@clef-sh/cloud 0.1.18-beta.85

package/dist/resolver.d.ts

@@ -0,0 +1,24 @@
+export type KeyserviceSource = "env" | "bundled" | "system";
+export interface KeyserviceResolution {
+    /** Absolute path to the keyservice binary, or "clef-keyservice" for system PATH fallback. */
+    path: string;
+    /** How the binary was located. */
+    source: KeyserviceSource;
+}
+/**
+ * Resolve the clef-keyservice binary path.
+ *
+ * Resolution order:
+ *   1. `CLEF_KEYSERVICE_PATH` env var — explicit override, used as-is
+ *   2. Bundled `@clef-sh/keyservice-{platform}-{arch}` package
+ *   3. System PATH fallback — returns bare `"clef-keyservice"`
+ *
+ * The result is cached module-wide. Call {@link resetKeyserviceResolution} in tests
+ * to clear the cache.
+ */
+export declare function resolveKeyservicePath(): KeyserviceResolution;
+/**
+ * Clear the cached resolution. Only intended for use in tests.
+ */
+export declare function resetKeyserviceResolution(): void;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAwB5D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}

package/dist/sops.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Cloud-aware SopsClient factory.
+ *
+ * Spawns the keyservice sidecar and creates a SopsClient with the keyservice
+ * address for cloud backend decrypt/encrypt operations.
+ */
+import { SopsClient, SubprocessRunner } from "@clef-sh/core";
+export interface CloudSopsResult {
+    client: SopsClient;
+    cleanup: () => Promise<void>;
+}
+export type CreateSopsClientFn = (repoRoot: string, runner: SubprocessRunner, keyserviceAddr?: string) => Promise<SopsClient>;
+/**
+ * Resolve a fresh Cognito access token.
+ *
+ * Priority:
+ *   1. CLEF_CLOUD_REFRESH_TOKEN env var (CI)
+ *   2. ~/.clef/credentials.yaml refreshToken (interactive)
+ *
+ * If a cached access token exists and hasn't expired, returns it.
+ * Otherwise refreshes via the Cognito token endpoint.
+ */
+export declare function resolveAccessToken(): Promise<{
+    accessToken: string;
+    endpoint?: string;
+}>;
+/**
+ * Create a SopsClient backed by the cloud keyservice sidecar.
+ *
+ * @param repoRoot - Repository root directory.
+ * @param runner - Subprocess runner for SOPS invocations.
+ * @param createSopsClient - Factory function from the CLI to create a SopsClient
+ *   (handles age credential resolution).
+ */
+export declare function createCloudSopsClient(repoRoot: string, runner: SubprocessRunner, createSopsClient: CreateSopsClientFn): Promise<CloudSopsResult>;
+//# sourceMappingURL=sops.d.ts.map

package/dist/sops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../src/sops.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAM7D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,gBAAgB,EACxB,cAAc,CAAC,EAAE,MAAM,KACpB,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0C9F;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,gBAAgB,EACxB,gBAAgB,EAAE,kBAAkB,GACnC,OAAO,CAAC,eAAe,CAAC,CAe1B"}

package/dist/token-refresh.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Cognito token refresh via the OAuth2 token endpoint.
+ *
+ * Uses plain HTTP — no AWS SDK dependency. The Cognito token endpoint
+ * accepts refresh tokens and returns fresh access tokens.
+ */
+export interface TokenRefreshConfig {
+    cognitoDomain: string;
+    clientId: string;
+    refreshToken: string;
+}
+export interface TokenRefreshResult {
+    accessToken: string;
+    idToken: string;
+    expiresIn: number;
+}
+/**
+ * Refresh a Cognito access token using a refresh token.
+ *
+ * Calls the Cognito OAuth2 token endpoint directly:
+ *   POST https://<domain>.auth.<region>.amazoncognito.com/oauth2/token
+ *
+ * @returns Fresh access token, ID token, and expiry (seconds).
+ * @throws If the refresh token is expired or invalid.
+ */
+export declare function refreshAccessToken(config: TokenRefreshConfig): Promise<TokenRefreshResult>;
+//# sourceMappingURL=token-refresh.d.ts.map

package/dist/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../src/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqChG"}

package/dist/types.d.ts

@@ -0,0 +1,96 @@
+/** User-scoped Cloud credentials stored in ~/.clef/credentials.yaml. */
+export interface ClefCloudCredentials {
+    /** Cognito refresh token — long-lived, auto-refreshed to get access tokens. */
+    refreshToken: string;
+    /** Cached Cognito access token — short-lived, refreshed as needed. */
+    accessToken?: string;
+    /** Epoch ms when the cached access token expires. */
+    accessTokenExpiry?: number;
+    /** Cloud API endpoint override. Defaults to https://api.clef.sh. */
+    endpoint?: string;
+    /** Cognito OAuth2 domain for token refresh (e.g. https://clefcloud-123.auth.us-east-1.amazoncognito.com). */
+    cognitoDomain?: string;
+    /** Cognito CLI app client ID. */
+    clientId?: string;
+}
+/** Health status for a single matrix cell in a cloud report. */
+export type CloudCellHealthStatus = "healthy" | "warning" | "critical" | "unknown";
+/** A single cell summary sent to the Cloud API. */
+export interface CloudReportCell {
+    namespace: string;
+    environment: string;
+    healthStatus: CloudCellHealthStatus;
+    description: string;
+}
+/** Summary section of a cloud API report. */
+export interface CloudReportSummary {
+    filesScanned: number;
+    namespaces: string[];
+    environments: string[];
+    cells: CloudReportCell[];
+    violations: number;
+    passed: boolean;
+}
+/** Drift entry for a single namespace in a cloud report. */
+export interface CloudReportDrift {
+    namespace: string;
+    isDrifted: boolean;
+    driftCount: number;
+}
+/** A single policy result in a cloud report. */
+export interface CloudPolicyResult {
+    ruleId: string;
+    ruleName: string;
+    passed: boolean;
+    severity: string;
+    message: string;
+    scope?: {
+        namespace?: string;
+        environment?: string;
+    };
+}
+/** CI context attached to cloud reports when collectCIContext is enabled. */
+export interface CloudCIContext {
+    provider: string;
+    pipelineUrl?: string;
+    trigger?: string;
+}
+/** The report payload sent to the Cloud API. */
+export interface CloudApiReport {
+    commitSha: string;
+    branch: string;
+    commitTimestamp: number;
+    cliVersion: string;
+    summary: CloudReportSummary;
+    drift: CloudReportDrift[];
+    policyResults: CloudPolicyResult[];
+    ciContext?: CloudCIContext;
+}
+/** Batch payload for backfill submissions (max 500, oldest→newest). */
+export interface CloudBatchPayload {
+    reports: CloudApiReport[];
+}
+/** Response from GET /api/v1/integrations/:integrationId. */
+export interface CloudIntegrationResponse {
+    lastCommitSha: string | null;
+    config: {
+        collectCIContext: boolean;
+    };
+}
+/** Response from POST /api/v1/reports. */
+export interface CloudReportResponse {
+    id: string;
+    commitSha: string;
+}
+/** Response from POST /api/v1/reports/batch. */
+export interface CloudBatchResponse {
+    accepted: number;
+    reportIds: string[];
+}
+/** Thrown when a Cloud API request fails. */
+export declare class CloudApiError extends Error {
+    readonly statusCode: number;
+    readonly fix?: string | undefined;
+    constructor(message: string, statusCode: number, fix?: string | undefined);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnF,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,qBAAqB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,6DAA6D;AAC7D,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE;QACN,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAED,0CAA0C;AAC1C,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,6CAA6C;AAC7C,qBAAa,aAAc,SAAQ,KAAK;aAGpB,UAAU,EAAE,MAAM;aAClB,GAAG,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,MAAM,YAAA;CAK/B"}

package/package.json

@@ -0,0 +1,95 @@
+{
+  "name": "@clef-sh/cloud",
+  "version": "0.1.18-beta.85",
+  "description": "Clef Cloud integration — managed KMS, device-flow auth, artifact hosting",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/clef-sh/clef",
+    "directory": "packages/cloud"
+  },
+  "main": "dist/index.js",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./cli": {
+      "import": {
+        "types": "./dist/cli.d.mts",
+        "default": "./dist/cli.mjs"
+      },
+      "require": {
+        "types": "./dist/cli.d.ts",
+        "default": "./dist/cli.js"
+      }
+    },
+    "./ui": {
+      "import": {
+        "types": "./dist/ui/index.d.mts",
+        "default": "./dist/ui/index.mjs"
+      },
+      "require": {
+        "types": "./dist/ui/index.d.ts",
+        "default": "./dist/ui/index.js"
+      }
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "cli": [
+        "dist/cli.d.ts"
+      ],
+      "ui": [
+        "dist/ui/index.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc --noEmit && node scripts/build.mjs",
+    "test": "jest",
+    "test:coverage": "jest --coverage"
+  },
+  "dependencies": {
+    "yaml": "^2.8.3"
+  },
+  "optionalDependencies": {
+    "@clef-sh/keyservice-darwin-arm64": "0.1.5",
+    "@clef-sh/keyservice-darwin-x64": "0.1.5",
+    "@clef-sh/keyservice-linux-x64": "0.1.5",
+    "@clef-sh/keyservice-linux-arm64": "0.1.5",
+    "@clef-sh/keyservice-win32-x64": "0.1.5"
+  },
+  "peerDependencies": {
+    "@clef-sh/core": ">=0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@clef-sh/core": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@clef-sh/core": "*",
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.11.0",
+    "esbuild": "^0.27.4",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.1.0",
+    "typescript": "^5.4.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "license": "MIT"
+}