@clef-sh/core 0.1.11-beta.62 → 0.1.11-beta.68

package/dist/index.mjs

@@ -462,8 +462,26 @@ var ManifestParser = class {
         "sops.default_backend"
       );
     }
+    const ageObj = sopsObj.age;
+    const ageRecipients = ageObj && Array.isArray(ageObj.recipients) ? ageObj.recipients : void 0;
+    const parsedAge = ageRecipients ? {
+      age: {
+        recipients: ageRecipients.map((r) => {
+          if (typeof r === "string") return r;
+          if (typeof r === "object" && r !== null) {
+            const obj2 = r;
+            return {
+              key: String(obj2.key ?? ""),
+              ...typeof obj2.label === "string" ? { label: obj2.label } : {}
+            };
+          }
+          return String(r);
+        })
+      }
+    } : {};
     const sopsConfig = {
       default_backend: sopsObj.default_backend,
+      ...parsedAge,
       ...typeof sopsObj.aws_kms_arn === "string" ? { aws_kms_arn: sopsObj.aws_kms_arn } : {},
       ...typeof sopsObj.gcp_kms_resource_id === "string" ? { gcp_kms_resource_id: sopsObj.gcp_kms_resource_id } : {},
       ...typeof sopsObj.azure_kv_url === "string" ? { azure_kv_url: sopsObj.azure_kv_url } : {},
@@ -829,8 +847,8 @@ function matchesGlob(filePath, pattern) {
 var ALWAYS_SKIP_EXTENSIONS = [".enc.yaml", ".enc.json"];
 var ALWAYS_SKIP_NAMES = [
   ".clef-meta.yaml",
-  ".sops.yaml"
-  // contains age public keys and KMS ARNs — configuration, not secrets
+  "clef.yaml"
+  // manifest — contains public keys and config, not secrets
 ];
 var ALWAYS_SKIP_DIRS = ["node_modules", ".git"];
 var MAX_FILE_SIZE = 1024 * 1024;
@@ -2162,9 +2180,12 @@ var SopsClient = class {
     }
     let result;
     try {
+      const configPath = process.platform === "win32" ? "NUL" : "/dev/null";
       result = await this.runner.run(
         this.sopsCommand,
         [
+          "--config",
+          configPath,
           "encrypt",
           ...args,
           "--input-type",
@@ -2401,8 +2422,15 @@ var SopsClient = class {
       pgp_fingerprint: manifest.sops.pgp_fingerprint
     };
     switch (config.backend) {
-      case "age":
+      case "age": {
+        const envRecipients = environment ? resolveRecipientsForEnvironment(manifest, environment) : void 0;
+        const recipients = envRecipients ?? manifest.sops.age?.recipients ?? [];
+        const keys = recipients.map((r) => typeof r === "string" ? r : r.key);
+        if (keys.length > 0) {
+          args.push("--age", keys.join(","));
+        }
         break;
+      }
       case "awskms":
         if (config.aws_kms_arn) {
           args.push("--kms", config.aws_kms_arn);
@@ -4437,14 +4465,13 @@ import * as crypto3 from "crypto";
 import * as crypto2 from "crypto";
 function buildSigningPayload(artifact) {
   const fields = [
-    "clef-sig-v2",
+    "clef-sig-v3",
     String(artifact.version),
     artifact.identity,
     artifact.environment,
     artifact.revision,
     artifact.packedAt,
     artifact.ciphertextHash,
-    [...artifact.keys].sort().join(","),
     artifact.expiresAt ?? "",
     artifact.envelope?.provider ?? "",
     artifact.envelope?.keyId ?? "",
@@ -4567,7 +4594,6 @@ var ArtifactPacker = class {
           revision,
           ciphertextHash,
           ciphertext,
-          keys: Object.keys(resolved.values),
           envelope: {
             provider: kmsConfig.provider,
             keyId: kmsConfig.keyId,
@@ -4601,8 +4627,7 @@ var ArtifactPacker = class {
         packedAt: (/* @__PURE__ */ new Date()).toISOString(),
         revision,
         ciphertextHash,
-        ciphertext,
-        keys: Object.keys(resolved.values)
+        ciphertext
       };
     }
     const outputDir = path19.dirname(config.outputPath);
@@ -4665,7 +4690,7 @@ var BackendMigrator = class {
     this.encryption = encryption;
     this.matrixManager = matrixManager;
   }
-  async migrate(manifest, repoRoot, options, callbacks, onProgress) {
+  async migrate(manifest, repoRoot, options, onProgress) {
     const { target, environment, dryRun, skipVerify } = options;
     if (environment) {
       const env = manifest.environments.find((e) => e.name === environment);
@@ -4735,14 +4760,11 @@ var BackendMigrator = class {
     }
     const manifestPath = path20.join(repoRoot, CLEF_MANIFEST_FILENAME);
     const manifestBackup = fs17.readFileSync(manifestPath, "utf-8");
-    const sopsYamlPath = path20.join(repoRoot, ".sops.yaml");
-    const sopsYamlBackup = fs17.existsSync(sopsYamlPath) ? fs17.readFileSync(sopsYamlPath, "utf-8") : void 0;
     const fileBackups = /* @__PURE__ */ new Map();
     const doc = readManifestYaml(repoRoot);
     this.updateManifestDoc(doc, target, environment);
     writeManifestYaml(repoRoot, doc);
     const updatedManifest = YAML11.parse(YAML11.stringify(doc));
-    callbacks.regenerateSopsConfig();
     const migratedFiles = [];
     for (const cell of toMigrate) {
       try {
@@ -4761,7 +4783,7 @@ var BackendMigrator = class {
         );
         migratedFiles.push(cell.filePath);
       } catch (err) {
-        this.rollback(manifestPath, manifestBackup, sopsYamlPath, sopsYamlBackup, fileBackups);
+        this.rollback(manifestPath, manifestBackup, fileBackups);
         const errorMsg = err instanceof Error ? err.message : String(err);
         onProgress?.({
           type: "warn",
@@ -4825,15 +4847,10 @@ var BackendMigrator = class {
       }
     }
   }
-  rollback(manifestPath, manifestBackup, sopsYamlPath, sopsYamlBackup, fileBackups) {
+  rollback(manifestPath, manifestBackup, fileBackups) {
     for (const [filePath, backup] of fileBackups) {
       fs17.writeFileSync(filePath, backup, "utf-8");
     }
-    if (sopsYamlBackup !== void 0) {
-      fs17.writeFileSync(sopsYamlPath, sopsYamlBackup, "utf-8");
-    } else if (fs17.existsSync(sopsYamlPath)) {
-      fs17.unlinkSync(sopsYamlPath);
-    }
     fs17.writeFileSync(manifestPath, manifestBackup, "utf-8");
   }
   checkAgeRecipientsWarning(manifest, target, environment, warnings) {