@kitsy/cnos 1.1.0 → 1.1.2

package/dist/plugin/env-export.cjs

@@ -76,6 +76,52 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+function isObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isSecretReference(value) {
+  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
+}
+
+// ../core/src/runtime/toEnv.ts
+function normalizeEnvValue(value) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function toEnv(graph, manifest, options = {}) {
+  const includeSecrets = options.includeSecrets ?? true;
+  const output = {};
+  const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
+    ([left], [right]) => left.localeCompare(right)
+  );
+  for (const [envVar, logicalKey] of mappedEntries) {
+    const entry = graph.entries.get(logicalKey);
+    if (!entry) {
+      continue;
+    }
+    if (entry.namespace === "secret" && !includeSecrets) {
+      continue;
+    }
+    if (isSecretReference(entry.value)) {
+      continue;
+    }
+    output[envVar] = normalizeEnvValue(entry.value);
+  }
+  return output;
+}
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -107,48 +153,6 @@ function logicalKeyToEnvVar(key, config = {}) {
   return void 0;
 }
 
-// ../core/src/runtime/toEnv.ts
-function fallbackLogicalKeyToEnvVar(key) {
-  if (key.startsWith("value.")) {
-    return key.slice("value.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-  }
-  if (key.startsWith("secret.")) {
-    const normalized = key.slice("secret.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-    return `SECRET_${normalized}`;
-  }
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-}
-function normalizeEnvValue(value) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-}
-function toEnv(graph, manifest, options = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
-  const output = {};
-  const resolvedEntries = Array.from(graph.entries.values()).sort(
-    (left, right) => left.key.localeCompare(right.key)
-  );
-  for (const entry of resolvedEntries) {
-    if (entry.namespace === "meta") {
-      continue;
-    }
-    if (!includeSecrets && entry.namespace === "secret") {
-      continue;
-    }
-    const envVar = logicalKeyToEnvVar(entry.key, manifest.envMapping) ?? fallbackLogicalKeyToEnvVar(entry.key);
-    output[envVar] = normalizeEnvValue(entry.value);
-  }
-  return output;
-}
-
 // ../core/src/runtime/toPublicEnv.ts
 function fallbackValueEnvVar(key) {
   return key.replace(/^value\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
@@ -201,11 +205,6 @@ function toPublicEnv(graph, manifest, options = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-ASZ7I3JJ.js";
+} from "../chunk-IHSV5AFX.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-K2T4R5WH.js";
+} from "../chunk-33ZDYDQJ.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.cjs

@@ -100,29 +100,29 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
-// ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 function isObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isSecretReference(value) {
-  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && Object.keys(value).every((key) => ["provider", "ref"].includes(key));
+  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
 }
 function resolveSecretStoreRoot(processEnv = process.env) {
-  return import_node_path7.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
+  return import_node_path6.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
 }
-function resolveSecretStoreFile(storeRoot, ref) {
-  return import_node_path7.default.join(storeRoot, "store", ...ref.split("/")).concat(".json");
+function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
+  return import_node_path6.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
 }
 function deriveKey(passphrase, salt) {
   return (0, import_node_crypto.scryptSync)(passphrase, salt, 32);
 }
+function resolveSecretPassphrase(vault = "default", processEnv = process.env) {
+  const vaultToken = vault.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+  return processEnv[`CNOS_SECRET_PASSPHRASE_${vaultToken}`] ?? processEnv.CNOS_SECRET_PASSPHRASE;
+}
 function decryptDocument(document, passphrase) {
   const salt = Buffer.from(document.salt, "base64");
   const iv = Buffer.from(document.iv, "base64");
@@ -134,14 +134,14 @@ function decryptDocument(document, passphrase) {
   const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
   return plaintext.toString("utf8");
 }
-async function readLocalSecret(storeRoot, ref, passphrase) {
+async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
   if (!passphrase) {
     throw new CnosManifestError(
       `Missing CNOS secret passphrase for local secret ref "${ref}". Set CNOS_SECRET_PASSPHRASE or pass processEnv explicitly.`
     );
   }
-  const filePath = resolveSecretStoreFile(storeRoot, ref);
-  const source = await (0, import_promises7.readFile)(filePath, "utf8");
+  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
+  const source = await (0, import_promises6.readFile)(filePath, "utf8");
   const document = JSON.parse(source);
   if (document.version !== 1 || document.algorithm !== "aes-256-gcm" || typeof document.salt !== "string" || typeof document.iv !== "string" || typeof document.tag !== "string" || typeof document.ciphertext !== "string") {
     throw new CnosManifestError("Invalid local secret document", filePath);
@@ -149,6 +149,10 @@ async function readLocalSecret(storeRoot, ref, passphrase) {
   return decryptDocument(document, passphrase);
 }
 
+// ../core/src/runtime/dump.ts
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
+
 // ../../plugins/filesystem/src/helpers.ts
 var YAML_EXTENSIONS = /* @__PURE__ */ new Set([".yml", ".yaml"]);
 var FILESYSTEM_PLUGIN_ID = "@kitsy/cnos/plugins/filesystem";
@@ -242,13 +246,15 @@ async function resolveSecretValue(value, processEnv) {
     return value;
   }
   if (value.provider === "local") {
-    if (!processEnv?.CNOS_SECRET_PASSPHRASE) {
+    const passphrase = resolveSecretPassphrase(value.vault, processEnv);
+    if (!passphrase) {
       return value;
     }
     return readLocalSecret(
       resolveSecretStoreRoot(processEnv),
       value.ref,
-      processEnv?.CNOS_SECRET_PASSPHRASE
+      passphrase,
+      value.vault
     );
   }
   if (value.provider === "env") {

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-KG6OZX5C.js";
-import "../chunk-K2T4R5WH.js";
+} from "../chunk-7FBRVJD6.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.cjs

@@ -59,6 +59,11 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -92,11 +97,6 @@ function envVarToLogicalKey(envVar, config = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/process-env.js

@@ -1,8 +1,8 @@
 import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject
-} from "../chunk-CGTFH4QQ.js";
-import "../chunk-K2T4R5WH.js";
+} from "../chunk-53HXUSM6.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Batteries-included CNOS runtime package wired with the official plugins.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -73,7 +73,7 @@
     "yaml": "^2.8.3"
   },
   "scripts": {
-    "build": "tsup --config tsup.config.ts",
+    "build": "rimraf dist && tsup --config tsup.config.ts",
     "clean": "rimraf dist",
     "dev": "tsup --config tsup.config.ts --watch",
     "lint": "eslint src test",