, debug, readOptions);
       };
     }
     function createQueryParser(options) {
@@ -41055,7 +41072,7 @@ var require_parseurl = __commonJS({
   "../../node_modules/parseurl/index.js"(exports2, module2) {
     "use strict";
     var url = require("url");
-    var parse16 = url.parse;
+    var parse15 = url.parse;
     var Url = url.Url;
     module2.exports = parseurl;
     module2.exports.original = originalurl;
@@ -41087,7 +41104,7 @@ var require_parseurl = __commonJS({
     }
     function fastparse(str2) {
       if (typeof str2 !== "string" || str2.charCodeAt(0) !== 47) {
-        return parse16(str2);
+        return parse15(str2);
       }
       var pathname = str2;
       var query = null;
@@ -41115,7 +41132,7 @@ var require_parseurl = __commonJS({
           /* #  */
           case 160:
           case 65279:
-            return parse16(str2);
+            return parse15(str2);
         }
       }
       var url2 = Url !== void 0 ? new Url() : {};
@@ -50911,7 +50928,7 @@ var require_forwarded = __commonJS({
       if (!req) {
         throw new TypeError("argument req is required");
       }
-      var proxyAddrs = parse16(req.headers["x-forwarded-for"] || "");
+      var proxyAddrs = parse15(req.headers["x-forwarded-for"] || "");
       var socketAddr = getSocketAddr(req);
       var addrs = [socketAddr].concat(proxyAddrs);
       return addrs;
@@ -50919,7 +50936,7 @@ var require_forwarded = __commonJS({
     function getSocketAddr(req) {
       return req.socket ? req.socket.remoteAddress : req.connection.remoteAddress;
     }
-    function parse16(header) {
+    function parse15(header) {
       var end = header.length;
       var list = [];
       var start = header.length;
@@ -51948,7 +51965,7 @@ var require_dist2 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.PathError = exports2.TokenData = void 0;
-    exports2.parse = parse16;
+    exports2.parse = parse15;
     exports2.compile = compile;
     exports2.match = match;
     exports2.pathToRegexp = pathToRegexp;
@@ -51983,7 +52000,7 @@ var require_dist2 = __commonJS({
       }
     };
     exports2.PathError = PathError;
-    function parse16(str2, options = {}) {
+    function parse15(str2, options = {}) {
       const { encodePath = NOOP_VALUE } = options;
       const chars = [...str2];
       const tokens = [];
@@ -52072,7 +52089,7 @@ var require_dist2 = __commonJS({
     }
     function compile(path47, options = {}) {
       const { encode = encodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const data = typeof path47 === "object" ? path47 : parse16(path47, options);
+      const data = typeof path47 === "object" ? path47 : parse15(path47, options);
       const fn = tokensToFunction(data.tokens, delimiter, encode);
       return function path48(params = {}) {
         const [path49, ...missing] = fn(params);
@@ -52173,7 +52190,7 @@ var require_dist2 = __commonJS({
           paths.push(...path48);
           continue;
         }
-        const data = typeof path48 === "object" ? path48 : parse16(path48, options);
+        const data = typeof path48 === "object" ? path48 : parse15(path48, options);
         flatten(data.tokens, 0, [], (tokens) => {
           if (combinations++ >= 256) {
             throw new PathError("Too many path combinations", data.originalPath);
@@ -63498,7 +63515,7 @@ var require_request = __commonJS({
     var http = require("node:http");
     var fresh = require_fresh();
     var parseRange = require_range_parser();
-    var parse16 = require_parseurl();
+    var parse15 = require_parseurl();
     var proxyaddr = require_proxy_addr();
     var req = Object.create(http.IncomingMessage.prototype);
     module2.exports = req;
@@ -63543,7 +63560,7 @@ var require_request = __commonJS({
       if (!queryparse) {
         return /* @__PURE__ */ Object.create(null);
       }
-      var querystring = parse16(this).query;
+      var querystring = parse15(this).query;
       return queryparse(querystring);
     });
     req.is = function is(types) {
@@ -63587,7 +63604,7 @@ var require_request = __commonJS({
       return subdomains2.slice(offset);
     });
     defineGetter(req, "path", function path47() {
-      return parse16(this).pathname;
+      return parse15(this).pathname;
     });
     defineGetter(req, "host", function host() {
       var trust = this.app.get("trust proxy fn");
@@ -63641,7 +63658,7 @@ var require_content_disposition = __commonJS({
   "../../node_modules/content-disposition/index.js"(exports2, module2) {
     "use strict";
     module2.exports = contentDisposition;
-    module2.exports.parse = parse16;
+    module2.exports.parse = parse15;
     var basename5 = require("path").basename;
     var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
     var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/;
@@ -63732,7 +63749,7 @@ var require_content_disposition = __commonJS({
     function getlatin1(val) {
       return String(val).replace(NON_LATIN1_REGEXP, "?");
     }
-    function parse16(string) {
+    function parse15(string) {
       if (!string || typeof string !== "string") {
         throw new TypeError("argument string is required");
       }
@@ -63821,7 +63838,7 @@ var require_cookie_signature = __commonJS({
 var require_cookie = __commonJS({
   "../../node_modules/cookie/index.js"(exports2) {
     "use strict";
-    exports2.parse = parse16;
+    exports2.parse = parse15;
     exports2.serialize = serialize;
     var __toString = Object.prototype.toString;
     var __hasOwnProperty = Object.prototype.hasOwnProperty;
@@ -63829,7 +63846,7 @@ var require_cookie = __commonJS({
     var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
     var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
     var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
-    function parse16(str2, opt) {
+    function parse15(str2, opt) {
       if (typeof str2 !== "string") {
         throw new TypeError("argument str must be a string");
       }
@@ -73985,7 +74002,7 @@ var require_vary = __commonJS({
       if (!field) {
         throw new TypeError("field argument is required");
       }
-      var fields = !Array.isArray(field) ? parse16(String(field)) : field;
+      var fields = !Array.isArray(field) ? parse15(String(field)) : field;
       for (var j = 0; j < fields.length; j++) {
         if (!FIELD_NAME_REGEXP.test(fields[j])) {
           throw new TypeError("field argument contains an invalid header name");
@@ -73995,7 +74012,7 @@ var require_vary = __commonJS({
         return header;
       }
       var val = header;
-      var vals = parse16(header.toLowerCase());
+      var vals = parse15(header.toLowerCase());
       if (fields.indexOf("*") !== -1 || vals.indexOf("*") !== -1) {
         return "*";
       }
@@ -74008,7 +74025,7 @@ var require_vary = __commonJS({
       }
       return val;
     }
-    function parse16(header) {
+    function parse15(header) {
       var end = 0;
       var list = [];
       var start = 0;
@@ -75469,161 +75486,6 @@ var require_dist3 = __commonJS({
   }
 });
 
-// ../ui/dist/server/sops-config.js
-var require_sops_config = __commonJS({
-  "../ui/dist/server/sops-config.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.scaffoldSopsConfig = scaffoldSopsConfig2;
-    var fs28 = __importStar(require("fs"));
-    var path47 = __importStar(require("path"));
-    var YAML15 = __importStar(require_dist());
-    var core_1 = (init_src(), __toCommonJS(src_exports));
-    function scaffoldSopsConfig2(repoRoot, ageKeyFile, ageKey) {
-      const parser = new core_1.ManifestParser();
-      const manifest = parser.parse(path47.join(repoRoot, "clef.yaml"));
-      const sopsYamlPath = path47.join(repoRoot, ".sops.yaml");
-      let agePublicKey;
-      if (manifest.sops.default_backend === "age") {
-        agePublicKey = resolveAgePublicKey(repoRoot, ageKeyFile, ageKey);
-      }
-      const sopsConfig = buildSopsYaml2(manifest, agePublicKey);
-      fs28.writeFileSync(sopsYamlPath, YAML15.stringify(sopsConfig), "utf-8");
-    }
-    function buildSopsYaml2(manifest, agePublicKey) {
-      const creationRules = [];
-      for (const ns of manifest.namespaces) {
-        for (const env of manifest.environments) {
-          const pathRegex = `${ns.name}/${env.name}\\.enc\\.yaml$`;
-          const rule = { path_regex: pathRegex };
-          const backend = env.sops?.backend ?? manifest.sops.default_backend;
-          switch (backend) {
-            case "age": {
-              const envRecipients = (0, core_1.resolveRecipientsForEnvironment)(manifest, env.name);
-              if (envRecipients && envRecipients.length > 0) {
-                const keys = envRecipients.map((r) => typeof r === "string" ? r : r.key);
-                rule.age = keys.join(",");
-              } else if (agePublicKey) {
-                rule.age = agePublicKey;
-              }
-              break;
-            }
-            case "awskms": {
-              const arn = env.sops?.aws_kms_arn ?? manifest.sops.aws_kms_arn;
-              if (arn)
-                rule.kms = arn;
-              break;
-            }
-            case "gcpkms": {
-              const resourceId = env.sops?.gcp_kms_resource_id ?? manifest.sops.gcp_kms_resource_id;
-              if (resourceId)
-                rule.gcp_kms = resourceId;
-              break;
-            }
-            case "azurekv": {
-              const kvUrl = env.sops?.azure_kv_url ?? manifest.sops.azure_kv_url;
-              if (kvUrl)
-                rule.azure_keyvault = kvUrl;
-              break;
-            }
-            case "pgp": {
-              const fingerprint = env.sops?.pgp_fingerprint ?? manifest.sops.pgp_fingerprint;
-              if (fingerprint)
-                rule.pgp = fingerprint;
-              break;
-            }
-          }
-          creationRules.push(rule);
-        }
-      }
-      return { creation_rules: creationRules };
-    }
-    function resolveAgePublicKey(repoRoot, ageKeyFile, ageKey) {
-      if (ageKeyFile) {
-        const pubKey = extractAgePublicKey2(ageKeyFile);
-        if (pubKey)
-          return pubKey;
-      }
-      if (ageKey) {
-        const match = ageKey.match(/# public key: (age1[a-z0-9]+)/);
-        if (match)
-          return match[1];
-      }
-      if (process.env.CLEF_AGE_KEY_FILE) {
-        const pubKey = extractAgePublicKey2(process.env.CLEF_AGE_KEY_FILE);
-        if (pubKey)
-          return pubKey;
-      }
-      if (process.env.CLEF_AGE_KEY) {
-        const match = process.env.CLEF_AGE_KEY.match(/# public key: (age1[a-z0-9]+)/);
-        if (match)
-          return match[1];
-      }
-      const clefConfigPath = path47.join(repoRoot, ".clef", "config.yaml");
-      if (fs28.existsSync(clefConfigPath)) {
-        try {
-          const config = YAML15.parse(fs28.readFileSync(clefConfigPath, "utf-8"));
-          if (config?.age_key_file) {
-            const pubKey = extractAgePublicKey2(config.age_key_file);
-            if (pubKey)
-              return pubKey;
-          }
-        } catch {
-        }
-      }
-      return void 0;
-    }
-    function extractAgePublicKey2(keyFilePath) {
-      try {
-        if (!fs28.existsSync(keyFilePath))
-          return void 0;
-        const content = fs28.readFileSync(keyFilePath, "utf-8");
-        const match = content.match(/# public key: (age1[a-z0-9]+)/);
-        return match ? match[1] : void 0;
-      } catch {
-        return void 0;
-      }
-    }
-  }
-});
-
 // ../ui/dist/server/api.js
 var require_api = __commonJS({
   "../ui/dist/server/api.js"(exports2) {
@@ -75673,7 +75535,6 @@ var require_api = __commonJS({
     var express_1 = require_express2();
     var _useStdinFifo = process.platform === "linux" && !process.env.JEST_WORKER_ID;
     var core_1 = (init_src(), __toCommonJS(src_exports));
-    var sops_config_1 = require_sops_config();
     function createApiRouter(deps2) {
       const router = (0, express_1.Router)();
       const parser = new core_1.ManifestParser();
@@ -75686,7 +75547,7 @@ var require_api = __commonJS({
             return deps2.runner.run(cmd, args, {
               ...opts,
               cwd: opts?.cwd ?? deps2.repoRoot,
-              env: { SOPS_CONFIG: path47.join(deps2.repoRoot, ".sops.yaml"), ...opts?.env }
+              env: opts?.env
             });
           }
           const fifoDir = (0, child_process_1.execFileSync)("mktemp", ["-d", path47.join(os4.tmpdir(), "clef-fifo-XXXXXX")]).toString().trim();
@@ -75925,6 +75786,29 @@ var require_api = __commonJS({
           res.status(500).json({ error: "Failed to delete key", code: "DELETE_ERROR" });
         }
       });
+      router.post("/namespace/:ns/:env/:key/accept", async (req, res) => {
+        setNoCacheHeaders(res);
+        try {
+          const manifest = loadManifest();
+          const { ns, env, key } = req.params;
+          const nsExists = manifest.namespaces.some((n) => n.name === ns);
+          const envExists = manifest.environments.some((e) => e.name === env);
+          if (!nsExists || !envExists) {
+            res.status(404).json({
+              error: `Namespace '${ns}' or environment '${env}' not found in manifest.`,
+              code: "NOT_FOUND"
+            });
+            return;
+          }
+          const filePath = `${deps2.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+          const decrypted = await sops.decrypt(filePath);
+          const value = key in decrypted.values ? String(decrypted.values[key]) : void 0;
+          await (0, core_1.markResolved)(filePath, [key]);
+          res.json({ success: true, key, value });
+        } catch {
+          res.status(500).json({ error: "Failed to accept pending value", code: "ACCEPT_ERROR" });
+        }
+      });
       router.post("/copy", async (req, res) => {
         try {
           const manifest = loadManifest();
@@ -76442,9 +76326,7 @@ var require_api = __commonJS({
             return;
           }
           const events = [];
-          const result = await backendMigrator.migrate(manifest, deps2.repoRoot, { target, environment, dryRun: true }, {
-            regenerateSopsConfig: () => (0, sops_config_1.scaffoldSopsConfig)(deps2.repoRoot, deps2.ageKeyFile, deps2.ageKey)
-          }, (event) => events.push(event));
+          const result = await backendMigrator.migrate(manifest, deps2.repoRoot, { target, environment, dryRun: true }, (event) => events.push(event));
           res.json({ success: !result.rolledBack, result, events });
         } catch (err) {
           const message = err instanceof Error ? err.message : "Migration preview failed";
@@ -76470,9 +76352,7 @@ var require_api = __commonJS({
             return;
           }
           const events = [];
-          const result = await backendMigrator.migrate(manifest, deps2.repoRoot, { target, environment, dryRun: false }, {
-            regenerateSopsConfig: () => (0, sops_config_1.scaffoldSopsConfig)(deps2.repoRoot, deps2.ageKeyFile, deps2.ageKey)
-          }, (event) => events.push(event));
+          const result = await backendMigrator.migrate(manifest, deps2.repoRoot, { target, environment, dryRun: false }, (event) => events.push(event));
           res.json({ success: !result.rolledBack, result, events });
         } catch (err) {
           const message = err instanceof Error ? err.message : "Migration failed";
@@ -77336,7 +77216,7 @@ var require_artifact_decryptor = __commonJS({
         } finally {
           plaintext = "";
         }
-        return { values, keys: artifact.keys, revision: artifact.revision };
+        return { values, keys: Object.keys(values), revision: artifact.revision };
       }
       /** KMS envelope: unwrap DEK via KMS, then AES-256-GCM decrypt. */
       async decryptKmsEnvelope(artifact) {
@@ -77437,14 +77317,13 @@ var require_signature = __commonJS({
     var crypto6 = __importStar(require("crypto"));
     function buildSigningPayload2(artifact) {
       const fields = [
-        "clef-sig-v2",
+        "clef-sig-v3",
         String(artifact.version),
         artifact.identity,
         artifact.environment,
         artifact.revision,
         artifact.packedAt,
         artifact.ciphertextHash,
-        [...artifact.keys].sort().join(","),
         artifact.expiresAt ?? "",
         artifact.envelope?.provider ?? "",
         artifact.envelope?.keyId ?? "",
@@ -77577,7 +77456,6 @@ var require_poller = __commonJS({
         this.options.onRefresh?.(artifact.revision);
         this.telemetry?.artifactRefreshed({
           revision: artifact.revision,
-          keyCount: artifact.keys.length,
           kmsEnvelope: !!artifact.envelope
         });
       }
@@ -77734,14 +77612,15 @@ var require_poller = __commonJS({
         if (artifact.revision === this.lastRevision)
           return;
         const { values } = await this.decryptor.decrypt(artifact);
-        this.options.cache.swap(values, artifact.keys, artifact.revision);
+        const keys = Object.keys(values);
+        this.options.cache.swap(values, keys, artifact.revision);
         this.lastRevision = artifact.revision;
         this.lastContentHash = contentHash ?? null;
         this.lastExpiresAt = artifact.expiresAt ?? null;
         this.options.onRefresh?.(artifact.revision);
         this.telemetry?.artifactRefreshed({
           revision: artifact.revision,
-          keyCount: artifact.keys.length,
+          keyCount: keys.length,
           kmsEnvelope: !!artifact.envelope
         });
       }
@@ -77864,10 +77743,6 @@ var require_encrypted_artifact_store = __commonJS({
       getStoredAt() {
         return this._storedAt;
       }
-      /** Get key names from the stored artifact metadata (no decryption needed). */
-      getKeys() {
-        return this.artifact ? [...this.artifact.keys] : [];
-      }
       /** Get the revision from the stored artifact. */
       getRevision() {
         return this.artifact?.revision ?? null;
@@ -78349,12 +78224,228 @@ var require_vcs2 = __commonJS({
   }
 });
 
+// ../runtime/dist/sources/s3.js
+var require_s3 = __commonJS({
+  "../runtime/dist/sources/s3.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.S3ArtifactSource = void 0;
+    exports2.isS3Url = isS3Url;
+    var crypto6 = __importStar(require("crypto"));
+    function isS3Url(url) {
+      return parseS3UrlSafe(url) !== null;
+    }
+    function parseS3Url(url) {
+      const loc = parseS3UrlSafe(url);
+      if (!loc)
+        throw new Error(`Not a valid S3 URL: ${url}`);
+      return loc;
+    }
+    function parseS3UrlSafe(url) {
+      let u;
+      try {
+        u = new URL(url);
+      } catch {
+        return null;
+      }
+      if (u.protocol !== "https:")
+        return null;
+      const host = u.hostname;
+      const key = u.pathname.slice(1);
+      if (!key)
+        return null;
+      const vhMatch = host.match(/^(.+)\.s3\.([a-z0-9-]+)\.amazonaws\.com$/) ?? host.match(/^(.+)\.s3\.amazonaws\.com$/);
+      if (vhMatch) {
+        return { bucket: vhMatch[1], key, region: vhMatch[2] || "us-east-1" };
+      }
+      const psMatch = host.match(/^s3\.([a-z0-9-]+)\.amazonaws\.com$/) ?? host.match(/^s3\.amazonaws\.com$/);
+      if (psMatch) {
+        const slashIdx = key.indexOf("/");
+        if (slashIdx < 0)
+          return null;
+        return {
+          bucket: key.slice(0, slashIdx),
+          key: key.slice(slashIdx + 1),
+          region: psMatch[1] || "us-east-1"
+        };
+      }
+      return null;
+    }
+    var S3ArtifactSource = class {
+      url;
+      location;
+      cachedCredentials = null;
+      constructor(url) {
+        this.url = url;
+        this.location = parseS3Url(url);
+      }
+      async fetch() {
+        const creds = await this.resolveCredentials();
+        const { bucket, key, region } = this.location;
+        const host = `${bucket}.s3.${region}.amazonaws.com`;
+        const path47 = `/${encodeS3Key(key)}`;
+        const now = /* @__PURE__ */ new Date();
+        const headers = signS3GetRequest(host, path47, region, creds, now);
+        const res = await globalThis.fetch(`https://${host}${path47}`, { headers });
+        if (!res.ok) {
+          throw new Error(`Failed to fetch artifact from ${this.describe()}: ${res.status} ${res.statusText}`);
+        }
+        const raw = await res.text();
+        const etag = res.headers.get("etag") ?? void 0;
+        return { raw, contentHash: etag };
+      }
+      describe() {
+        const { bucket, key } = this.location;
+        return `S3 s3://${bucket}/${key}`;
+      }
+      async resolveCredentials() {
+        if (this.cachedCredentials && Date.now() < this.cachedCredentials.expiresAt - 3e5) {
+          return this.cachedCredentials.creds;
+        }
+        const relativeUri = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+        if (relativeUri) {
+          return this.fetchEcsCredentials(`http://169.254.170.2${relativeUri}`);
+        }
+        const fullUri = process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+        if (fullUri) {
+          return this.fetchEcsCredentials(fullUri);
+        }
+        const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+        const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+        if (accessKeyId && secretAccessKey) {
+          return {
+            accessKeyId,
+            secretAccessKey,
+            sessionToken: process.env.AWS_SESSION_TOKEN
+          };
+        }
+        throw new Error("No AWS credentials found. Set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or run in ECS/Fargate with a task role.");
+      }
+      async fetchEcsCredentials(endpoint) {
+        const headers = {};
+        const authToken = process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN;
+        if (authToken) {
+          headers["Authorization"] = authToken;
+        }
+        const res = await globalThis.fetch(endpoint, { headers });
+        if (!res.ok) {
+          throw new Error(`Failed to fetch ECS credentials: ${res.status} ${res.statusText}`);
+        }
+        const data = await res.json();
+        const creds = {
+          accessKeyId: data.AccessKeyId,
+          secretAccessKey: data.SecretAccessKey,
+          sessionToken: data.Token
+        };
+        if (data.Expiration) {
+          this.cachedCredentials = {
+            creds,
+            expiresAt: new Date(data.Expiration).getTime()
+          };
+        }
+        return creds;
+      }
+    };
+    exports2.S3ArtifactSource = S3ArtifactSource;
+    function hmacSha256(key, data) {
+      return crypto6.createHmac("sha256", key).update(data, "utf-8").digest();
+    }
+    function sha256Hex(data) {
+      return crypto6.createHash("sha256").update(data, "utf-8").digest("hex");
+    }
+    function toAmzDate(date) {
+      return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+    }
+    function toDateStamp(date) {
+      return toAmzDate(date).slice(0, 8);
+    }
+    function encodeS3Key(key) {
+      return key.split("/").map((s) => encodeURIComponent(s)).join("/");
+    }
+    function signS3GetRequest(host, path47, region, creds, now) {
+      const amzDate = toAmzDate(now);
+      const dateStamp = toDateStamp(now);
+      const service = "s3";
+      const scope = `${dateStamp}/${region}/${service}/aws4_request`;
+      const headers = {
+        host,
+        "x-amz-date": amzDate,
+        "x-amz-content-sha256": "UNSIGNED-PAYLOAD"
+      };
+      if (creds.sessionToken) {
+        headers["x-amz-security-token"] = creds.sessionToken;
+      }
+      const signedHeaderKeys = Object.keys(headers).sort();
+      const signedHeaders = signedHeaderKeys.join(";");
+      const canonicalHeaders = signedHeaderKeys.map((k) => `${k}:${headers[k]}
+`).join("");
+      const canonicalRequest = [
+        "GET",
+        path47,
+        "",
+        // no query string
+        canonicalHeaders,
+        signedHeaders,
+        "UNSIGNED-PAYLOAD"
+      ].join("\n");
+      const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256Hex(canonicalRequest)].join("\n");
+      const kDate = hmacSha256(`AWS4${creds.secretAccessKey}`, dateStamp);
+      const kRegion = hmacSha256(kDate, region);
+      const kService = hmacSha256(kRegion, service);
+      const kSigning = hmacSha256(kService, "aws4_request");
+      const signature = hmacSha256(kSigning, stringToSign).toString("hex");
+      const authorization = `AWS4-HMAC-SHA256 Credential=${creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+      return {
+        ...headers,
+        Authorization: authorization
+      };
+    }
+  }
+});
+
 // ../runtime/dist/index.js
 var require_dist4 = __commonJS({
   "../runtime/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ClefRuntime = exports2.verifySignature = exports2.buildSigningPayload = exports2.VcsArtifactSource = exports2.FileArtifactSource = exports2.HttpArtifactSource = exports2.createKmsProvider = exports2.AwsKmsProvider = exports2.createVcsProvider = exports2.BitbucketProvider = exports2.GitLabProvider = exports2.GitHubProvider = exports2.TelemetryEmitter = exports2.EncryptedArtifactStore = exports2.ArtifactDecryptor = exports2.ArtifactPoller = exports2.AgeDecryptor = exports2.DiskCache = exports2.SecretsCache = void 0;
+    exports2.ClefRuntime = exports2.verifySignature = exports2.buildSigningPayload = exports2.isS3Url = exports2.S3ArtifactSource = exports2.VcsArtifactSource = exports2.FileArtifactSource = exports2.HttpArtifactSource = exports2.createKmsProvider = exports2.AwsKmsProvider = exports2.createVcsProvider = exports2.BitbucketProvider = exports2.GitLabProvider = exports2.GitHubProvider = exports2.TelemetryEmitter = exports2.EncryptedArtifactStore = exports2.ArtifactDecryptor = exports2.ArtifactPoller = exports2.AgeDecryptor = exports2.DiskCache = exports2.SecretsCache = void 0;
     exports2.init = init;
     var secrets_cache_1 = require_secrets_cache();
     Object.defineProperty(exports2, "SecretsCache", { enumerable: true, get: function() {
@@ -78420,6 +78511,13 @@ var require_dist4 = __commonJS({
     Object.defineProperty(exports2, "VcsArtifactSource", { enumerable: true, get: function() {
       return vcs_1.VcsArtifactSource;
     } });
+    var s3_1 = require_s3();
+    Object.defineProperty(exports2, "S3ArtifactSource", { enumerable: true, get: function() {
+      return s3_1.S3ArtifactSource;
+    } });
+    Object.defineProperty(exports2, "isS3Url", { enumerable: true, get: function() {
+      return s3_1.isS3Url;
+    } });
     var signature_1 = require_signature();
     Object.defineProperty(exports2, "buildSigningPayload", { enumerable: true, get: function() {
       return signature_1.buildSigningPayload;
@@ -78435,6 +78533,7 @@ var require_dist4 = __commonJS({
     var vcs_2 = require_vcs2();
     var http_2 = require_http();
     var file_2 = require_file();
+    var s3_2 = require_s3();
     var ClefRuntime = class {
       cache = new secrets_cache_2.SecretsCache();
       poller;
@@ -78528,6 +78627,9 @@ var require_dist4 = __commonJS({
           return new vcs_2.VcsArtifactSource(provider, config.identity, config.environment);
         }
         if (config.source) {
+          if ((0, s3_2.isS3Url)(config.source)) {
+            return new s3_2.S3ArtifactSource(config.source);
+          }
           if (config.source.startsWith("http://") || config.source.startsWith("https://")) {
             return new http_2.HttpArtifactSource(config.source);
           }
@@ -79460,12 +79562,6 @@ async function handleFullSetup(repoRoot, manifestPath, clefConfigPath, deps2, op
   }
   fs18.writeFileSync(manifestPath, YAML12.stringify(manifestDoc), "utf-8");
   formatter.success("Created clef.yaml");
-  {
-    const sopsYamlPath = path21.join(repoRoot, ".sops.yaml");
-    const sopsConfig = buildSopsYaml(manifest, repoRoot, publicKey);
-    fs18.writeFileSync(sopsYamlPath, YAML12.stringify(sopsConfig), "utf-8");
-    formatter.success("Created .sops.yaml");
-  }
   const sopsClient = new SopsClient(deps2.runner, ageKeyFile, ageKey);
   const matrixManager = new MatrixManager();
   const cells = matrixManager.resolveMatrix(manifest, repoRoot);
@@ -79543,102 +79639,6 @@ async function handleFullSetup(repoRoot, manifestPath, clefConfigPath, deps2, op
   formatter.hint("clef lint  \u2014 check repo health");
   formatter.hint("clef ui    \u2014 open the web UI");
 }
-function scaffoldSopsConfig(repoRoot) {
-  const manifestPath = path21.join(repoRoot, "clef.yaml");
-  const parser = new ManifestParser();
-  const manifest = parser.parse(manifestPath);
-  const sopsYamlPath = path21.join(repoRoot, ".sops.yaml");
-  let agePublicKey;
-  if (manifest.sops.default_backend === "age") {
-    agePublicKey = resolveAgePublicKeyFromEnvOrFile(repoRoot);
-  }
-  const sopsConfig = buildSopsYaml(manifest, repoRoot, agePublicKey);
-  fs18.writeFileSync(sopsYamlPath, YAML12.stringify(sopsConfig), "utf-8");
-}
-function buildSopsYaml(manifest, _repoRoot, agePublicKey) {
-  const creationRules = [];
-  for (const ns of manifest.namespaces) {
-    for (const env of manifest.environments) {
-      const pathRegex = `${ns.name}/${env.name}\\.enc\\.yaml$`;
-      const rule = { path_regex: pathRegex };
-      const backend = env.sops?.backend ?? manifest.sops.default_backend;
-      switch (backend) {
-        case "age": {
-          const envRecipients = resolveRecipientsForEnvironment(manifest, env.name);
-          if (envRecipients && envRecipients.length > 0) {
-            const keys = envRecipients.map((r) => typeof r === "string" ? r : r.key);
-            rule.age = keys.join(",");
-          } else if (agePublicKey) {
-            rule.age = agePublicKey;
-          }
-          break;
-        }
-        case "awskms": {
-          const arn = env.sops?.aws_kms_arn ?? manifest.sops.aws_kms_arn;
-          if (arn) {
-            rule.kms = arn;
-          }
-          break;
-        }
-        case "gcpkms": {
-          const resourceId = env.sops?.gcp_kms_resource_id ?? manifest.sops.gcp_kms_resource_id;
-          if (resourceId) {
-            rule.gcp_kms = resourceId;
-          }
-          break;
-        }
-        case "azurekv": {
-          const kvUrl = env.sops?.azure_kv_url ?? manifest.sops.azure_kv_url;
-          if (kvUrl) {
-            rule.azure_keyvault = kvUrl;
-          }
-          break;
-        }
-        case "pgp": {
-          const fingerprint = env.sops?.pgp_fingerprint ?? manifest.sops.pgp_fingerprint;
-          if (fingerprint) {
-            rule.pgp = fingerprint;
-          }
-          break;
-        }
-      }
-      creationRules.push(rule);
-    }
-  }
-  return { creation_rules: creationRules };
-}
-function resolveAgePublicKeyFromEnvOrFile(repoRoot) {
-  if (process.env.CLEF_AGE_KEY_FILE) {
-    const pubKey = extractAgePublicKey(process.env.CLEF_AGE_KEY_FILE);
-    if (pubKey) return pubKey;
-  }
-  if (process.env.CLEF_AGE_KEY) {
-    const match = process.env.CLEF_AGE_KEY.match(/# public key: (age1[a-z0-9]+)/);
-    if (match) return match[1];
-  }
-  const clefConfigPath = path21.join(repoRoot, CLEF_DIR, CLEF_CONFIG_FILENAME);
-  if (fs18.existsSync(clefConfigPath)) {
-    try {
-      const config = YAML12.parse(fs18.readFileSync(clefConfigPath, "utf-8"));
-      if (config?.age_key_file) {
-        const pubKey = extractAgePublicKey(config.age_key_file);
-        if (pubKey) return pubKey;
-      }
-    } catch {
-    }
-  }
-  return void 0;
-}
-function extractAgePublicKey(keyFilePath) {
-  try {
-    if (!fs18.existsSync(keyFilePath)) return void 0;
-    const content = fs18.readFileSync(keyFilePath, "utf-8");
-    const match = content.match(/# public key: (age1[a-z0-9]+)/);
-    return match ? match[1] : void 0;
-  } catch {
-    return void 0;
-  }
-}
 async function scaffoldRandomValues(ns, manifest, schemaValidator, sopsClient, repoRoot, includeOptional, addCount) {
   let schema;
   try {
@@ -80553,7 +80553,7 @@ async function fetchCheckpoint(config) {
 }
 
 // package.json
-var version = "0.1.11-beta.62";
+var version = "0.1.11-beta.66";
 var package_default = {
   name: "@clef-sh/cli",
   version,
@@ -81108,15 +81108,11 @@ Usage: clef export payments/production --format env`
 // src/commands/doctor.ts
 var fs21 = __toESM(require("fs"));
 var path34 = __toESM(require("path"));
-var YAML14 = __toESM(require_dist());
 init_src();
 function registerDoctorCommand(program3, deps2) {
   program3.command("doctor").description(
     "Check your environment for required dependencies and configuration.\n\nExit codes:\n  0  All checks pass\n  1  One or more checks failed"
-  ).option("--json", "Output the full status as JSON").option(
-    "--fix",
-    "Attempt to auto-fix issues (runs clef init if .sops.yaml is the only failure)"
-  ).action(async (options) => {
+  ).option("--json", "Output the full status as JSON").option("--fix", "Attempt to auto-fix issues").action(async (options) => {
     const repoRoot = program3.opts().dir || process.cwd();
     const clefVersion = program3.version() ?? "unknown";
     const checks = [];
@@ -81167,14 +81163,6 @@ function registerDoctorCommand(program3, deps2) {
     });
     const ageKeyResult = await checkAgeKey(repoRoot, deps2.runner);
     checks.push(ageKeyResult);
-    const sopsYamlPath = path34.join(repoRoot, ".sops.yaml");
-    const sopsYamlFound = fs21.existsSync(sopsYamlPath);
-    checks.push({
-      name: ".sops.yaml",
-      ok: sopsYamlFound,
-      detail: sopsYamlFound ? "found" : "not found",
-      hint: sopsYamlFound ? void 0 : "run: clef init"
-    });
     const clefignorePath = path34.join(repoRoot, ".clefignore");
     const clefignoreFound = fs21.existsSync(clefignorePath);
     let clefignoreRuleCount = 0;
@@ -81207,25 +81195,7 @@ function registerDoctorCommand(program3, deps2) {
     });
     if (options.fix) {
       const failures2 = checks.filter((c) => !c.ok);
-      const onlySopsYamlMissing = failures2.length === 1 && failures2[0].name === ".sops.yaml" && !sopsYamlFound;
-      if (onlySopsYamlMissing) {
-        formatter.info("Attempting to fix: generating .sops.yaml from manifest...");
-        try {
-          scaffoldSopsConfig(repoRoot);
-          const nowFound = fs21.existsSync(sopsYamlPath);
-          if (nowFound) {
-            const sopsYamlCheck = checks.find((c) => c.name === ".sops.yaml");
-            if (sopsYamlCheck) {
-              sopsYamlCheck.ok = true;
-              sopsYamlCheck.detail = "found (fixed)";
-              delete sopsYamlCheck.hint;
-            }
-            formatter.success(".sops.yaml created from manifest.");
-          }
-        } catch {
-          formatter.error("Failed to generate .sops.yaml. Run 'clef init' manually to diagnose.");
-        }
-      } else if (failures2.length > 0) {
+      if (failures2.length > 0) {
         formatter.warn("--fix cannot resolve these issues automatically.");
       }
     }
@@ -81247,14 +81217,8 @@ function registerDoctorCommand(program3, deps2) {
         manifest: { found: manifestFound, ok: manifestFound },
         ageKey: {
           source: ageKeyResult.source,
-          recipients: countAgeRecipients(sopsYamlPath),
           ok: ageKeyResult.ok
         },
-        sopsYaml: {
-          found: checks.find((c) => c.name === ".sops.yaml").ok,
-          ok: checks.find((c) => c.name === ".sops.yaml").ok,
-          ...!checks.find((c) => c.name === ".sops.yaml").ok ? { fix: "clef init" } : {}
-        },
         scanner: {
           clefignoreFound: checks.find((c) => c.name === "scanner")?.ok ?? false,
           ok: checks.find((c) => c.name === "scanner")?.ok ?? false
@@ -81353,30 +81317,6 @@ async function checkAgeKey(repoRoot, runner2) {
       };
   }
 }
-function countAgeRecipients(sopsYamlPath) {
-  try {
-    if (!fs21.existsSync(sopsYamlPath)) return 0;
-    const content = fs21.readFileSync(sopsYamlPath, "utf-8");
-    const config = YAML14.parse(content);
-    if (!config?.creation_rules || !Array.isArray(config.creation_rules)) {
-      return 0;
-    }
-    const recipients = /* @__PURE__ */ new Set();
-    for (const rule of config.creation_rules) {
-      if (typeof rule.age === "string") {
-        for (const r of rule.age.split(",")) {
-          const trimmed = r.trim();
-          if (trimmed) {
-            recipients.add(trimmed);
-          }
-        }
-      }
-    }
-    return recipients.size;
-  } catch {
-    return 0;
-  }
-}
 function getSopsInstallHint() {
   if (process.platform === "darwin") return "brew install sops";
   return "see https://github.com/getsops/sops/releases";
@@ -83239,7 +83179,7 @@ function resolveTarget(opts) {
 }
 function registerMigrateBackendCommand(program3, deps2) {
   program3.command("migrate-backend").description(
-    "Migrate encrypted files from one SOPS backend to another.\n\n  Decrypts each file with the current backend, re-encrypts with\n  the new one, updates clef.yaml, and regenerates .sops.yaml.\n\nExit codes:\n  0  migration completed successfully\n  1  migration failed (all changes rolled back)"
+    "Migrate encrypted files from one SOPS backend to another.\n\n  Decrypts each file with the current backend, re-encrypts with\n  the new one, and updates clef.yaml.\n\nExit codes:\n  0  migration completed successfully\n  1  migration failed (all changes rolled back)"
   ).option("--aws-kms-arn <arn>", "Migrate to AWS KMS with this key ARN").option("--gcp-kms-resource-id <id>", "Migrate to GCP KMS with this resource ID").option("--azure-kv-url <url>", "Migrate to Azure Key Vault with this URL").option("--pgp-fingerprint <fp>", "Migrate to PGP with this fingerprint").option("--age", "Migrate to age backend").option("-e, --environment <env>", "Scope migration to a single environment").option("--dry-run", "Preview changes without modifying any files").option("--skip-verify", "Skip post-migration verification step").action(async (opts) => {
     try {
       const repoRoot = program3.opts().dir || process.cwd();
@@ -83287,7 +83227,6 @@ ${sym("working")}  Backend migration summary:`);
           dryRun: opts.dryRun,
           skipVerify: opts.skipVerify
         },
-        { regenerateSopsConfig: () => scaffoldSopsConfig(repoRoot) },
         (event) => {
           switch (event.type) {
             case "skip":
@@ -83336,7 +83275,7 @@ ${sym("working")}  Backend migration summary:`);
       }
       if (!opts.dryRun && result.migratedFiles.length > 0) {
         formatter.hint(
-          'git add clef.yaml .sops.yaml secrets/ && git commit -m "chore: migrate backend to ' + target.backend + '"'
+          'git add clef.yaml secrets/ && git commit -m "chore: migrate backend to ' + target.backend + '"'
         );
       }
     } catch (err) {