@kitsy/cnos 1.1.2 → 1.2.0

package/dist/plugin/basic-schema.d.ts

@@ -1,4 +1,4 @@
-import { j as ValidatorPlugin } from '../plugin-BVNEHj19.js';
+import { m as ValidatorPlugin } from '../plugin-DkOIT5uI.js';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-JQGGSNCL.js";
-import "../chunk-33ZDYDQJ.js";
+} from "../chunk-MLQGYCO7.js";
+import "../chunk-APCTXRUN.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.d.cts

@@ -1,4 +1,4 @@
-import { f as ConfigEntry, L as LoaderPlugin } from '../plugin-BVNEHj19.cjs';
+import { f as ConfigEntry, L as LoaderPlugin } from '../plugin-DkOIT5uI.cjs';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.d.ts

@@ -1,4 +1,4 @@
-import { f as ConfigEntry, L as LoaderPlugin } from '../plugin-BVNEHj19.js';
+import { f as ConfigEntry, L as LoaderPlugin } from '../plugin-DkOIT5uI.js';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-HOS4E7XO.js";
-import "../chunk-33ZDYDQJ.js";
+} from "../chunk-ZA74BO47.js";
+import "../chunk-APCTXRUN.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.cjs

@@ -94,6 +94,10 @@ var import_node_crypto = require("crypto");
 var import_promises6 = require("fs/promises");
 var import_node_path6 = __toESM(require("path"), 1);
 
+// ../core/src/runtime/dump.ts
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -126,10 +130,6 @@ function envVarToLogicalKey(envVar, config = {}) {
   return `value.${fromScreamingSnake(envVar)}`;
 }
 
-// ../core/src/runtime/dump.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
-
 // ../../plugins/dotenv/src/index.ts
 var DOTENV_PLUGIN_ID = "@kitsy/cnos/plugins/dotenv";
 function parseDoubleQuoted(value) {

package/dist/plugin/dotenv.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-BVNEHj19.cjs';
-import { E as EnvMappingConfig } from '../envNaming-BrOk5ndZ.cjs';
+import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-DkOIT5uI.cjs';
+import { E as EnvMappingConfig } from '../envNaming-BTJpH93W.cjs';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-BVNEHj19.js';
-import { E as EnvMappingConfig } from '../envNaming-DCaNdnrF.js';
+import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-DkOIT5uI.js';
+import { E as EnvMappingConfig } from '../envNaming-CcsqAel3.js';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-IQOUWY6T.js";
-import "../chunk-33ZDYDQJ.js";
+} from "../chunk-RD5WMHPM.js";
+import "../chunk-APCTXRUN.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.cjs

@@ -60,6 +60,9 @@ var import_node_path2 = __toESM(require("path"), 1);
 var import_promises = require("fs/promises");
 var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
+function stripNamespace(key) {
+  return key.split(".").slice(1).join(".");
+}
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
@@ -72,6 +75,23 @@ var import_node_path3 = __toESM(require("path"), 1);
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
+// ../core/src/promotions/validatePromotion.ts
+var DEFAULT_DATA_NAMESPACE = {
+  kind: "data",
+  shareable: false
+};
+function getNamespaceNameForKey(key) {
+  const [namespace] = key.split(".");
+  if (!namespace || !key.includes(".")) {
+    throw new CnosManifestError(`Logical key must be namespace-qualified: ${key}`);
+  }
+  return namespace;
+}
+function getNamespaceDefinition(manifest, namespaceOrKey) {
+  const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
+  return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
+}
+
 // ../core/src/workspaces/resolveWorkspaceContext.ts
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
@@ -111,6 +131,10 @@ function toEnv(graph, manifest, options = {}) {
     if (!entry) {
       continue;
     }
+    const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
+    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+      continue;
+    }
     if (entry.namespace === "secret" && !includeSecrets) {
       continue;
     }
@@ -122,40 +146,9 @@ function toEnv(graph, manifest, options = {}) {
   return output;
 }
 
-// ../core/src/utils/envNaming.ts
-function normalizeMappingConfig(config = {}) {
-  return {
-    convention: config.convention,
-    explicit: config.explicit ?? {}
-  };
-}
-function toScreamingSnakeSegment(segment) {
-  return segment.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-}
-function toScreamingSnake(path8) {
-  return path8.split(".").map((segment) => toScreamingSnakeSegment(segment)).filter(Boolean).join("_");
-}
-function logicalKeyToEnvVar(key, config = {}) {
-  const normalized = normalizeMappingConfig(config);
-  const explicitEntry = Object.entries(normalized.explicit).find(([, logicalKey]) => logicalKey === key);
-  if (explicitEntry) {
-    return explicitEntry[0];
-  }
-  if (normalized.convention !== "SCREAMING_SNAKE") {
-    return void 0;
-  }
-  if (key.startsWith("value.")) {
-    return toScreamingSnake(key.slice("value.".length));
-  }
-  if (key.startsWith("secret.")) {
-    return `SECRET_${toScreamingSnake(key.slice("secret.".length))}`;
-  }
-  return void 0;
-}
-
 // ../core/src/runtime/toPublicEnv.ts
-function fallbackValueEnvVar(key) {
-  return key.replace(/^value\./, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+function fallbackPublicEnvVar(valuePath) {
+  return valuePath.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
 }
 function normalizeEnvValue2(value) {
   if (value === void 0 || value === null) {
@@ -182,22 +175,12 @@ function resolvePublicPrefix(manifest, options) {
   }
   return configuredPrefix;
 }
-function ensurePublicPromotionKey(key) {
-  if (!key.startsWith("value.")) {
-    throw new CnosManifestError(`public.promote may only contain value.* keys: ${key}`);
-  }
-}
 function toPublicEnv(graph, manifest, options = {}) {
   const prefix = resolvePublicPrefix(manifest, options);
   const output = {};
-  const promotions = [...manifest.public.promote].sort((left, right) => left.localeCompare(right));
-  for (const key of promotions) {
-    ensurePublicPromotionKey(key);
-    const resolved = graph.entries.get(key);
-    if (!resolved) {
-      continue;
-    }
-    const baseEnvVar = logicalKeyToEnvVar(key, manifest.envMapping) ?? fallbackValueEnvVar(key);
+  const promotions = Array.from(graph.entries.values()).filter((entry) => entry.namespace === "public").sort((left, right) => left.key.localeCompare(right.key));
+  for (const resolved of promotions) {
+    const baseEnvVar = fallbackPublicEnvVar(stripNamespace(resolved.key));
     const envVar = prefix && !baseEnvVar.startsWith(prefix) ? `${prefix}${baseEnvVar}` : baseEnvVar;
     output[envVar] = normalizeEnvValue2(resolved.value);
   }

package/dist/plugin/env-export.d.cts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-BVNEHj19.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-Dd152fFy.cjs';
+import { E as ExporterPlugin } from '../plugin-DkOIT5uI.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-DvFeV3qG.cjs';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.d.ts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-BVNEHj19.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-Gwz3xTK0.js';
+import { E as ExporterPlugin } from '../plugin-DkOIT5uI.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-C9clvXLo.js';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-IHSV5AFX.js";
+} from "../chunk-EIN55XXA.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-33ZDYDQJ.js";
+} from "../chunk-APCTXRUN.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.cjs

@@ -257,7 +257,7 @@ async function resolveSecretValue(value, processEnv) {
       value.vault
     );
   }
-  if (value.provider === "env") {
+  if (value.provider === "env" || value.provider === "github-secrets") {
     const resolved = processEnv?.[value.ref];
     if (resolved === void 0) {
       return value;

package/dist/plugin/filesystem.d.cts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, f as ConfigEntry, k as WorkspaceRoot, l as NamespaceName } from '../plugin-BVNEHj19.cjs';
+import { L as LoaderPlugin, f as ConfigEntry, n as WorkspaceRoot, o as NamespaceName } from '../plugin-DkOIT5uI.cjs';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.d.ts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, f as ConfigEntry, k as WorkspaceRoot, l as NamespaceName } from '../plugin-BVNEHj19.js';
+import { L as LoaderPlugin, f as ConfigEntry, n as WorkspaceRoot, o as NamespaceName } from '../plugin-DkOIT5uI.js';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-7FBRVJD6.js";
-import "../chunk-33ZDYDQJ.js";
+} from "../chunk-SXTMTACL.js";
+import "../chunk-APCTXRUN.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.cjs

@@ -64,6 +64,10 @@ var import_node_crypto = require("crypto");
 var import_promises6 = require("fs/promises");
 var import_node_path6 = __toESM(require("path"), 1);
 
+// ../core/src/runtime/dump.ts
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
+
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
   return {
@@ -96,10 +100,6 @@ function envVarToLogicalKey(envVar, config = {}) {
   return `value.${fromScreamingSnake(envVar)}`;
 }
 
-// ../core/src/runtime/dump.ts
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
-
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";
 function processEnvEntriesFromObject(env, mapping = {}, workspaceId = "default") {

package/dist/plugin/process-env.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-BVNEHj19.cjs';
-import { E as EnvMappingConfig } from '../envNaming-BrOk5ndZ.cjs';
+import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-DkOIT5uI.cjs';
+import { E as EnvMappingConfig } from '../envNaming-BTJpH93W.cjs';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
 declare function createProcessEnvPlugin(): LoaderPlugin;

package/dist/plugin/process-env.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-BVNEHj19.js';
-import { E as EnvMappingConfig } from '../envNaming-DCaNdnrF.js';
+import { L as LoaderPlugin, f as ConfigEntry } from '../plugin-DkOIT5uI.js';
+import { E as EnvMappingConfig } from '../envNaming-CcsqAel3.js';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
 declare function createProcessEnvPlugin(): LoaderPlugin;

package/dist/plugin/process-env.js

@@ -1,8 +1,8 @@
 import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject
-} from "../chunk-53HXUSM6.js";
-import "../chunk-33ZDYDQJ.js";
+} from "../chunk-WHUGFPE4.js";
+import "../chunk-APCTXRUN.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject

package/dist/{plugin-BVNEHj19.d.cts → plugin-DkOIT5uI.d.cts}

@@ -44,6 +44,20 @@ interface WorkspaceContext {
 }
 
 type ResolutionArrayPolicy = 'replace' | 'append' | 'unique-append';
+type NamespaceKind = 'data' | 'projection' | 'system';
+type NamespaceProjectionSource = 'promote' | 'envMapping';
+type VaultProviderName = 'local' | 'github-secrets' | (string & {});
+interface NamespaceDefinition {
+    kind: NamespaceKind;
+    shareable: boolean;
+    sensitive?: boolean;
+    readonly?: boolean;
+    source?: NamespaceProjectionSource;
+}
+interface VaultDefinition {
+    provider: VaultProviderName;
+    passphrase?: string;
+}
 interface ManifestFile {
     version?: number;
     project?: {
@@ -82,6 +96,8 @@ interface ManifestFile {
         promote?: LogicalKey[];
         frameworks?: Record<string, string>;
     };
+    namespaces?: Record<string, Partial<NamespaceDefinition>>;
+    vaults?: Record<string, Partial<VaultDefinition>>;
     writePolicy?: {
         define?: {
             defaultProfile?: string;
@@ -128,6 +144,8 @@ interface NormalizedManifest {
         promote: LogicalKey[];
         frameworks: Record<string, string>;
     };
+    namespaces: Record<string, NamespaceDefinition>;
+    vaults: Record<string, VaultDefinition>;
     writePolicy: {
         define: {
             defaultProfile: string;
@@ -136,9 +154,19 @@ interface NormalizedManifest {
     };
     schema: Record<LogicalKey, SchemaRule>;
 }
+interface LoadManifestOptions {
+    root?: string;
+}
+interface LoadedManifest {
+    manifestRoot: string;
+    repoRoot: string;
+    manifestPath: string;
+    manifest: NormalizedManifest;
+    rawManifest: ManifestFile;
+}
 
 type LogicalKey = string;
-type NamespaceName = 'value' | 'secret' | 'meta';
+type NamespaceName = string;
 interface ConfigOrigin {
     file?: string;
     line?: number;
@@ -306,4 +334,4 @@ interface ExporterPlugin extends CnosPlugin {
     export(graph: ResolvedGraph, context: ExportContext): Promise<ExportResult>;
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidationSummary as V, WorkspaceFile as W, DumpPlan as a, DumpOptions as b, DumpResult as c, CnosRuntime as d, CnosPlugin as e, ConfigEntry as f, LogicalKey as g, ToPublicEnvOptions as h, ValidationIssue as i, ValidatorPlugin as j, WorkspaceRoot as k, NamespaceName as l };
+export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, VaultDefinition as V, WorkspaceFile as W, DumpPlan as a, DumpOptions as b, DumpResult as c, CnosRuntime as d, CnosPlugin as e, ConfigEntry as f, LogicalKey as g, ToPublicEnvOptions as h, LoadManifestOptions as i, LoadedManifest as j, ValidationSummary as k, ValidationIssue as l, ValidatorPlugin as m, WorkspaceRoot as n, NamespaceName as o };

package/dist/{plugin-BVNEHj19.d.ts → plugin-DkOIT5uI.d.ts}

@@ -44,6 +44,20 @@ interface WorkspaceContext {
 }
 
 type ResolutionArrayPolicy = 'replace' | 'append' | 'unique-append';
+type NamespaceKind = 'data' | 'projection' | 'system';
+type NamespaceProjectionSource = 'promote' | 'envMapping';
+type VaultProviderName = 'local' | 'github-secrets' | (string & {});
+interface NamespaceDefinition {
+    kind: NamespaceKind;
+    shareable: boolean;
+    sensitive?: boolean;
+    readonly?: boolean;
+    source?: NamespaceProjectionSource;
+}
+interface VaultDefinition {
+    provider: VaultProviderName;
+    passphrase?: string;
+}
 interface ManifestFile {
     version?: number;
     project?: {
@@ -82,6 +96,8 @@ interface ManifestFile {
         promote?: LogicalKey[];
         frameworks?: Record<string, string>;
     };
+    namespaces?: Record<string, Partial<NamespaceDefinition>>;
+    vaults?: Record<string, Partial<VaultDefinition>>;
     writePolicy?: {
         define?: {
             defaultProfile?: string;
@@ -128,6 +144,8 @@ interface NormalizedManifest {
         promote: LogicalKey[];
         frameworks: Record<string, string>;
     };
+    namespaces: Record<string, NamespaceDefinition>;
+    vaults: Record<string, VaultDefinition>;
     writePolicy: {
         define: {
             defaultProfile: string;
@@ -136,9 +154,19 @@ interface NormalizedManifest {
     };
     schema: Record<LogicalKey, SchemaRule>;
 }
+interface LoadManifestOptions {
+    root?: string;
+}
+interface LoadedManifest {
+    manifestRoot: string;
+    repoRoot: string;
+    manifestPath: string;
+    manifest: NormalizedManifest;
+    rawManifest: ManifestFile;
+}
 
 type LogicalKey = string;
-type NamespaceName = 'value' | 'secret' | 'meta';
+type NamespaceName = string;
 interface ConfigOrigin {
     file?: string;
     line?: number;
@@ -306,4 +334,4 @@ interface ExporterPlugin extends CnosPlugin {
     export(graph: ResolvedGraph, context: ExportContext): Promise<ExportResult>;
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidationSummary as V, WorkspaceFile as W, DumpPlan as a, DumpOptions as b, DumpResult as c, CnosRuntime as d, CnosPlugin as e, ConfigEntry as f, LogicalKey as g, ToPublicEnvOptions as h, ValidationIssue as i, ValidatorPlugin as j, WorkspaceRoot as k, NamespaceName as l };
+export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, VaultDefinition as V, WorkspaceFile as W, DumpPlan as a, DumpOptions as b, DumpResult as c, CnosRuntime as d, CnosPlugin as e, ConfigEntry as f, LogicalKey as g, ToPublicEnvOptions as h, LoadManifestOptions as i, LoadedManifest as j, ValidationSummary as k, ValidationIssue as l, ValidatorPlugin as m, WorkspaceRoot as n, NamespaceName as o };