@clef-sh/core 0.1.10 → 0.1.11-beta.66

package/dist/index.js

@@ -608,7 +608,7 @@ var require_age_encryption = __commonJS({
       };
     }
     // @__NO_SIDE_EFFECTS__
-    function join16(separator = "") {
+    function join18(separator = "") {
       astr("join", separator);
       return {
         encode: (from) => {
@@ -738,9 +738,9 @@ var require_age_encryption = __commonJS({
       decode(s) {
         return decodeBase64Builtin(s, false);
       }
-    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join16(""));
-    var base64nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ join16(""));
-    var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join16(""));
+    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join18(""));
+    var base64nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ join18(""));
+    var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join18(""));
     var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059];
     function bech32Polymod(pre) {
       const b = pre >> 25;
@@ -5789,7 +5789,7 @@ var require_age_encryption = __commonJS({
       return new TextDecoder().decode(bytes);
     }
     function flatten(arr) {
-      const len = arr.reduce((sum, line) => sum + line.length, 0);
+      const len = arr.reduce(((sum, line) => sum + line.length), 0);
       const out = new Uint8Array(len);
       let n = 0;
       for (const a of arr) {
@@ -6911,9 +6911,10 @@ var require_age_encryption = __commonJS({
 });
 
 // src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var index_exports = {};
+__export(index_exports, {
   ArtifactPacker: () => ArtifactPacker,
+  BackendMigrator: () => BackendMigrator,
   BulkOps: () => BulkOps,
   CLEF_MANIFEST_FILENAME: () => CLEF_MANIFEST_FILENAME,
   CLEF_REPORT_SCHEMA_VERSION: () => CLEF_REPORT_SCHEMA_VERSION,
@@ -6976,11 +6977,12 @@ __export(src_exports, {
   markResolved: () => markResolved,
   matchPatterns: () => matchPatterns,
   metadataPath: () => metadataPath,
-  parse: () => parse8,
+  parse: () => parse9,
   parseDotenv: () => parseDotenv,
   parseIgnoreContent: () => parseIgnoreContent,
   parseJson: () => parseJson,
   parseYaml: () => parseYaml,
+  readManifestYaml: () => readManifestYaml,
   redactValue: () => redactValue,
   removeAccessRequest: () => removeRequest,
   requestsFilePath: () => requestsFilePath,
@@ -6998,9 +7000,10 @@ __export(src_exports, {
   signKms: () => signKms,
   upsertRequest: () => upsertRequest,
   validateAgePublicKey: () => validateAgePublicKey,
-  verifySignature: () => verifySignature
+  verifySignature: () => verifySignature,
+  writeManifestYaml: () => writeManifestYaml
 });
-module.exports = __toCommonJS(src_exports);
+module.exports = __toCommonJS(index_exports);
 
 // src/types/index.ts
 var CLEF_SUPPORTED_EXTENSIONS = [".enc.yaml", ".enc.json"];
@@ -7459,8 +7462,26 @@ var ManifestParser = class {
         "sops.default_backend"
       );
     }
+    const ageObj = sopsObj.age;
+    const ageRecipients = ageObj && Array.isArray(ageObj.recipients) ? ageObj.recipients : void 0;
+    const parsedAge = ageRecipients ? {
+      age: {
+        recipients: ageRecipients.map((r) => {
+          if (typeof r === "string") return r;
+          if (typeof r === "object" && r !== null) {
+            const obj2 = r;
+            return {
+              key: String(obj2.key ?? ""),
+              ...typeof obj2.label === "string" ? { label: obj2.label } : {}
+            };
+          }
+          return String(r);
+        })
+      }
+    } : {};
     const sopsConfig = {
       default_backend: sopsObj.default_backend,
+      ...parsedAge,
       ...typeof sopsObj.aws_kms_arn === "string" ? { aws_kms_arn: sopsObj.aws_kms_arn } : {},
       ...typeof sopsObj.gcp_kms_resource_id === "string" ? { gcp_kms_resource_id: sopsObj.gcp_kms_resource_id } : {},
       ...typeof sopsObj.azure_kv_url === "string" ? { azure_kv_url: sopsObj.azure_kv_url } : {},
@@ -7692,9 +7713,21 @@ var ManifestParser = class {
   }
 };
 
+// src/manifest/io.ts
+var fs2 = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var YAML2 = __toESM(require("yaml"));
+function readManifestYaml(repoRoot) {
+  const raw = fs2.readFileSync(path.join(repoRoot, CLEF_MANIFEST_FILENAME), "utf-8");
+  return YAML2.parse(raw);
+}
+function writeManifestYaml(repoRoot, doc) {
+  fs2.writeFileSync(path.join(repoRoot, CLEF_MANIFEST_FILENAME), YAML2.stringify(doc), "utf-8");
+}
+
 // src/scanner/index.ts
-var fs3 = __toESM(require("fs"));
-var path2 = __toESM(require("path"));
+var fs4 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
 
 // src/scanner/patterns.ts
 var PATTERNS = [
@@ -7754,12 +7787,12 @@ function matchPatterns(line, lineNumber, filePath) {
 }
 
 // src/scanner/ignore.ts
-var fs2 = __toESM(require("fs"));
-var path = __toESM(require("path"));
+var fs3 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
 function loadIgnoreRules(repoRoot) {
-  const ignorePath = path.join(repoRoot, ".clefignore");
+  const ignorePath = path2.join(repoRoot, ".clefignore");
   try {
-    const content = fs2.readFileSync(ignorePath, "utf-8");
+    const content = fs3.readFileSync(ignorePath, "utf-8");
     return parseIgnoreContent(content);
   } catch {
     return { files: [], patterns: [], paths: [] };
@@ -7814,8 +7847,8 @@ function matchesGlob(filePath, pattern) {
 var ALWAYS_SKIP_EXTENSIONS = [".enc.yaml", ".enc.json"];
 var ALWAYS_SKIP_NAMES = [
   ".clef-meta.yaml",
-  ".sops.yaml"
-  // contains age public keys and KMS ARNs — configuration, not secrets
+  "clef.yaml"
+  // manifest — contains public keys and config, not secrets
 ];
 var ALWAYS_SKIP_DIRS = ["node_modules", ".git"];
 var MAX_FILE_SIZE = 1024 * 1024;
@@ -7842,9 +7875,9 @@ var ScanRunner = class {
     for (const ns of manifest.namespaces) {
       for (const env of manifest.environments) {
         const relPath = manifest.file_pattern.replace("{namespace}", ns.name).replace("{environment}", env.name);
-        const absPath = path2.join(repoRoot, relPath);
-        if (fs3.existsSync(absPath)) {
-          const content = fs3.readFileSync(absPath, "utf-8");
+        const absPath = path3.join(repoRoot, relPath);
+        if (fs4.existsSync(absPath)) {
+          const content = fs4.readFileSync(absPath, "utf-8");
           if (!content.includes("sops:") && !content.includes('"sops"')) {
             unencryptedMatrixFiles.push(relPath);
           }
@@ -7860,8 +7893,8 @@ var ScanRunner = class {
       filesToScan = await this.getAllTrackedFiles(repoRoot);
     }
     for (const relFile of filesToScan) {
-      const absFile = path2.isAbsolute(relFile) ? relFile : path2.join(repoRoot, relFile);
-      const relPath = path2.relative(repoRoot, absFile).replace(/\\/g, "/");
+      const absFile = path3.isAbsolute(relFile) ? relFile : path3.join(repoRoot, relFile);
+      const relPath = path3.relative(repoRoot, absFile).replace(/\\/g, "/");
       if (this.shouldAlwaysSkip(relPath)) {
         filesSkipped++;
         continue;
@@ -7870,13 +7903,13 @@ var ScanRunner = class {
         filesSkipped++;
         continue;
       }
-      if (!fs3.existsSync(absFile)) {
+      if (!fs4.existsSync(absFile)) {
         filesSkipped++;
         continue;
       }
       let stat;
       try {
-        stat = fs3.statSync(absFile);
+        stat = fs4.statSync(absFile);
       } catch {
         filesSkipped++;
         continue;
@@ -7890,7 +7923,7 @@ var ScanRunner = class {
         continue;
       }
       filesScanned++;
-      const content = fs3.readFileSync(absFile, "utf-8");
+      const content = fs4.readFileSync(absFile, "utf-8");
       const lines = content.split("\n");
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
@@ -7932,10 +7965,10 @@ var ScanRunner = class {
   }
   isBinary(filePath) {
     try {
-      const fd = fs3.openSync(filePath, "r");
+      const fd = fs4.openSync(filePath, "r");
       const buf = Buffer.alloc(512);
-      const bytesRead = fs3.readSync(fd, buf, 0, 512, 0);
-      fs3.closeSync(fd);
+      const bytesRead = fs4.readSync(fd, buf, 0, 512, 0);
+      fs4.closeSync(fd);
       for (let i = 0; i < bytesRead; i++) {
         if (buf[i] === 0) return true;
       }
@@ -7975,13 +8008,13 @@ var ScanRunner = class {
   async getFilesInPaths(repoRoot, paths) {
     const files = [];
     for (const p of paths) {
-      const absPath = path2.isAbsolute(p) ? p : path2.join(repoRoot, p);
-      if (!fs3.existsSync(absPath)) continue;
-      const stat = fs3.statSync(absPath);
+      const absPath = path3.isAbsolute(p) ? p : path3.join(repoRoot, p);
+      if (!fs4.existsSync(absPath)) continue;
+      const stat = fs4.statSync(absPath);
       if (stat.isDirectory()) {
         files.push(...this.walkDir(absPath, repoRoot));
       } else {
-        files.push(path2.relative(repoRoot, absPath).replace(/\\/g, "/"));
+        files.push(path3.relative(repoRoot, absPath).replace(/\\/g, "/"));
       }
     }
     return files;
@@ -7997,13 +8030,13 @@ var ScanRunner = class {
     const files = [];
     let entries;
     try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
+      entries = fs4.readdirSync(dir, { withFileTypes: true });
     } catch {
       return files;
     }
     for (const entry of entries) {
-      const fullPath = path2.join(dir, entry.name);
-      const relPath = path2.relative(repoRoot, fullPath).replace(/\\/g, "/");
+      const fullPath = path3.join(dir, entry.name);
+      const relPath = path3.relative(repoRoot, fullPath).replace(/\\/g, "/");
       if (entry.isDirectory()) {
         if (!ALWAYS_SKIP_DIRS.includes(entry.name)) {
           files.push(...this.walkDir(fullPath, repoRoot));
@@ -8017,29 +8050,29 @@ var ScanRunner = class {
 };
 
 // src/matrix/manager.ts
-var fs6 = __toESM(require("fs"));
-var path4 = __toESM(require("path"));
-var YAML4 = __toESM(require("yaml"));
+var fs7 = __toESM(require("fs"));
+var path5 = __toESM(require("path"));
+var YAML5 = __toESM(require("yaml"));
 
 // src/pending/metadata.ts
-var fs4 = __toESM(require("fs"));
-var path3 = __toESM(require("path"));
+var fs5 = __toESM(require("fs"));
+var path4 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var YAML2 = __toESM(require("yaml"));
+var YAML3 = __toESM(require("yaml"));
 function metadataPath(encryptedFilePath) {
-  const dir = path3.dirname(encryptedFilePath);
-  const base = path3.basename(encryptedFilePath).replace(/\.enc\.(yaml|json)$/, "");
-  return path3.join(dir, `${base}.clef-meta.yaml`);
+  const dir = path4.dirname(encryptedFilePath);
+  const base = path4.basename(encryptedFilePath).replace(/\.enc\.(yaml|json)$/, "");
+  return path4.join(dir, `${base}.clef-meta.yaml`);
 }
 var HEADER_COMMENT = "# Managed by Clef. Do not edit manually.\n";
 async function loadMetadata(filePath) {
   const metaPath = metadataPath(filePath);
   try {
-    if (!fs4.existsSync(metaPath)) {
+    if (!fs5.existsSync(metaPath)) {
       return { version: 1, pending: [] };
     }
-    const content = fs4.readFileSync(metaPath, "utf-8");
-    const parsed = YAML2.parse(content);
+    const content = fs5.readFileSync(metaPath, "utf-8");
+    const parsed = YAML3.parse(content);
     if (!parsed || !Array.isArray(parsed.pending)) {
       return { version: 1, pending: [] };
     }
@@ -8057,9 +8090,9 @@ async function loadMetadata(filePath) {
 }
 async function saveMetadata(filePath, metadata) {
   const metaPath = metadataPath(filePath);
-  const dir = path3.dirname(metaPath);
-  if (!fs4.existsSync(dir)) {
-    fs4.mkdirSync(dir, { recursive: true });
+  const dir = path4.dirname(metaPath);
+  if (!fs5.existsSync(dir)) {
+    fs5.mkdirSync(dir, { recursive: true });
   }
   const data = {
     version: metadata.version,
@@ -8069,7 +8102,7 @@ async function saveMetadata(filePath, metadata) {
       setBy: p.setBy
     }))
   };
-  fs4.writeFileSync(metaPath, HEADER_COMMENT + YAML2.stringify(data), "utf-8");
+  fs5.writeFileSync(metaPath, HEADER_COMMENT + YAML3.stringify(data), "utf-8");
 }
 async function markPending(filePath, keys, setBy) {
   const metadata = await loadMetadata(filePath);
@@ -8110,12 +8143,12 @@ async function markPendingWithRetry(filePath, keys, setBy, retryDelayMs = 200) {
 }
 
 // src/sops/keys.ts
-var fs5 = __toESM(require("fs"));
-var YAML3 = __toESM(require("yaml"));
+var fs6 = __toESM(require("fs"));
+var YAML4 = __toESM(require("yaml"));
 function readSopsKeyNames(filePath) {
   try {
-    const raw = fs5.readFileSync(filePath, "utf-8");
-    const parsed = YAML3.parse(raw);
+    const raw = fs6.readFileSync(filePath, "utf-8");
+    const parsed = YAML4.parse(raw);
     if (parsed === null || parsed === void 0 || typeof parsed !== "object") return null;
     return Object.keys(parsed).filter((k) => k !== "sops");
   } catch {
@@ -8137,12 +8170,12 @@ var MatrixManager = class {
     for (const ns of manifest.namespaces) {
       for (const env of manifest.environments) {
         const relativePath = manifest.file_pattern.replace("{namespace}", ns.name).replace("{environment}", env.name);
-        const filePath = path4.join(repoRoot, relativePath);
+        const filePath = path5.join(repoRoot, relativePath);
         cells.push({
           namespace: ns.name,
           environment: env.name,
           filePath,
-          exists: fs6.existsSync(filePath)
+          exists: fs7.existsSync(filePath)
         });
       }
     }
@@ -8165,9 +8198,9 @@ var MatrixManager = class {
    * @param manifest - Parsed manifest used to determine the encryption backend.
    */
   async scaffoldCell(cell, sopsClient, manifest) {
-    const dir = path4.dirname(cell.filePath);
-    if (!fs6.existsSync(dir)) {
-      fs6.mkdirSync(dir, { recursive: true });
+    const dir = path5.dirname(cell.filePath);
+    if (!fs7.existsSync(dir)) {
+      fs7.mkdirSync(dir, { recursive: true });
     }
     await sopsClient.encrypt(cell.filePath, {}, manifest, cell.environment);
   }
@@ -8243,8 +8276,8 @@ var MatrixManager = class {
    */
   readLastModified(filePath) {
     try {
-      const raw = fs6.readFileSync(filePath, "utf-8");
-      const parsed = YAML4.parse(raw);
+      const raw = fs7.readFileSync(filePath, "utf-8");
+      const parsed = YAML5.parse(raw);
       const sops = parsed?.sops;
       if (sops?.lastmodified) return new Date(String(sops.lastmodified));
       return null;
@@ -8265,8 +8298,8 @@ var MatrixManager = class {
 };
 
 // src/schema/validator.ts
-var fs7 = __toESM(require("fs"));
-var YAML5 = __toESM(require("yaml"));
+var fs8 = __toESM(require("fs"));
+var YAML6 = __toESM(require("yaml"));
 var SchemaValidator = class {
   /**
    * Read and parse a YAML schema file from disk.
@@ -8278,13 +8311,13 @@ var SchemaValidator = class {
   loadSchema(filePath) {
     let raw;
     try {
-      raw = fs7.readFileSync(filePath, "utf-8");
+      raw = fs8.readFileSync(filePath, "utf-8");
     } catch {
       throw new SchemaLoadError(`Could not read schema file at '${filePath}'.`, filePath);
     }
     let parsed;
     try {
-      parsed = YAML5.parse(raw);
+      parsed = YAML6.parse(raw);
     } catch {
       throw new SchemaLoadError(`Schema file '${filePath}' contains invalid YAML.`, filePath);
     }
@@ -8412,7 +8445,7 @@ var SchemaValidator = class {
 };
 
 // src/diff/engine.ts
-var path5 = __toESM(require("path"));
+var path6 = __toESM(require("path"));
 var DiffEngine = class {
   /**
    * Compare two in-memory value maps and produce a sorted diff result.
@@ -8469,11 +8502,11 @@ var DiffEngine = class {
    * @throws {@link SopsDecryptionError} If either file cannot be decrypted.
    */
   async diffFiles(namespace, envA, envB, manifest, sopsClient, repoRoot) {
-    const fileA = path5.join(
+    const fileA = path6.join(
       repoRoot,
       manifest.file_pattern.replace("{namespace}", namespace).replace("{environment}", envA)
     );
-    const fileB = path5.join(
+    const fileB = path6.join(
       repoRoot,
       manifest.file_pattern.replace("{namespace}", namespace).replace("{environment}", envB)
     );
@@ -8486,7 +8519,7 @@ var DiffEngine = class {
 };
 
 // src/bulk/ops.ts
-var path6 = __toESM(require("path"));
+var path7 = __toESM(require("path"));
 var BulkOps = class {
   /**
    * Set a key to different values in multiple environments at once.
@@ -8505,7 +8538,7 @@ var BulkOps = class {
       if (!(env.name in values)) {
         continue;
       }
-      const filePath = path6.join(
+      const filePath = path7.join(
         repoRoot,
         manifest.file_pattern.replace("{namespace}", namespace).replace("{environment}", env.name)
       );
@@ -8539,7 +8572,7 @@ Successfully updated ${Object.keys(values).length - errors.length} environment(s
   async deleteAcrossEnvironments(namespace, key, manifest, sopsClient, repoRoot) {
     const errors = [];
     for (const env of manifest.environments) {
-      const filePath = path6.join(
+      const filePath = path7.join(
         repoRoot,
         manifest.file_pattern.replace("{namespace}", namespace).replace("{environment}", env.name)
       );
@@ -8585,8 +8618,8 @@ ${details}`
 };
 
 // src/git/integration.ts
-var fs8 = __toESM(require("fs"));
-var path7 = __toESM(require("path"));
+var fs9 = __toESM(require("fs"));
+var path8 = __toESM(require("path"));
 var PRE_COMMIT_HOOK = `#!/bin/sh
 # Clef pre-commit hook \u2014 blocks commits of files missing SOPS encryption metadata
 # and scans staged files for plaintext secrets.
@@ -8793,15 +8826,15 @@ var GitIntegration = class {
       cwd: repoRoot
     });
     const gitConfig = configResult.exitCode === 0 && configResult.stdout.trim().length > 0;
-    const attrFilePath = path7.join(repoRoot, ".gitattributes");
-    const attrContent = fs8.existsSync(attrFilePath) ? fs8.readFileSync(attrFilePath, "utf-8") : "";
+    const attrFilePath = path8.join(repoRoot, ".gitattributes");
+    const attrContent = fs9.existsSync(attrFilePath) ? fs9.readFileSync(attrFilePath, "utf-8") : "";
     const gitattributes = attrContent.includes("merge=sops");
     return { gitConfig, gitattributes };
   }
   async ensureGitattributes(repoRoot) {
-    const attrPath = path7.join(repoRoot, ".gitattributes");
+    const attrPath = path8.join(repoRoot, ".gitattributes");
     const mergeRule = "*.enc.yaml merge=sops\n*.enc.json merge=sops";
-    const existing = fs8.existsSync(attrPath) ? fs8.readFileSync(attrPath, "utf-8") : "";
+    const existing = fs9.existsSync(attrPath) ? fs9.readFileSync(attrPath, "utf-8") : "";
     if (existing.includes("merge=sops")) {
       return;
     }
@@ -8828,7 +8861,7 @@ ${mergeRule}
    * @throws {@link GitOperationError} On failure.
    */
   async installPreCommitHook(repoRoot) {
-    const hookPath = path7.join(repoRoot, ".git", "hooks", "pre-commit");
+    const hookPath = path8.join(repoRoot, ".git", "hooks", "pre-commit");
     const result = await this.runner.run("tee", [hookPath], {
       stdin: PRE_COMMIT_HOOK,
       cwd: repoRoot
@@ -8849,18 +8882,18 @@ ${mergeRule}
 };
 
 // src/sops/client.ts
-var fs11 = __toESM(require("fs"));
+var fs12 = __toESM(require("fs"));
 var net = __toESM(require("net"));
 var import_crypto = require("crypto");
-var YAML6 = __toESM(require("yaml"));
+var YAML7 = __toESM(require("yaml"));
 
 // src/sops/resolver.ts
-var fs10 = __toESM(require("fs"));
-var path9 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
+var path10 = __toESM(require("path"));
 
 // src/sops/bundled.ts
-var fs9 = __toESM(require("fs"));
-var path8 = __toESM(require("path"));
+var fs10 = __toESM(require("fs"));
+var path9 = __toESM(require("path"));
 function tryBundled() {
   const platform = process.platform;
   const arch = process.arch;
@@ -8872,9 +8905,9 @@ function tryBundled() {
   const binName = platform === "win32" ? "sops.exe" : "sops";
   try {
     const packageMain = require.resolve(`${packageName}/package.json`);
-    const packageDir = path8.dirname(packageMain);
-    const binPath = path8.join(packageDir, "bin", binName);
-    return fs9.existsSync(binPath) ? binPath : null;
+    const packageDir = path9.dirname(packageMain);
+    const binPath = path9.join(packageDir, "bin", binName);
+    return fs10.existsSync(binPath) ? binPath : null;
   } catch {
     return null;
   }
@@ -8882,7 +8915,7 @@ function tryBundled() {
 
 // src/sops/resolver.ts
 function validateSopsPath(candidate) {
-  if (!path9.isAbsolute(candidate)) {
+  if (!path10.isAbsolute(candidate)) {
     throw new Error(`CLEF_SOPS_PATH must be an absolute path, got '${candidate}'.`);
   }
   const segments = candidate.split(/[/\\]/);
@@ -8898,7 +8931,7 @@ function resolveSopsPath() {
   const envPath = process.env.CLEF_SOPS_PATH?.trim();
   if (envPath) {
     validateSopsPath(envPath);
-    if (!fs10.existsSync(envPath)) {
+    if (!fs11.existsSync(envPath)) {
       throw new Error(`CLEF_SOPS_PATH points to '${envPath}' but the file does not exist.`);
     }
     cached = { path: envPath, source: "env" };
@@ -9106,7 +9139,7 @@ var SopsClient = class {
     }
     let parsed;
     try {
-      parsed = YAML6.parse(result.stdout) ?? {};
+      parsed = YAML7.parse(result.stdout) ?? {};
     } catch {
       throw new SopsDecryptionError(
         `Decrypted content of '${filePath}' is not valid YAML.`,
@@ -9133,7 +9166,7 @@ var SopsClient = class {
   async encrypt(filePath, values, manifest, environment) {
     await assertSops(this.runner, this.sopsCommand);
     const fmt = formatFromPath(filePath);
-    const content = fmt === "json" ? JSON.stringify(values, null, 2) : YAML6.stringify(values);
+    const content = fmt === "json" ? JSON.stringify(values, null, 2) : YAML7.stringify(values);
     const args = this.buildEncryptArgs(filePath, manifest, environment);
     const env = this.buildSopsEnv();
     let inputArg;
@@ -9147,9 +9180,12 @@ var SopsClient = class {
     }
     let result;
     try {
+      const configPath = process.platform === "win32" ? "NUL" : "/dev/null";
       result = await this.runner.run(
         this.sopsCommand,
         [
+          "--config",
+          configPath,
           "encrypt",
           ...args,
           "--input-type",
@@ -9177,7 +9213,7 @@ var SopsClient = class {
       );
     }
     try {
-      fs11.writeFileSync(filePath, result.stdout);
+      fs12.writeFileSync(filePath, result.stdout);
     } catch {
       throw new SopsEncryptionError(`Failed to write encrypted data to '${filePath}'.`, filePath);
     }
@@ -9293,7 +9329,7 @@ var SopsClient = class {
     if (!this.ageKey && !this.ageKeyFile) return "key-not-found";
     let keyContent;
     try {
-      keyContent = this.ageKey ?? fs11.readFileSync(this.ageKeyFile, "utf-8");
+      keyContent = this.ageKey ?? fs12.readFileSync(this.ageKeyFile, "utf-8");
     } catch {
       return "key-not-found";
     }
@@ -9310,7 +9346,7 @@ var SopsClient = class {
   parseMetadataFromFile(filePath) {
     let content;
     try {
-      content = fs11.readFileSync(filePath, "utf-8");
+      content = fs12.readFileSync(filePath, "utf-8");
     } catch {
       throw new SopsDecryptionError(
         `Could not read file '${filePath}' to extract SOPS metadata.`,
@@ -9319,7 +9355,7 @@ var SopsClient = class {
     }
     let parsed;
     try {
-      parsed = YAML6.parse(content);
+      parsed = YAML7.parse(content);
     } catch {
       throw new SopsDecryptionError(
         `File '${filePath}' is not valid YAML. Cannot extract SOPS metadata.`,
@@ -9386,8 +9422,15 @@ var SopsClient = class {
       pgp_fingerprint: manifest.sops.pgp_fingerprint
     };
     switch (config.backend) {
-      case "age":
+      case "age": {
+        const envRecipients = environment ? resolveRecipientsForEnvironment(manifest, environment) : void 0;
+        const recipients = envRecipients ?? manifest.sops.age?.recipients ?? [];
+        const keys = recipients.map((r) => typeof r === "string" ? r : r.key);
+        if (keys.length > 0) {
+          args.push("--age", keys.join(","));
+        }
         break;
+      }
       case "awskms":
         if (config.aws_kms_arn) {
           args.push("--kms", config.aws_kms_arn);
@@ -9414,7 +9457,7 @@ var SopsClient = class {
 };
 
 // src/lint/runner.ts
-var path10 = __toESM(require("path"));
+var path11 = __toESM(require("path"));
 var LintRunner = class {
   constructor(matrixManager, schemaValidator, sopsClient) {
     this.matrixManager = matrixManager;
@@ -9514,7 +9557,7 @@ var LintRunner = class {
         }
         const ns = manifest.namespaces.find((n) => n.name === cell.namespace);
         if (ns?.schema) {
-          const schemaPath = path10.join(repoRoot, ns.schema);
+          const schemaPath = path11.join(repoRoot, ns.schema);
           try {
             const schema = this.schemaValidator.loadSchema(schemaPath);
             const result = this.schemaValidator.validate(decrypted.values, schema);
@@ -9747,14 +9790,14 @@ Use 'clef exec' to inject secrets directly into a process, or 'clef export --for
 };
 
 // src/import/index.ts
-var path12 = __toESM(require("path"));
+var path13 = __toESM(require("path"));
 
 // src/import/parsers.ts
-var path11 = __toESM(require("path"));
-var YAML7 = __toESM(require("yaml"));
+var path12 = __toESM(require("path"));
+var YAML8 = __toESM(require("yaml"));
 function detectFormat(filePath, content) {
-  const base = path11.basename(filePath);
-  const ext = path11.extname(filePath).toLowerCase();
+  const base = path12.basename(filePath);
+  const ext = path12.extname(filePath).toLowerCase();
   if (base === ".env" || base.startsWith(".env.")) {
     return "dotenv";
   }
@@ -9775,7 +9818,7 @@ function detectFormat(filePath, content) {
   } catch {
   }
   try {
-    const parsed = YAML7.parse(content);
+    const parsed = YAML8.parse(content);
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
       return "yaml";
     }
@@ -9856,7 +9899,7 @@ function parseJson(content) {
 function parseYaml(content) {
   let parsed;
   try {
-    parsed = YAML7.parse(content);
+    parsed = YAML8.parse(content);
   } catch (err) {
     throw new Error(`Invalid YAML: ${err.message}`);
   }
@@ -9890,7 +9933,7 @@ function parseYaml(content) {
   }
   return { pairs, format: "yaml", skipped, warnings };
 }
-function parse8(content, format, filePath) {
+function parse9(content, format, filePath) {
   const resolved = format === "auto" ? detectFormat(filePath ?? "", content) : format;
   switch (resolved) {
     case "dotenv":
@@ -9919,11 +9962,11 @@ var ImportRunner = class {
    */
   async import(target, sourcePath, content, manifest, repoRoot, options) {
     const [ns, env] = target.split("/");
-    const filePath = path12.join(
+    const filePath = path13.join(
       repoRoot,
       manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)
     );
-    const parsed = parse8(content, options.format ?? "auto", sourcePath ?? "");
+    const parsed = parse9(content, options.format ?? "auto", sourcePath ?? "");
     let candidates = Object.entries(parsed.pairs);
     if (options.prefix) {
       const prefix = options.prefix;
@@ -9977,9 +10020,8 @@ var ImportRunner = class {
 };
 
 // src/recipients/index.ts
-var fs12 = __toESM(require("fs"));
-var path13 = __toESM(require("path"));
-var YAML8 = __toESM(require("yaml"));
+var fs13 = __toESM(require("fs"));
+var path14 = __toESM(require("path"));
 function parseRecipientEntry(entry) {
   if (typeof entry === "string") {
     return { key: entry };
@@ -10000,15 +10042,6 @@ function toRecipient(entry) {
     ...entry.label ? { label: entry.label } : {}
   };
 }
-function readManifestYaml(repoRoot) {
-  const manifestPath = path13.join(repoRoot, CLEF_MANIFEST_FILENAME);
-  const raw = fs12.readFileSync(manifestPath, "utf-8");
-  return YAML8.parse(raw);
-}
-function writeManifestYaml(repoRoot, doc) {
-  const manifestPath = path13.join(repoRoot, CLEF_MANIFEST_FILENAME);
-  fs12.writeFileSync(manifestPath, YAML8.stringify(doc), "utf-8");
-}
 function getRecipientsArray(doc) {
   const sops = doc.sops;
   if (!sops) return [];
@@ -10107,8 +10140,8 @@ var RecipientManager = class {
     if (currentKeys.includes(normalizedKey)) {
       throw new Error(`Recipient '${keyPreview(normalizedKey)}' is already present.`);
     }
-    const manifestPath = path13.join(repoRoot, CLEF_MANIFEST_FILENAME);
-    const manifestBackup = fs12.readFileSync(manifestPath, "utf-8");
+    const manifestPath = path14.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const manifestBackup = fs13.readFileSync(manifestPath, "utf-8");
     const recipients = environment ? ensureEnvironmentRecipientsArray(doc, environment) : ensureRecipientsArray(doc);
     if (label) {
       recipients.push({ key: normalizedKey, label });
@@ -10123,16 +10156,16 @@ var RecipientManager = class {
     const fileBackups = /* @__PURE__ */ new Map();
     for (const cell of cells) {
       try {
-        fileBackups.set(cell.filePath, fs12.readFileSync(cell.filePath, "utf-8"));
+        fileBackups.set(cell.filePath, fs13.readFileSync(cell.filePath, "utf-8"));
         await this.encryption.addRecipient(cell.filePath, normalizedKey);
         reEncryptedFiles.push(cell.filePath);
       } catch {
         failedFiles.push(cell.filePath);
-        fs12.writeFileSync(manifestPath, manifestBackup, "utf-8");
+        fs13.writeFileSync(manifestPath, manifestBackup, "utf-8");
         for (const reEncryptedFile of reEncryptedFiles) {
           const backup = fileBackups.get(reEncryptedFile);
           if (backup) {
-            fs12.writeFileSync(reEncryptedFile, backup, "utf-8");
+            fs13.writeFileSync(reEncryptedFile, backup, "utf-8");
           }
         }
         const restoredDoc = readManifestYaml(repoRoot);
@@ -10185,8 +10218,8 @@ var RecipientManager = class {
       throw new Error(`Recipient '${keyPreview(trimmedKey)}' is not in the manifest.`);
     }
     const removedEntry = parsed[matchIndex];
-    const manifestPath = path13.join(repoRoot, CLEF_MANIFEST_FILENAME);
-    const manifestBackup = fs12.readFileSync(manifestPath, "utf-8");
+    const manifestPath = path14.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const manifestBackup = fs13.readFileSync(manifestPath, "utf-8");
     const recipients = environment ? ensureEnvironmentRecipientsArray(doc, environment) : ensureRecipientsArray(doc);
     recipients.splice(matchIndex, 1);
     writeManifestYaml(repoRoot, doc);
@@ -10197,16 +10230,16 @@ var RecipientManager = class {
     const fileBackups = /* @__PURE__ */ new Map();
     for (const cell of cells) {
       try {
-        fileBackups.set(cell.filePath, fs12.readFileSync(cell.filePath, "utf-8"));
+        fileBackups.set(cell.filePath, fs13.readFileSync(cell.filePath, "utf-8"));
         await this.encryption.removeRecipient(cell.filePath, trimmedKey);
         reEncryptedFiles.push(cell.filePath);
       } catch {
         failedFiles.push(cell.filePath);
-        fs12.writeFileSync(manifestPath, manifestBackup, "utf-8");
+        fs13.writeFileSync(manifestPath, manifestBackup, "utf-8");
         for (const reEncryptedFile of reEncryptedFiles) {
           const backup = fileBackups.get(reEncryptedFile);
           if (backup) {
-            fs12.writeFileSync(reEncryptedFile, backup, "utf-8");
+            fs13.writeFileSync(reEncryptedFile, backup, "utf-8");
           }
         }
         const restoredDoc = readManifestYaml(repoRoot);
@@ -10240,19 +10273,19 @@ var RecipientManager = class {
 };
 
 // src/recipients/requests.ts
-var fs13 = __toESM(require("fs"));
-var path14 = __toESM(require("path"));
+var fs14 = __toESM(require("fs"));
+var path15 = __toESM(require("path"));
 var YAML9 = __toESM(require("yaml"));
 var REQUESTS_FILENAME = ".clef-requests.yaml";
 var HEADER_COMMENT2 = "# Pending recipient access requests. Approve with: clef recipients approve <label>\n";
 function requestsFilePath(repoRoot) {
-  return path14.join(repoRoot, REQUESTS_FILENAME);
+  return path15.join(repoRoot, REQUESTS_FILENAME);
 }
 function loadRequests(repoRoot) {
   const filePath = requestsFilePath(repoRoot);
   try {
-    if (!fs13.existsSync(filePath)) return [];
-    const content = fs13.readFileSync(filePath, "utf-8");
+    if (!fs14.existsSync(filePath)) return [];
+    const content = fs14.readFileSync(filePath, "utf-8");
     const parsed = YAML9.parse(content);
     if (!parsed || !Array.isArray(parsed.requests)) return [];
     return parsed.requests.map((r) => ({
@@ -10269,7 +10302,7 @@ function saveRequests(repoRoot, requests) {
   const filePath = requestsFilePath(repoRoot);
   if (requests.length === 0) {
     try {
-      fs13.unlinkSync(filePath);
+      fs14.unlinkSync(filePath);
     } catch {
     }
     return;
@@ -10285,7 +10318,7 @@ function saveRequests(repoRoot, requests) {
       return raw;
     })
   };
-  fs13.writeFileSync(filePath, HEADER_COMMENT2 + YAML9.stringify(data), "utf-8");
+  fs14.writeFileSync(filePath, HEADER_COMMENT2 + YAML9.stringify(data), "utf-8");
 }
 function upsertRequest(repoRoot, key, label, environment) {
   const requests = loadRequests(repoRoot);
@@ -10321,7 +10354,7 @@ function findInList(requests, identifier) {
 }
 
 // src/drift/detector.ts
-var path15 = __toESM(require("path"));
+var path16 = __toESM(require("path"));
 var DriftDetector = class {
   parser = new ManifestParser();
   matrix = new MatrixManager();
@@ -10334,8 +10367,8 @@ var DriftDetector = class {
    * @returns Drift result with any issues found.
    */
   detect(localRoot, remoteRoot, namespaceFilter) {
-    const localManifest = this.parser.parse(path15.join(localRoot, CLEF_MANIFEST_FILENAME));
-    const remoteManifest = this.parser.parse(path15.join(remoteRoot, CLEF_MANIFEST_FILENAME));
+    const localManifest = this.parser.parse(path16.join(localRoot, CLEF_MANIFEST_FILENAME));
+    const remoteManifest = this.parser.parse(path16.join(remoteRoot, CLEF_MANIFEST_FILENAME));
     const localCells = this.matrix.resolveMatrix(localManifest, localRoot);
     const remoteCells = this.matrix.resolveMatrix(remoteManifest, remoteRoot);
     const localEnvNames = localManifest.environments.map((e) => e.name);
@@ -10399,7 +10432,7 @@ var DriftDetector = class {
 };
 
 // src/report/generator.ts
-var path16 = __toESM(require("path"));
+var path17 = __toESM(require("path"));
 
 // src/report/sanitizer.ts
 var ReportSanitizer = class {
@@ -10555,7 +10588,7 @@ var ReportGenerator = class {
     let manifest = null;
     try {
       const parser = new ManifestParser();
-      manifest = parser.parse(path16.join(repoRoot, "clef.yaml"));
+      manifest = parser.parse(path17.join(repoRoot, "clef.yaml"));
     } catch {
       const emptyManifest = {
         manifestVersion: 0,
@@ -11033,9 +11066,9 @@ var SopsMergeDriver = class {
 };
 
 // src/service-identity/manager.ts
-var fs14 = __toESM(require("fs"));
+var fs15 = __toESM(require("fs"));
 var os = __toESM(require("os"));
-var path17 = __toESM(require("path"));
+var path18 = __toESM(require("path"));
 var YAML10 = __toESM(require("yaml"));
 var PartialRotationError = class extends Error {
   constructor(message, rotatedKeys) {
@@ -11087,8 +11120,8 @@ var ServiceIdentityManager = class {
       environments
     };
     await this.registerRecipients(definition, manifest, repoRoot);
-    const manifestPath = path17.join(repoRoot, CLEF_MANIFEST_FILENAME);
-    const raw = fs14.readFileSync(manifestPath, "utf-8");
+    const manifestPath = path18.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const raw = fs15.readFileSync(manifestPath, "utf-8");
     const doc = YAML10.parse(raw);
     if (!Array.isArray(doc.service_identities)) {
       doc.service_identities = [];
@@ -11099,13 +11132,13 @@ var ServiceIdentityManager = class {
       namespaces,
       environments
     });
-    const tmpCreate = path17.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
+    const tmpCreate = path18.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
     try {
-      fs14.writeFileSync(tmpCreate, YAML10.stringify(doc), "utf-8");
-      fs14.renameSync(tmpCreate, manifestPath);
+      fs15.writeFileSync(tmpCreate, YAML10.stringify(doc), "utf-8");
+      fs15.renameSync(tmpCreate, manifestPath);
     } finally {
       try {
-        fs14.unlinkSync(tmpCreate);
+        fs15.unlinkSync(tmpCreate);
       } catch {
       }
     }
@@ -11143,8 +11176,8 @@ var ServiceIdentityManager = class {
       } catch {
       }
     }
-    const manifestPath = path17.join(repoRoot, CLEF_MANIFEST_FILENAME);
-    const raw = fs14.readFileSync(manifestPath, "utf-8");
+    const manifestPath = path18.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const raw = fs15.readFileSync(manifestPath, "utf-8");
     const doc = YAML10.parse(raw);
     const identities = doc.service_identities;
     if (Array.isArray(identities)) {
@@ -11152,13 +11185,13 @@ var ServiceIdentityManager = class {
         (si) => si.name !== name
       );
     }
-    const tmp = path17.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
+    const tmp = path18.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
     try {
-      fs14.writeFileSync(tmp, YAML10.stringify(doc), "utf-8");
-      fs14.renameSync(tmp, manifestPath);
+      fs15.writeFileSync(tmp, YAML10.stringify(doc), "utf-8");
+      fs15.renameSync(tmp, manifestPath);
     } finally {
       try {
-        fs14.unlinkSync(tmp);
+        fs15.unlinkSync(tmp);
       } catch {
       }
     }
@@ -11173,8 +11206,8 @@ var ServiceIdentityManager = class {
     if (!identity) {
       throw new Error(`Service identity '${name}' not found.`);
     }
-    const manifestPath = path17.join(repoRoot, CLEF_MANIFEST_FILENAME);
-    const raw = fs14.readFileSync(manifestPath, "utf-8");
+    const manifestPath = path18.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const raw = fs15.readFileSync(manifestPath, "utf-8");
     const doc = YAML10.parse(raw);
     const identities = doc.service_identities;
     const siDoc = identities.find((si) => si.name === name);
@@ -11200,13 +11233,13 @@ var ServiceIdentityManager = class {
       envs[envName] = { kms: kmsConfig };
       identity.environments[envName] = { kms: kmsConfig };
     }
-    const tmp = path17.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
+    const tmp = path18.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
     try {
-      fs14.writeFileSync(tmp, YAML10.stringify(doc), "utf-8");
-      fs14.renameSync(tmp, manifestPath);
+      fs15.writeFileSync(tmp, YAML10.stringify(doc), "utf-8");
+      fs15.renameSync(tmp, manifestPath);
     } finally {
       try {
-        fs14.unlinkSync(tmp);
+        fs15.unlinkSync(tmp);
       } catch {
       }
     }
@@ -11242,8 +11275,8 @@ var ServiceIdentityManager = class {
     if (!identity) {
       throw new Error(`Service identity '${name}' not found.`);
     }
-    const manifestPath = path17.join(repoRoot, CLEF_MANIFEST_FILENAME);
-    const raw = fs14.readFileSync(manifestPath, "utf-8");
+    const manifestPath = path18.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const raw = fs15.readFileSync(manifestPath, "utf-8");
     const doc = YAML10.parse(raw);
     const identities = doc.service_identities;
     const siDoc = identities.find((si) => si.name === name);
@@ -11297,13 +11330,13 @@ var ServiceIdentityManager = class {
       }
       throw err;
     }
-    const tmpRotate = path17.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
+    const tmpRotate = path18.join(os.tmpdir(), `clef-manifest-${process.pid}-${Date.now()}.tmp`);
     try {
-      fs14.writeFileSync(tmpRotate, YAML10.stringify(doc), "utf-8");
-      fs14.renameSync(tmpRotate, manifestPath);
+      fs15.writeFileSync(tmpRotate, YAML10.stringify(doc), "utf-8");
+      fs15.renameSync(tmpRotate, manifestPath);
     } finally {
       try {
-        fs14.unlinkSync(tmpRotate);
+        fs15.unlinkSync(tmpRotate);
       } catch {
       }
     }
@@ -11424,22 +11457,21 @@ async function resolveIdentitySecrets(identityName, environment, manifest, repoR
 }
 
 // src/artifact/packer.ts
-var fs15 = __toESM(require("fs"));
-var path18 = __toESM(require("path"));
+var fs16 = __toESM(require("fs"));
+var path19 = __toESM(require("path"));
 var crypto4 = __toESM(require("crypto"));
 
 // src/artifact/signer.ts
 var crypto3 = __toESM(require("crypto"));
 function buildSigningPayload(artifact) {
   const fields = [
-    "clef-sig-v2",
+    "clef-sig-v3",
     String(artifact.version),
     artifact.identity,
     artifact.environment,
     artifact.revision,
     artifact.packedAt,
     artifact.ciphertextHash,
-    [...artifact.keys].sort().join(","),
     artifact.expiresAt ?? "",
     artifact.envelope?.provider ?? "",
     artifact.envelope?.keyId ?? "",
@@ -11562,7 +11594,6 @@ var ArtifactPacker = class {
           revision,
           ciphertextHash,
           ciphertext,
-          keys: Object.keys(resolved.values),
           envelope: {
             provider: kmsConfig.provider,
             keyId: kmsConfig.keyId,
@@ -11596,13 +11627,12 @@ var ArtifactPacker = class {
         packedAt: (/* @__PURE__ */ new Date()).toISOString(),
         revision,
         ciphertextHash,
-        ciphertext,
-        keys: Object.keys(resolved.values)
+        ciphertext
       };
     }
-    const outputDir = path18.dirname(config.outputPath);
-    if (!fs15.existsSync(outputDir)) {
-      fs15.mkdirSync(outputDir, { recursive: true });
+    const outputDir = path19.dirname(config.outputPath);
+    if (!fs16.existsSync(outputDir)) {
+      fs16.mkdirSync(outputDir, { recursive: true });
     }
     if (config.ttl && config.ttl > 0) {
       artifact.expiresAt = new Date(Date.now() + config.ttl * 1e3).toISOString();
@@ -11621,8 +11651,8 @@ var ArtifactPacker = class {
     }
     const json = JSON.stringify(artifact, null, 2);
     const tmpOutput = `${config.outputPath}.tmp.${process.pid}`;
-    fs15.writeFileSync(tmpOutput, json, "utf-8");
-    fs15.renameSync(tmpOutput, config.outputPath);
+    fs16.writeFileSync(tmpOutput, json, "utf-8");
+    fs16.renameSync(tmpOutput, config.outputPath);
     return {
       outputPath: config.outputPath,
       namespaceCount: resolved.identity.namespaces.length,
@@ -11635,9 +11665,208 @@ var ArtifactPacker = class {
 
 // src/kms/types.ts
 var VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
+
+// src/migration/backend.ts
+var fs17 = __toESM(require("fs"));
+var path20 = __toESM(require("path"));
+var YAML11 = __toESM(require("yaml"));
+var BACKEND_KEY_FIELDS = {
+  age: void 0,
+  awskms: "aws_kms_arn",
+  gcpkms: "gcp_kms_resource_id",
+  azurekv: "azure_kv_url",
+  pgp: "pgp_fingerprint"
+};
+var ALL_KEY_FIELDS = Object.values(BACKEND_KEY_FIELDS).filter(
+  (v) => v !== void 0
+);
+function metadataMatchesTarget(meta, target) {
+  if (meta.backend !== target.backend) return false;
+  if (!target.key) return true;
+  return meta.recipients.includes(target.key);
+}
+var BackendMigrator = class {
+  constructor(encryption, matrixManager) {
+    this.encryption = encryption;
+    this.matrixManager = matrixManager;
+  }
+  async migrate(manifest, repoRoot, options, onProgress) {
+    const { target, environment, dryRun, skipVerify } = options;
+    if (environment) {
+      const env = manifest.environments.find((e) => e.name === environment);
+      if (!env) {
+        throw new Error(`Environment '${environment}' not found in manifest.`);
+      }
+    }
+    const allCells = this.matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists);
+    const targetCells = environment ? allCells.filter((c) => c.environment === environment) : allCells;
+    if (targetCells.length === 0) {
+      return {
+        migratedFiles: [],
+        skippedFiles: [],
+        rolledBack: false,
+        verifiedFiles: [],
+        warnings: ["No encrypted files found to migrate."]
+      };
+    }
+    const toMigrate = [];
+    const skippedFiles = [];
+    for (const cell of targetCells) {
+      const meta = await this.encryption.getMetadata(cell.filePath);
+      if (metadataMatchesTarget(meta, target)) {
+        skippedFiles.push(cell.filePath);
+        onProgress?.({
+          type: "skip",
+          file: cell.filePath,
+          message: `${cell.namespace}/${cell.environment}: already on ${target.backend}, skipping`
+        });
+      } else {
+        toMigrate.push(cell);
+      }
+    }
+    if (toMigrate.length === 0) {
+      return {
+        migratedFiles: [],
+        skippedFiles,
+        rolledBack: false,
+        verifiedFiles: [],
+        warnings: ["All files already use the target backend and key. Nothing to migrate."]
+      };
+    }
+    if (dryRun) {
+      const warnings2 = [];
+      for (const cell of toMigrate) {
+        onProgress?.({
+          type: "info",
+          file: cell.filePath,
+          message: `Would migrate ${cell.namespace}/${cell.environment} to ${target.backend}`
+        });
+      }
+      if (environment) {
+        warnings2.push(
+          `Would add per-environment backend override for '${environment}' \u2192 ${target.backend}`
+        );
+      } else {
+        warnings2.push(`Would update global default_backend \u2192 ${target.backend}`);
+      }
+      this.checkAgeRecipientsWarning(manifest, target, environment, warnings2);
+      return {
+        migratedFiles: [],
+        skippedFiles,
+        rolledBack: false,
+        verifiedFiles: [],
+        warnings: warnings2
+      };
+    }
+    const manifestPath = path20.join(repoRoot, CLEF_MANIFEST_FILENAME);
+    const manifestBackup = fs17.readFileSync(manifestPath, "utf-8");
+    const fileBackups = /* @__PURE__ */ new Map();
+    const doc = readManifestYaml(repoRoot);
+    this.updateManifestDoc(doc, target, environment);
+    writeManifestYaml(repoRoot, doc);
+    const updatedManifest = YAML11.parse(YAML11.stringify(doc));
+    const migratedFiles = [];
+    for (const cell of toMigrate) {
+      try {
+        fileBackups.set(cell.filePath, fs17.readFileSync(cell.filePath, "utf-8"));
+        onProgress?.({
+          type: "migrate",
+          file: cell.filePath,
+          message: `Migrating ${cell.namespace}/${cell.environment}...`
+        });
+        const decrypted = await this.encryption.decrypt(cell.filePath);
+        await this.encryption.encrypt(
+          cell.filePath,
+          decrypted.values,
+          updatedManifest,
+          cell.environment
+        );
+        migratedFiles.push(cell.filePath);
+      } catch (err) {
+        this.rollback(manifestPath, manifestBackup, fileBackups);
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        onProgress?.({
+          type: "warn",
+          file: cell.filePath,
+          message: `Migration failed: ${errorMsg}. All changes rolled back.`
+        });
+        return {
+          migratedFiles: [],
+          skippedFiles,
+          rolledBack: true,
+          error: `Failed on ${cell.namespace}/${cell.environment}: ${errorMsg}`,
+          verifiedFiles: [],
+          warnings: ["All changes have been rolled back."]
+        };
+      }
+    }
+    const verifiedFiles = [];
+    const warnings = [];
+    if (!skipVerify) {
+      for (const cell of toMigrate) {
+        try {
+          onProgress?.({
+            type: "verify",
+            file: cell.filePath,
+            message: `Verifying ${cell.namespace}/${cell.environment}...`
+          });
+          await this.encryption.decrypt(cell.filePath);
+          verifiedFiles.push(cell.filePath);
+        } catch (err) {
+          const errorMsg = err instanceof Error ? err.message : String(err);
+          warnings.push(
+            `Verification failed for ${cell.namespace}/${cell.environment}: ${errorMsg}`
+          );
+        }
+      }
+    }
+    this.checkAgeRecipientsWarning(manifest, target, environment, warnings);
+    return { migratedFiles, skippedFiles, rolledBack: false, verifiedFiles, warnings };
+  }
+  // ── Private helpers ──────────────────────────────────────────────────
+  updateManifestDoc(doc, target, environment) {
+    const keyField = BACKEND_KEY_FIELDS[target.backend];
+    if (environment) {
+      const environments = doc.environments;
+      const envDoc = environments.find(
+        (e) => e.name === environment
+      );
+      const sopsOverride = { backend: target.backend };
+      if (keyField && target.key) {
+        sopsOverride[keyField] = target.key;
+      }
+      envDoc.sops = sopsOverride;
+    } else {
+      const sops = doc.sops;
+      sops.default_backend = target.backend;
+      for (const field of ALL_KEY_FIELDS) {
+        delete sops[field];
+      }
+      if (keyField && target.key) {
+        sops[keyField] = target.key;
+      }
+    }
+  }
+  rollback(manifestPath, manifestBackup, fileBackups) {
+    for (const [filePath, backup] of fileBackups) {
+      fs17.writeFileSync(filePath, backup, "utf-8");
+    }
+    fs17.writeFileSync(manifestPath, manifestBackup, "utf-8");
+  }
+  checkAgeRecipientsWarning(manifest, target, environment, warnings) {
+    if (target.backend === "age") return;
+    const hasRecipients = environment ? manifest.environments.find((e) => e.name === environment)?.recipients?.length : manifest.environments.some((e) => e.recipients?.length);
+    if (hasRecipients) {
+      warnings.push(
+        "Per-environment age recipients are no longer used for encryption on the migrated environments. Consider removing them from clef.yaml if they are no longer needed."
+      );
+    }
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ArtifactPacker,
+  BackendMigrator,
   BulkOps,
   CLEF_MANIFEST_FILENAME,
   CLEF_REPORT_SCHEMA_VERSION,
@@ -11705,6 +11934,7 @@ var VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
   parseIgnoreContent,
   parseJson,
   parseYaml,
+  readManifestYaml,
   redactValue,
   removeAccessRequest,
   requestsFilePath,
@@ -11722,10 +11952,13 @@ var VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
   signKms,
   upsertRequest,
   validateAgePublicKey,
-  verifySignature
+  verifySignature,
+  writeManifestYaml
 });
 /*! Bundled license information:
 
+@noble/hashes/utils.js:
+@noble/hashes/utils.js:
 @noble/hashes/utils.js:
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 
@@ -11735,42 +11968,18 @@ var VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
 @noble/ciphers/utils.js:
   (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
 
-@noble/hashes/utils.js:
-  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/utils.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/abstract/modular.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/abstract/curve.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/abstract/montgomery.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/abstract/weierstrass.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/ed25519.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/curves/nist.js:
   (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 
-@noble/hashes/utils.js:
-  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @noble/post-quantum/utils.js:
-  (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
-
 @noble/post-quantum/_crystals.js:
-  (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
-
 @noble/post-quantum/ml-kem.js:
-  (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
-
 @noble/post-quantum/hybrid.js:
   (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
 */