@clef-sh/core 0.1.11-beta.74 → 0.1.12-beta.85

package/dist/artifact/output.d.ts

@@ -0,0 +1,18 @@
+import type { PackOutput, PackedArtifact } from "./types";
+/** Writes the packed artifact to a local file (atomic rename). */
+export declare class FilePackOutput implements PackOutput {
+    private readonly outputPath;
+    constructor(outputPath: string);
+    write(_artifact: PackedArtifact, json: string): Promise<void>;
+}
+/** Keeps the packed artifact in memory. Used by `clef serve` to avoid disk I/O. */
+export declare class MemoryPackOutput implements PackOutput {
+    private _artifact;
+    private _json;
+    write(artifact: PackedArtifact, json: string): Promise<void>;
+    /** The packed artifact, or null if `write` hasn't been called. */
+    get artifact(): PackedArtifact | null;
+    /** The serialized JSON, or null if `write` hasn't been called. */
+    get json(): string | null;
+}
+//# sourceMappingURL=output.d.ts.map

package/dist/artifact/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/artifact/output.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1D,kEAAkE;AAClE,qBAAa,cAAe,YAAW,UAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEzC,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASpE;AAED,mFAAmF;AACnF,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,KAAK,CAAuB;IAE9B,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlE,kEAAkE;IAClE,IAAI,QAAQ,IAAI,cAAc,GAAG,IAAI,CAEpC;IAED,kEAAkE;IAClE,IAAI,IAAI,IAAI,MAAM,GAAG,IAAI,CAExB;CACF"}

package/dist/artifact/packer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/artifact/packer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAiB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAIjE;;;;;;GAMG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAFJ,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAGpC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAmI9F"}
+{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/artifact/packer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAiB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAKjE;;;;;;GAMG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAFJ,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAGpC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA+H9F"}

package/dist/artifact/types.d.ts

@@ -39,14 +39,20 @@ export interface PackedArtifact {
     /** Algorithm used to produce the signature. */
     signatureAlgorithm?: SignatureAlgorithm;
 }
+/** Output backend for packed artifacts. */
+export interface PackOutput {
+    write(artifact: PackedArtifact, json: string): Promise<void>;
+}
 /** Configuration for the `pack` command. */
 export interface PackConfig {
     /** Service identity name from the manifest. */
     identity: string;
     /** Target environment name. */
     environment: string;
-    /** Local file path to write the artifact JSON to. */
-    outputPath: string;
+    /** Local file path to write the artifact JSON to. Used when `output` is not provided. */
+    outputPath?: string;
+    /** Output backend. When provided, `outputPath` is ignored and the backend handles storage. */
+    output?: PackOutput;
     /** TTL in seconds — embeds an `expiresAt` timestamp in the artifact envelope. */
     ttl?: number;
     /** Ed25519 private key for artifact signing (base64-encoded DER PKCS8). */
@@ -56,7 +62,7 @@ export interface PackConfig {
 }
 /** Result of a pack operation. */
 export interface PackResult {
-    /** Path where the artifact was written. */
+    /** Path where the artifact was written (empty string for non-file outputs). */
     outputPath: string;
     /** Number of namespaces included. */
     namespaceCount: number;

package/dist/artifact/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/artifact/types.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE5D,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/artifact/types.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE5D,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/cloud/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cloud/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAKrD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,GAAG,IAAI,CAkBlE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAS7E"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cloud/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAKrD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,GAAG,IAAI,CAqBlE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAS7E"}

package/dist/cloud/device-flow.d.ts

@@ -5,14 +5,23 @@ export interface DeviceSession {
     /** Session lifetime in seconds. */
     expiresIn: number;
 }
+export type DeviceFlowType = "login" | "setup";
 export interface DevicePollResult {
     status: "pending" | "awaiting_payment" | "complete" | "cancelled" | "expired";
-    /** Present when status is "complete". */
+    /** Cognito refresh token. Present when status is "complete". */
     token?: string;
+    /** Cognito access token. Present when status is "complete". */
+    accessToken?: string;
+    /** Access token lifetime in seconds. Present alongside accessToken. */
+    accessTokenExpiresIn?: number;
     /** Present when status is "complete". */
     integrationId?: string;
     /** Present when status is "complete". */
     keyId?: string;
+    /** Cognito OAuth2 domain URL for token refresh. Present when status is "complete". */
+    cognitoDomain?: string;
+    /** CLI Cognito app client ID. Present when status is "complete". */
+    clientId?: string;
 }
 /**
  * Initiate a device flow session with the Cloud API.
@@ -23,8 +32,9 @@ export interface DevicePollResult {
  */
 export declare function initiateDeviceFlow(endpoint: string | undefined, options: {
     repoName: string;
-    environment: string;
+    environment?: string;
     clientVersion: string;
+    flow: DeviceFlowType;
 }): Promise<DeviceSession>;
 /**
  * Poll a device flow session for completion.

package/dist/cloud/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/cloud/device-flow.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,SAAS,GAAG,kBAAkB,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9E,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACxE,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS/E"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/cloud/device-flow.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,SAAS,GAAG,kBAAkB,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9E,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,cAAc,CAAC;CACtB,GACA,OAAO,CAAC,aAAa,CAAC,CAgCxB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU/E"}

package/dist/cloud/index.d.ts

@@ -4,7 +4,7 @@ export { resolveKeyservicePath, resetKeyserviceResolution } from "./resolver";
 export type { KeyserviceResolution, KeyserviceSource } from "./resolver";
 export { readCloudCredentials, writeCloudCredentials } from "./credentials";
 export { initiateDeviceFlow, pollDeviceFlow } from "./device-flow";
-export type { DeviceSession, DevicePollResult } from "./device-flow";
+export type { DeviceSession, DevicePollResult, DeviceFlowType } from "./device-flow";
 export { CloudPackClient, CloudArtifactClient } from "./pack-client";
 export type { RemotePackConfig, RemotePackResult } from "./pack-client";
 //# sourceMappingURL=index.d.ts.map

package/dist/cloud/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloud/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloud/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/cloud/pack-client.d.ts

@@ -28,7 +28,7 @@ export declare class CloudArtifactClient {
     upload(token: string, config: {
         identity: string;
         environment: string;
-        artifactPath: string;
+        artifactJson: string;
     }): Promise<void>;
 }
 //# sourceMappingURL=pack-client.d.ts.map

package/dist/cloud/pack-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-client.d.ts","sourceRoot":"","sources":["../../src/cloud/pack-client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,UAAU,CAAC;AAIzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAsC/E;AAED;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAIvB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,IAAI,CAAC;CAoBjB"}
+{"version":3,"file":"pack-client.d.ts","sourceRoot":"","sources":["../../src/cloud/pack-client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,UAAU,CAAC;AAIzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAsC/E;AAED;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAIvB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,IAAI,CAAC;CAkBjB"}

package/dist/index.d.mts

@@ -35,12 +35,13 @@ export { ServiceIdentityManager, PartialRotationError } from "./service-identity
 export { resolveIdentitySecrets } from "./artifact/resolve";
 export type { ResolvedSecrets } from "./artifact/resolve";
 export { ArtifactPacker } from "./artifact/packer";
-export type { PackedArtifact, PackConfig, PackResult, ArtifactEnvelope, SignatureAlgorithm, } from "./artifact/types";
+export { FilePackOutput, MemoryPackOutput } from "./artifact/output";
+export type { PackedArtifact, PackConfig, PackResult, PackOutput, ArtifactEnvelope, SignatureAlgorithm, } from "./artifact/types";
 export { buildSigningPayload, generateSigningKeyPair, signEd25519, signKms, verifySignature, detectAlgorithm, } from "./artifact/signer";
 export type { KmsProvider, KmsWrapResult, KmsProviderType } from "./kms";
 export { VALID_KMS_PROVIDERS } from "./kms";
 export { BackendMigrator } from "./migration/backend";
 export type { MigrationTarget, MigrationOptions, MigrationResult, MigrationProgressEvent, } from "./migration/backend";
 export { spawnKeyservice, resolveKeyservicePath, resetKeyserviceResolution, readCloudCredentials, writeCloudCredentials, initiateDeviceFlow, pollDeviceFlow, CloudPackClient, CloudArtifactClient, } from "./cloud";
-export type { KeyserviceHandle, KeyserviceResolution, KeyserviceSource, DeviceSession, DevicePollResult, RemotePackConfig, RemotePackResult, } from "./cloud";
+export type { KeyserviceHandle, KeyserviceResolution, KeyserviceSource, DeviceSession, DevicePollResult, DeviceFlowType, RemotePackConfig, RemotePackResult, } from "./cloud";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts

@@ -35,12 +35,13 @@ export { ServiceIdentityManager, PartialRotationError } from "./service-identity
 export { resolveIdentitySecrets } from "./artifact/resolve";
 export type { ResolvedSecrets } from "./artifact/resolve";
 export { ArtifactPacker } from "./artifact/packer";
-export type { PackedArtifact, PackConfig, PackResult, ArtifactEnvelope, SignatureAlgorithm, } from "./artifact/types";
+export { FilePackOutput, MemoryPackOutput } from "./artifact/output";
+export type { PackedArtifact, PackConfig, PackResult, PackOutput, ArtifactEnvelope, SignatureAlgorithm, } from "./artifact/types";
 export { buildSigningPayload, generateSigningKeyPair, signEd25519, signKms, verifySignature, detectAlgorithm, } from "./artifact/signer";
 export type { KmsProvider, KmsWrapResult, KmsProviderType } from "./kms";
 export { VALID_KMS_PROVIDERS } from "./kms";
 export { BackendMigrator } from "./migration/backend";
 export type { MigrationTarget, MigrationOptions, MigrationResult, MigrationProgressEvent, } from "./migration/backend";
 export { spawnKeyservice, resolveKeyservicePath, resetKeyserviceResolution, readCloudCredentials, writeCloudCredentials, initiateDeviceFlow, pollDeviceFlow, CloudPackClient, CloudArtifactClient, } from "./cloud";
-export type { KeyserviceHandle, KeyserviceResolution, KeyserviceSource, DeviceSession, DevicePollResult, RemotePackConfig, RemotePackResult, } from "./cloud";
+export type { KeyserviceHandle, KeyserviceResolution, KeyserviceSource, DeviceSession, DevicePollResult, DeviceFlowType, RemotePackConfig, RemotePackResult, } from "./cloud";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -6927,6 +6927,7 @@ __export(index_exports, {
   ConsumptionClient: () => ConsumptionClient,
   DiffEngine: () => DiffEngine,
   DriftDetector: () => DriftDetector,
+  FilePackOutput: () => FilePackOutput,
   GitIntegration: () => GitIntegration,
   GitOperationError: () => GitOperationError,
   ImportRunner: () => ImportRunner,
@@ -6934,6 +6935,7 @@ __export(index_exports, {
   ManifestParser: () => ManifestParser,
   ManifestValidationError: () => ManifestValidationError,
   MatrixManager: () => MatrixManager,
+  MemoryPackOutput: () => MemoryPackOutput,
   PartialRotationError: () => PartialRotationError,
   REQUESTS_FILENAME: () => REQUESTS_FILENAME,
   REQUIREMENTS: () => REQUIREMENTS,
@@ -7544,6 +7546,12 @@ var ManifestParser = class {
           );
         }
         const siName = siObj.name;
+        if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(siName)) {
+          throw new ManifestValidationError(
+            `Service identity '${siName}' has an invalid name. Names must be lowercase alphanumeric with hyphens, must not start or end with a hyphen, and max 63 characters (e.g. 'api-gateway', 'auth-service').`,
+            "service_identities"
+          );
+        }
         if (siObj.description != null && typeof siObj.description !== "string") {
           throw new ManifestValidationError(
             `Service identity '${siName}' has a non-string 'description'.`,
@@ -7695,7 +7703,7 @@ var ManifestParser = class {
           "cloud"
         );
       }
-      if (!/^clef:[a-z0-9_]+\/[a-z0-9_-]+$/.test(cloudObj.keyId)) {
+      if (!/^clef:[a-zA-Z0-9_]+\/[a-zA-Z0-9_-]+$/.test(cloudObj.keyId)) {
         throw new ManifestValidationError(
           `Field 'cloud.keyId' has invalid format '${cloudObj.keyId}'. Must match: clef:<integrationId>/<keyAlias>`,
           "cloud"
@@ -9107,6 +9115,13 @@ function openWindowsInputPipe(content) {
     });
   });
 }
+function cloudKeyToArn(keyId) {
+  const body = keyId.replace(/^clef:/, "");
+  const sep = body.indexOf("/");
+  const integration = sep >= 0 ? body.slice(0, sep) : body;
+  const env = sep >= 0 ? body.slice(sep + 1) : "default";
+  return `arn:aws:kms:us-east-1:000000000000:alias/clef/${integration}/${env}`;
+}
 var SopsClient = class {
   /**
    * @param runner - Subprocess runner used to invoke the `sops` binary.
@@ -9152,7 +9167,7 @@ var SopsClient = class {
     const env = this.buildSopsEnv();
     const result = await this.runner.run(
       this.sopsCommand,
-      [...this.keyserviceArgs, "decrypt", "--output-type", fmt, filePath],
+      ["decrypt", ...this.keyserviceArgs, "--output-type", fmt, filePath],
       {
         ...env ? { env } : {}
       }
@@ -9218,8 +9233,8 @@ var SopsClient = class {
         [
           "--config",
           configPath,
-          ...this.keyserviceArgs,
           "encrypt",
+          ...this.keyserviceArgs,
           ...args,
           "--input-type",
           fmt,
@@ -9273,7 +9288,7 @@ var SopsClient = class {
     const env = this.buildSopsEnv();
     const result = await this.runner.run(
       this.sopsCommand,
-      [...this.keyserviceArgs, "rotate", "-i", "--add-age", key, filePath],
+      ["rotate", ...this.keyserviceArgs, "-i", "--add-age", key, filePath],
       {
         ...env ? { env } : {}
       }
@@ -9297,7 +9312,7 @@ var SopsClient = class {
     const env = this.buildSopsEnv();
     const result = await this.runner.run(
       this.sopsCommand,
-      [...this.keyserviceArgs, "rotate", "-i", "--rm-age", key, filePath],
+      ["rotate", ...this.keyserviceArgs, "-i", "--rm-age", key, filePath],
       {
         ...env ? { env } : {}
       }
@@ -9411,7 +9426,7 @@ var SopsClient = class {
     if (sops.age && Array.isArray(sops.age) && sops.age.length > 0) return "age";
     if (sops.kms && Array.isArray(sops.kms) && sops.kms.length > 0) {
       const firstArn = sops.kms[0]?.arn;
-      if (typeof firstArn === "string" && firstArn.startsWith("clef:")) {
+      if (typeof firstArn === "string" && (firstArn.startsWith("clef:") || firstArn.includes("alias/clef/"))) {
         return "cloud";
       }
       return "awskms";
@@ -9494,7 +9509,7 @@ var SopsClient = class {
       case "cloud": {
         const cloudKeyId = manifest.cloud?.keyId;
         if (cloudKeyId) {
-          args.push("--kms", cloudKeyId);
+          args.push("--kms", cloudKeyToArn(cloudKeyId));
         }
         break;
       }
@@ -10961,7 +10976,7 @@ var CloudClient = class {
         response = await fetch(url, init);
       } catch (retryErr) {
         throw new CloudApiError(
-          `Network error contacting Clef Pro: ${retryErr.message}`,
+          `Network error contacting Clef Cloud: ${retryErr.message}`,
           0,
           "Check your network connection and CLEF_API_URL."
         );
@@ -10983,7 +10998,7 @@ var CloudClient = class {
   buildError(response) {
     const hint = response.status === 401 || response.status === 403 ? "Check your API token (--api-token or CLEF_API_TOKEN)." : response.status === 404 ? "Check your cloud.integrationId in clef.yaml." : void 0;
     return new CloudApiError(
-      `Clef Pro API returned ${response.status} ${response.statusText}`,
+      `Clef Cloud API returned ${response.status} ${response.statusText}`,
       response.status,
       hint
     );
@@ -11504,9 +11519,41 @@ async function resolveIdentitySecrets(identityName, environment, manifest, repoR
 }
 
 // src/artifact/packer.ts
+var crypto4 = __toESM(require("crypto"));
+
+// src/artifact/output.ts
 var fs16 = __toESM(require("fs"));
 var path19 = __toESM(require("path"));
-var crypto4 = __toESM(require("crypto"));
+var FilePackOutput = class {
+  constructor(outputPath) {
+    this.outputPath = outputPath;
+  }
+  async write(_artifact, json) {
+    const outputDir = path19.dirname(this.outputPath);
+    if (!fs16.existsSync(outputDir)) {
+      fs16.mkdirSync(outputDir, { recursive: true });
+    }
+    const tmpOutput = `${this.outputPath}.tmp.${process.pid}`;
+    fs16.writeFileSync(tmpOutput, json, "utf-8");
+    fs16.renameSync(tmpOutput, this.outputPath);
+  }
+};
+var MemoryPackOutput = class {
+  _artifact = null;
+  _json = null;
+  async write(artifact, json) {
+    this._artifact = artifact;
+    this._json = json;
+  }
+  /** The packed artifact, or null if `write` hasn't been called. */
+  get artifact() {
+    return this._artifact;
+  }
+  /** The serialized JSON, or null if `write` hasn't been called. */
+  get json() {
+    return this._json;
+  }
+};
 
 // src/artifact/signer.ts
 var crypto3 = __toESM(require("crypto"));
@@ -11677,10 +11724,6 @@ var ArtifactPacker = class {
         ciphertext
       };
     }
-    const outputDir = path19.dirname(config.outputPath);
-    if (!fs16.existsSync(outputDir)) {
-      fs16.mkdirSync(outputDir, { recursive: true });
-    }
     if (config.ttl && config.ttl > 0) {
       artifact.expiresAt = new Date(Date.now() + config.ttl * 1e3).toISOString();
     }
@@ -11697,11 +11740,10 @@ var ArtifactPacker = class {
       artifact.signatureAlgorithm = "ECDSA_SHA256";
     }
     const json = JSON.stringify(artifact, null, 2);
-    const tmpOutput = `${config.outputPath}.tmp.${process.pid}`;
-    fs16.writeFileSync(tmpOutput, json, "utf-8");
-    fs16.renameSync(tmpOutput, config.outputPath);
+    const output = config.output ?? new FilePackOutput(config.outputPath ?? "artifact.json");
+    await output.write(artifact, json);
     return {
-      outputPath: config.outputPath,
+      outputPath: config.outputPath ?? "",
       namespaceCount: resolved.identity.namespaces.length,
       keyCount: Object.keys(resolved.values).length,
       artifactSize: Buffer.byteLength(json, "utf-8"),
@@ -11734,10 +11776,19 @@ function metadataMatchesTarget(meta, target) {
   return meta.recipients.includes(target.key);
 }
 var BackendMigrator = class {
-  constructor(encryption, matrixManager) {
-    this.encryption = encryption;
+  /**
+   * @param encryption - Backend used for both decrypt and encrypt (standard case).
+   * @param matrixManager - Matrix resolver.
+   * @param targetEncryption - Optional separate backend for encrypt. Use when migrating
+   *   from cloud (decrypt via keyservice) to another backend (encrypt via local credentials).
+   */
+  constructor(encryption, matrixManager, targetEncryption) {
     this.matrixManager = matrixManager;
+    this.decryptBackend = encryption;
+    this.encryptBackend = targetEncryption ?? encryption;
   }
+  decryptBackend;
+  encryptBackend;
   async migrate(manifest, repoRoot, options, onProgress) {
     const { target, environment, dryRun, skipVerify } = options;
     if (environment) {
@@ -11760,7 +11811,7 @@ var BackendMigrator = class {
     const toMigrate = [];
     const skippedFiles = [];
     for (const cell of targetCells) {
-      const meta = await this.encryption.getMetadata(cell.filePath);
+      const meta = await this.decryptBackend.getMetadata(cell.filePath);
       if (metadataMatchesTarget(meta, target)) {
         skippedFiles.push(cell.filePath);
         onProgress?.({
@@ -11822,8 +11873,8 @@ var BackendMigrator = class {
           file: cell.filePath,
           message: `Migrating ${cell.namespace}/${cell.environment}...`
         });
-        const decrypted = await this.encryption.decrypt(cell.filePath);
-        await this.encryption.encrypt(
+        const decrypted = await this.decryptBackend.decrypt(cell.filePath);
+        await this.encryptBackend.encrypt(
           cell.filePath,
           decrypted.values,
           updatedManifest,
@@ -11858,7 +11909,7 @@ var BackendMigrator = class {
             file: cell.filePath,
             message: `Verifying ${cell.namespace}/${cell.environment}...`
           });
-          await this.encryption.decrypt(cell.filePath);
+          await this.encryptBackend.decrypt(cell.filePath);
           verifiedFiles.push(cell.filePath);
         } catch (err) {
           const errorMsg = err instanceof Error ? err.message : String(err);
@@ -11894,6 +11945,18 @@ var BackendMigrator = class {
         sops[keyField] = target.key;
       }
     }
+    if (doc.cloud && target.backend !== "cloud") {
+      const sops = doc.sops;
+      const environments = doc.environments;
+      const defaultIsCloud = sops.default_backend === "cloud";
+      const anyEnvIsCloud = environments.some((e) => {
+        const envSops = e.sops;
+        return envSops?.backend === "cloud";
+      });
+      if (!defaultIsCloud && !anyEnvIsCloud) {
+        delete doc.cloud;
+      }
+    }
   }
   rollback(manifestPath, manifestBackup, fileBackups) {
     for (const [filePath, backup] of fileBackups) {
@@ -12074,11 +12137,10 @@ function readCloudCredentials() {
   }
   if (!raw || typeof raw !== "object") return null;
   const obj = raw;
-  if (typeof obj.token !== "string" || obj.token.length === 0) return null;
-  return {
-    token: obj.token,
-    endpoint: typeof obj.endpoint === "string" ? obj.endpoint : CLOUD_DEFAULT_ENDPOINT
-  };
+  const token = typeof obj.token === "string" && obj.token.length > 0 ? obj.token : "";
+  const endpoint = typeof obj.endpoint === "string" ? obj.endpoint : CLOUD_DEFAULT_ENDPOINT;
+  if (!token && endpoint === CLOUD_DEFAULT_ENDPOINT) return null;
+  return { token, endpoint };
 }
 function writeCloudCredentials(credentials) {
   const clefDir = path23.join(os2.homedir(), ".clef");
@@ -12094,21 +12156,30 @@ function writeCloudCredentials(credentials) {
 // src/cloud/device-flow.ts
 async function initiateDeviceFlow(endpoint, options) {
   const base = endpoint ?? CLOUD_DEFAULT_ENDPOINT;
+  const payload = {
+    clientType: "cli",
+    clientVersion: options.clientVersion,
+    repoName: options.repoName,
+    flow: options.flow
+  };
+  if (options.environment) {
+    payload.environment = options.environment;
+  }
   const res = await fetch(`${base}/api/v1/device/init`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      clientType: "cli",
-      clientVersion: options.clientVersion,
-      repoName: options.repoName,
-      environment: options.environment
-    })
+    body: JSON.stringify(payload)
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     throw new Error(`Device flow init failed (${res.status}): ${body}`);
   }
-  return await res.json();
+  const json = await res.json();
+  const session = json.data ?? json;
+  if (session.pollUrl && !session.pollUrl.startsWith("http")) {
+    session.pollUrl = `${base}${session.pollUrl}`;
+  }
+  return session;
 }
 async function pollDeviceFlow(pollUrl) {
   const res = await fetch(pollUrl);
@@ -12116,7 +12187,8 @@ async function pollDeviceFlow(pollUrl) {
     const body = await res.text().catch(() => "");
     throw new Error(`Device flow poll failed (${res.status}): ${body}`);
   }
-  return await res.json();
+  const json = await res.json();
+  return json.data ?? json;
 }
 
 // src/cloud/pack-client.ts
@@ -12163,7 +12235,6 @@ var CloudArtifactClient = class {
     this.endpoint = endpoint ?? CLOUD_DEFAULT_ENDPOINT;
   }
   async upload(token, config) {
-    const content = fs21.readFileSync(config.artifactPath, "utf-8");
     const res = await fetch(
       `${this.endpoint}/api/v1/cloud/artifacts/${config.identity}/${config.environment}`,
       {
@@ -12172,7 +12243,7 @@ var CloudArtifactClient = class {
           Authorization: `Bearer ${token}`,
           "Content-Type": "application/json"
         },
-        body: content
+        body: config.artifactJson
       }
     );
     if (!res.ok) {
@@ -12197,6 +12268,7 @@ var CloudArtifactClient = class {
   ConsumptionClient,
   DiffEngine,
   DriftDetector,
+  FilePackOutput,
   GitIntegration,
   GitOperationError,
   ImportRunner,
@@ -12204,6 +12276,7 @@ var CloudArtifactClient = class {
   ManifestParser,
   ManifestValidationError,
   MatrixManager,
+  MemoryPackOutput,
   PartialRotationError,
   REQUESTS_FILENAME,
   REQUIREMENTS,