@clef-sh/core 0.1.14 → 0.1.15-beta.106

package/dist/__mocks__/write-file-atomic.d.ts

@@ -0,0 +1,5 @@
+declare const writeFileAtomic: jest.Mock<any, any, any> & {
+    sync: jest.Mock<any, any, any>;
+};
+export default writeFileAtomic;
+//# sourceMappingURL=write-file-atomic.d.ts.map

package/dist/__mocks__/write-file-atomic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-file-atomic.d.ts","sourceRoot":"","sources":["../../src/__mocks__/write-file-atomic.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,eAAe;;CAAkE,CAAC;AACxF,eAAe,eAAe,CAAC"}

package/dist/bulk/ops.d.ts

@@ -1,15 +1,24 @@
 import { ClefManifest, MatrixCell } from "../types";
 import { EncryptionBackend } from "../types";
+import { TransactionManager } from "../tx";
 /**
  * Performs bulk set, delete, and copy operations across multiple environments.
  *
+ * Each public method wraps its work in a single TransactionManager commit so
+ * any cell-write failure rolls back ALL writes via `git reset --hard`. The
+ * previous "collect errors and continue" behavior is gone — bulk ops are now
+ * all-or-nothing.
+ *
  * @example
  * ```ts
- * const bulk = new BulkOps();
+ * const tx = new TransactionManager(new GitIntegration(runner));
+ * const bulk = new BulkOps(tx);
  * await bulk.setAcrossEnvironments("app", "DATABASE_URL", { staging: "...", production: "..." }, manifest, sopsClient, repoRoot);
  * ```
  */
 export declare class BulkOps {
+    private readonly tx;
+    constructor(tx: TransactionManager);
     /**
      * Set a key to different values in multiple environments at once.
      *
@@ -19,7 +28,7 @@ export declare class BulkOps {
      * @param manifest - Parsed manifest.
      * @param sopsClient - SOPS client used to decrypt and re-encrypt each file.
      * @param repoRoot - Absolute path to the repository root.
-     * @throws `Error` with details if any environment fails.
+     * @throws Whatever the underlying encrypt throws — the transaction rolls back.
      */
     setAcrossEnvironments(namespace: string, key: string, values: Record<string, string>, manifest: ClefManifest, sopsClient: EncryptionBackend, repoRoot: string): Promise<void>;
     /**
@@ -30,7 +39,6 @@ export declare class BulkOps {
      * @param manifest - Parsed manifest.
      * @param sopsClient - SOPS client.
      * @param repoRoot - Absolute path to the repository root.
-     * @throws `Error` with details if any environment fails.
      */
     deleteAcrossEnvironments(namespace: string, key: string, manifest: ClefManifest, sopsClient: EncryptionBackend, repoRoot: string): Promise<void>;
     /**
@@ -41,8 +49,9 @@ export declare class BulkOps {
      * @param toCell - Destination matrix cell.
      * @param sopsClient - SOPS client.
      * @param manifest - Parsed manifest.
+     * @param repoRoot - Absolute path to the repository root.
      * @throws `Error` if the key does not exist in the source cell.
      */
-    copyValue(key: string, fromCell: MatrixCell, toCell: MatrixCell, sopsClient: EncryptionBackend, manifest: ClefManifest): Promise<void>;
+    copyValue(key: string, fromCell: MatrixCell, toCell: MatrixCell, sopsClient: EncryptionBackend, manifest: ClefManifest, repoRoot: string): Promise<void>;
 }
 //# sourceMappingURL=ops.d.ts.map

package/dist/bulk/ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../../src/bulk/ops.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,OAAO;IAClB;;;;;;;;;;OAUG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA+BhB;;;;;;;;;OASG;IACG,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;;OASG;IACG,SAAS,CACb,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;CAajB"}
+{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../../src/bulk/ops.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,kBAAkB;IAEnD;;;;;;;;;;OAUG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;OAQG;IACG,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;;;;;;;;OAUG;IACG,SAAS,CACb,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAmBjB"}

package/dist/git/integration.d.ts

@@ -25,10 +25,81 @@ export declare class GitIntegration {
      *
      * @param message - Commit message.
      * @param repoRoot - Working directory for the git command.
-     * @returns The short commit hash, or an empty string if parsing fails.
+     * @param options - Optional commit options (env vars, no-verify).
+     * @returns The full commit hash.
      * @throws {@link GitOperationError} On failure.
      */
-    commit(message: string, repoRoot: string): Promise<string>;
+    commit(message: string, repoRoot: string, options?: {
+        env?: Record<string, string>;
+        noVerify?: boolean;
+    }): Promise<string>;
+    /**
+     * Get the current HEAD commit SHA.
+     *
+     * @param repoRoot - Working directory for the git command.
+     * @returns The full commit hash.
+     * @throws {@link GitOperationError} On failure.
+     */
+    getHead(repoRoot: string): Promise<string>;
+    /**
+     * Reset HEAD and the working tree to a specific commit (`git reset --hard`).
+     * Used by the transaction manager to roll back failed mutations.
+     *
+     * WARNING: this discards uncommitted changes in the working tree. Callers
+     * must verify the working tree state before calling.
+     *
+     * @param repoRoot - Working directory for the git command.
+     * @param sha - Commit SHA to reset to.
+     * @throws {@link GitOperationError} On failure.
+     */
+    resetHard(repoRoot: string, sha: string): Promise<void>;
+    /**
+     * Remove untracked files matching the given paths (`git clean -fd <paths>`).
+     * Scoped to the declared paths so unrelated untracked files are preserved.
+     *
+     * @param repoRoot - Working directory for the git command.
+     * @param paths - Paths to clean (relative to repoRoot).
+     * @throws {@link GitOperationError} On failure.
+     */
+    cleanFiles(repoRoot: string, paths: string[]): Promise<void>;
+    /**
+     * Check whether the working tree has uncommitted changes (staged or unstaged).
+     *
+     * @param repoRoot - Working directory for the git command.
+     * @returns True if there are uncommitted changes.
+     * @throws {@link GitOperationError} On failure.
+     */
+    isDirty(repoRoot: string): Promise<boolean>;
+    /**
+     * Check whether the repository is in the middle of a multi-step git operation
+     * (merge, rebase, cherry-pick, revert). Mutating during these operations is
+     * dangerous because rollback via `git reset --hard` would corrupt them.
+     *
+     * @param repoRoot - Absolute path to the repository root.
+     * @returns The kind of operation in progress, or null if none.
+     */
+    isMidOperation(repoRoot: string): Promise<{
+        midOp: boolean;
+        kind?: "merge" | "rebase" | "cherry-pick" | "revert";
+    }>;
+    /**
+     * Check whether the directory is inside a git repository.
+     *
+     * @param repoRoot - Working directory for the git command.
+     * @returns True if `git rev-parse --git-dir` succeeds.
+     */
+    isRepo(repoRoot: string): Promise<boolean>;
+    /**
+     * Check whether the user has configured a git author identity.
+     * `git commit` will fail if either `user.name` or `user.email` is unset.
+     *
+     * @param repoRoot - Working directory for the git command.
+     * @returns The configured name and email, or null if unset.
+     */
+    getAuthorIdentity(repoRoot: string): Promise<{
+        name: string;
+        email: string;
+    } | null>;
     /**
      * Retrieve recent commits for a specific file.
      *

package/dist/git/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/git/integration.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAqB,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAyCrF;;;;;;;;;GASG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IAErD;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAatE;;;;;;;OAOG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAehE;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IA6B1F;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAmCrD;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BzD;;;;;;OAMG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;YAe5C,mBAAmB;IAyBjC;;;;;;OAMG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB5D"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/git/integration.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAqB,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAyCrF;;;;;;;;;GASG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IAErD;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAatE;;;;;;;;OAQG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7D,OAAO,CAAC,MAAM,CAAC;IAqBlB;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAahD;;;;;;;;;;OAUG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7D;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAelE;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBjD;;;;;;;OAOG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAA;KAAE,CAAC;IAsBpF;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhD;;;;;;OAMG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1F;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IA6B1F;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA8CrD;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BzD;;;;;;OAMG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;YAe5C,mBAAmB;IAyBjC;;;;;;OAMG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB5D"}

package/dist/import/index.d.ts

@@ -1,6 +1,7 @@
 import { ClefManifest } from "../types";
 import { EncryptionBackend } from "../types";
 import { ImportFormat } from "./parsers";
+import { TransactionManager } from "../tx";
 export type { ImportFormat, ParsedImport } from "./parsers";
 export interface ImportOptions {
     format?: ImportFormat;
@@ -23,15 +24,23 @@ export interface ImportResult {
 /**
  * Imports secrets from `.env`, JSON, or YAML files into encrypted matrix cells.
  *
+ * Real (non-dry-run) imports run inside a single TransactionManager commit:
+ * one encrypt of the merged value set, one commit, all-or-nothing rollback
+ * via `git reset --hard`. The previous per-key encrypt-then-continue
+ * behavior is gone — partial imports were a footgun and N file rewrites for
+ * N keys was wasteful.
+ *
  * @example
  * ```ts
- * const runner = new ImportRunner(sopsClient);
- * const result = await runner.import("app/staging", null, envContent, manifest, repoRoot, { format: "dotenv" });
+ * const tx = new TransactionManager(new GitIntegration(runner));
+ * const importer = new ImportRunner(sopsClient, tx);
+ * const result = await importer.import("app/staging", null, envContent, manifest, repoRoot, { format: "dotenv" });
  * ```
  */
 export declare class ImportRunner {
     private readonly sopsClient;
-    constructor(sopsClient: EncryptionBackend);
+    private readonly tx;
+    constructor(sopsClient: EncryptionBackend, tx: TransactionManager);
     /**
      * Parse a source file and import its key/value pairs into a target `namespace/environment` cell.
      *

package/dist/import/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAS,YAAY,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,iBAAiB;IAE1D;;;;;;;;;OASG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC;CA6EzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAS,YAAY,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAC3C,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBADF,UAAU,EAAE,iBAAiB,EAC7B,EAAE,EAAE,kBAAkB;IAGzC;;;;;;;;;OASG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC;CAiFzB"}

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 export * from "./types";
 export { ManifestParser, CLEF_MANIFEST_FILENAME } from "./manifest/parser";
-export { readManifestYaml, writeManifestYaml } from "./manifest/io";
+export { readManifestYaml, writeManifestYaml, writeManifestYamlRaw } from "./manifest/io";
 export { ScanRunner, shannonEntropy, isHighEntropy, matchPatterns, redactValue, loadIgnoreRules, shouldIgnoreFile, shouldIgnoreMatch, parseIgnoreContent, } from "./scanner";
 export type { ScanMatch, ScanResult, ScanOptions, ClefIgnoreRules } from "./scanner";
 export { MatrixManager } from "./matrix/manager";
@@ -8,6 +8,8 @@ export { SchemaValidator } from "./schema/validator";
 export { DiffEngine } from "./diff/engine";
 export { BulkOps } from "./bulk/ops";
 export { GitIntegration } from "./git/integration";
+export { TransactionManager, TransactionLockError, TransactionPreflightError, TransactionRollbackError, } from "./tx";
+export type { TransactionOptions, TransactionResult } from "./tx";
 export { SopsClient } from "./sops/client";
 export { resolveSopsPath, resetSopsResolution } from "./sops/resolver";
 export type { SopsResolution, SopsSource } from "./sops/resolver";
@@ -31,7 +33,9 @@ export { DriftDetector } from "./drift/detector";
 export { ReportGenerator, ReportSanitizer, ReportTransformer, CloudClient, collectCIContext, } from "./report";
 export { SopsMergeDriver } from "./merge/driver";
 export type { MergeResult, MergeKey, MergeKeyStatus } from "./merge/driver";
-export { ServiceIdentityManager, PartialRotationError } from "./service-identity/manager";
+export { ServiceIdentityManager } from "./service-identity/manager";
+export { StructureManager } from "./structure/manager";
+export type { NamespaceEditOptions, EnvironmentEditOptions, AddNamespaceOptions, AddEnvironmentOptions, } from "./structure/manager";
 export { resolveIdentitySecrets } from "./artifact/resolve";
 export type { ResolvedSecrets } from "./artifact/resolve";
 export { ArtifactPacker } from "./artifact/packer";
@@ -42,6 +46,8 @@ export type { KmsProvider, KmsWrapResult, KmsProviderType } from "./kms";
 export { VALID_KMS_PROVIDERS } from "./kms";
 export { BackendMigrator } from "./migration/backend";
 export type { MigrationTarget, MigrationOptions, MigrationResult, MigrationProgressEvent, } from "./migration/backend";
+export { ResetManager, describeScope, validateResetScope } from "./reset/manager";
+export type { ResetScope, ResetOptions, ResetResult } from "./reset/manager";
 export { spawnKeyservice, resolveKeyservicePath, resetKeyserviceResolution, readCloudCredentials, writeCloudCredentials, initiateDeviceFlow, pollDeviceFlow, CloudPackClient, CloudArtifactClient, } from "./cloud";
 export type { KeyserviceHandle, KeyserviceResolution, KeyserviceSource, DeviceSession, DevicePollResult, DeviceFlowType, RemotePackConfig, RemotePackResult, } from "./cloud";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export * from "./types";
 export { ManifestParser, CLEF_MANIFEST_FILENAME } from "./manifest/parser";
-export { readManifestYaml, writeManifestYaml } from "./manifest/io";
+export { readManifestYaml, writeManifestYaml, writeManifestYamlRaw } from "./manifest/io";
 export { ScanRunner, shannonEntropy, isHighEntropy, matchPatterns, redactValue, loadIgnoreRules, shouldIgnoreFile, shouldIgnoreMatch, parseIgnoreContent, } from "./scanner";
 export type { ScanMatch, ScanResult, ScanOptions, ClefIgnoreRules } from "./scanner";
 export { MatrixManager } from "./matrix/manager";
@@ -8,6 +8,8 @@ export { SchemaValidator } from "./schema/validator";
 export { DiffEngine } from "./diff/engine";
 export { BulkOps } from "./bulk/ops";
 export { GitIntegration } from "./git/integration";
+export { TransactionManager, TransactionLockError, TransactionPreflightError, TransactionRollbackError, } from "./tx";
+export type { TransactionOptions, TransactionResult } from "./tx";
 export { SopsClient } from "./sops/client";
 export { resolveSopsPath, resetSopsResolution } from "./sops/resolver";
 export type { SopsResolution, SopsSource } from "./sops/resolver";
@@ -31,7 +33,9 @@ export { DriftDetector } from "./drift/detector";
 export { ReportGenerator, ReportSanitizer, ReportTransformer, CloudClient, collectCIContext, } from "./report";
 export { SopsMergeDriver } from "./merge/driver";
 export type { MergeResult, MergeKey, MergeKeyStatus } from "./merge/driver";
-export { ServiceIdentityManager, PartialRotationError } from "./service-identity/manager";
+export { ServiceIdentityManager } from "./service-identity/manager";
+export { StructureManager } from "./structure/manager";
+export type { NamespaceEditOptions, EnvironmentEditOptions, AddNamespaceOptions, AddEnvironmentOptions, } from "./structure/manager";
 export { resolveIdentitySecrets } from "./artifact/resolve";
 export type { ResolvedSecrets } from "./artifact/resolve";
 export { ArtifactPacker } from "./artifact/packer";
@@ -42,6 +46,8 @@ export type { KmsProvider, KmsWrapResult, KmsProviderType } from "./kms";
 export { VALID_KMS_PROVIDERS } from "./kms";
 export { BackendMigrator } from "./migration/backend";
 export type { MigrationTarget, MigrationOptions, MigrationResult, MigrationProgressEvent, } from "./migration/backend";
+export { ResetManager, describeScope, validateResetScope } from "./reset/manager";
+export type { ResetScope, ResetOptions, ResetResult } from "./reset/manager";
 export { spawnKeyservice, resolveKeyservicePath, resetKeyserviceResolution, readCloudCredentials, writeCloudCredentials, initiateDeviceFlow, pollDeviceFlow, CloudPackClient, CloudArtifactClient, } from "./cloud";
 export type { KeyserviceHandle, KeyserviceResolution, KeyserviceSource, DeviceSession, DevicePollResult, DeviceFlowType, RemotePackConfig, RemotePackResult, } from "./cloud";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC"}