@clef-sh/core 0.1.19 → 0.1.20-beta.142

package/dist/index.mjs

@@ -30,9 +30,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/signal-exit/dist/cjs/signals.js
+// ../../node_modules/write-file-atomic/node_modules/signal-exit/dist/cjs/signals.js
 var require_signals = __commonJS({
-  "node_modules/signal-exit/dist/cjs/signals.js"(exports) {
+  "../../node_modules/write-file-atomic/node_modules/signal-exit/dist/cjs/signals.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.signals = void 0;
@@ -61,9 +61,9 @@ var require_signals = __commonJS({
   }
 });
 
-// node_modules/signal-exit/dist/cjs/index.js
+// ../../node_modules/write-file-atomic/node_modules/signal-exit/dist/cjs/index.js
 var require_cjs = __commonJS({
-  "node_modules/signal-exit/dist/cjs/index.js"(exports) {
+  "../../node_modules/write-file-atomic/node_modules/signal-exit/dist/cjs/index.js"(exports) {
     "use strict";
     var _a;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -296,9 +296,9 @@ var require_cjs = __commonJS({
   }
 });
 
-// node_modules/write-file-atomic/lib/index.js
+// ../../node_modules/write-file-atomic/lib/index.js
 var require_lib = __commonJS({
-  "node_modules/write-file-atomic/lib/index.js"(exports, module) {
+  "../../node_modules/write-file-atomic/lib/index.js"(exports, module) {
     "use strict";
     module.exports = writeFile;
     module.exports.sync = writeFileSync7;
@@ -2122,6 +2122,7 @@ var ClefError = class extends Error {
     this.fix = fix;
     this.name = "ClefError";
   }
+  fix;
 };
 var ManifestValidationError = class extends ClefError {
   constructor(message, field) {
@@ -2129,6 +2130,7 @@ var ManifestValidationError = class extends ClefError {
     this.field = field;
     this.name = "ManifestValidationError";
   }
+  field;
 };
 var SopsDecryptionError = class extends ClefError {
   constructor(message, filePath) {
@@ -2139,6 +2141,7 @@ var SopsDecryptionError = class extends ClefError {
     this.filePath = filePath;
     this.name = "SopsDecryptionError";
   }
+  filePath;
 };
 var SopsEncryptionError = class extends ClefError {
   constructor(message, filePath) {
@@ -2149,6 +2152,7 @@ var SopsEncryptionError = class extends ClefError {
     this.filePath = filePath;
     this.name = "SopsEncryptionError";
   }
+  filePath;
 };
 var SopsKeyNotFoundError = class extends ClefError {
   constructor(message) {
@@ -2168,6 +2172,7 @@ var PolicyValidationError = class extends ClefError {
     this.field = field;
     this.name = "PolicyValidationError";
   }
+  field;
 };
 var SchemaLoadError = class extends ClefError {
   constructor(message, filePath) {
@@ -2178,6 +2183,7 @@ var SchemaLoadError = class extends ClefError {
     this.filePath = filePath;
     this.name = "SchemaLoadError";
   }
+  filePath;
 };
 var SopsMissingError = class extends ClefError {
   constructor(installHint) {
@@ -2189,6 +2195,7 @@ Then run clef doctor to verify your setup.`
     this.installHint = installHint;
     this.name = "SopsMissingError";
   }
+  installHint;
 };
 var SopsVersionError = class extends ClefError {
   constructor(installed, required, installHint) {
@@ -2202,6 +2209,9 @@ Then run clef doctor to verify your setup.`
     this.installHint = installHint;
     this.name = "SopsVersionError";
   }
+  installed;
+  required;
+  installHint;
 };
 function isKmsEnvelope(cfg) {
   return cfg.kms !== void 0;
@@ -2213,6 +2223,7 @@ var CloudApiError = class extends ClefError {
     this.statusCode = statusCode;
     this.name = "CloudApiError";
   }
+  statusCode;
 };
 
 // src/manifest/parser.ts
@@ -3000,6 +3011,7 @@ var ScanRunner = class {
   constructor(runner) {
     this.runner = runner;
   }
+  runner;
   /**
    * Scan tracked (or staged) files for secret-like values and unencrypted matrix files.
    *
@@ -3711,6 +3723,7 @@ var BulkOps = class {
   constructor(tx) {
     this.tx = tx;
   }
+  tx;
   /**
    * Set a key to different values in multiple environments at once.
    *
@@ -3854,6 +3867,7 @@ var GitIntegration = class {
   constructor(runner) {
     this.runner = runner;
   }
+  runner;
   /**
    * Stage one or more file paths with `git add`.
    *
@@ -4237,6 +4251,7 @@ var TransactionLockError = class extends Error {
     this.holderPid = holderPid;
     this.name = "TransactionLockError";
   }
+  holderPid;
 };
 var TransactionPreflightError = class extends Error {
   constructor(reason, message, hint) {
@@ -4245,6 +4260,8 @@ var TransactionPreflightError = class extends Error {
     this.hint = hint;
     this.name = "TransactionPreflightError";
   }
+  reason;
+  hint;
 };
 var TransactionRollbackError = class extends Error {
   constructor(originalError, rollbackOk, message) {
@@ -4253,6 +4270,8 @@ var TransactionRollbackError = class extends Error {
     this.rollbackOk = rollbackOk;
     this.name = "TransactionRollbackError";
   }
+  originalError;
+  rollbackOk;
 };
 
 // src/tx/transaction-manager.ts
@@ -4267,6 +4286,7 @@ var TransactionManager = class {
   constructor(git) {
     this.git = git;
   }
+  git;
   async run(repoRoot, opts) {
     const shouldCommit = opts.commit !== false;
     const allowDirty = opts.allowDirty === true;
@@ -4665,6 +4685,9 @@ var SopsClient = class {
     this.sopsCommand = sopsPath ?? resolveSopsPath().path;
     this.keyserviceArgs = keyserviceAddr ? Object.freeze(["--enable-local-keyservice=false", "--keyservice", keyserviceAddr]) : Object.freeze([]);
   }
+  runner;
+  ageKeyFile;
+  ageKey;
   sopsCommand;
   keyserviceArgs;
   buildSopsEnv() {
@@ -5216,6 +5239,9 @@ var LintRunner = class {
     this.schemaValidator = schemaValidator;
     this.sopsClient = sopsClient;
   }
+  matrixManager;
+  schemaValidator;
+  sopsClient;
   /**
    * Lint the entire matrix: check missing files, schema errors, SOPS integrity,
    * single-recipient warnings, and cross-environment key drift.
@@ -5757,6 +5783,8 @@ var ImportRunner = class {
     this.sopsClient = sopsClient;
     this.tx = tx;
   }
+  sopsClient;
+  tx;
   /**
    * Parse a source file and import its key/value pairs into a target `namespace/environment` cell.
    *
@@ -5913,6 +5941,9 @@ var RecipientManager = class {
     this.matrixManager = matrixManager;
     this.tx = tx;
   }
+  encryption;
+  matrixManager;
+  tx;
   /**
    * List all age recipients declared in the manifest.
    *
@@ -6355,6 +6386,10 @@ var ReportGenerator = class {
     this.matrixManager = matrixManager;
     this.schemaValidator = schemaValidator;
   }
+  runner;
+  sopsClient;
+  matrixManager;
+  schemaValidator;
   /**
    * Generate a full {@link ClefReport} for the given repository root.
    * Each section gathers data independently — partial failures return empty
@@ -6766,6 +6801,7 @@ var SopsMergeDriver = class {
   constructor(sopsClient) {
     this.sopsClient = sopsClient;
   }
+  sopsClient;
   /**
    * Perform a three-way merge on three in-memory key/value maps.
    *
@@ -6963,6 +6999,9 @@ var ServiceIdentityManager = class {
     this.matrixManager = matrixManager;
     this.tx = tx;
   }
+  encryption;
+  matrixManager;
+  tx;
   /**
    * Compute repo-relative paths for a set of cells plus the manifest. Used
    * to seed TransactionManager.run's `paths` argument.
@@ -7498,6 +7537,9 @@ var StructureManager = class {
     this.encryption = encryption;
     this.tx = tx;
   }
+  matrixManager;
+  encryption;
+  tx;
   // ── add ──────────────────────────────────────────────────────────────────
   /**
    * Add a new namespace to the manifest and scaffold an empty encrypted cell
@@ -8068,6 +8110,7 @@ var FilePackOutput = class {
   constructor(outputPath) {
     this.outputPath = outputPath;
   }
+  outputPath;
   async write(_artifact, json) {
     const outputDir = path23.dirname(this.outputPath);
     if (!fs19.existsSync(outputDir)) {
@@ -8181,6 +8224,9 @@ var ArtifactPacker = class {
     this.matrixManager = matrixManager;
     this.kms = kms;
   }
+  encryption;
+  matrixManager;
+  kms;
   /**
    * Pack an artifact: decrypt scoped SOPS files, age-encrypt the merged
    * values to the service identity's recipient, and write a JSON envelope.
@@ -8495,6 +8541,8 @@ var BackendMigrator = class {
     this.decryptBackend = encryption;
     this.encryptBackend = targetEncryption ?? encryption;
   }
+  matrixManager;
+  tx;
   decryptBackend;
   encryptBackend;
   async migrate(manifest, repoRoot, options, onProgress) {
@@ -8678,6 +8726,10 @@ var ResetManager = class {
     this.schemaValidator = schemaValidator;
     this.tx = tx;
   }
+  matrixManager;
+  encryption;
+  schemaValidator;
+  tx;
   async reset(opts, manifest, repoRoot) {
     validateResetScope(opts.scope, manifest);
     validateBackendKeyCombination(opts.backend, opts.key);
@@ -8873,6 +8925,9 @@ var SyncManager = class {
     this.encryption = encryption;
     this.tx = tx;
   }
+  matrixManager;
+  encryption;
+  tx;
   /**
    * Compute what sync would do without mutating anything.
    */
@@ -9091,6 +9146,7 @@ var PolicyEvaluator = class {
   constructor(policy) {
     this.policy = policy;
   }
+  policy;
   /**
    * Evaluate a single encrypted file's per-key rotation state.
    *