@clef-sh/core 0.1.17 → 0.1.18

package/dist/index.mjs

@@ -301,10 +301,10 @@ var require_lib = __commonJS({
   "node_modules/write-file-atomic/lib/index.js"(exports, module) {
     "use strict";
     module.exports = writeFile;
-    module.exports.sync = writeFileSync6;
+    module.exports.sync = writeFileSync7;
     module.exports._getTmpname = getTmpname;
     module.exports._cleanupOnExit = cleanupOnExit;
-    var fs18 = __require("fs");
+    var fs19 = __require("fs");
     var crypto4 = __require("node:crypto");
     var { onExit } = require_cjs();
     var path26 = __require("path");
@@ -325,7 +325,7 @@ var require_lib = __commonJS({
     function cleanupOnExit(tmpfile) {
       return () => {
         try {
-          fs18.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
+          fs19.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
         } catch {
         }
       };
@@ -363,10 +363,10 @@ var require_lib = __commonJS({
       const absoluteName = path26.resolve(filename);
       try {
         await serializeActiveFile(absoluteName);
-        const truename = await promisify(fs18.realpath)(filename).catch(() => filename);
+        const truename = await promisify(fs19.realpath)(filename).catch(() => filename);
         tmpfile = getTmpname(truename);
         if (!options.mode || !options.chown) {
-          const stats = await promisify(fs18.stat)(truename).catch(() => {
+          const stats = await promisify(fs19.stat)(truename).catch(() => {
           });
           if (stats) {
             if (options.mode == null) {
@@ -377,45 +377,45 @@ var require_lib = __commonJS({
             }
           }
         }
-        fd = await promisify(fs18.open)(tmpfile, "w", options.mode);
+        fd = await promisify(fs19.open)(tmpfile, "w", options.mode);
         if (options.tmpfileCreated) {
           await options.tmpfileCreated(tmpfile);
         }
         if (ArrayBuffer.isView(data)) {
-          await promisify(fs18.write)(fd, data, 0, data.length, 0);
+          await promisify(fs19.write)(fd, data, 0, data.length, 0);
         } else if (data != null) {
-          await promisify(fs18.write)(fd, String(data), 0, String(options.encoding || "utf8"));
+          await promisify(fs19.write)(fd, String(data), 0, String(options.encoding || "utf8"));
         }
         if (options.fsync !== false) {
-          await promisify(fs18.fsync)(fd);
+          await promisify(fs19.fsync)(fd);
         }
-        await promisify(fs18.close)(fd);
+        await promisify(fs19.close)(fd);
         fd = null;
         if (options.chown) {
-          await promisify(fs18.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
+          await promisify(fs19.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
             if (!isChownErrOk(err)) {
               throw err;
             }
           });
         }
         if (options.mode) {
-          await promisify(fs18.chmod)(tmpfile, options.mode).catch((err) => {
+          await promisify(fs19.chmod)(tmpfile, options.mode).catch((err) => {
             if (!isChownErrOk(err)) {
               throw err;
             }
           });
         }
-        await promisify(fs18.rename)(tmpfile, truename);
+        await promisify(fs19.rename)(tmpfile, truename);
       } finally {
         if (fd) {
-          await promisify(fs18.close)(fd).catch(
+          await promisify(fs19.close)(fd).catch(
             /* istanbul ignore next */
             () => {
             }
           );
         }
         removeOnExitHandler();
-        await promisify(fs18.unlink)(tmpfile).catch(() => {
+        await promisify(fs19.unlink)(tmpfile).catch(() => {
         });
         activeFiles[absoluteName].shift();
         if (activeFiles[absoluteName].length > 0) {
@@ -441,20 +441,20 @@ var require_lib = __commonJS({
       }
       return promise;
     }
-    function writeFileSync6(filename, data, options) {
+    function writeFileSync7(filename, data, options) {
       if (typeof options === "string") {
         options = { encoding: options };
       } else if (!options) {
         options = {};
       }
       try {
-        filename = fs18.realpathSync(filename);
+        filename = fs19.realpathSync(filename);
       } catch (ex) {
       }
       const tmpfile = getTmpname(filename);
       if (!options.mode || !options.chown) {
         try {
-          const stats = fs18.statSync(filename);
+          const stats = fs19.statSync(filename);
           options = Object.assign({}, options);
           if (!options.mode) {
             options.mode = stats.mode;
@@ -470,23 +470,23 @@ var require_lib = __commonJS({
       const removeOnExitHandler = onExit(cleanup);
       let threw = true;
       try {
-        fd = fs18.openSync(tmpfile, "w", options.mode || 438);
+        fd = fs19.openSync(tmpfile, "w", options.mode || 438);
         if (options.tmpfileCreated) {
           options.tmpfileCreated(tmpfile);
         }
         if (ArrayBuffer.isView(data)) {
-          fs18.writeSync(fd, data, 0, data.length, 0);
+          fs19.writeSync(fd, data, 0, data.length, 0);
         } else if (data != null) {
-          fs18.writeSync(fd, String(data), 0, String(options.encoding || "utf8"));
+          fs19.writeSync(fd, String(data), 0, String(options.encoding || "utf8"));
         }
         if (options.fsync !== false) {
-          fs18.fsyncSync(fd);
+          fs19.fsyncSync(fd);
         }
-        fs18.closeSync(fd);
+        fs19.closeSync(fd);
         fd = null;
         if (options.chown) {
           try {
-            fs18.chownSync(tmpfile, options.chown.uid, options.chown.gid);
+            fs19.chownSync(tmpfile, options.chown.uid, options.chown.gid);
           } catch (err) {
             if (!isChownErrOk(err)) {
               throw err;
@@ -495,19 +495,19 @@ var require_lib = __commonJS({
         }
         if (options.mode) {
           try {
-            fs18.chmodSync(tmpfile, options.mode);
+            fs19.chmodSync(tmpfile, options.mode);
           } catch (err) {
             if (!isChownErrOk(err)) {
               throw err;
             }
           }
         }
-        fs18.renameSync(tmpfile, filename);
+        fs19.renameSync(tmpfile, filename);
         threw = false;
       } finally {
         if (fd) {
           try {
-            fs18.closeSync(fd);
+            fs19.closeSync(fd);
           } catch (ex) {
           }
         }
@@ -546,54 +546,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs18) {
+    function patch(fs19) {
       if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs18);
-      }
-      if (!fs18.lutimes) {
-        patchLutimes(fs18);
-      }
-      fs18.chown = chownFix(fs18.chown);
-      fs18.fchown = chownFix(fs18.fchown);
-      fs18.lchown = chownFix(fs18.lchown);
-      fs18.chmod = chmodFix(fs18.chmod);
-      fs18.fchmod = chmodFix(fs18.fchmod);
-      fs18.lchmod = chmodFix(fs18.lchmod);
-      fs18.chownSync = chownFixSync(fs18.chownSync);
-      fs18.fchownSync = chownFixSync(fs18.fchownSync);
-      fs18.lchownSync = chownFixSync(fs18.lchownSync);
-      fs18.chmodSync = chmodFixSync(fs18.chmodSync);
-      fs18.fchmodSync = chmodFixSync(fs18.fchmodSync);
-      fs18.lchmodSync = chmodFixSync(fs18.lchmodSync);
-      fs18.stat = statFix(fs18.stat);
-      fs18.fstat = statFix(fs18.fstat);
-      fs18.lstat = statFix(fs18.lstat);
-      fs18.statSync = statFixSync(fs18.statSync);
-      fs18.fstatSync = statFixSync(fs18.fstatSync);
-      fs18.lstatSync = statFixSync(fs18.lstatSync);
-      if (fs18.chmod && !fs18.lchmod) {
-        fs18.lchmod = function(path26, mode, cb) {
+        patchLchmod(fs19);
+      }
+      if (!fs19.lutimes) {
+        patchLutimes(fs19);
+      }
+      fs19.chown = chownFix(fs19.chown);
+      fs19.fchown = chownFix(fs19.fchown);
+      fs19.lchown = chownFix(fs19.lchown);
+      fs19.chmod = chmodFix(fs19.chmod);
+      fs19.fchmod = chmodFix(fs19.fchmod);
+      fs19.lchmod = chmodFix(fs19.lchmod);
+      fs19.chownSync = chownFixSync(fs19.chownSync);
+      fs19.fchownSync = chownFixSync(fs19.fchownSync);
+      fs19.lchownSync = chownFixSync(fs19.lchownSync);
+      fs19.chmodSync = chmodFixSync(fs19.chmodSync);
+      fs19.fchmodSync = chmodFixSync(fs19.fchmodSync);
+      fs19.lchmodSync = chmodFixSync(fs19.lchmodSync);
+      fs19.stat = statFix(fs19.stat);
+      fs19.fstat = statFix(fs19.fstat);
+      fs19.lstat = statFix(fs19.lstat);
+      fs19.statSync = statFixSync(fs19.statSync);
+      fs19.fstatSync = statFixSync(fs19.fstatSync);
+      fs19.lstatSync = statFixSync(fs19.lstatSync);
+      if (fs19.chmod && !fs19.lchmod) {
+        fs19.lchmod = function(path26, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs18.lchmodSync = function() {
+        fs19.lchmodSync = function() {
         };
       }
-      if (fs18.chown && !fs18.lchown) {
-        fs18.lchown = function(path26, uid, gid, cb) {
+      if (fs19.chown && !fs19.lchown) {
+        fs19.lchown = function(path26, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs18.lchownSync = function() {
+        fs19.lchownSync = function() {
         };
       }
       if (platform === "win32") {
-        fs18.rename = typeof fs18.rename !== "function" ? fs18.rename : (function(fs$rename) {
+        fs19.rename = typeof fs19.rename !== "function" ? fs19.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs18.stat(to, function(stater, st) {
+                  fs19.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -609,9 +609,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs18.rename);
+        })(fs19.rename);
       }
-      fs18.read = typeof fs18.read !== "function" ? fs18.read : (function(fs$read) {
+      fs19.read = typeof fs19.read !== "function" ? fs19.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -619,22 +619,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs18, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs19, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs18, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs19, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs18.read);
-      fs18.readSync = typeof fs18.readSync !== "function" ? fs18.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs19.read);
+      fs19.readSync = typeof fs19.readSync !== "function" ? fs19.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs18, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs19, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -644,10 +644,10 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs18.readSync);
-      function patchLchmod(fs19) {
-        fs19.lchmod = function(path26, mode, callback) {
-          fs19.open(
+      })(fs19.readSync);
+      function patchLchmod(fs20) {
+        fs20.lchmod = function(path26, mode, callback) {
+          fs20.open(
             path26,
             constants.O_WRONLY | constants.O_SYMLINK,
             mode,
@@ -656,80 +656,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs19.fchmod(fd, mode, function(err2) {
-                fs19.close(fd, function(err22) {
+              fs20.fchmod(fd, mode, function(err2) {
+                fs20.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs19.lchmodSync = function(path26, mode) {
-          var fd = fs19.openSync(path26, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        fs20.lchmodSync = function(path26, mode) {
+          var fd = fs20.openSync(path26, constants.O_WRONLY | constants.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs19.fchmodSync(fd, mode);
+            ret = fs20.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs19.closeSync(fd);
+                fs20.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs19.closeSync(fd);
+              fs20.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs19) {
-        if (constants.hasOwnProperty("O_SYMLINK") && fs19.futimes) {
-          fs19.lutimes = function(path26, at, mt, cb) {
-            fs19.open(path26, constants.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs20) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs20.futimes) {
+          fs20.lutimes = function(path26, at, mt, cb) {
+            fs20.open(path26, constants.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs19.futimes(fd, at, mt, function(er2) {
-                fs19.close(fd, function(er22) {
+              fs20.futimes(fd, at, mt, function(er2) {
+                fs20.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs19.lutimesSync = function(path26, at, mt) {
-            var fd = fs19.openSync(path26, constants.O_SYMLINK);
+          fs20.lutimesSync = function(path26, at, mt) {
+            var fd = fs20.openSync(path26, constants.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs19.futimesSync(fd, at, mt);
+              ret = fs20.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs19.closeSync(fd);
+                  fs20.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs19.closeSync(fd);
+                fs20.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs19.futimes) {
-          fs19.lutimes = function(_a, _b, _c, cb) {
+        } else if (fs20.futimes) {
+          fs20.lutimes = function(_a, _b, _c, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs19.lutimesSync = function() {
+          fs20.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs18, target, mode, function(er) {
+          return orig.call(fs19, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -739,7 +739,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs18, target, mode);
+            return orig.call(fs19, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -748,7 +748,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs18, target, uid, gid, function(er) {
+          return orig.call(fs19, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -758,7 +758,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs18, target, uid, gid);
+            return orig.call(fs19, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -778,13 +778,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs18, target, options, callback) : orig.call(fs18, target, callback);
+          return options ? orig.call(fs19, target, options, callback) : orig.call(fs19, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs18, target, options) : orig.call(fs18, target);
+          var stats = options ? orig.call(fs19, target, options) : orig.call(fs19, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -813,7 +813,7 @@ var require_legacy_streams = __commonJS({
   "../../node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs18) {
+    function legacy(fs19) {
       return {
         ReadStream,
         WriteStream
@@ -856,7 +856,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs18.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs19.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self.emit("error", err);
             self.readable = false;
@@ -895,7 +895,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs18.open;
+          this._open = fs19.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -930,7 +930,7 @@ var require_clone = __commonJS({
 // ../../node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "../../node_modules/graceful-fs/graceful-fs.js"(exports, module) {
-    var fs18 = __require("fs");
+    var fs19 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -962,12 +962,12 @@ var require_graceful_fs = __commonJS({
         m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
         console.error(m);
       };
-    if (!fs18[gracefulQueue]) {
+    if (!fs19[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs18, queue);
-      fs18.close = (function(fs$close) {
+      publishQueue(fs19, queue);
+      fs19.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs18, fd, function(err) {
+          return fs$close.call(fs19, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -979,40 +979,40 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs18.close);
-      fs18.closeSync = (function(fs$closeSync) {
+      })(fs19.close);
+      fs19.closeSync = (function(fs$closeSync) {
         function closeSync2(fd) {
-          fs$closeSync.apply(fs18, arguments);
+          fs$closeSync.apply(fs19, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync2, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync2;
-      })(fs18.closeSync);
+      })(fs19.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug(fs18[gracefulQueue]);
-          __require("assert").equal(fs18[gracefulQueue].length, 0);
+          debug(fs19[gracefulQueue]);
+          __require("assert").equal(fs19[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs18[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs18));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs18.__patched) {
-      module.exports = patch(fs18);
-      fs18.__patched = true;
-    }
-    function patch(fs19) {
-      polyfills(fs19);
-      fs19.gracefulify = patch;
-      fs19.createReadStream = createReadStream;
-      fs19.createWriteStream = createWriteStream;
-      var fs$readFile = fs19.readFile;
-      fs19.readFile = readFile;
+      publishQueue(global, fs19[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs19));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs19.__patched) {
+      module.exports = patch(fs19);
+      fs19.__patched = true;
+    }
+    function patch(fs20) {
+      polyfills(fs20);
+      fs20.gracefulify = patch;
+      fs20.createReadStream = createReadStream;
+      fs20.createWriteStream = createWriteStream;
+      var fs$readFile = fs20.readFile;
+      fs20.readFile = readFile;
       function readFile(path26, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -1028,8 +1028,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs19.writeFile;
-      fs19.writeFile = writeFile;
+      var fs$writeFile = fs20.writeFile;
+      fs20.writeFile = writeFile;
       function writeFile(path26, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -1045,9 +1045,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs19.appendFile;
+      var fs$appendFile = fs20.appendFile;
       if (fs$appendFile)
-        fs19.appendFile = appendFile;
+        fs20.appendFile = appendFile;
       function appendFile(path26, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -1063,9 +1063,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs19.copyFile;
+      var fs$copyFile = fs20.copyFile;
       if (fs$copyFile)
-        fs19.copyFile = copyFile;
+        fs20.copyFile = copyFile;
       function copyFile(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -1083,8 +1083,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs19.readdir;
-      fs19.readdir = readdir;
+      var fs$readdir = fs20.readdir;
+      fs20.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
       function readdir(path26, options, cb) {
         if (typeof options === "function")
@@ -1125,21 +1125,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs19);
+        var legStreams = legacy(fs20);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs19.ReadStream;
+      var fs$ReadStream = fs20.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs19.WriteStream;
+      var fs$WriteStream = fs20.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs19, "ReadStream", {
+      Object.defineProperty(fs20, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -1149,7 +1149,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs19, "WriteStream", {
+      Object.defineProperty(fs20, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -1160,7 +1160,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs19, "FileReadStream", {
+      Object.defineProperty(fs20, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -1171,7 +1171,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs19, "FileWriteStream", {
+      Object.defineProperty(fs20, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -1220,13 +1220,13 @@ var require_graceful_fs = __commonJS({
         });
       }
       function createReadStream(path26, options) {
-        return new fs19.ReadStream(path26, options);
+        return new fs20.ReadStream(path26, options);
       }
       function createWriteStream(path26, options) {
-        return new fs19.WriteStream(path26, options);
+        return new fs20.WriteStream(path26, options);
       }
-      var fs$open = fs19.open;
-      fs19.open = open;
+      var fs$open = fs20.open;
+      fs20.open = open;
       function open(path26, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
@@ -1242,20 +1242,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs19;
+      return fs20;
     }
     function enqueue(elem) {
       debug("ENQUEUE", elem[0].name, elem[1]);
-      fs18[gracefulQueue].push(elem);
+      fs19[gracefulQueue].push(elem);
       retry();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i = 0; i < fs18[gracefulQueue].length; ++i) {
-        if (fs18[gracefulQueue][i].length > 2) {
-          fs18[gracefulQueue][i][3] = now;
-          fs18[gracefulQueue][i][4] = now;
+      for (var i = 0; i < fs19[gracefulQueue].length; ++i) {
+        if (fs19[gracefulQueue][i].length > 2) {
+          fs19[gracefulQueue][i][3] = now;
+          fs19[gracefulQueue][i][4] = now;
         }
       }
       retry();
@@ -1263,9 +1263,9 @@ var require_graceful_fs = __commonJS({
     function retry() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs18[gracefulQueue].length === 0)
+      if (fs19[gracefulQueue].length === 0)
         return;
-      var elem = fs18[gracefulQueue].shift();
+      var elem = fs19[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -1287,7 +1287,7 @@ var require_graceful_fs = __commonJS({
           debug("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs18[gracefulQueue].push(elem);
+          fs19[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -1722,10 +1722,10 @@ var require_mtime_precision = __commonJS({
   "../../node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = /* @__PURE__ */ Symbol();
-    function probe(file, fs18, callback) {
-      const cachedPrecision = fs18[cacheSymbol];
+    function probe(file, fs19, callback) {
+      const cachedPrecision = fs19[cacheSymbol];
       if (cachedPrecision) {
-        return fs18.stat(file, (err, stat) => {
+        return fs19.stat(file, (err, stat) => {
           if (err) {
             return callback(err);
           }
@@ -1733,16 +1733,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs18.utimes(file, mtime, mtime, (err) => {
+      fs19.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs18.stat(file, (err2, stat) => {
+        fs19.stat(file, (err2, stat) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs18, cacheSymbol, { value: precision });
+          Object.defineProperty(fs19, cacheSymbol, { value: precision });
           callback(null, stat.mtime, precision);
         });
       });
@@ -1764,7 +1764,7 @@ var require_lockfile = __commonJS({
   "../../node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
     var path26 = __require("path");
-    var fs18 = require_graceful_fs();
+    var fs19 = require_graceful_fs();
     var retry = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -1895,7 +1895,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs18,
+        fs: fs19,
         onCompromised: (err) => {
           throw err;
         },
@@ -1939,7 +1939,7 @@ var require_lockfile = __commonJS({
     }
     function unlock(file, options, callback) {
       options = {
-        fs: fs18,
+        fs: fs19,
         realpath: true,
         ...options
       };
@@ -1961,7 +1961,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs18,
+        fs: fs19,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -2000,16 +2000,16 @@ var require_lockfile = __commonJS({
 var require_adapter = __commonJS({
   "../../node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
-    var fs18 = require_graceful_fs();
-    function createSyncFs(fs19) {
+    var fs19 = require_graceful_fs();
+    function createSyncFs(fs20) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs19 };
+      const newFs = { ...fs20 };
       methods.forEach((method) => {
         newFs[method] = (...args) => {
           const callback = args.pop();
           let ret;
           try {
-            ret = fs19[`${method}Sync`](...args);
+            ret = fs20[`${method}Sync`](...args);
           } catch (err) {
             return callback(err);
           }
@@ -2047,7 +2047,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs18);
+      options.fs = createSyncFs(options.fs || fs19);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -2842,6 +2842,20 @@ var PATTERNS = [
   },
   { name: "Database URL", regex: /(?:postgres|mysql|mongodb|redis):\/\/[^:]+:[^@]+@/ }
 ];
+var PUBLIC_PREFIX_PATTERNS = [
+  // reCAPTCHA v2, v3, and Enterprise site keys are exactly 40 chars and
+  // begin with 6L[c-f]. Site keys are designed to be embedded in HTML.
+  // https://developers.google.com/recaptcha/docs/faq
+  { name: "reCAPTCHA site key", regex: /^6L[c-f][0-9A-Za-z_-]{37}$/ },
+  // Stripe publishable keys (client-side, distinct from sk_live_/sk_test_).
+  { name: "Stripe publishable key", regex: /^pk_(?:live|test)_[0-9a-zA-Z]{24,}$/ }
+];
+function matchPublicPrefix(value) {
+  for (const def of PUBLIC_PREFIX_PATTERNS) {
+    if (def.regex.test(value)) return { name: def.name };
+  }
+  return null;
+}
 function shannonEntropy(str) {
   if (str.length === 0) return 0;
   const freq = /* @__PURE__ */ new Map();
@@ -3030,7 +3044,8 @@ var ScanRunner = class {
           }
         }
         if (options.severity !== "high") {
-          const entropyHit = this.detectEntropy(line, lineNum, relPath);
+          const allowPublic = options.publicAllowlist !== false;
+          const entropyHit = this.detectEntropy(line, lineNum, relPath, allowPublic);
           if (entropyHit && !shouldIgnoreMatch(entropyHit, ignoreRules)) {
             matches.push(entropyHit);
           }
@@ -3071,13 +3086,14 @@ var ScanRunner = class {
       return false;
     }
   }
-  detectEntropy(line, lineNum, filePath) {
+  detectEntropy(line, lineNum, filePath, allowPublic) {
     const valuePattern = /(?:=|:\s*)["']?([A-Za-z0-9+/=_-]{20,})["']?/;
     const match = valuePattern.exec(line);
     if (!match) return null;
     const value = match[1];
     const entropy = shannonEntropy(value);
     if (!isHighEntropy(value)) return null;
+    if (allowPublic && matchPublicPrefix(value)) return null;
     const varMatch = /(\w+)\s*(?:=|:)/.exec(line);
     const varName = varMatch ? varMatch[1] : "";
     const preview = varName ? `${varName}=\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022` : redactValue(value);
@@ -3159,41 +3175,50 @@ function metadataPath(encryptedFilePath) {
   return path4.join(dir, `${base}.clef-meta.yaml`);
 }
 var HEADER_COMMENT = "# Managed by Clef. Do not edit manually.\n";
+function emptyMetadata() {
+  return { version: 1, pending: [], rotations: [] };
+}
 async function loadMetadata(filePath) {
   const metaPath = metadataPath(filePath);
   try {
-    if (!fs5.existsSync(metaPath)) {
-      return { version: 1, pending: [] };
-    }
+    if (!fs5.existsSync(metaPath)) return emptyMetadata();
     const content = fs5.readFileSync(metaPath, "utf-8");
     const parsed = YAML3.parse(content);
-    if (!parsed || !Array.isArray(parsed.pending)) {
-      return { version: 1, pending: [] };
-    }
-    return {
-      version: 1,
-      pending: parsed.pending.map((p) => ({
-        key: p.key,
-        since: new Date(p.since),
-        setBy: p.setBy
-      }))
-    };
+    if (!parsed || typeof parsed !== "object") return emptyMetadata();
+    const pendingRaw = Array.isArray(parsed.pending) ? parsed.pending : [];
+    const pending = pendingRaw.filter(
+      (p) => !!p && typeof p === "object" && typeof p.key === "string" && typeof p.since === "string" && typeof p.setBy === "string"
+    ).map((p) => ({ key: p.key, since: new Date(p.since), setBy: p.setBy }));
+    const rotationsRaw = Array.isArray(parsed.rotations) ? parsed.rotations : [];
+    const rotations = rotationsRaw.filter(
+      (r) => !!r && typeof r === "object" && typeof r.key === "string" && typeof r.last_rotated_at === "string" && typeof r.rotated_by === "string" && typeof r.rotation_count === "number"
+    ).map((r) => ({
+      key: r.key,
+      lastRotatedAt: new Date(r.last_rotated_at),
+      rotatedBy: r.rotated_by,
+      rotationCount: r.rotation_count
+    }));
+    return { version: 1, pending, rotations };
   } catch {
-    return { version: 1, pending: [] };
+    return emptyMetadata();
   }
 }
 async function saveMetadata(filePath, metadata) {
   const metaPath = metadataPath(filePath);
   const dir = path4.dirname(metaPath);
-  if (!fs5.existsSync(dir)) {
-    fs5.mkdirSync(dir, { recursive: true });
-  }
+  if (!fs5.existsSync(dir)) fs5.mkdirSync(dir, { recursive: true });
   const data = {
     version: metadata.version,
     pending: metadata.pending.map((p) => ({
       key: p.key,
       since: p.since.toISOString(),
       setBy: p.setBy
+    })),
+    rotations: metadata.rotations.map((r) => ({
+      key: r.key,
+      last_rotated_at: r.lastRotatedAt.toISOString(),
+      rotated_by: r.rotatedBy,
+      rotation_count: r.rotationCount
     }))
   };
   fs5.writeFileSync(metaPath, HEADER_COMMENT + YAML3.stringify(data), "utf-8");
@@ -3224,6 +3249,38 @@ async function isPending(filePath, key) {
   const metadata = await loadMetadata(filePath);
   return metadata.pending.some((p) => p.key === key);
 }
+async function recordRotation(filePath, keys, rotatedBy, now = /* @__PURE__ */ new Date()) {
+  const metadata = await loadMetadata(filePath);
+  for (const key of keys) {
+    const existing = metadata.rotations.findIndex((r) => r.key === key);
+    if (existing >= 0) {
+      metadata.rotations[existing] = {
+        key,
+        lastRotatedAt: now,
+        rotatedBy,
+        rotationCount: metadata.rotations[existing].rotationCount + 1
+      };
+    } else {
+      metadata.rotations.push({
+        key,
+        lastRotatedAt: now,
+        rotatedBy,
+        rotationCount: 1
+      });
+    }
+  }
+  metadata.pending = metadata.pending.filter((p) => !keys.includes(p.key));
+  await saveMetadata(filePath, metadata);
+}
+async function removeRotation(filePath, keys) {
+  const metadata = await loadMetadata(filePath);
+  metadata.rotations = metadata.rotations.filter((r) => !keys.includes(r.key));
+  await saveMetadata(filePath, metadata);
+}
+async function getRotations(filePath) {
+  const metadata = await loadMetadata(filePath);
+  return metadata.rotations;
+}
 function generateRandomValue() {
   return crypto.randomBytes(32).toString("hex");
 }
@@ -4025,61 +4082,83 @@ var GitIntegration = class {
    * @throws {@link GitOperationError} On failure.
    */
   async installMergeDriver(repoRoot) {
-    const configResult = await this.runner.run(
-      "git",
-      ["config", "merge.sops.name", "SOPS-aware merge driver"],
-      { cwd: repoRoot }
-    );
-    if (configResult.exitCode !== 0) {
-      throw new GitOperationError(
-        `Failed to configure merge driver name: ${configResult.stderr.trim()}`,
-        "Ensure you are inside a git repository."
+    const drivers = [
+      { config: "merge.sops", friendly: "SOPS-aware merge driver" },
+      { config: "merge.clef-metadata", friendly: "Clef metadata merge driver" }
+    ];
+    for (const driver of drivers) {
+      const nameResult = await this.runner.run(
+        "git",
+        ["config", `${driver.config}.name`, driver.friendly],
+        { cwd: repoRoot }
       );
-    }
-    const driverResult = await this.runner.run(
-      "git",
-      ["config", "merge.sops.driver", "clef merge-driver %O %A %B"],
-      { cwd: repoRoot }
-    );
-    if (driverResult.exitCode !== 0) {
-      throw new GitOperationError(
-        `Failed to configure merge driver command: ${driverResult.stderr.trim()}`,
-        "Ensure you are inside a git repository."
+      if (nameResult.exitCode !== 0) {
+        throw new GitOperationError(
+          `Failed to configure merge driver name: ${nameResult.stderr.trim()}`,
+          "Ensure you are inside a git repository."
+        );
+      }
+      const driverResult = await this.runner.run(
+        "git",
+        ["config", `${driver.config}.driver`, "clef merge-driver %O %A %B"],
+        { cwd: repoRoot }
       );
+      if (driverResult.exitCode !== 0) {
+        throw new GitOperationError(
+          `Failed to configure merge driver command: ${driverResult.stderr.trim()}`,
+          "Ensure you are inside a git repository."
+        );
+      }
     }
     await this.ensureGitattributes(repoRoot);
   }
   /**
-   * Check whether the SOPS merge driver is configured in both
-   * `.git/config` and `.gitattributes`.
-   *
-   * @param repoRoot - Absolute path to the repository root.
-   * @returns An object indicating which parts are configured.
+   * Check whether both Clef merge drivers are configured in `.git/config`
+   * and `.gitattributes`.  Reports separately on the SOPS driver
+   * (`merge=sops` for `.enc.*`) and the metadata driver
+   * (`merge=clef-metadata` for `.clef-meta.yaml`) so `clef doctor` can
+   * prompt the user to run `clef hooks` when only the SOPS driver is
+   * installed (older install, pre-metadata-merge).
    */
   async checkMergeDriver(repoRoot) {
-    const configResult = await this.runner.run("git", ["config", "--get", "merge.sops.driver"], {
+    const sopsConfig = await this.runner.run("git", ["config", "--get", "merge.sops.driver"], {
       cwd: repoRoot
     });
-    const gitConfig = configResult.exitCode === 0 && configResult.stdout.trim().length > 0;
+    const gitConfig = sopsConfig.exitCode === 0 && sopsConfig.stdout.trim().length > 0;
+    const metaConfig = await this.runner.run(
+      "git",
+      ["config", "--get", "merge.clef-metadata.driver"],
+      { cwd: repoRoot }
+    );
+    const metadataGitConfig = metaConfig.exitCode === 0 && metaConfig.stdout.trim().length > 0;
     const attrFilePath = path8.join(repoRoot, ".gitattributes");
     const attrContent = fs9.existsSync(attrFilePath) ? fs9.readFileSync(attrFilePath, "utf-8") : "";
     const gitattributes = attrContent.includes("merge=sops");
-    return { gitConfig, gitattributes };
+    const metadataGitattributes = attrContent.includes("merge=clef-metadata");
+    return { gitConfig, gitattributes, metadataGitConfig, metadataGitattributes };
   }
   async ensureGitattributes(repoRoot) {
     const attrPath = path8.join(repoRoot, ".gitattributes");
-    const mergeRule = "*.enc.yaml merge=sops\n*.enc.json merge=sops";
     const existing = fs9.existsSync(attrPath) ? fs9.readFileSync(attrPath, "utf-8") : "";
-    if (existing.includes("merge=sops")) {
-      return;
-    }
-    const newContent = existing.trimEnd() ? `${existing.trimEnd()}
+    let newContent = existing;
+    if (!existing.includes("merge=sops")) {
+      const block = `# Clef: SOPS-aware merge driver for encrypted files
+*.enc.yaml merge=sops
+*.enc.json merge=sops
+`;
+      newContent = newContent.trimEnd() ? `${newContent.trimEnd()}
 
-# Clef: SOPS-aware merge driver for encrypted files
-${mergeRule}
-` : `# Clef: SOPS-aware merge driver for encrypted files
-${mergeRule}
+${block}` : block;
+    }
+    if (!newContent.includes("merge=clef-metadata")) {
+      const block = `# Clef: rotation-aware merge driver for metadata sidecars
+*.clef-meta.yaml merge=clef-metadata
 `;
+      newContent = newContent.trimEnd() ? `${newContent.trimEnd()}
+
+${block}` : block;
+    }
+    if (newContent === existing) return;
     try {
       fs9.writeFileSync(attrPath, newContent, "utf-8");
     } catch (err) {
@@ -5076,8 +5155,50 @@ var LintRunner = class {
       );
       issues.push(...siIssues);
     }
+    const metadataIssues = await this.lintMetadataConsistency(existingCells);
+    issues.push(...metadataIssues);
     return { issues, fileCount: fileCount + missingCells.length, pendingCount };
   }
+  /**
+   * Cross-reference `.clef-meta.yaml` against the cipher's plaintext key
+   * names for each existing cell.  Reports orphan rotation records and
+   * dual-state (pending + rotation) inconsistencies.  Uses
+   * {@link readSopsKeyNames} (plaintext YAML parse) — no decryption.
+   */
+  async lintMetadataConsistency(cells) {
+    const issues = [];
+    for (const cell of cells) {
+      const keysInCipher = readSopsKeyNames(cell.filePath);
+      if (keysInCipher === null) continue;
+      const cipherKeys = new Set(keysInCipher);
+      const metadata = await loadMetadata(cell.filePath);
+      for (const record of metadata.rotations) {
+        if (!cipherKeys.has(record.key)) {
+          issues.push({
+            severity: "warning",
+            category: "metadata",
+            file: cell.filePath,
+            key: record.key,
+            message: `Rotation record exists for key '${record.key}' but the key is not in this cell. Remove the orphan entry from .clef-meta.yaml or re-add the key via clef set.`
+          });
+        }
+      }
+      const pendingKeys = new Set(metadata.pending.map((p) => p.key));
+      for (const record of metadata.rotations) {
+        if (pendingKeys.has(record.key)) {
+          issues.push({
+            severity: "error",
+            category: "metadata",
+            file: cell.filePath,
+            key: record.key,
+            message: `Key '${record.key}' appears in both 'pending' and 'rotations' sections of .clef-meta.yaml. One of them is stale \u2014 likely a manual edit or a failed transaction. Re-run clef set to reconcile.`,
+            fixCommand: `clef set ${cell.namespace}/${cell.environment} ${record.key}`
+          });
+        }
+      }
+    }
+    return issues;
+  }
   /**
    * Lint service identity configurations for drift issues.
    */
@@ -5430,22 +5551,33 @@ var ImportRunner = class {
     }
     const decrypted = await this.sopsClient.decrypt(filePath);
     const newValues = { ...decrypted.values };
+    const rotatedKeys = [];
     for (const [key, value] of candidates) {
-      if (key in decrypted.values && !options.overwrite) {
+      const existed = key in decrypted.values;
+      if (existed && !options.overwrite) {
         skipped.push(key);
         continue;
       }
+      const valueChanged = !existed || decrypted.values[key] !== value;
       newValues[key] = value;
       imported.push(key);
+      if (valueChanged) rotatedKeys.push(key);
     }
     if (imported.length === 0) {
       return { imported, skipped, failed, warnings, dryRun: false };
     }
+    const relCellPath = path14.relative(repoRoot, filePath);
+    const relMetaPath = relCellPath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml");
     await this.tx.run(repoRoot, {
       description: `clef import ${target}: ${imported.length} key(s)`,
-      paths: [path14.relative(repoRoot, filePath)],
+      // Include the metadata path so rotation records created in the mutate
+      // callback are staged and rolled back atomically with the ciphertext.
+      paths: [relCellPath, relMetaPath],
       mutate: async () => {
         await this.sopsClient.encrypt(filePath, newValues, manifest, env);
+        if (options.rotatedBy && rotatedKeys.length > 0) {
+          await recordRotation(filePath, rotatedKeys, options.rotatedBy);
+        }
       }
     });
     return { imported, skipped, failed, warnings, dryRun: false };
@@ -6458,6 +6590,116 @@ var SopsMergeDriver = class {
   }
 };
 
+// src/merge/metadata-driver.ts
+import * as fs15 from "fs";
+import * as YAML10 from "yaml";
+var HEADER_COMMENT3 = "# Managed by Clef. Do not edit manually.\n";
+function parseMetadata(content) {
+  try {
+    const parsed = YAML10.parse(content);
+    if (!parsed || typeof parsed !== "object") return emptyMetadata2();
+    const pendingRaw = Array.isArray(parsed.pending) ? parsed.pending : [];
+    const pending = pendingRaw.filter(
+      (p) => !!p && typeof p === "object" && typeof p.key === "string" && typeof p.since === "string" && typeof p.setBy === "string"
+    ).map((p) => ({ key: p.key, since: new Date(p.since), setBy: p.setBy }));
+    const rotationsRaw = Array.isArray(parsed.rotations) ? parsed.rotations : [];
+    const rotations = rotationsRaw.filter(
+      (r) => !!r && typeof r === "object" && typeof r.key === "string" && typeof r.last_rotated_at === "string" && typeof r.rotated_by === "string" && typeof r.rotation_count === "number"
+    ).map((r) => ({
+      key: r.key,
+      lastRotatedAt: new Date(r.last_rotated_at),
+      rotatedBy: r.rotated_by,
+      rotationCount: r.rotation_count
+    }));
+    return { version: 1, pending, rotations };
+  } catch {
+    return emptyMetadata2();
+  }
+}
+function emptyMetadata2() {
+  return { version: 1, pending: [], rotations: [] };
+}
+function serializeMetadata(m) {
+  const data = {
+    version: m.version,
+    pending: m.pending.map((p) => ({
+      key: p.key,
+      since: p.since.toISOString(),
+      setBy: p.setBy
+    })),
+    rotations: m.rotations.map((r) => ({
+      key: r.key,
+      last_rotated_at: r.lastRotatedAt.toISOString(),
+      rotated_by: r.rotatedBy,
+      rotation_count: r.rotationCount
+    }))
+  };
+  return HEADER_COMMENT3 + YAML10.stringify(data);
+}
+function mergeRotations(ours, theirs) {
+  const byKey = /* @__PURE__ */ new Map();
+  const ourByKey = new Map(ours.map((r) => [r.key, r]));
+  const theirByKey = new Map(theirs.map((r) => [r.key, r]));
+  const allKeys = /* @__PURE__ */ new Set([...ourByKey.keys(), ...theirByKey.keys()]);
+  for (const key of allKeys) {
+    const o = ourByKey.get(key);
+    const t = theirByKey.get(key);
+    if (o && t) {
+      const oTime = o.lastRotatedAt.getTime();
+      const tTime = t.lastRotatedAt.getTime();
+      const winner = tTime > oTime ? t : o;
+      byKey.set(key, {
+        key,
+        lastRotatedAt: winner.lastRotatedAt,
+        rotatedBy: winner.rotatedBy,
+        rotationCount: Math.max(o.rotationCount, t.rotationCount) + 1
+      });
+    } else if (o) {
+      byKey.set(key, o);
+    } else if (t) {
+      byKey.set(key, t);
+    }
+  }
+  return Array.from(byKey.values());
+}
+function mergePending(oursPending, theirsPending, oursRotations, theirsRotations) {
+  const ourByKey = new Map(oursPending.map((p) => [p.key, p]));
+  const theirByKey = new Map(theirsPending.map((p) => [p.key, p]));
+  const rotatedKeys = /* @__PURE__ */ new Set([
+    ...oursRotations.map((r) => r.key),
+    ...theirsRotations.map((r) => r.key)
+  ]);
+  const allKeys = /* @__PURE__ */ new Set([...ourByKey.keys(), ...theirByKey.keys()]);
+  const out = [];
+  for (const key of allKeys) {
+    if (rotatedKeys.has(key)) continue;
+    const o = ourByKey.get(key);
+    const t = theirByKey.get(key);
+    if (o && t) {
+      const winner = t.since.getTime() > o.since.getTime() ? t : o;
+      out.push({ key, since: winner.since, setBy: winner.setBy });
+    } else if (o) {
+      out.push(o);
+    } else if (t) {
+      out.push(t);
+    }
+  }
+  return out;
+}
+function mergeMetadataContents(oursContent, theirsContent) {
+  const ours = parseMetadata(oursContent);
+  const theirs = parseMetadata(theirsContent);
+  const rotations = mergeRotations(ours.rotations, theirs.rotations);
+  const pending = mergePending(ours.pending, theirs.pending, ours.rotations, theirs.rotations);
+  return serializeMetadata({ version: 1, pending, rotations });
+}
+function mergeMetadataFiles(_basePath, oursPath, theirsPath) {
+  const oursContent = fs15.existsSync(oursPath) ? fs15.readFileSync(oursPath, "utf-8") : "";
+  const theirsContent = fs15.existsSync(theirsPath) ? fs15.readFileSync(theirsPath, "utf-8") : "";
+  const merged = mergeMetadataContents(oursContent, theirsContent);
+  fs15.writeFileSync(oursPath, merged, "utf-8");
+}
+
 // src/service-identity/manager.ts
 import * as path19 from "path";
 var ServiceIdentityManager = class {
@@ -6993,7 +7235,7 @@ var ServiceIdentityManager = class {
 };
 
 // src/structure/manager.ts
-import * as fs15 from "fs";
+import * as fs16 from "fs";
 import * as path20 from "path";
 var StructureManager = class {
   constructor(matrixManager, encryption, tx) {
@@ -7021,7 +7263,7 @@ var StructureManager = class {
       )
     }));
     for (const cell of newCellPaths) {
-      if (fs15.existsSync(cell.filePath)) {
+      if (fs16.existsSync(cell.filePath)) {
         throw new Error(
           `Cannot add namespace '${name}': file '${path20.relative(repoRoot, cell.filePath)}' already exists.`
         );
@@ -7093,7 +7335,7 @@ var StructureManager = class {
       )
     }));
     for (const cell of newCellPaths) {
-      if (fs15.existsSync(cell.filePath)) {
+      if (fs16.existsSync(cell.filePath)) {
         throw new Error(
           `Cannot add environment '${name}': file '${path20.relative(repoRoot, cell.filePath)}' already exists.`
         );
@@ -7177,7 +7419,7 @@ var StructureManager = class {
       paths: this.deletePaths(repoRoot, cellsToDelete),
       mutate: async () => {
         for (const cell of cellsToDelete) {
-          fs15.unlinkSync(cell.filePath);
+          fs16.unlinkSync(cell.filePath);
           this.unlinkMetaSibling(cell.filePath);
         }
         const doc = readManifestYaml(repoRoot);
@@ -7227,7 +7469,7 @@ var StructureManager = class {
       paths: this.deletePaths(repoRoot, cellsToDelete),
       mutate: async () => {
         for (const cell of cellsToDelete) {
-          fs15.unlinkSync(cell.filePath);
+          fs16.unlinkSync(cell.filePath);
           this.unlinkMetaSibling(cell.filePath);
         }
         const doc = readManifestYaml(repoRoot);
@@ -7269,7 +7511,7 @@ var StructureManager = class {
     const renamePairs = isRename ? this.collectRenamePairs(manifest, repoRoot, name, opts.rename, "namespace") : [];
     if (isRename) {
       for (const pair of renamePairs) {
-        if (fs15.existsSync(pair.to)) {
+        if (fs16.existsSync(pair.to)) {
           throw new Error(
             `Rename target '${path20.relative(repoRoot, pair.to)}' already exists. Move or remove it first.`
           );
@@ -7312,7 +7554,7 @@ var StructureManager = class {
     const renamePairs = isRename ? this.collectRenamePairs(manifest, repoRoot, name, opts.rename, "environment") : [];
     if (isRename) {
       for (const pair of renamePairs) {
-        if (fs15.existsSync(pair.to)) {
+        if (fs16.existsSync(pair.to)) {
           throw new Error(
             `Rename target '${path20.relative(repoRoot, pair.to)}' already exists. Move or remove it first.`
           );
@@ -7349,7 +7591,7 @@ var StructureManager = class {
       const newCellPath = this.swapAxisInCellPath(repoRoot, manifest, cell, axis, newName);
       pairs.push({ from: cell.filePath, to: newCellPath });
       const oldMeta = cell.filePath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml");
-      if (fs15.existsSync(oldMeta)) {
+      if (fs16.existsSync(oldMeta)) {
         const newMeta = newCellPath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml");
         pairs.push({ from: oldMeta, to: newMeta });
       }
@@ -7389,10 +7631,10 @@ var StructureManager = class {
   applyRenames(pairs) {
     for (const pair of pairs) {
       const targetDir = path20.dirname(pair.to);
-      if (!fs15.existsSync(targetDir)) {
-        fs15.mkdirSync(targetDir, { recursive: true });
+      if (!fs16.existsSync(targetDir)) {
+        fs16.mkdirSync(targetDir, { recursive: true });
       }
-      fs15.renameSync(pair.from, pair.to);
+      fs16.renameSync(pair.from, pair.to);
     }
   }
   /**
@@ -7405,7 +7647,7 @@ var StructureManager = class {
     for (const cell of cells) {
       paths.add(path20.relative(repoRoot, cell.filePath));
       const meta = cell.filePath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml");
-      if (fs15.existsSync(meta)) {
+      if (fs16.existsSync(meta)) {
         paths.add(path20.relative(repoRoot, meta));
       }
     }
@@ -7419,8 +7661,8 @@ var StructureManager = class {
    */
   unlinkMetaSibling(cellPath) {
     const meta = cellPath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml");
-    if (fs15.existsSync(meta)) {
-      fs15.unlinkSync(meta);
+    if (fs16.existsSync(meta)) {
+      fs16.unlinkSync(meta);
     }
   }
   /**
@@ -7565,7 +7807,7 @@ async function resolveIdentitySecrets(identityName, environment, manifest, repoR
 import * as crypto3 from "crypto";
 
 // src/artifact/output.ts
-import * as fs16 from "fs";
+import * as fs17 from "fs";
 import * as path21 from "path";
 var FilePackOutput = class {
   constructor(outputPath) {
@@ -7573,12 +7815,12 @@ var FilePackOutput = class {
   }
   async write(_artifact, json) {
     const outputDir = path21.dirname(this.outputPath);
-    if (!fs16.existsSync(outputDir)) {
-      fs16.mkdirSync(outputDir, { recursive: true });
+    if (!fs17.existsSync(outputDir)) {
+      fs17.mkdirSync(outputDir, { recursive: true });
     }
     const tmpOutput = `${this.outputPath}.tmp.${process.pid}`;
-    fs16.writeFileSync(tmpOutput, json, "utf-8");
-    fs16.renameSync(tmpOutput, this.outputPath);
+    fs17.writeFileSync(tmpOutput, json, "utf-8");
+    fs17.renameSync(tmpOutput, this.outputPath);
   }
 };
 var MemoryPackOutput = class {
@@ -7800,7 +8042,7 @@ var VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
 
 // src/migration/backend.ts
 import * as path22 from "path";
-import * as YAML10 from "yaml";
+import * as YAML11 from "yaml";
 var BACKEND_KEY_FIELDS = {
   age: void 0,
   awskms: "aws_kms_arn",
@@ -7923,7 +8165,7 @@ var BackendMigrator = class {
           const doc = readManifestYaml(repoRoot);
           this.updateManifestDoc(doc, target, environment);
           writeManifestYaml(repoRoot, doc);
-          const updatedManifest = YAML10.parse(YAML10.stringify(doc));
+          const updatedManifest = YAML11.parse(YAML11.stringify(doc));
           for (const cell of toMigrate) {
             onProgress?.({
               type: "migrate",
@@ -8318,8 +8560,8 @@ var SyncManager = class {
 };
 
 // src/policy/parser.ts
-import * as fs17 from "fs";
-import * as YAML11 from "yaml";
+import * as fs18 from "fs";
+import * as YAML12 from "yaml";
 
 // src/policy/types.ts
 var DEFAULT_POLICY = Object.freeze({
@@ -8340,7 +8582,7 @@ var PolicyParser = class {
   parse(filePath) {
     let raw;
     try {
-      raw = fs17.readFileSync(filePath, "utf-8");
+      raw = fs18.readFileSync(filePath, "utf-8");
     } catch {
       throw new PolicyValidationError(`Could not read policy file at '${filePath}'.`);
     }
@@ -8355,7 +8597,7 @@ var PolicyParser = class {
   parseContent(content) {
     let parsed;
     try {
-      parsed = YAML11.parse(content);
+      parsed = YAML12.parse(content);
     } catch {
       throw new PolicyValidationError(
         "Policy file contains invalid YAML. Check for syntax errors."
@@ -8368,7 +8610,7 @@ var PolicyParser = class {
    * not exist. Any other read or validation error throws.
    */
   load(filePath) {
-    if (!fs17.existsSync(filePath)) return DEFAULT_POLICY;
+    if (!fs18.existsSync(filePath)) return DEFAULT_POLICY;
     return this.parse(filePath);
   }
   validate(raw) {
@@ -8436,31 +8678,64 @@ var PolicyEvaluator = class {
     this.policy = policy;
   }
   /**
-   * Evaluate a single encrypted file's rotation state.
+   * Evaluate a single encrypted file's per-key rotation state.
    *
    * @param filePath    Repo-relative or absolute path to the encrypted file.
-   * @param environment Environment name from the matrix; selects per-env
-   *                    overrides if present in the policy.
-   * @param metadata    Result of `SopsClient.getMetadata()` for the file.
-   * @param now         Reference time (defaults to `new Date()`).  Inject for
-   *                    deterministic tests and reproducible audits.
+   * @param environment Environment name; selects per-env overrides.
+   * @param metadata    SOPS metadata for the file (carries last_modified,
+   *                    backend, recipients).  The evaluator does not read
+   *                    `last_modified` for the policy gate — it is echoed
+   *                    into the output for audit consumers only.
+   * @param keys        Plaintext key names present in the cipher, enumerated
+   *                    from the unencrypted YAML top-level keys (no decrypt
+   *                    required since SOPS stores key names in plaintext).
+   * @param rotations   Rotation records from `.clef-meta.yaml`.  Records for
+   *                    keys not in `keys` are ignored (those are orphans;
+   *                    lint surfaces them as a warning).
+   * @param now         Reference time.  Inject for deterministic tests.
    */
-  evaluateFile(filePath, environment, metadata, now = /* @__PURE__ */ new Date()) {
+  evaluateFile(filePath, environment, metadata, keys, rotations, now = /* @__PURE__ */ new Date()) {
     const maxAgeDays = this.resolveMaxAgeDays(environment);
-    const rotationDue = new Date(metadata.lastModified.getTime() + maxAgeDays * MS_PER_DAY);
-    const rotationOverdue = now.getTime() > rotationDue.getTime();
-    const daysOverdue = rotationOverdue ? Math.floor((now.getTime() - rotationDue.getTime()) / MS_PER_DAY) : 0;
+    const byKey = new Map(rotations.map((r) => [r.key, r]));
+    const keyStatuses = keys.map(
+      (key) => this.evaluateKey(key, byKey.get(key), maxAgeDays, now)
+    );
     return {
       path: filePath,
       environment,
       backend: metadata.backend,
       recipients: metadata.recipients,
       last_modified: metadata.lastModified.toISOString(),
-      // Treat a missing `lastModifiedPresent` as `true` — the field is
-      // optional on SopsMetadata and only `parseMetadataFromFile` knows
-      // authoritatively whether the underlying file carried `sops.lastmodified`.
-      // Hand-constructed metadata is assumed trustworthy.
       last_modified_known: metadata.lastModifiedPresent !== false,
+      keys: keyStatuses,
+      // Cell-level compliance is the AND of per-key verdicts.  An empty
+      // `keys` array (cell with no secrets) is vacuously compliant.
+      compliant: keyStatuses.every((k) => k.compliant)
+    };
+  }
+  evaluateKey(key, record, maxAgeDays, now) {
+    if (!record) {
+      return {
+        key,
+        last_rotated_at: null,
+        last_rotated_known: false,
+        rotated_by: null,
+        rotation_count: 0,
+        rotation_due: null,
+        rotation_overdue: false,
+        days_overdue: 0,
+        compliant: false
+      };
+    }
+    const rotationDue = new Date(record.lastRotatedAt.getTime() + maxAgeDays * MS_PER_DAY);
+    const rotationOverdue = now.getTime() > rotationDue.getTime();
+    const daysOverdue = rotationOverdue ? Math.floor((now.getTime() - rotationDue.getTime()) / MS_PER_DAY) : 0;
+    return {
+      key,
+      last_rotated_at: record.lastRotatedAt.toISOString(),
+      last_rotated_known: true,
+      rotated_by: record.rotatedBy,
+      rotation_count: record.rotationCount,
       rotation_due: rotationDue.toISOString(),
       rotation_overdue: rotationOverdue,
       days_overdue: daysOverdue,
@@ -8516,10 +8791,11 @@ var ComplianceGenerator = class {
     return `sha256:${createHash3("sha256").update(canonicalJson(policy)).digest("hex")}`;
   }
   buildSummary(scan, lint, files) {
+    const rotationOverdue = files.filter((f) => !f.compliant).length;
     return {
       total_files: files.length,
       compliant: files.filter((f) => f.compliant).length,
-      rotation_overdue: files.filter((f) => f.rotation_overdue).length,
+      rotation_overdue: rotationOverdue,
       scan_violations: scan.matches.length,
       lint_errors: lint.issues.filter((i) => i.severity === "error").length
     };
@@ -8542,7 +8818,7 @@ async function runCompliance(opts) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const manifest = new ManifestParser().parse(manifestPath);
   const policy = opts.policy ?? new PolicyParser().load(policyPath);
-  const sopsClient = new SopsClient(opts.runner);
+  const sopsClient = new SopsClient(opts.runner, opts.ageKeyFile, opts.ageKey, opts.sopsPath);
   const matrixManager = new MatrixManager();
   const schemaValidator = new SchemaValidator();
   const [sha, repo, files, scanResult, lintResult] = await Promise.all([
@@ -8560,12 +8836,13 @@ async function runCompliance(opts) {
     include.scan ? new ScanRunner(opts.runner).scan(repoRoot, manifest) : Promise.resolve(emptyScan()),
     include.lint ? new LintRunner(matrixManager, schemaValidator, sopsClient).run(manifest, repoRoot) : Promise.resolve(emptyLint())
   ]);
+  const adjustedLint = downgradeDecryptIssues(lintResult);
   const document = new ComplianceGenerator().generate({
     sha,
     repo,
     policy,
     scanResult,
-    lintResult,
+    lintResult: adjustedLint,
     files,
     now
   });
@@ -8579,7 +8856,9 @@ async function evaluateMatrix(args) {
     cells.map(async (cell) => {
       const metadata = await args.sopsClient.getMetadata(cell.filePath);
       const relPath = path25.relative(args.repoRoot, cell.filePath).replace(/\\/g, "/");
-      return evaluator.evaluateFile(relPath, cell.environment, metadata, args.now);
+      const keys = readSopsKeyNames(cell.filePath) ?? [];
+      const rotations = await getRotations(cell.filePath);
+      return evaluator.evaluateFile(relPath, cell.environment, metadata, keys, rotations, args.now);
     })
   );
 }
@@ -8600,6 +8879,21 @@ function emptyScan() {
 function emptyLint() {
   return { issues: [], fileCount: 0, pendingCount: 0 };
 }
+function downgradeDecryptIssues(result) {
+  return {
+    ...result,
+    issues: result.issues.map((issue) => {
+      if (issue.category === "sops" && issue.message.startsWith("Failed to decrypt")) {
+        return {
+          ...issue,
+          severity: "info",
+          message: `File not decryptable in this environment (compliance runs without keys). Original check: ${issue.message}`
+        };
+      }
+      return issue;
+    })
+  };
+}
 async function detectSha(runner, repoRoot) {
   const env = process.env;
   const fromEnv = env.GITHUB_SHA ?? env.CI_COMMIT_SHA ?? env.BITBUCKET_COMMIT ?? env.CIRCLE_SHA1 ?? env.BUILD_VCS_NUMBER;
@@ -8687,6 +8981,7 @@ export {
   generateRandomValue,
   generateSigningKeyPair,
   getPendingKeys,
+  getRotations,
   isHighEntropy,
   isKmsEnvelope,
   isPending,
@@ -8698,6 +8993,8 @@ export {
   markPendingWithRetry,
   markResolved,
   matchPatterns,
+  mergeMetadataContents,
+  mergeMetadataFiles,
   metadataPath,
   parse9 as parse,
   parseDotenv,
@@ -8705,8 +9002,10 @@ export {
   parseJson,
   parseYaml,
   readManifestYaml,
+  recordRotation,
   redactValue,
   removeRequest as removeAccessRequest,
+  removeRotation,
   requestsFilePath,
   resetSopsResolution,
   resolveBackendConfig,