@clef-sh/core 0.1.16 → 0.1.17

package/dist/index.mjs

@@ -304,10 +304,10 @@ var require_lib = __commonJS({
     module.exports.sync = writeFileSync6;
     module.exports._getTmpname = getTmpname;
     module.exports._cleanupOnExit = cleanupOnExit;
-    var fs17 = __require("fs");
+    var fs18 = __require("fs");
     var crypto4 = __require("node:crypto");
     var { onExit } = require_cjs();
-    var path25 = __require("path");
+    var path26 = __require("path");
     var { promisify } = __require("util");
     var activeFiles = {};
     var threadId = (function getId() {
@@ -325,7 +325,7 @@ var require_lib = __commonJS({
     function cleanupOnExit(tmpfile) {
       return () => {
         try {
-          fs17.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
+          fs18.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
         } catch {
         }
       };
@@ -360,13 +360,13 @@ var require_lib = __commonJS({
       let fd;
       let tmpfile;
       const removeOnExitHandler = onExit(cleanupOnExit(() => tmpfile));
-      const absoluteName = path25.resolve(filename);
+      const absoluteName = path26.resolve(filename);
       try {
         await serializeActiveFile(absoluteName);
-        const truename = await promisify(fs17.realpath)(filename).catch(() => filename);
+        const truename = await promisify(fs18.realpath)(filename).catch(() => filename);
         tmpfile = getTmpname(truename);
         if (!options.mode || !options.chown) {
-          const stats = await promisify(fs17.stat)(truename).catch(() => {
+          const stats = await promisify(fs18.stat)(truename).catch(() => {
           });
           if (stats) {
             if (options.mode == null) {
@@ -377,45 +377,45 @@ var require_lib = __commonJS({
             }
           }
         }
-        fd = await promisify(fs17.open)(tmpfile, "w", options.mode);
+        fd = await promisify(fs18.open)(tmpfile, "w", options.mode);
         if (options.tmpfileCreated) {
           await options.tmpfileCreated(tmpfile);
         }
         if (ArrayBuffer.isView(data)) {
-          await promisify(fs17.write)(fd, data, 0, data.length, 0);
+          await promisify(fs18.write)(fd, data, 0, data.length, 0);
         } else if (data != null) {
-          await promisify(fs17.write)(fd, String(data), 0, String(options.encoding || "utf8"));
+          await promisify(fs18.write)(fd, String(data), 0, String(options.encoding || "utf8"));
         }
         if (options.fsync !== false) {
-          await promisify(fs17.fsync)(fd);
+          await promisify(fs18.fsync)(fd);
         }
-        await promisify(fs17.close)(fd);
+        await promisify(fs18.close)(fd);
         fd = null;
         if (options.chown) {
-          await promisify(fs17.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
+          await promisify(fs18.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
             if (!isChownErrOk(err)) {
               throw err;
             }
           });
         }
         if (options.mode) {
-          await promisify(fs17.chmod)(tmpfile, options.mode).catch((err) => {
+          await promisify(fs18.chmod)(tmpfile, options.mode).catch((err) => {
             if (!isChownErrOk(err)) {
               throw err;
             }
           });
         }
-        await promisify(fs17.rename)(tmpfile, truename);
+        await promisify(fs18.rename)(tmpfile, truename);
       } finally {
         if (fd) {
-          await promisify(fs17.close)(fd).catch(
+          await promisify(fs18.close)(fd).catch(
             /* istanbul ignore next */
             () => {
             }
           );
         }
         removeOnExitHandler();
-        await promisify(fs17.unlink)(tmpfile).catch(() => {
+        await promisify(fs18.unlink)(tmpfile).catch(() => {
         });
         activeFiles[absoluteName].shift();
         if (activeFiles[absoluteName].length > 0) {
@@ -448,13 +448,13 @@ var require_lib = __commonJS({
         options = {};
       }
       try {
-        filename = fs17.realpathSync(filename);
+        filename = fs18.realpathSync(filename);
       } catch (ex) {
       }
       const tmpfile = getTmpname(filename);
       if (!options.mode || !options.chown) {
         try {
-          const stats = fs17.statSync(filename);
+          const stats = fs18.statSync(filename);
           options = Object.assign({}, options);
           if (!options.mode) {
             options.mode = stats.mode;
@@ -470,23 +470,23 @@ var require_lib = __commonJS({
       const removeOnExitHandler = onExit(cleanup);
       let threw = true;
       try {
-        fd = fs17.openSync(tmpfile, "w", options.mode || 438);
+        fd = fs18.openSync(tmpfile, "w", options.mode || 438);
         if (options.tmpfileCreated) {
           options.tmpfileCreated(tmpfile);
         }
         if (ArrayBuffer.isView(data)) {
-          fs17.writeSync(fd, data, 0, data.length, 0);
+          fs18.writeSync(fd, data, 0, data.length, 0);
         } else if (data != null) {
-          fs17.writeSync(fd, String(data), 0, String(options.encoding || "utf8"));
+          fs18.writeSync(fd, String(data), 0, String(options.encoding || "utf8"));
         }
         if (options.fsync !== false) {
-          fs17.fsyncSync(fd);
+          fs18.fsyncSync(fd);
         }
-        fs17.closeSync(fd);
+        fs18.closeSync(fd);
         fd = null;
         if (options.chown) {
           try {
-            fs17.chownSync(tmpfile, options.chown.uid, options.chown.gid);
+            fs18.chownSync(tmpfile, options.chown.uid, options.chown.gid);
           } catch (err) {
             if (!isChownErrOk(err)) {
               throw err;
@@ -495,19 +495,19 @@ var require_lib = __commonJS({
         }
         if (options.mode) {
           try {
-            fs17.chmodSync(tmpfile, options.mode);
+            fs18.chmodSync(tmpfile, options.mode);
           } catch (err) {
             if (!isChownErrOk(err)) {
               throw err;
             }
           }
         }
-        fs17.renameSync(tmpfile, filename);
+        fs18.renameSync(tmpfile, filename);
         threw = false;
       } finally {
         if (fd) {
           try {
-            fs17.closeSync(fd);
+            fs18.closeSync(fd);
           } catch (ex) {
           }
         }
@@ -546,54 +546,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs17) {
+    function patch(fs18) {
       if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs17);
-      }
-      if (!fs17.lutimes) {
-        patchLutimes(fs17);
-      }
-      fs17.chown = chownFix(fs17.chown);
-      fs17.fchown = chownFix(fs17.fchown);
-      fs17.lchown = chownFix(fs17.lchown);
-      fs17.chmod = chmodFix(fs17.chmod);
-      fs17.fchmod = chmodFix(fs17.fchmod);
-      fs17.lchmod = chmodFix(fs17.lchmod);
-      fs17.chownSync = chownFixSync(fs17.chownSync);
-      fs17.fchownSync = chownFixSync(fs17.fchownSync);
-      fs17.lchownSync = chownFixSync(fs17.lchownSync);
-      fs17.chmodSync = chmodFixSync(fs17.chmodSync);
-      fs17.fchmodSync = chmodFixSync(fs17.fchmodSync);
-      fs17.lchmodSync = chmodFixSync(fs17.lchmodSync);
-      fs17.stat = statFix(fs17.stat);
-      fs17.fstat = statFix(fs17.fstat);
-      fs17.lstat = statFix(fs17.lstat);
-      fs17.statSync = statFixSync(fs17.statSync);
-      fs17.fstatSync = statFixSync(fs17.fstatSync);
-      fs17.lstatSync = statFixSync(fs17.lstatSync);
-      if (fs17.chmod && !fs17.lchmod) {
-        fs17.lchmod = function(path25, mode, cb) {
+        patchLchmod(fs18);
+      }
+      if (!fs18.lutimes) {
+        patchLutimes(fs18);
+      }
+      fs18.chown = chownFix(fs18.chown);
+      fs18.fchown = chownFix(fs18.fchown);
+      fs18.lchown = chownFix(fs18.lchown);
+      fs18.chmod = chmodFix(fs18.chmod);
+      fs18.fchmod = chmodFix(fs18.fchmod);
+      fs18.lchmod = chmodFix(fs18.lchmod);
+      fs18.chownSync = chownFixSync(fs18.chownSync);
+      fs18.fchownSync = chownFixSync(fs18.fchownSync);
+      fs18.lchownSync = chownFixSync(fs18.lchownSync);
+      fs18.chmodSync = chmodFixSync(fs18.chmodSync);
+      fs18.fchmodSync = chmodFixSync(fs18.fchmodSync);
+      fs18.lchmodSync = chmodFixSync(fs18.lchmodSync);
+      fs18.stat = statFix(fs18.stat);
+      fs18.fstat = statFix(fs18.fstat);
+      fs18.lstat = statFix(fs18.lstat);
+      fs18.statSync = statFixSync(fs18.statSync);
+      fs18.fstatSync = statFixSync(fs18.fstatSync);
+      fs18.lstatSync = statFixSync(fs18.lstatSync);
+      if (fs18.chmod && !fs18.lchmod) {
+        fs18.lchmod = function(path26, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs17.lchmodSync = function() {
+        fs18.lchmodSync = function() {
         };
       }
-      if (fs17.chown && !fs17.lchown) {
-        fs17.lchown = function(path25, uid, gid, cb) {
+      if (fs18.chown && !fs18.lchown) {
+        fs18.lchown = function(path26, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs17.lchownSync = function() {
+        fs18.lchownSync = function() {
         };
       }
       if (platform === "win32") {
-        fs17.rename = typeof fs17.rename !== "function" ? fs17.rename : (function(fs$rename) {
+        fs18.rename = typeof fs18.rename !== "function" ? fs18.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs17.stat(to, function(stater, st) {
+                  fs18.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -609,9 +609,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs17.rename);
+        })(fs18.rename);
       }
-      fs17.read = typeof fs17.read !== "function" ? fs17.read : (function(fs$read) {
+      fs18.read = typeof fs18.read !== "function" ? fs18.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -619,22 +619,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs17, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs18, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs17, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs18, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs17.read);
-      fs17.readSync = typeof fs17.readSync !== "function" ? fs17.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs18.read);
+      fs18.readSync = typeof fs18.readSync !== "function" ? fs18.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs17, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs18, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -644,11 +644,11 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs17.readSync);
-      function patchLchmod(fs18) {
-        fs18.lchmod = function(path25, mode, callback) {
-          fs18.open(
-            path25,
+      })(fs18.readSync);
+      function patchLchmod(fs19) {
+        fs19.lchmod = function(path26, mode, callback) {
+          fs19.open(
+            path26,
             constants.O_WRONLY | constants.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -656,80 +656,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs18.fchmod(fd, mode, function(err2) {
-                fs18.close(fd, function(err22) {
+              fs19.fchmod(fd, mode, function(err2) {
+                fs19.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs18.lchmodSync = function(path25, mode) {
-          var fd = fs18.openSync(path25, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        fs19.lchmodSync = function(path26, mode) {
+          var fd = fs19.openSync(path26, constants.O_WRONLY | constants.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs18.fchmodSync(fd, mode);
+            ret = fs19.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs18.closeSync(fd);
+                fs19.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs18.closeSync(fd);
+              fs19.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs18) {
-        if (constants.hasOwnProperty("O_SYMLINK") && fs18.futimes) {
-          fs18.lutimes = function(path25, at, mt, cb) {
-            fs18.open(path25, constants.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs19) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs19.futimes) {
+          fs19.lutimes = function(path26, at, mt, cb) {
+            fs19.open(path26, constants.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs18.futimes(fd, at, mt, function(er2) {
-                fs18.close(fd, function(er22) {
+              fs19.futimes(fd, at, mt, function(er2) {
+                fs19.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs18.lutimesSync = function(path25, at, mt) {
-            var fd = fs18.openSync(path25, constants.O_SYMLINK);
+          fs19.lutimesSync = function(path26, at, mt) {
+            var fd = fs19.openSync(path26, constants.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs18.futimesSync(fd, at, mt);
+              ret = fs19.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs18.closeSync(fd);
+                  fs19.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs18.closeSync(fd);
+                fs19.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs18.futimes) {
-          fs18.lutimes = function(_a, _b, _c, cb) {
+        } else if (fs19.futimes) {
+          fs19.lutimes = function(_a, _b, _c, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs18.lutimesSync = function() {
+          fs19.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs17, target, mode, function(er) {
+          return orig.call(fs18, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -739,7 +739,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs17, target, mode);
+            return orig.call(fs18, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -748,7 +748,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs17, target, uid, gid, function(er) {
+          return orig.call(fs18, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -758,7 +758,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs17, target, uid, gid);
+            return orig.call(fs18, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -778,13 +778,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs17, target, options, callback) : orig.call(fs17, target, callback);
+          return options ? orig.call(fs18, target, options, callback) : orig.call(fs18, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs17, target, options) : orig.call(fs17, target);
+          var stats = options ? orig.call(fs18, target, options) : orig.call(fs18, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -813,16 +813,16 @@ var require_legacy_streams = __commonJS({
   "../../node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs17) {
+    function legacy(fs18) {
       return {
         ReadStream,
         WriteStream
       };
-      function ReadStream(path25, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path25, options);
+      function ReadStream(path26, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path26, options);
         Stream.call(this);
         var self = this;
-        this.path = path25;
+        this.path = path26;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -856,7 +856,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs17.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs18.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self.emit("error", err);
             self.readable = false;
@@ -867,10 +867,10 @@ var require_legacy_streams = __commonJS({
           self._read();
         });
       }
-      function WriteStream(path25, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path25, options);
+      function WriteStream(path26, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path26, options);
         Stream.call(this);
-        this.path = path25;
+        this.path = path26;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -895,7 +895,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs17.open;
+          this._open = fs18.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -930,7 +930,7 @@ var require_clone = __commonJS({
 // ../../node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "../../node_modules/graceful-fs/graceful-fs.js"(exports, module) {
-    var fs17 = __require("fs");
+    var fs18 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -962,12 +962,12 @@ var require_graceful_fs = __commonJS({
         m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
         console.error(m);
       };
-    if (!fs17[gracefulQueue]) {
+    if (!fs18[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs17, queue);
-      fs17.close = (function(fs$close) {
+      publishQueue(fs18, queue);
+      fs18.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs17, fd, function(err) {
+          return fs$close.call(fs18, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -979,48 +979,48 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs17.close);
-      fs17.closeSync = (function(fs$closeSync) {
+      })(fs18.close);
+      fs18.closeSync = (function(fs$closeSync) {
         function closeSync2(fd) {
-          fs$closeSync.apply(fs17, arguments);
+          fs$closeSync.apply(fs18, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync2, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync2;
-      })(fs17.closeSync);
+      })(fs18.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug(fs17[gracefulQueue]);
-          __require("assert").equal(fs17[gracefulQueue].length, 0);
+          debug(fs18[gracefulQueue]);
+          __require("assert").equal(fs18[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs17[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs17));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs17.__patched) {
-      module.exports = patch(fs17);
-      fs17.__patched = true;
-    }
-    function patch(fs18) {
-      polyfills(fs18);
-      fs18.gracefulify = patch;
-      fs18.createReadStream = createReadStream;
-      fs18.createWriteStream = createWriteStream;
-      var fs$readFile = fs18.readFile;
-      fs18.readFile = readFile;
-      function readFile(path25, options, cb) {
+      publishQueue(global, fs18[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs18));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs18.__patched) {
+      module.exports = patch(fs18);
+      fs18.__patched = true;
+    }
+    function patch(fs19) {
+      polyfills(fs19);
+      fs19.gracefulify = patch;
+      fs19.createReadStream = createReadStream;
+      fs19.createWriteStream = createWriteStream;
+      var fs$readFile = fs19.readFile;
+      fs19.readFile = readFile;
+      function readFile(path26, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path25, options, cb);
-        function go$readFile(path26, options2, cb2, startTime) {
-          return fs$readFile(path26, options2, function(err) {
+        return go$readFile(path26, options, cb);
+        function go$readFile(path27, options2, cb2, startTime) {
+          return fs$readFile(path27, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path26, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path27, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1028,16 +1028,16 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs18.writeFile;
-      fs18.writeFile = writeFile;
-      function writeFile(path25, data, options, cb) {
+      var fs$writeFile = fs19.writeFile;
+      fs19.writeFile = writeFile;
+      function writeFile(path26, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path25, data, options, cb);
-        function go$writeFile(path26, data2, options2, cb2, startTime) {
-          return fs$writeFile(path26, data2, options2, function(err) {
+        return go$writeFile(path26, data, options, cb);
+        function go$writeFile(path27, data2, options2, cb2, startTime) {
+          return fs$writeFile(path27, data2, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path26, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path27, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1045,17 +1045,17 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs18.appendFile;
+      var fs$appendFile = fs19.appendFile;
       if (fs$appendFile)
-        fs18.appendFile = appendFile;
-      function appendFile(path25, data, options, cb) {
+        fs19.appendFile = appendFile;
+      function appendFile(path26, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path25, data, options, cb);
-        function go$appendFile(path26, data2, options2, cb2, startTime) {
-          return fs$appendFile(path26, data2, options2, function(err) {
+        return go$appendFile(path26, data, options, cb);
+        function go$appendFile(path27, data2, options2, cb2, startTime) {
+          return fs$appendFile(path27, data2, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path26, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path27, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1063,9 +1063,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs18.copyFile;
+      var fs$copyFile = fs19.copyFile;
       if (fs$copyFile)
-        fs18.copyFile = copyFile;
+        fs19.copyFile = copyFile;
       function copyFile(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -1083,34 +1083,34 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs18.readdir;
-      fs18.readdir = readdir;
+      var fs$readdir = fs19.readdir;
+      fs19.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir(path25, options, cb) {
+      function readdir(path26, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path26, options2, cb2, startTime) {
-          return fs$readdir(path26, fs$readdirCallback(
-            path26,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path27, options2, cb2, startTime) {
+          return fs$readdir(path27, fs$readdirCallback(
+            path27,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path26, options2, cb2, startTime) {
-          return fs$readdir(path26, options2, fs$readdirCallback(
-            path26,
+        } : function go$readdir2(path27, options2, cb2, startTime) {
+          return fs$readdir(path27, options2, fs$readdirCallback(
+            path27,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path25, options, cb);
-        function fs$readdirCallback(path26, options2, cb2, startTime) {
+        return go$readdir(path26, options, cb);
+        function fs$readdirCallback(path27, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path26, options2, cb2],
+                [path27, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -1125,21 +1125,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs18);
+        var legStreams = legacy(fs19);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs18.ReadStream;
+      var fs$ReadStream = fs19.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs18.WriteStream;
+      var fs$WriteStream = fs19.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs18, "ReadStream", {
+      Object.defineProperty(fs19, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -1149,7 +1149,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs18, "WriteStream", {
+      Object.defineProperty(fs19, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -1160,7 +1160,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs18, "FileReadStream", {
+      Object.defineProperty(fs19, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -1171,7 +1171,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs18, "FileWriteStream", {
+      Object.defineProperty(fs19, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -1181,7 +1181,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path25, options) {
+      function ReadStream(path26, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -1201,7 +1201,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function WriteStream(path25, options) {
+      function WriteStream(path26, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -1219,22 +1219,22 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path25, options) {
-        return new fs18.ReadStream(path25, options);
+      function createReadStream(path26, options) {
+        return new fs19.ReadStream(path26, options);
       }
-      function createWriteStream(path25, options) {
-        return new fs18.WriteStream(path25, options);
+      function createWriteStream(path26, options) {
+        return new fs19.WriteStream(path26, options);
       }
-      var fs$open = fs18.open;
-      fs18.open = open;
-      function open(path25, flags, mode, cb) {
+      var fs$open = fs19.open;
+      fs19.open = open;
+      function open(path26, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path25, flags, mode, cb);
-        function go$open(path26, flags2, mode2, cb2, startTime) {
-          return fs$open(path26, flags2, mode2, function(err, fd) {
+        return go$open(path26, flags, mode, cb);
+        function go$open(path27, flags2, mode2, cb2, startTime) {
+          return fs$open(path27, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path26, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path27, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1242,20 +1242,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs18;
+      return fs19;
     }
     function enqueue(elem) {
       debug("ENQUEUE", elem[0].name, elem[1]);
-      fs17[gracefulQueue].push(elem);
+      fs18[gracefulQueue].push(elem);
       retry();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i = 0; i < fs17[gracefulQueue].length; ++i) {
-        if (fs17[gracefulQueue][i].length > 2) {
-          fs17[gracefulQueue][i][3] = now;
-          fs17[gracefulQueue][i][4] = now;
+      for (var i = 0; i < fs18[gracefulQueue].length; ++i) {
+        if (fs18[gracefulQueue][i].length > 2) {
+          fs18[gracefulQueue][i][3] = now;
+          fs18[gracefulQueue][i][4] = now;
         }
       }
       retry();
@@ -1263,9 +1263,9 @@ var require_graceful_fs = __commonJS({
     function retry() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs17[gracefulQueue].length === 0)
+      if (fs18[gracefulQueue].length === 0)
         return;
-      var elem = fs17[gracefulQueue].shift();
+      var elem = fs18[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -1287,7 +1287,7 @@ var require_graceful_fs = __commonJS({
           debug("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs17[gracefulQueue].push(elem);
+          fs18[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -1722,10 +1722,10 @@ var require_mtime_precision = __commonJS({
   "../../node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = /* @__PURE__ */ Symbol();
-    function probe(file, fs17, callback) {
-      const cachedPrecision = fs17[cacheSymbol];
+    function probe(file, fs18, callback) {
+      const cachedPrecision = fs18[cacheSymbol];
       if (cachedPrecision) {
-        return fs17.stat(file, (err, stat) => {
+        return fs18.stat(file, (err, stat) => {
           if (err) {
             return callback(err);
           }
@@ -1733,16 +1733,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs17.utimes(file, mtime, mtime, (err) => {
+      fs18.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs17.stat(file, (err2, stat) => {
+        fs18.stat(file, (err2, stat) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs17, cacheSymbol, { value: precision });
+          Object.defineProperty(fs18, cacheSymbol, { value: precision });
           callback(null, stat.mtime, precision);
         });
       });
@@ -1763,8 +1763,8 @@ var require_mtime_precision = __commonJS({
 var require_lockfile = __commonJS({
   "../../node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
-    var path25 = __require("path");
-    var fs17 = require_graceful_fs();
+    var path26 = __require("path");
+    var fs18 = require_graceful_fs();
     var retry = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -1774,7 +1774,7 @@ var require_lockfile = __commonJS({
     }
     function resolveCanonicalPath(file, options, callback) {
       if (!options.realpath) {
-        return callback(null, path25.resolve(file));
+        return callback(null, path26.resolve(file));
       }
       options.fs.realpath(file, callback);
     }
@@ -1895,7 +1895,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs17,
+        fs: fs18,
         onCompromised: (err) => {
           throw err;
         },
@@ -1939,7 +1939,7 @@ var require_lockfile = __commonJS({
     }
     function unlock(file, options, callback) {
       options = {
-        fs: fs17,
+        fs: fs18,
         realpath: true,
         ...options
       };
@@ -1961,7 +1961,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs17,
+        fs: fs18,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -2000,16 +2000,16 @@ var require_lockfile = __commonJS({
 var require_adapter = __commonJS({
   "../../node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
-    var fs17 = require_graceful_fs();
-    function createSyncFs(fs18) {
+    var fs18 = require_graceful_fs();
+    function createSyncFs(fs19) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs18 };
+      const newFs = { ...fs19 };
       methods.forEach((method) => {
         newFs[method] = (...args) => {
           const callback = args.pop();
           let ret;
           try {
-            ret = fs18[`${method}Sync`](...args);
+            ret = fs19[`${method}Sync`](...args);
           } catch (err) {
             return callback(err);
           }
@@ -2047,7 +2047,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs17);
+      options.fs = createSyncFs(options.fs || fs18);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -2161,6 +2161,13 @@ var GitOperationError = class extends ClefError {
     this.name = "GitOperationError";
   }
 };
+var PolicyValidationError = class extends ClefError {
+  constructor(message, field) {
+    super(message, field ? `Check the '${field}' field in .clef/policy.yaml` : void 0);
+    this.field = field;
+    this.name = "PolicyValidationError";
+  }
+};
 var SchemaLoadError = class extends ClefError {
   constructor(message, filePath) {
     super(
@@ -4779,8 +4786,11 @@ var SopsClient = class {
     }
     const backend = this.detectBackend(sops);
     const recipients = this.extractRecipients(sops, backend);
-    const lastModified = sops.lastmodified ? new Date(sops.lastmodified) : /* @__PURE__ */ new Date();
-    return { backend, recipients, lastModified };
+    const lastModifiedRaw = typeof sops.lastmodified === "string" ? sops.lastmodified : void 0;
+    const lastModified = lastModifiedRaw ? new Date(lastModifiedRaw) : /* @__PURE__ */ new Date();
+    const lastModifiedPresent = lastModifiedRaw !== void 0;
+    const version = typeof sops.version === "string" ? sops.version : void 0;
+    return { backend, recipients, lastModified, lastModifiedPresent, version };
   }
   detectBackend(sops) {
     if (sops.age && Array.isArray(sops.age) && sops.age.length > 0) return "age";
@@ -8306,17 +8316,323 @@ var SyncManager = class {
     };
   }
 };
+
+// src/policy/parser.ts
+import * as fs17 from "fs";
+import * as YAML11 from "yaml";
+
+// src/policy/types.ts
+var DEFAULT_POLICY = Object.freeze({
+  version: 1,
+  rotation: Object.freeze({ max_age_days: 90 })
+});
+
+// src/policy/parser.ts
+var CLEF_POLICY_FILENAME = ".clef/policy.yaml";
+var SUPPORTED_VERSIONS = [1];
+var PolicyParser = class {
+  /**
+   * Read and validate a policy file from disk.
+   *
+   * @throws {@link PolicyValidationError} If the file cannot be read, contains
+   *   invalid YAML, or fails schema validation.
+   */
+  parse(filePath) {
+    let raw;
+    try {
+      raw = fs17.readFileSync(filePath, "utf-8");
+    } catch {
+      throw new PolicyValidationError(`Could not read policy file at '${filePath}'.`);
+    }
+    return this.parseContent(raw);
+  }
+  /**
+   * Parse and validate a policy document from a YAML string.
+   *
+   * @throws {@link PolicyValidationError} If the content is malformed or
+   *   fails validation.
+   */
+  parseContent(content) {
+    let parsed;
+    try {
+      parsed = YAML11.parse(content);
+    } catch {
+      throw new PolicyValidationError(
+        "Policy file contains invalid YAML. Check for syntax errors."
+      );
+    }
+    return this.validate(parsed);
+  }
+  /**
+   * Load policy from disk, returning {@link DEFAULT_POLICY} if the file does
+   * not exist. Any other read or validation error throws.
+   */
+  load(filePath) {
+    if (!fs17.existsSync(filePath)) return DEFAULT_POLICY;
+    return this.parse(filePath);
+  }
+  validate(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      throw new PolicyValidationError("Policy file must be a YAML object.");
+    }
+    const doc = raw;
+    if (!SUPPORTED_VERSIONS.includes(doc.version)) {
+      throw new PolicyValidationError(
+        `Policy file must declare 'version: 1', got: ${JSON.stringify(doc.version)}.`,
+        "version"
+      );
+    }
+    const rotation = doc.rotation === void 0 ? void 0 : this.validateRotation(doc.rotation);
+    return { version: 1, ...rotation ? { rotation } : {} };
+  }
+  validateRotation(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      throw new PolicyValidationError("Policy 'rotation' must be an object.", "rotation");
+    }
+    const rot = raw;
+    const maxAge = rot.max_age_days;
+    if (typeof maxAge !== "number" || !Number.isFinite(maxAge) || maxAge <= 0) {
+      throw new PolicyValidationError(
+        "Policy 'rotation.max_age_days' must be a positive number.",
+        "rotation.max_age_days"
+      );
+    }
+    const result = { max_age_days: maxAge };
+    if (rot.environments !== void 0) {
+      if (typeof rot.environments !== "object" || rot.environments === null || Array.isArray(rot.environments)) {
+        throw new PolicyValidationError(
+          "Policy 'rotation.environments' must be an object keyed by environment name.",
+          "rotation.environments"
+        );
+      }
+      const envs = {};
+      for (const [envName, envVal] of Object.entries(rot.environments)) {
+        if (typeof envVal !== "object" || envVal === null || Array.isArray(envVal)) {
+          throw new PolicyValidationError(
+            `Policy 'rotation.environments.${envName}' must be an object.`,
+            `rotation.environments.${envName}`
+          );
+        }
+        const envMaxAge = envVal.max_age_days;
+        if (typeof envMaxAge !== "number" || !Number.isFinite(envMaxAge) || envMaxAge <= 0) {
+          throw new PolicyValidationError(
+            `Policy 'rotation.environments.${envName}.max_age_days' must be a positive number.`,
+            `rotation.environments.${envName}.max_age_days`
+          );
+        }
+        envs[envName] = { max_age_days: envMaxAge };
+      }
+      result.environments = envs;
+    }
+    return result;
+  }
+};
+
+// src/policy/evaluator.ts
+var MS_PER_DAY = 864e5;
+var DEFAULT_MAX_AGE_DAYS = 90;
+var PolicyEvaluator = class {
+  constructor(policy) {
+    this.policy = policy;
+  }
+  /**
+   * Evaluate a single encrypted file's rotation state.
+   *
+   * @param filePath    Repo-relative or absolute path to the encrypted file.
+   * @param environment Environment name from the matrix; selects per-env
+   *                    overrides if present in the policy.
+   * @param metadata    Result of `SopsClient.getMetadata()` for the file.
+   * @param now         Reference time (defaults to `new Date()`).  Inject for
+   *                    deterministic tests and reproducible audits.
+   */
+  evaluateFile(filePath, environment, metadata, now = /* @__PURE__ */ new Date()) {
+    const maxAgeDays = this.resolveMaxAgeDays(environment);
+    const rotationDue = new Date(metadata.lastModified.getTime() + maxAgeDays * MS_PER_DAY);
+    const rotationOverdue = now.getTime() > rotationDue.getTime();
+    const daysOverdue = rotationOverdue ? Math.floor((now.getTime() - rotationDue.getTime()) / MS_PER_DAY) : 0;
+    return {
+      path: filePath,
+      environment,
+      backend: metadata.backend,
+      recipients: metadata.recipients,
+      last_modified: metadata.lastModified.toISOString(),
+      // Treat a missing `lastModifiedPresent` as `true` — the field is
+      // optional on SopsMetadata and only `parseMetadataFromFile` knows
+      // authoritatively whether the underlying file carried `sops.lastmodified`.
+      // Hand-constructed metadata is assumed trustworthy.
+      last_modified_known: metadata.lastModifiedPresent !== false,
+      rotation_due: rotationDue.toISOString(),
+      rotation_overdue: rotationOverdue,
+      days_overdue: daysOverdue,
+      compliant: !rotationOverdue
+    };
+  }
+  resolveMaxAgeDays(environment) {
+    const envOverride = this.policy.rotation?.environments?.[environment];
+    if (envOverride !== void 0) return envOverride.max_age_days;
+    return this.policy.rotation?.max_age_days ?? DEFAULT_MAX_AGE_DAYS;
+  }
+};
+
+// src/compliance/generator.ts
+import { createHash as createHash3 } from "crypto";
+var SCHEMA_VERSION = "1";
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  const entries = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`);
+  return `{${entries.join(",")}}`;
+}
+var ComplianceGenerator = class {
+  generate(opts) {
+    const { sha, repo, policy, scanResult, lintResult, files, now } = opts;
+    const generated_at = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const policy_hash = `sha256:${createHash3("sha256").update(canonicalJson(policy)).digest("hex")}`;
+    return {
+      schema_version: SCHEMA_VERSION,
+      generated_at,
+      sha,
+      repo,
+      policy_hash,
+      policy_snapshot: policy,
+      summary: this.buildSummary(scanResult, lintResult, files),
+      files,
+      scan: scanResult,
+      lint: lintResult
+    };
+  }
+  /**
+   * Compute a {@link ComplianceDocument.policy_hash}-format hash of any
+   * {@link PolicyDocument} without generating a full document.  Useful for
+   * external consumers that want to compare policies across repos.
+   */
+  static hashPolicy(policy) {
+    return `sha256:${createHash3("sha256").update(canonicalJson(policy)).digest("hex")}`;
+  }
+  buildSummary(scan, lint, files) {
+    return {
+      total_files: files.length,
+      compliant: files.filter((f) => f.compliant).length,
+      rotation_overdue: files.filter((f) => f.rotation_overdue).length,
+      scan_violations: scan.matches.length,
+      lint_errors: lint.issues.filter((i) => i.severity === "error").length
+    };
+  }
+};
+
+// src/compliance/run.ts
+import * as path25 from "path";
+var UNKNOWN = "unknown";
+async function runCompliance(opts) {
+  const start = Date.now();
+  const repoRoot = opts.repoRoot ?? process.cwd();
+  const manifestPath = opts.manifestPath ?? path25.join(repoRoot, "clef.yaml");
+  const policyPath = opts.policyPath ?? path25.join(repoRoot, CLEF_POLICY_FILENAME);
+  const include = {
+    scan: opts.include?.scan ?? true,
+    lint: opts.include?.lint ?? true,
+    rotation: opts.include?.rotation ?? true
+  };
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const manifest = new ManifestParser().parse(manifestPath);
+  const policy = opts.policy ?? new PolicyParser().load(policyPath);
+  const sopsClient = new SopsClient(opts.runner);
+  const matrixManager = new MatrixManager();
+  const schemaValidator = new SchemaValidator();
+  const [sha, repo, files, scanResult, lintResult] = await Promise.all([
+    opts.sha !== void 0 ? Promise.resolve(opts.sha) : detectSha(opts.runner, repoRoot),
+    opts.repo !== void 0 ? Promise.resolve(opts.repo) : detectRepo(opts.runner, repoRoot),
+    include.rotation ? evaluateMatrix({
+      manifest,
+      repoRoot,
+      policy,
+      matrixManager,
+      sopsClient,
+      filter: opts.filter,
+      now
+    }) : Promise.resolve([]),
+    include.scan ? new ScanRunner(opts.runner).scan(repoRoot, manifest) : Promise.resolve(emptyScan()),
+    include.lint ? new LintRunner(matrixManager, schemaValidator, sopsClient).run(manifest, repoRoot) : Promise.resolve(emptyLint())
+  ]);
+  const document = new ComplianceGenerator().generate({
+    sha,
+    repo,
+    policy,
+    scanResult,
+    lintResult,
+    files,
+    now
+  });
+  const passed = document.summary.rotation_overdue === 0 && document.summary.scan_violations === 0 && document.summary.lint_errors === 0;
+  return { document, passed, durationMs: Date.now() - start };
+}
+async function evaluateMatrix(args) {
+  const evaluator = new PolicyEvaluator(args.policy);
+  const cells = args.matrixManager.resolveMatrix(args.manifest, args.repoRoot).filter((c) => applyFilter(c.namespace, c.environment, args.filter)).filter((c) => c.exists);
+  return Promise.all(
+    cells.map(async (cell) => {
+      const metadata = await args.sopsClient.getMetadata(cell.filePath);
+      const relPath = path25.relative(args.repoRoot, cell.filePath).replace(/\\/g, "/");
+      return evaluator.evaluateFile(relPath, cell.environment, metadata, args.now);
+    })
+  );
+}
+function applyFilter(namespace, environment, filter) {
+  if (filter?.namespaces?.length && !filter.namespaces.includes(namespace)) return false;
+  if (filter?.environments?.length && !filter.environments.includes(environment)) return false;
+  return true;
+}
+function emptyScan() {
+  return {
+    matches: [],
+    filesScanned: 0,
+    filesSkipped: 0,
+    unencryptedMatrixFiles: [],
+    durationMs: 0
+  };
+}
+function emptyLint() {
+  return { issues: [], fileCount: 0, pendingCount: 0 };
+}
+async function detectSha(runner, repoRoot) {
+  const env = process.env;
+  const fromEnv = env.GITHUB_SHA ?? env.CI_COMMIT_SHA ?? env.BITBUCKET_COMMIT ?? env.CIRCLE_SHA1 ?? env.BUILD_VCS_NUMBER;
+  if (fromEnv) return fromEnv;
+  const result = await runner.run("git", ["rev-parse", "HEAD"], { cwd: repoRoot });
+  if (result.exitCode !== 0) return UNKNOWN;
+  const trimmed = result.stdout.trim();
+  return trimmed || UNKNOWN;
+}
+async function detectRepo(runner, repoRoot) {
+  const env = process.env;
+  const fromEnv = env.GITHUB_REPOSITORY ?? env.CI_PROJECT_PATH ?? env.BITBUCKET_REPO_FULL_NAME ?? (env.CIRCLE_PROJECT_USERNAME && env.CIRCLE_PROJECT_REPONAME ? `${env.CIRCLE_PROJECT_USERNAME}/${env.CIRCLE_PROJECT_REPONAME}` : void 0);
+  if (fromEnv) return fromEnv;
+  const result = await runner.run("git", ["remote", "get-url", "origin"], { cwd: repoRoot });
+  if (result.exitCode !== 0) return UNKNOWN;
+  const url = result.stdout.trim();
+  const match = url.match(/[:/]([^/:]+)\/([^/]+?)(?:\.git)?\/?$/);
+  return match ? `${match[1]}/${match[2]}` : UNKNOWN;
+}
 export {
   ArtifactPacker,
   BackendMigrator,
   BulkOps,
   CLEF_MANIFEST_FILENAME,
+  CLEF_POLICY_FILENAME,
   CLEF_REPORT_SCHEMA_VERSION,
   CLEF_SUPPORTED_EXTENSIONS,
   ClefError,
   CloudApiError,
   CloudClient,
+  ComplianceGenerator,
   ConsumptionClient,
+  DEFAULT_POLICY,
   DiffEngine,
   DriftDetector,
   FilePackOutput,
@@ -8328,6 +8644,9 @@ export {
   ManifestValidationError,
   MatrixManager,
   MemoryPackOutput,
+  PolicyEvaluator,
+  PolicyParser,
+  PolicyValidationError,
   REQUESTS_FILENAME,
   REQUIREMENTS,
   RecipientManager,
@@ -8394,6 +8713,7 @@ export {
   resolveIdentitySecrets,
   resolveRecipientsForEnvironment,
   resolveSopsPath,
+  runCompliance,
   saveMetadata,
   saveRequests,
   shannonEntropy,