@kitsy/cnos 1.1.1 → 1.1.2

package/dist/{chunk-JPJ3S3CO.js → chunk-33ZDYDQJ.js}

@@ -120,6 +120,151 @@ function stringifyYaml(value) {
   return stringify(value);
 }
 
+// ../core/src/utils/secretStore.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
+import { mkdir, readdir, readFile, writeFile } from "fs/promises";
+import path2 from "path";
+function isObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isSecretReference(value) {
+  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
+}
+function resolveSecretStoreRoot(processEnv = process.env) {
+  return path2.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
+}
+function resolveSecretVaultFile(storeRoot, vault = "default") {
+  return path2.join(storeRoot, "vaults", `${vault}.json`);
+}
+function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
+  return path2.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
+}
+function deriveKey(passphrase, salt) {
+  return scryptSync(passphrase, salt, 32);
+}
+function resolveSecretPassphrase(vault = "default", processEnv = process.env) {
+  const vaultToken = vault.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+  return processEnv[`CNOS_SECRET_PASSPHRASE_${vaultToken}`] ?? processEnv.CNOS_SECRET_PASSPHRASE;
+}
+function encryptDocument(value, passphrase) {
+  const salt = randomBytes(16);
+  const iv = randomBytes(12);
+  const key = deriveKey(passphrase, salt);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    version: 1,
+    algorithm: "aes-256-gcm",
+    salt: salt.toString("base64"),
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    ciphertext: ciphertext.toString("base64")
+  };
+}
+function decryptDocument(document, passphrase) {
+  const salt = Buffer.from(document.salt, "base64");
+  const iv = Buffer.from(document.iv, "base64");
+  const tag = Buffer.from(document.tag, "base64");
+  const ciphertext = Buffer.from(document.ciphertext, "base64");
+  const key = deriveKey(passphrase, salt);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return plaintext.toString("utf8");
+}
+async function createSecretVault(storeRoot, vault, passphrase) {
+  const normalizedVault = vault.trim() || "default";
+  const filePath = resolveSecretVaultFile(storeRoot, normalizedVault);
+  await mkdir(path2.dirname(filePath), { recursive: true });
+  const document = {
+    version: 1,
+    name: normalizedVault,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    verifier: encryptDocument(`cnos-vault:${normalizedVault}`, passphrase)
+  };
+  await writeFile(filePath, JSON.stringify(document, null, 2), "utf8");
+  return filePath;
+}
+async function ensureSecretVault(storeRoot, vault, passphrase) {
+  const normalizedVault = vault.trim() || "default";
+  const filePath = resolveSecretVaultFile(storeRoot, normalizedVault);
+  try {
+    await readFile(filePath, "utf8");
+    return filePath;
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  return createSecretVault(storeRoot, normalizedVault, passphrase);
+}
+async function listSecretVaults(storeRoot) {
+  const vaultRoot = path2.join(storeRoot, "vaults");
+  try {
+    const entries = await readdir(vaultRoot, { withFileTypes: true });
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.replace(/\.json$/, "")).sort((left, right) => left.localeCompare(right));
+  } catch {
+    return [];
+  }
+}
+async function writeLocalSecret(storeRoot, ref, value, passphrase, vault = "default") {
+  await ensureSecretVault(storeRoot, vault, passphrase);
+  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
+  await mkdir(path2.dirname(filePath), { recursive: true });
+  await writeFile(filePath, JSON.stringify(encryptDocument(value, passphrase), null, 2), "utf8");
+  return filePath;
+}
+async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
+  if (!passphrase) {
+    throw new CnosManifestError(
+      `Missing CNOS secret passphrase for local secret ref "${ref}". Set CNOS_SECRET_PASSPHRASE or pass processEnv explicitly.`
+    );
+  }
+  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
+  const source = await readFile(filePath, "utf8");
+  const document = JSON.parse(source);
+  if (document.version !== 1 || document.algorithm !== "aes-256-gcm" || typeof document.salt !== "string" || typeof document.iv !== "string" || typeof document.tag !== "string" || typeof document.ciphertext !== "string") {
+    throw new CnosManifestError("Invalid local secret document", filePath);
+  }
+  return decryptDocument(document, passphrase);
+}
+
+// ../core/src/runtime/toEnv.ts
+function normalizeEnvValue(value) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function toEnv(graph, manifest, options = {}) {
+  const includeSecrets = options.includeSecrets ?? true;
+  const output = {};
+  const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
+    ([left], [right]) => left.localeCompare(right)
+  );
+  for (const [envVar, logicalKey] of mappedEntries) {
+    const entry = graph.entries.get(logicalKey);
+    if (!entry) {
+      continue;
+    }
+    if (entry.namespace === "secret" && !includeSecrets) {
+      continue;
+    }
+    if (isSecretReference(entry.value)) {
+      continue;
+    }
+    output[envVar] = normalizeEnvValue(entry.value);
+  }
+  return output;
+}
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -175,48 +320,6 @@ function envVarToLogicalKey(envVar, config = {}) {
   return `value.${fromScreamingSnake(envVar)}`;
 }
 
-// ../core/src/runtime/toEnv.ts
-function fallbackLogicalKeyToEnvVar(key) {
-  if (key.startsWith("value.")) {
-    return key.slice("value.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-  }
-  if (key.startsWith("secret.")) {
-    const normalized = key.slice("secret.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-    return `SECRET_${normalized}`;
-  }
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-}
-function normalizeEnvValue(value) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-}
-function toEnv(graph, manifest, options = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
-  const output = {};
-  const resolvedEntries = Array.from(graph.entries.values()).sort(
-    (left, right) => left.key.localeCompare(right.key)
-  );
-  for (const entry of resolvedEntries) {
-    if (entry.namespace === "meta") {
-      continue;
-    }
-    if (!includeSecrets && entry.namespace === "secret") {
-      continue;
-    }
-    const envVar = logicalKeyToEnvVar(entry.key, manifest.envMapping) ?? fallbackLogicalKeyToEnvVar(entry.key);
-    output[envVar] = normalizeEnvValue(entry.value);
-  }
-  return output;
-}
-
 // ../core/src/runtime/toPublicEnv.ts
 function fallbackValueEnvVar(key) {
   return key.replace(/^value\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
@@ -269,8 +372,8 @@ function toPublicEnv(graph, manifest, options = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-import { mkdir, writeFile } from "fs/promises";
-import path2 from "path";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import path3 from "path";
 
 // ../core/src/runtime/projection.ts
 function setNestedValue(target, pathSegments, value) {
@@ -304,20 +407,20 @@ function toNamespaceObject(graph, namespace) {
 
 // ../core/src/runtime/dump.ts
 function buildDumpFiles(graph, options = {}) {
-  const basePath = options.flatten ? "" : path2.posix.join("workspaces", graph.workspace.workspaceId);
+  const basePath = options.flatten ? "" : path3.posix.join("workspaces", graph.workspace.workspaceId);
   const values = toNamespaceObject(graph, "value");
   const secrets = toNamespaceObject(graph, "secret");
   const files = [];
   if (Object.keys(values).length > 0) {
     files.push({
-      path: path2.posix.join(basePath, "values", graph.profile, "app.yml"),
+      path: path3.posix.join(basePath, "values", graph.profile, "app.yml"),
       namespace: "value",
       content: stringifyYaml(values)
     });
   }
   if (Object.keys(secrets).length > 0) {
     files.push({
-      path: path2.posix.join(basePath, "secrets", graph.profile, "app.yml"),
+      path: path3.posix.join(basePath, "secrets", graph.profile, "app.yml"),
       namespace: "secret",
       content: stringifyYaml(secrets)
     });
@@ -333,12 +436,12 @@ function planDump(graph, options = {}) {
   };
 }
 async function writeDump(graph, options) {
-  const root = path2.resolve(options.to);
+  const root = path3.resolve(options.to);
   const plan = planDump(graph, options);
   for (const file of plan.files) {
-    const destination = path2.join(root, file.path);
-    await mkdir(path2.dirname(destination), { recursive: true });
-    await writeFile(destination, file.content, "utf8");
+    const destination = path3.join(root, file.path);
+    await mkdir2(path3.dirname(destination), { recursive: true });
+    await writeFile2(destination, file.content, "utf8");
   }
   return {
     ...plan,
@@ -359,118 +462,8 @@ function flattenObject(value, prefix = "") {
   }, {});
 }
 
-// ../core/src/utils/secretStore.ts
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
-import { mkdir as mkdir2, readdir, readFile, writeFile as writeFile2 } from "fs/promises";
-import path3 from "path";
-function isObject(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function isSecretReference(value) {
-  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
-}
-function resolveSecretStoreRoot(processEnv = process.env) {
-  return path3.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
-}
-function resolveSecretVaultFile(storeRoot, vault = "default") {
-  return path3.join(storeRoot, "vaults", `${vault}.json`);
-}
-function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
-  return path3.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
-}
-function deriveKey(passphrase, salt) {
-  return scryptSync(passphrase, salt, 32);
-}
-function resolveSecretPassphrase(vault = "default", processEnv = process.env) {
-  const vaultToken = vault.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-  return processEnv[`CNOS_SECRET_PASSPHRASE_${vaultToken}`] ?? processEnv.CNOS_SECRET_PASSPHRASE;
-}
-function encryptDocument(value, passphrase) {
-  const salt = randomBytes(16);
-  const iv = randomBytes(12);
-  const key = deriveKey(passphrase, salt);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return {
-    version: 1,
-    algorithm: "aes-256-gcm",
-    salt: salt.toString("base64"),
-    iv: iv.toString("base64"),
-    tag: tag.toString("base64"),
-    ciphertext: ciphertext.toString("base64")
-  };
-}
-function decryptDocument(document, passphrase) {
-  const salt = Buffer.from(document.salt, "base64");
-  const iv = Buffer.from(document.iv, "base64");
-  const tag = Buffer.from(document.tag, "base64");
-  const ciphertext = Buffer.from(document.ciphertext, "base64");
-  const key = deriveKey(passphrase, salt);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  return plaintext.toString("utf8");
-}
-async function createSecretVault(storeRoot, vault, passphrase) {
-  const normalizedVault = vault.trim() || "default";
-  const filePath = resolveSecretVaultFile(storeRoot, normalizedVault);
-  await mkdir2(path3.dirname(filePath), { recursive: true });
-  const document = {
-    version: 1,
-    name: normalizedVault,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    verifier: encryptDocument(`cnos-vault:${normalizedVault}`, passphrase)
-  };
-  await writeFile2(filePath, JSON.stringify(document, null, 2), "utf8");
-  return filePath;
-}
-async function ensureSecretVault(storeRoot, vault, passphrase) {
-  const normalizedVault = vault.trim() || "default";
-  const filePath = resolveSecretVaultFile(storeRoot, normalizedVault);
-  try {
-    await readFile(filePath, "utf8");
-    return filePath;
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      throw error;
-    }
-  }
-  return createSecretVault(storeRoot, normalizedVault, passphrase);
-}
-async function listSecretVaults(storeRoot) {
-  const vaultRoot = path3.join(storeRoot, "vaults");
-  try {
-    const entries = await readdir(vaultRoot, { withFileTypes: true });
-    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.replace(/\.json$/, "")).sort((left, right) => left.localeCompare(right));
-  } catch {
-    return [];
-  }
-}
-async function writeLocalSecret(storeRoot, ref, value, passphrase, vault = "default") {
-  await ensureSecretVault(storeRoot, vault, passphrase);
-  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
-  await mkdir2(path3.dirname(filePath), { recursive: true });
-  await writeFile2(filePath, JSON.stringify(encryptDocument(value, passphrase), null, 2), "utf8");
-  return filePath;
-}
-async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
-  if (!passphrase) {
-    throw new CnosManifestError(
-      `Missing CNOS secret passphrase for local secret ref "${ref}". Set CNOS_SECRET_PASSPHRASE or pass processEnv explicitly.`
-    );
-  }
-  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
-  const source = await readFile(filePath, "utf8");
-  const document = JSON.parse(source);
-  if (document.version !== 1 || document.algorithm !== "aes-256-gcm" || typeof document.salt !== "string" || typeof document.iv !== "string" || typeof document.tag !== "string" || typeof document.ciphertext !== "string") {
-    throw new CnosManifestError("Invalid local secret document", filePath);
-  }
-  return decryptDocument(document, passphrase);
-}
-
 // ../core/src/validation/envMapping.ts
-function fallbackLogicalKeyToEnvVar2(key) {
+function fallbackLogicalKeyToEnvVar(key) {
   return key.replace(/^(value|secret)\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
 }
 function validateEnvMappingCollisions(manifest, graph) {
@@ -485,7 +478,7 @@ function validateEnvMappingCollisions(manifest, graph) {
     if (key.startsWith("meta.")) {
       continue;
     }
-    const envVar = logicalKeyToEnvVar(key, manifest.envMapping) ?? (key.startsWith("value.") || key.startsWith("secret.") ? fallbackLogicalKeyToEnvVar2(key) : void 0);
+    const envVar = logicalKeyToEnvVar(key, manifest.envMapping) ?? (key.startsWith("value.") || key.startsWith("secret.") ? fallbackLogicalKeyToEnvVar(key) : void 0);
     if (!envVar) {
       continue;
     }
@@ -1593,13 +1586,6 @@ export {
   parseYaml,
   stringifyYaml,
   applySchemaRules,
-  envVarToLogicalKey,
-  toEnv,
-  toPublicEnv,
-  createCnos,
-  planDump,
-  writeDump,
-  flattenObject,
   isSecretReference,
   resolveSecretStoreRoot,
   resolveSecretVaultFile,
@@ -1608,5 +1594,12 @@ export {
   listSecretVaults,
   writeLocalSecret,
   readLocalSecret,
+  toEnv,
+  envVarToLogicalKey,
+  toPublicEnv,
+  createCnos,
+  planDump,
+  writeDump,
+  flattenObject,
   validateRuntime
 };

package/dist/{chunk-X4GOXEKX.js → chunk-53HXUSM6.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";

package/dist/{chunk-QKJ6QLRS.js → chunk-7FBRVJD6.js}

@@ -6,7 +6,7 @@ import {
   resolveSecretPassphrase,
   resolveSecretStoreRoot,
   toPortablePath
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";

package/dist/{chunk-M4S6PYM5.js → chunk-HOS4E7XO.js}

@@ -1,6 +1,6 @@
 import {
   joinConfigPath
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/{chunk-PBU5NAX4.js → chunk-IHSV5AFX.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/{chunk-7GNXYEO6.js → chunk-IQOUWY6T.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-L3HOQHCH.js → chunk-JQGGSNCL.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/index.cjs

@@ -1003,6 +1003,90 @@ function requireValue(graph, key) {
   return value;
 }
 
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+function isObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isSecretReference(value) {
+  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
+}
+function resolveSecretStoreRoot(processEnv = process.env) {
+  return import_node_path6.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
+}
+function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
+  return import_node_path6.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
+}
+function deriveKey(passphrase, salt) {
+  return (0, import_node_crypto.scryptSync)(passphrase, salt, 32);
+}
+function resolveSecretPassphrase(vault = "default", processEnv = process.env) {
+  const vaultToken = vault.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+  return processEnv[`CNOS_SECRET_PASSPHRASE_${vaultToken}`] ?? processEnv.CNOS_SECRET_PASSPHRASE;
+}
+function decryptDocument(document, passphrase) {
+  const salt = Buffer.from(document.salt, "base64");
+  const iv = Buffer.from(document.iv, "base64");
+  const tag = Buffer.from(document.tag, "base64");
+  const ciphertext = Buffer.from(document.ciphertext, "base64");
+  const key = deriveKey(passphrase, salt);
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return plaintext.toString("utf8");
+}
+async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
+  if (!passphrase) {
+    throw new CnosManifestError(
+      `Missing CNOS secret passphrase for local secret ref "${ref}". Set CNOS_SECRET_PASSPHRASE or pass processEnv explicitly.`
+    );
+  }
+  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
+  const source = await (0, import_promises6.readFile)(filePath, "utf8");
+  const document = JSON.parse(source);
+  if (document.version !== 1 || document.algorithm !== "aes-256-gcm" || typeof document.salt !== "string" || typeof document.iv !== "string" || typeof document.tag !== "string" || typeof document.ciphertext !== "string") {
+    throw new CnosManifestError("Invalid local secret document", filePath);
+  }
+  return decryptDocument(document, passphrase);
+}
+
+// ../core/src/runtime/toEnv.ts
+function normalizeEnvValue(value) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function toEnv(graph, manifest, options = {}) {
+  const includeSecrets = options.includeSecrets ?? true;
+  const output = {};
+  const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
+    ([left], [right]) => left.localeCompare(right)
+  );
+  for (const [envVar, logicalKey] of mappedEntries) {
+    const entry = graph.entries.get(logicalKey);
+    if (!entry) {
+      continue;
+    }
+    if (entry.namespace === "secret" && !includeSecrets) {
+      continue;
+    }
+    if (isSecretReference(entry.value)) {
+      continue;
+    }
+    output[envVar] = normalizeEnvValue(entry.value);
+  }
+  return output;
+}
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -1058,48 +1142,6 @@ function envVarToLogicalKey(envVar, config = {}) {
   return `value.${fromScreamingSnake(envVar)}`;
 }
 
-// ../core/src/runtime/toEnv.ts
-function fallbackLogicalKeyToEnvVar(key) {
-  if (key.startsWith("value.")) {
-    return key.slice("value.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-  }
-  if (key.startsWith("secret.")) {
-    const normalized = key.slice("secret.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-    return `SECRET_${normalized}`;
-  }
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-}
-function normalizeEnvValue(value) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-}
-function toEnv(graph, manifest, options = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
-  const output = {};
-  const resolvedEntries = Array.from(graph.entries.values()).sort(
-    (left, right) => left.key.localeCompare(right.key)
-  );
-  for (const entry of resolvedEntries) {
-    if (entry.namespace === "meta") {
-      continue;
-    }
-    if (!includeSecrets && entry.namespace === "secret") {
-      continue;
-    }
-    const envVar = logicalKeyToEnvVar(entry.key, manifest.envMapping) ?? fallbackLogicalKeyToEnvVar(entry.key);
-    output[envVar] = normalizeEnvValue(entry.value);
-  }
-  return output;
-}
-
 // ../core/src/runtime/toPublicEnv.ts
 function fallbackValueEnvVar(key) {
   return key.replace(/^value\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
@@ -1338,23 +1380,23 @@ async function createCnos(options = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 function buildDumpFiles(graph, options = {}) {
-  const basePath = options.flatten ? "" : import_node_path6.default.posix.join("workspaces", graph.workspace.workspaceId);
+  const basePath = options.flatten ? "" : import_node_path7.default.posix.join("workspaces", graph.workspace.workspaceId);
   const values = toNamespaceObject(graph, "value");
   const secrets = toNamespaceObject(graph, "secret");
   const files = [];
   if (Object.keys(values).length > 0) {
     files.push({
-      path: import_node_path6.default.posix.join(basePath, "values", graph.profile, "app.yml"),
+      path: import_node_path7.default.posix.join(basePath, "values", graph.profile, "app.yml"),
       namespace: "value",
       content: stringifyYaml(values)
     });
   }
   if (Object.keys(secrets).length > 0) {
     files.push({
-      path: import_node_path6.default.posix.join(basePath, "secrets", graph.profile, "app.yml"),
+      path: import_node_path7.default.posix.join(basePath, "secrets", graph.profile, "app.yml"),
       namespace: "secret",
       content: stringifyYaml(secrets)
     });
@@ -1370,12 +1412,12 @@ function planDump(graph, options = {}) {
   };
 }
 async function writeDump(graph, options) {
-  const root = import_node_path6.default.resolve(options.to);
+  const root = import_node_path7.default.resolve(options.to);
   const plan = planDump(graph, options);
   for (const file of plan.files) {
-    const destination = import_node_path6.default.join(root, file.path);
-    await (0, import_promises6.mkdir)(import_node_path6.default.dirname(destination), { recursive: true });
-    await (0, import_promises6.writeFile)(destination, file.content, "utf8");
+    const destination = import_node_path7.default.join(root, file.path);
+    await (0, import_promises7.mkdir)(import_node_path7.default.dirname(destination), { recursive: true });
+    await (0, import_promises7.writeFile)(destination, file.content, "utf8");
   }
   return {
     ...plan,
@@ -1383,59 +1425,10 @@ async function writeDump(graph, options) {
   };
 }
 
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
-function isObject(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function isSecretReference(value) {
-  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
-}
-function resolveSecretStoreRoot(processEnv = process.env) {
-  return import_node_path7.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
-}
-function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
-  return import_node_path7.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
-}
-function deriveKey(passphrase, salt) {
-  return (0, import_node_crypto.scryptSync)(passphrase, salt, 32);
-}
-function resolveSecretPassphrase(vault = "default", processEnv = process.env) {
-  const vaultToken = vault.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-  return processEnv[`CNOS_SECRET_PASSPHRASE_${vaultToken}`] ?? processEnv.CNOS_SECRET_PASSPHRASE;
-}
-function decryptDocument(document, passphrase) {
-  const salt = Buffer.from(document.salt, "base64");
-  const iv = Buffer.from(document.iv, "base64");
-  const tag = Buffer.from(document.tag, "base64");
-  const ciphertext = Buffer.from(document.ciphertext, "base64");
-  const key = deriveKey(passphrase, salt);
-  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  return plaintext.toString("utf8");
-}
-async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
-  if (!passphrase) {
-    throw new CnosManifestError(
-      `Missing CNOS secret passphrase for local secret ref "${ref}". Set CNOS_SECRET_PASSPHRASE or pass processEnv explicitly.`
-    );
-  }
-  const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
-  const source = await (0, import_promises7.readFile)(filePath, "utf8");
-  const document = JSON.parse(source);
-  if (document.version !== 1 || document.algorithm !== "aes-256-gcm" || typeof document.salt !== "string" || typeof document.iv !== "string" || typeof document.tag !== "string" || typeof document.ciphertext !== "string") {
-    throw new CnosManifestError("Invalid local secret document", filePath);
-  }
-  return decryptDocument(document, passphrase);
-}
-
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.1.1",
+  version: "1.1.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/index.js

@@ -1,23 +1,23 @@
 import {
   createBasicSchemaPlugin
-} from "./chunk-L3HOQHCH.js";
+} from "./chunk-JQGGSNCL.js";
 import {
   createCliArgsPlugin
-} from "./chunk-M4S6PYM5.js";
+} from "./chunk-HOS4E7XO.js";
 import {
   createDotenvPlugin
-} from "./chunk-7GNXYEO6.js";
+} from "./chunk-IQOUWY6T.js";
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-PBU5NAX4.js";
+} from "./chunk-IHSV5AFX.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-QKJ6QLRS.js";
+} from "./chunk-7FBRVJD6.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-X4GOXEKX.js";
+} from "./chunk-53HXUSM6.js";
 import {
   createCnos,
   createProvenanceInspector,
@@ -25,12 +25,12 @@ import {
   toEnv,
   toPublicEnv,
   writeDump
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.1.1",
+  version: "1.1.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/internal.cjs

@@ -95,66 +95,18 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
-// ../core/src/utils/envNaming.ts
-function normalizeMappingConfig(config = {}) {
-  return {
-    convention: config.convention,
-    explicit: config.explicit ?? {}
-  };
-}
-function toScreamingSnakeSegment(segment) {
-  return segment.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-}
-function toScreamingSnake(path8) {
-  return path8.split(".").map((segment) => toScreamingSnakeSegment(segment)).filter(Boolean).join("_");
-}
-function logicalKeyToEnvVar(key, config = {}) {
-  const normalized = normalizeMappingConfig(config);
-  const explicitEntry = Object.entries(normalized.explicit).find(([, logicalKey]) => logicalKey === key);
-  if (explicitEntry) {
-    return explicitEntry[0];
-  }
-  if (normalized.convention !== "SCREAMING_SNAKE") {
-    return void 0;
-  }
-  if (key.startsWith("value.")) {
-    return toScreamingSnake(key.slice("value.".length));
-  }
-  if (key.startsWith("secret.")) {
-    return `SECRET_${toScreamingSnake(key.slice("secret.".length))}`;
-  }
-  return void 0;
-}
-
-// ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
-// ../core/src/utils/flatten.ts
-function flattenObject(value, prefix = "") {
-  return Object.entries(value).reduce((accumulator, [key, nestedValue]) => {
-    const nextKey = prefix ? `${prefix}.${key}` : key;
-    if (nestedValue && typeof nestedValue === "object" && !Array.isArray(nestedValue)) {
-      Object.assign(accumulator, flattenObject(nestedValue, nextKey));
-      return accumulator;
-    }
-    accumulator[nextKey] = nestedValue;
-    return accumulator;
-  }, {});
-}
-
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 function resolveSecretStoreRoot(processEnv = process.env) {
-  return import_node_path7.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
+  return import_node_path6.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
 }
 function resolveSecretVaultFile(storeRoot, vault = "default") {
-  return import_node_path7.default.join(storeRoot, "vaults", `${vault}.json`);
+  return import_node_path6.default.join(storeRoot, "vaults", `${vault}.json`);
 }
 function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
-  return import_node_path7.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
+  return import_node_path6.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
 }
 function deriveKey(passphrase, salt) {
   return (0, import_node_crypto.scryptSync)(passphrase, salt, 32);
@@ -182,21 +134,21 @@ function encryptDocument(value, passphrase) {
 async function createSecretVault(storeRoot, vault, passphrase) {
   const normalizedVault = vault.trim() || "default";
   const filePath = resolveSecretVaultFile(storeRoot, normalizedVault);
-  await (0, import_promises7.mkdir)(import_node_path7.default.dirname(filePath), { recursive: true });
+  await (0, import_promises6.mkdir)(import_node_path6.default.dirname(filePath), { recursive: true });
   const document = {
     version: 1,
     name: normalizedVault,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     verifier: encryptDocument(`cnos-vault:${normalizedVault}`, passphrase)
   };
-  await (0, import_promises7.writeFile)(filePath, JSON.stringify(document, null, 2), "utf8");
+  await (0, import_promises6.writeFile)(filePath, JSON.stringify(document, null, 2), "utf8");
   return filePath;
 }
 async function ensureSecretVault(storeRoot, vault, passphrase) {
   const normalizedVault = vault.trim() || "default";
   const filePath = resolveSecretVaultFile(storeRoot, normalizedVault);
   try {
-    await (0, import_promises7.readFile)(filePath, "utf8");
+    await (0, import_promises6.readFile)(filePath, "utf8");
     return filePath;
   } catch (error) {
     if (error.code !== "ENOENT") {
@@ -206,9 +158,9 @@ async function ensureSecretVault(storeRoot, vault, passphrase) {
   return createSecretVault(storeRoot, normalizedVault, passphrase);
 }
 async function listSecretVaults(storeRoot) {
-  const vaultRoot = import_node_path7.default.join(storeRoot, "vaults");
+  const vaultRoot = import_node_path6.default.join(storeRoot, "vaults");
   try {
-    const entries = await (0, import_promises7.readdir)(vaultRoot, { withFileTypes: true });
+    const entries = await (0, import_promises6.readdir)(vaultRoot, { withFileTypes: true });
     return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.replace(/\.json$/, "")).sort((left, right) => left.localeCompare(right));
   } catch {
     return [];
@@ -217,11 +169,59 @@ async function listSecretVaults(storeRoot) {
 async function writeLocalSecret(storeRoot, ref, value, passphrase, vault = "default") {
   await ensureSecretVault(storeRoot, vault, passphrase);
   const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
-  await (0, import_promises7.mkdir)(import_node_path7.default.dirname(filePath), { recursive: true });
-  await (0, import_promises7.writeFile)(filePath, JSON.stringify(encryptDocument(value, passphrase), null, 2), "utf8");
+  await (0, import_promises6.mkdir)(import_node_path6.default.dirname(filePath), { recursive: true });
+  await (0, import_promises6.writeFile)(filePath, JSON.stringify(encryptDocument(value, passphrase), null, 2), "utf8");
   return filePath;
 }
 
+// ../core/src/utils/envNaming.ts
+function normalizeMappingConfig(config = {}) {
+  return {
+    convention: config.convention,
+    explicit: config.explicit ?? {}
+  };
+}
+function toScreamingSnakeSegment(segment) {
+  return segment.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+}
+function toScreamingSnake(path8) {
+  return path8.split(".").map((segment) => toScreamingSnakeSegment(segment)).filter(Boolean).join("_");
+}
+function logicalKeyToEnvVar(key, config = {}) {
+  const normalized = normalizeMappingConfig(config);
+  const explicitEntry = Object.entries(normalized.explicit).find(([, logicalKey]) => logicalKey === key);
+  if (explicitEntry) {
+    return explicitEntry[0];
+  }
+  if (normalized.convention !== "SCREAMING_SNAKE") {
+    return void 0;
+  }
+  if (key.startsWith("value.")) {
+    return toScreamingSnake(key.slice("value.".length));
+  }
+  if (key.startsWith("secret.")) {
+    return `SECRET_${toScreamingSnake(key.slice("secret.".length))}`;
+  }
+  return void 0;
+}
+
+// ../core/src/runtime/dump.ts
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
+
+// ../core/src/utils/flatten.ts
+function flattenObject(value, prefix = "") {
+  return Object.entries(value).reduce((accumulator, [key, nestedValue]) => {
+    const nextKey = prefix ? `${prefix}.${key}` : key;
+    if (nestedValue && typeof nestedValue === "object" && !Array.isArray(nestedValue)) {
+      Object.assign(accumulator, flattenObject(nestedValue, nextKey));
+      return accumulator;
+    }
+    accumulator[nextKey] = nestedValue;
+    return accumulator;
+  }, {});
+}
+
 // ../core/src/validation/envMapping.ts
 function fallbackLogicalKeyToEnvVar(key) {
   return key.replace(/^(value|secret)\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();

package/dist/internal.js

@@ -10,7 +10,7 @@ import {
   stringifyYaml,
   validateRuntime,
   writeLocalSecret
-} from "./chunk-JPJ3S3CO.js";
+} from "./chunk-33ZDYDQJ.js";
 export {
   createSecretVault,
   flattenObject,

package/dist/plugin/basic-schema.cjs

@@ -205,12 +205,12 @@ function applySchemaRules(graph, schema) {
   };
 }
 
-// ../core/src/runtime/dump.ts
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
 var import_promises6 = require("fs/promises");
 var import_node_path6 = __toESM(require("path"), 1);
 
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
+// ../core/src/runtime/dump.ts
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-L3HOQHCH.js";
-import "../chunk-JPJ3S3CO.js";
+} from "../chunk-JQGGSNCL.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.cjs

@@ -63,12 +63,12 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
-// ../core/src/runtime/dump.ts
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
 var import_promises6 = require("fs/promises");
 var import_node_path6 = __toESM(require("path"), 1);
 
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
+// ../core/src/runtime/dump.ts
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-M4S6PYM5.js";
-import "../chunk-JPJ3S3CO.js";
+} from "../chunk-HOS4E7XO.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.cjs

@@ -89,6 +89,11 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -122,11 +127,6 @@ function envVarToLogicalKey(envVar, config = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-7GNXYEO6.js";
-import "../chunk-JPJ3S3CO.js";
+} from "../chunk-IQOUWY6T.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.cjs

@@ -76,6 +76,52 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+function isObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isSecretReference(value) {
+  return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
+}
+
+// ../core/src/runtime/toEnv.ts
+function normalizeEnvValue(value) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function toEnv(graph, manifest, options = {}) {
+  const includeSecrets = options.includeSecrets ?? true;
+  const output = {};
+  const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
+    ([left], [right]) => left.localeCompare(right)
+  );
+  for (const [envVar, logicalKey] of mappedEntries) {
+    const entry = graph.entries.get(logicalKey);
+    if (!entry) {
+      continue;
+    }
+    if (entry.namespace === "secret" && !includeSecrets) {
+      continue;
+    }
+    if (isSecretReference(entry.value)) {
+      continue;
+    }
+    output[envVar] = normalizeEnvValue(entry.value);
+  }
+  return output;
+}
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -107,48 +153,6 @@ function logicalKeyToEnvVar(key, config = {}) {
   return void 0;
 }
 
-// ../core/src/runtime/toEnv.ts
-function fallbackLogicalKeyToEnvVar(key) {
-  if (key.startsWith("value.")) {
-    return key.slice("value.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-  }
-  if (key.startsWith("secret.")) {
-    const normalized = key.slice("secret.".length).replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-    return `SECRET_${normalized}`;
-  }
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-}
-function normalizeEnvValue(value) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-}
-function toEnv(graph, manifest, options = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
-  const output = {};
-  const resolvedEntries = Array.from(graph.entries.values()).sort(
-    (left, right) => left.key.localeCompare(right.key)
-  );
-  for (const entry of resolvedEntries) {
-    if (entry.namespace === "meta") {
-      continue;
-    }
-    if (!includeSecrets && entry.namespace === "secret") {
-      continue;
-    }
-    const envVar = logicalKeyToEnvVar(entry.key, manifest.envMapping) ?? fallbackLogicalKeyToEnvVar(entry.key);
-    output[envVar] = normalizeEnvValue(entry.value);
-  }
-  return output;
-}
-
 // ../core/src/runtime/toPublicEnv.ts
 function fallbackValueEnvVar(key) {
   return key.replace(/^value\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
@@ -201,11 +205,6 @@ function toPublicEnv(graph, manifest, options = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-PBU5NAX4.js";
+} from "../chunk-IHSV5AFX.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-JPJ3S3CO.js";
+} from "../chunk-33ZDYDQJ.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.cjs

@@ -100,14 +100,10 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
-// ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 function isObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -115,10 +111,10 @@ function isSecretReference(value) {
   return isObject(value) && typeof value.provider === "string" && value.provider.trim().length > 0 && typeof value.ref === "string" && value.ref.trim().length > 0 && (value.vault === void 0 && true || typeof value.vault === "string" && value.vault.trim().length > 0) && Object.keys(value).every((key) => ["provider", "ref", "vault"].includes(key));
 }
 function resolveSecretStoreRoot(processEnv = process.env) {
-  return import_node_path7.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
+  return import_node_path6.default.resolve(expandHomePath(processEnv.CNOS_SECRET_HOME ?? "~/.cnos/secrets"));
 }
 function resolveSecretStoreFile(storeRoot, ref, vault = "default") {
-  return import_node_path7.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
+  return import_node_path6.default.join(storeRoot, "vaults", vault, "store", ...ref.split("/")).concat(".json");
 }
 function deriveKey(passphrase, salt) {
   return (0, import_node_crypto.scryptSync)(passphrase, salt, 32);
@@ -145,7 +141,7 @@ async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
     );
   }
   const filePath = resolveSecretStoreFile(storeRoot, ref, vault);
-  const source = await (0, import_promises7.readFile)(filePath, "utf8");
+  const source = await (0, import_promises6.readFile)(filePath, "utf8");
   const document = JSON.parse(source);
   if (document.version !== 1 || document.algorithm !== "aes-256-gcm" || typeof document.salt !== "string" || typeof document.iv !== "string" || typeof document.tag !== "string" || typeof document.ciphertext !== "string") {
     throw new CnosManifestError("Invalid local secret document", filePath);
@@ -153,6 +149,10 @@ async function readLocalSecret(storeRoot, ref, passphrase, vault = "default") {
   return decryptDocument(document, passphrase);
 }
 
+// ../core/src/runtime/dump.ts
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
+
 // ../../plugins/filesystem/src/helpers.ts
 var YAML_EXTENSIONS = /* @__PURE__ */ new Set([".yml", ".yaml"]);
 var FILESYSTEM_PLUGIN_ID = "@kitsy/cnos/plugins/filesystem";

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-QKJ6QLRS.js";
-import "../chunk-JPJ3S3CO.js";
+} from "../chunk-7FBRVJD6.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.cjs

@@ -59,6 +59,11 @@ var import_node_path4 = __toESM(require("path"), 1);
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/utils/secretStore.ts
+var import_node_crypto = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -92,11 +97,6 @@ function envVarToLogicalKey(envVar, config = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
-
-// ../core/src/utils/secretStore.ts
-var import_node_crypto = require("crypto");
 var import_promises7 = require("fs/promises");
 var import_node_path7 = __toESM(require("path"), 1);
 

package/dist/plugin/process-env.js

@@ -1,8 +1,8 @@
 import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject
-} from "../chunk-X4GOXEKX.js";
-import "../chunk-JPJ3S3CO.js";
+} from "../chunk-53HXUSM6.js";
+import "../chunk-33ZDYDQJ.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Batteries-included CNOS runtime package wired with the official plugins.",
   "type": "module",
   "main": "./dist/index.cjs",