@clef-sh/core 0.1.15 → 0.1.16

package/dist/index.d.mts

@@ -34,6 +34,7 @@ export { ReportGenerator, ReportSanitizer, ReportTransformer, CloudClient, colle
 export { SopsMergeDriver } from "./merge/driver";
 export type { MergeResult, MergeKey, MergeKeyStatus } from "./merge/driver";
 export { ServiceIdentityManager } from "./service-identity/manager";
+export type { CreateServiceIdentityOptions } from "./service-identity/manager";
 export { StructureManager } from "./structure/manager";
 export type { NamespaceEditOptions, EnvironmentEditOptions, AddNamespaceOptions, AddEnvironmentOptions, } from "./structure/manager";
 export { resolveIdentitySecrets } from "./artifact/resolve";

package/dist/index.d.ts

@@ -34,6 +34,7 @@ export { ReportGenerator, ReportSanitizer, ReportTransformer, CloudClient, colle
 export { SopsMergeDriver } from "./merge/driver";
 export type { MergeResult, MergeKey, MergeKeyStatus } from "./merge/driver";
 export { ServiceIdentityManager } from "./service-identity/manager";
+export type { CreateServiceIdentityOptions } from "./service-identity/manager";
 export { StructureManager } from "./structure/manager";
 export type { NamespaceEditOptions, EnvironmentEditOptions, AddNamespaceOptions, AddEnvironmentOptions, } from "./structure/manager";
 export { resolveIdentitySecrets } from "./artifact/resolve";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC"}

package/dist/index.js

@@ -9624,6 +9624,12 @@ var ManifestParser = class {
             "service_identities"
           );
         }
+        if (siObj.pack_only !== void 0 && typeof siObj.pack_only !== "boolean") {
+          throw new ManifestValidationError(
+            `Service identity '${siName}' has a non-boolean 'pack_only' field.`,
+            "service_identities"
+          );
+        }
         if (!Array.isArray(siObj.namespaces) || siObj.namespaces.length === 0) {
           throw new ManifestValidationError(
             `Service identity '${siName}' must have a non-empty 'namespaces' array.`,
@@ -9729,7 +9735,8 @@ var ManifestParser = class {
           name: siName,
           description: siObj.description ?? "",
           namespaces: siObj.namespaces,
-          environments: parsedEnvs
+          environments: parsedEnvs,
+          ...siObj.pack_only === true ? { pack_only: true } : {}
         };
       });
       const siNames = /* @__PURE__ */ new Set();
@@ -12075,6 +12082,18 @@ var LintRunner = class {
           });
         }
       }
+      if (si.pack_only) {
+        const ageRecipients = Object.values(si.environments).filter((cfg) => !isKmsEnvelope(cfg) && cfg.recipient).map((cfg) => cfg.recipient);
+        if (ageRecipients.length >= 2 && new Set(ageRecipients).size === 1) {
+          issues.push({
+            severity: "warning",
+            category: "service-identity",
+            file: "clef.yaml",
+            message: `Runtime identity '${si.name}' uses a shared recipient across all environments. A compromised key in any environment decrypts artifacts for all environments. Consider per-environment keys for runtime workloads.`
+          });
+        }
+        continue;
+      }
       for (const cell of existingCells) {
         const envConfig = si.environments[cell.environment];
         if (!envConfig) continue;
@@ -13434,12 +13453,10 @@ var ServiceIdentityManager = class {
    * Create a new service identity with per-environment age key pairs or KMS envelope config.
    * For age-only: generates keys, updates the manifest, and registers public keys as SOPS recipients.
    * For KMS: stores KMS config in manifest, no age keys generated.
-   *
-   * @param kmsEnvConfigs - Optional per-environment KMS config. When provided, those envs use
-   *   KMS envelope encryption instead of generating age keys.
-   * @returns The created identity definition and the per-environment private keys (empty for KMS envs).
+   * For pack-only (runtime) identities: keys are generated but NOT registered on SOPS files.
    */
-  async create(name, namespaces, description, manifest, repoRoot, kmsEnvConfigs) {
+  async create(name, namespaces, description, manifest, repoRoot, options) {
+    const { kmsEnvConfigs, sharedRecipient, packOnly } = options ?? {};
     if (manifest.service_identities?.some((si) => si.name === name)) {
       throw new Error(`Service identity '${name}' already exists.`);
     }
@@ -13451,23 +13468,25 @@ var ServiceIdentityManager = class {
     }
     const environments = {};
     const privateKeys = {};
+    const sharedKey = sharedRecipient ? await generateAgeIdentity() : void 0;
     for (const env of manifest.environments) {
       const kmsConfig = kmsEnvConfigs?.[env.name];
       if (kmsConfig) {
         environments[env.name] = { kms: kmsConfig };
       } else {
-        const identity = await generateAgeIdentity();
-        environments[env.name] = { recipient: identity.publicKey };
-        privateKeys[env.name] = identity.privateKey;
+        const ageIdentity = sharedKey ?? await generateAgeIdentity();
+        environments[env.name] = { recipient: ageIdentity.publicKey };
+        privateKeys[env.name] = ageIdentity.privateKey;
       }
     }
     const definition = {
       name,
       description,
       namespaces,
-      environments
+      environments,
+      ...packOnly ? { pack_only: true } : {}
     };
-    const cells = this.matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists && namespaces.includes(c.namespace));
+    const cells = packOnly ? [] : this.matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists && namespaces.includes(c.namespace));
     await this.tx.run(repoRoot, {
       description: `clef service create ${name}`,
       paths: this.txPaths(repoRoot, cells),
@@ -13481,12 +13500,13 @@ var ServiceIdentityManager = class {
           name,
           description,
           namespaces,
-          environments
+          environments,
+          ...packOnly ? { pack_only: true } : {}
         });
         writeManifestYaml(repoRoot, doc);
       }
     });
-    return { identity: definition, privateKeys };
+    return { identity: definition, privateKeys, sharedRecipient: sharedKey !== void 0 };
   }
   /**
    * List all service identities from the manifest.
@@ -13509,7 +13529,7 @@ var ServiceIdentityManager = class {
     if (!identity) {
       throw new Error(`Service identity '${name}' not found.`);
     }
-    const scopedCells = this.matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists && identity.namespaces.includes(c.namespace));
+    const scopedCells = identity.pack_only ? [] : this.matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists && identity.namespaces.includes(c.namespace));
     await this.tx.run(repoRoot, {
       description: `clef service delete ${name}`,
       paths: this.txPaths(repoRoot, scopedCells),
@@ -13565,7 +13585,7 @@ var ServiceIdentityManager = class {
         const envs = siDoc.environments;
         for (const [envName, kmsConfig] of Object.entries(kmsEnvConfigs)) {
           const oldConfig = identity.environments[envName];
-          if (oldConfig?.recipient && !isKmsEnvelope(oldConfig)) {
+          if (!identity.pack_only && oldConfig?.recipient && !isKmsEnvelope(oldConfig)) {
             const scopedCells = cells.filter((c) => c.environment === envName);
             for (const cell of scopedCells) {
               try {
@@ -13584,8 +13604,10 @@ var ServiceIdentityManager = class {
   }
   /**
    * Register a service identity's public keys as SOPS recipients on scoped matrix files.
+   * Pack-only (runtime) identities skip registration entirely.
    */
   async registerRecipients(identity, manifest, repoRoot) {
+    if (identity.pack_only) return;
     const cells = this.matrixManager.resolveMatrix(manifest, repoRoot).filter((c) => c.exists);
     for (const cell of cells) {
       if (!identity.namespaces.includes(cell.namespace)) continue;
@@ -13635,18 +13657,20 @@ var ServiceIdentityManager = class {
       description: `clef service update ${name}: add namespaces ${toAdd.join(",")}`,
       paths: this.txPaths(repoRoot, cells),
       mutate: async () => {
-        for (const cell of cells) {
-          const envConfig = identity.environments[cell.environment];
-          if (!envConfig) continue;
-          if (isKmsEnvelope(envConfig)) continue;
-          if (!envConfig.recipient) continue;
-          try {
-            await this.encryption.addRecipient(cell.filePath, envConfig.recipient);
-            affectedFiles.push(cell.filePath);
-          } catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            if (!message.includes("already")) {
-              throw err;
+        if (!identity.pack_only) {
+          for (const cell of cells) {
+            const envConfig = identity.environments[cell.environment];
+            if (!envConfig) continue;
+            if (isKmsEnvelope(envConfig)) continue;
+            if (!envConfig.recipient) continue;
+            try {
+              await this.encryption.addRecipient(cell.filePath, envConfig.recipient);
+              affectedFiles.push(cell.filePath);
+            } catch (err) {
+              const message = err instanceof Error ? err.message : String(err);
+              if (!message.includes("already")) {
+                throw err;
+              }
             }
           }
         }
@@ -13694,15 +13718,17 @@ var ServiceIdentityManager = class {
       description: `clef service update ${name}: remove namespaces ${namespacesToRemove.join(",")}`,
       paths: this.txPaths(repoRoot, cells),
       mutate: async () => {
-        for (const cell of cells) {
-          const envConfig = identity.environments[cell.environment];
-          if (!envConfig) continue;
-          if (isKmsEnvelope(envConfig)) continue;
-          if (!envConfig.recipient) continue;
-          try {
-            await this.encryption.removeRecipient(cell.filePath, envConfig.recipient);
-            affectedFiles.push(cell.filePath);
-          } catch {
+        if (!identity.pack_only) {
+          for (const cell of cells) {
+            const envConfig = identity.environments[cell.environment];
+            if (!envConfig) continue;
+            if (isKmsEnvelope(envConfig)) continue;
+            if (!envConfig.recipient) continue;
+            try {
+              await this.encryption.removeRecipient(cell.filePath, envConfig.recipient);
+              affectedFiles.push(cell.filePath);
+            } catch {
+            }
           }
         }
         const doc = readManifestYaml(repoRoot);
@@ -13765,7 +13791,7 @@ var ServiceIdentityManager = class {
       description: `clef service add-env ${name} ${envName}`,
       paths: this.txPaths(repoRoot, cells),
       mutate: async () => {
-        if (!isKmsEnvelope(envConfig) && envConfig.recipient) {
+        if (!identity.pack_only && !isKmsEnvelope(envConfig) && envConfig.recipient) {
           for (const cell of cells) {
             try {
               await this.encryption.addRecipient(cell.filePath, envConfig.recipient);
@@ -13824,7 +13850,7 @@ var ServiceIdentityManager = class {
     if (targetEnvNames.size === 0) {
       return newPrivateKeys;
     }
-    const cells = this.matrixManager.resolveMatrix(manifest, repoRoot).filter(
+    const cells = identity.pack_only ? [] : this.matrixManager.resolveMatrix(manifest, repoRoot).filter(
       (c) => c.exists && identity.namespaces.includes(c.namespace) && targetEnvNames.has(c.environment)
     );
     await this.tx.run(repoRoot, {
@@ -13841,13 +13867,15 @@ var ServiceIdentityManager = class {
           const oldRecipient = identity.environments[envName].recipient;
           const newPublicKey = newPublicKeys[envName];
           envs[envName] = { recipient: newPublicKey };
-          const scopedCells = cells.filter((c) => c.environment === envName);
-          for (const cell of scopedCells) {
-            try {
-              await this.encryption.removeRecipient(cell.filePath, oldRecipient);
-            } catch {
+          if (!identity.pack_only) {
+            const scopedCells = cells.filter((c) => c.environment === envName);
+            for (const cell of scopedCells) {
+              try {
+                await this.encryption.removeRecipient(cell.filePath, oldRecipient);
+              } catch {
+              }
+              await this.encryption.addRecipient(cell.filePath, newPublicKey);
             }
-            await this.encryption.addRecipient(cell.filePath, newPublicKey);
           }
         }
         writeManifestYaml(repoRoot, doc);
@@ -13887,6 +13915,17 @@ var ServiceIdentityManager = class {
           });
         }
       }
+      if (si.pack_only) {
+        const ageRecipients = Object.values(si.environments).filter((cfg) => !isKmsEnvelope(cfg) && cfg.recipient).map((cfg) => cfg.recipient);
+        if (ageRecipients.length >= 2 && new Set(ageRecipients).size === 1) {
+          issues.push({
+            identity: si.name,
+            type: "runtime_shared_recipient",
+            message: `Runtime identity '${si.name}' uses a shared recipient across all environments. A compromised key in any environment decrypts artifacts for all environments. Consider per-environment keys for runtime workloads.`
+          });
+        }
+        continue;
+      }
       for (const cell of cells) {
         const envConfig = si.environments[cell.environment];
         if (!envConfig) continue;