@kitsy/cnos 1.1.2 → 1.3.0

package/dist/internal.d.cts

@@ -1,25 +1,207 @@
-import { d as CnosRuntime, V as ValidationSummary } from './plugin-BVNEHj19.cjs';
-export { i as ValidationIssue, W as WorkspaceFile } from './plugin-BVNEHj19.cjs';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as VaultDefinition, g as CnosRuntime, m as ValidationSummary, R as ResolvedGraph } from './plugin-CyNkf7Dm.cjs';
+export { n as ValidationIssue, o as WorkspaceFile } from './plugin-CyNkf7Dm.cjs';
 
-declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
+declare class CnosError extends Error {
+    constructor(message: string);
+}
+declare class CnosSecurityError extends CnosError {
+    constructor(message: string);
+}
+declare class CnosAuthenticationError extends CnosError {
+    constructor(message: string);
+}
 
-declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
+declare function readKeychain(entry: string): Promise<string | undefined>;
+declare function writeKeychain(entry: string, value: string): Promise<void>;
+
+declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
+
+type ProjectionTarget = 'public' | 'env';
+declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
 interface SecretReference {
     provider: string;
     ref: string;
     vault?: string;
 }
+interface VaultAuthConfig {
+    passphrase?: string;
+    token?: string;
+    derivedKey?: Buffer;
+    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
+    config?: Record<string, unknown>;
+}
+interface SecretVaultProvider {
+    readonly vaultId: string;
+    readonly definition: VaultDefinition;
+    authenticate(authConfig: VaultAuthConfig): Promise<void>;
+    isAuthenticated(): boolean;
+    batchGet(refs: string[]): Promise<Map<string, string>>;
+    get(ref: string): Promise<string | undefined>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+
+declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
+
+declare function writeVaultSessionKey(vault: string, derivedKey: Buffer, processEnv?: Record<string, string | undefined>): Promise<string>;
+declare function clearVaultSessionKey(vault: string, processEnv?: Record<string, string | undefined>): Promise<void>;
+declare function clearAllVaultSessionKeys(processEnv?: Record<string, string | undefined>): Promise<void>;
+
+declare function createSecretVaultProvider(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
+
+declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
+
+declare function resolveManifestRoot(root?: string): Promise<string>;
+declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
+
+interface ResolvedVaultDefinition extends VaultDefinition {
+    name: string;
+    requiresAuthentication: boolean;
+}
+interface VaultMetadata {
+    version: 1;
+    algorithm: 'aes-256-gcm';
+    kdf: 'pbkdf2-sha512';
+    iterations: number;
+    salt: string;
+    createdAt: string;
+    secretCount: number;
+}
+declare function isSecretReference(value: unknown): value is SecretReference;
 declare function resolveSecretStoreRoot(processEnv?: Record<string, string | undefined>): string;
-declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
+declare function getVaultPassphraseEnvVar(vault?: string): string;
+declare function isPassphraseEnvRef(value: string | undefined): boolean;
+declare function getVaultSessionKeyEnvVar(vault?: string): string;
 declare function resolveSecretPassphrase(vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
-declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
+declare function deriveVaultKey(passphrase: string, salt: Buffer, iterations?: number): Buffer;
+declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
+declare function detectLegacyVaultFormat(storeRoot: string, vault?: string): Promise<string | undefined>;
+declare function readVaultMetadata(storeRoot: string, vault?: string): Promise<VaultMetadata | undefined>;
 declare function listSecretVaults(storeRoot: string): Promise<string[]>;
-declare function writeLocalSecret(storeRoot: string, ref: string, value: string, passphrase: string, vault?: string): Promise<string>;
+declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
+declare function resolveConfiguredVaultPassphrase(definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
+declare function resolveVaultAccessKey(storeRoot: string, definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig | undefined>;
+declare function writeLocalSecret(storeRoot: string, ref: string, value: string, authOrPassphrase: VaultAuthConfig | string, vault?: string): Promise<string>;
+declare function deleteLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<boolean>;
+declare function readLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<string>;
+declare function listLocalSecrets(storeRoot: string, auth: VaultAuthConfig, vault?: string): Promise<string[]>;
+declare function resolveVaultDefinition(vaults: Record<string, VaultDefinition> | undefined, vault?: string): ResolvedVaultDefinition;
+declare function removeLocalVaultFiles(storeRoot: string, vault?: string): Promise<void>;
 
 declare function parseYaml<T>(source: string): T;
 declare function stringifyYaml(value: unknown): string;
 
 declare function validateRuntime(runtime: CnosRuntime): Promise<ValidationSummary>;
 
-export { type SecretReference, ValidationSummary, createSecretVault, flattenObject, listSecretVaults, parseYaml, resolveConfigDocumentPath, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, stringifyYaml, validateRuntime, writeLocalSecret };
+declare const CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+declare const CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
+declare const CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
+declare function serializeRuntimeGraph(graph: ResolvedGraph): string;
+declare function deserializeRuntimeGraph(source: string): ResolvedGraph;
+declare function serializeSecretPayload(values: Record<string, unknown>): {
+    payload: string;
+    sessionKey: string;
+};
+declare function readRuntimeGraphFromEnv(processEnv?: Record<string, string | undefined>): ResolvedGraph | undefined;
+declare function graphRequiresSecretHydration(graph: ResolvedGraph): boolean;
+
+interface GeneratedCodegenContent {
+    typesContent: string;
+    runtimeContent: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function generateCodegenContent(manifest: NormalizedManifest, sourcePath: string, typeModuleImport?: string): GeneratedCodegenContent;
+
+interface WriteCodegenOutputOptions {
+    root?: string;
+    out?: string;
+}
+interface CodegenWriteResult {
+    manifestPath: string;
+    typesPath: string;
+    runtimePath: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function resolveCodegenPaths(repoRoot: string, out?: string): {
+    typesPath: string;
+    runtimePath: string;
+    typeImportPath: string;
+};
+declare function writeCodegenOutput(options?: WriteCodegenOutputOptions): Promise<CodegenWriteResult>;
+
+interface WatchSchemaOptions extends WriteCodegenOutputOptions {
+    debounceMs?: number;
+    onWrite?: (result: CodegenWriteResult) => void | Promise<void>;
+    onError?: (error: unknown) => void | Promise<void>;
+}
+interface CnosWatchHandle {
+    close(): void;
+    on(event: 'close', listener: () => void): this;
+}
+declare function watchSchema(options?: WatchSchemaOptions): Promise<CnosWatchHandle>;
+
+interface DriftIssue {
+    key: string;
+    expectedType?: string;
+    actualType?: string;
+    value?: unknown;
+    sourceFile?: string;
+}
+interface DriftReport {
+    profile: string;
+    workspace: string;
+    missing: DriftIssue[];
+    undeclared: DriftIssue[];
+    mismatches: DriftIssue[];
+    defaultsApplied: DriftIssue[];
+}
+declare function compareSchemaToGraph(runtime: CnosRuntime): DriftReport;
+
+declare function formatDriftReport(report: DriftReport): string;
+
+interface EnvMappingProposal {
+    envVar: string;
+    namespace: 'value' | 'secret';
+    logicalPath: string;
+    logicalKey: string;
+    public: boolean;
+    framework?: 'vite' | 'next';
+}
+declare function proposeMapping(envVar: string): EnvMappingProposal;
+
+interface ApplyManifestResult {
+    manifestPath: string;
+    appliedMappings: number;
+    appliedPromotions: number;
+}
+declare function applyManifestMappings(proposals: EnvMappingProposal[], root?: string): Promise<ApplyManifestResult>;
+
+interface EnvUsage {
+    filePath: string;
+    envVar: string;
+    source: string;
+    kind: 'process-env' | 'import-meta-env';
+}
+declare function scanEnvUsage(scanRoot: string): Promise<EnvUsage[]>;
+
+interface RewriteSourceResult {
+    rewrittenFiles: string[];
+    backupFiles: string[];
+    skippedUsages: string[];
+}
+declare function rewriteSourceFiles(usages: EnvUsage[], proposals: Map<string, EnvMappingProposal>): Promise<RewriteSourceResult>;
+
+declare function diffGraphs(previous: ResolvedGraph, next: ResolvedGraph): string[];
+
+interface WatchTargetSet {
+    manifestPath: string;
+    roots: string[];
+    files: string[];
+}
+declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
+
+export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };

package/dist/internal.d.ts

@@ -1,25 +1,207 @@
-import { d as CnosRuntime, V as ValidationSummary } from './plugin-BVNEHj19.js';
-export { i as ValidationIssue, W as WorkspaceFile } from './plugin-BVNEHj19.js';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as VaultDefinition, g as CnosRuntime, m as ValidationSummary, R as ResolvedGraph } from './plugin-CyNkf7Dm.js';
+export { n as ValidationIssue, o as WorkspaceFile } from './plugin-CyNkf7Dm.js';
 
-declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
+declare class CnosError extends Error {
+    constructor(message: string);
+}
+declare class CnosSecurityError extends CnosError {
+    constructor(message: string);
+}
+declare class CnosAuthenticationError extends CnosError {
+    constructor(message: string);
+}
 
-declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
+declare function readKeychain(entry: string): Promise<string | undefined>;
+declare function writeKeychain(entry: string, value: string): Promise<void>;
+
+declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
+
+type ProjectionTarget = 'public' | 'env';
+declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
 interface SecretReference {
     provider: string;
     ref: string;
     vault?: string;
 }
+interface VaultAuthConfig {
+    passphrase?: string;
+    token?: string;
+    derivedKey?: Buffer;
+    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
+    config?: Record<string, unknown>;
+}
+interface SecretVaultProvider {
+    readonly vaultId: string;
+    readonly definition: VaultDefinition;
+    authenticate(authConfig: VaultAuthConfig): Promise<void>;
+    isAuthenticated(): boolean;
+    batchGet(refs: string[]): Promise<Map<string, string>>;
+    get(ref: string): Promise<string | undefined>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+
+declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
+
+declare function writeVaultSessionKey(vault: string, derivedKey: Buffer, processEnv?: Record<string, string | undefined>): Promise<string>;
+declare function clearVaultSessionKey(vault: string, processEnv?: Record<string, string | undefined>): Promise<void>;
+declare function clearAllVaultSessionKeys(processEnv?: Record<string, string | undefined>): Promise<void>;
+
+declare function createSecretVaultProvider(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
+
+declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
+
+declare function resolveManifestRoot(root?: string): Promise<string>;
+declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
+
+interface ResolvedVaultDefinition extends VaultDefinition {
+    name: string;
+    requiresAuthentication: boolean;
+}
+interface VaultMetadata {
+    version: 1;
+    algorithm: 'aes-256-gcm';
+    kdf: 'pbkdf2-sha512';
+    iterations: number;
+    salt: string;
+    createdAt: string;
+    secretCount: number;
+}
+declare function isSecretReference(value: unknown): value is SecretReference;
 declare function resolveSecretStoreRoot(processEnv?: Record<string, string | undefined>): string;
-declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
+declare function getVaultPassphraseEnvVar(vault?: string): string;
+declare function isPassphraseEnvRef(value: string | undefined): boolean;
+declare function getVaultSessionKeyEnvVar(vault?: string): string;
 declare function resolveSecretPassphrase(vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
-declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
+declare function deriveVaultKey(passphrase: string, salt: Buffer, iterations?: number): Buffer;
+declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
+declare function detectLegacyVaultFormat(storeRoot: string, vault?: string): Promise<string | undefined>;
+declare function readVaultMetadata(storeRoot: string, vault?: string): Promise<VaultMetadata | undefined>;
 declare function listSecretVaults(storeRoot: string): Promise<string[]>;
-declare function writeLocalSecret(storeRoot: string, ref: string, value: string, passphrase: string, vault?: string): Promise<string>;
+declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
+declare function resolveConfiguredVaultPassphrase(definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
+declare function resolveVaultAccessKey(storeRoot: string, definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig | undefined>;
+declare function writeLocalSecret(storeRoot: string, ref: string, value: string, authOrPassphrase: VaultAuthConfig | string, vault?: string): Promise<string>;
+declare function deleteLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<boolean>;
+declare function readLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<string>;
+declare function listLocalSecrets(storeRoot: string, auth: VaultAuthConfig, vault?: string): Promise<string[]>;
+declare function resolveVaultDefinition(vaults: Record<string, VaultDefinition> | undefined, vault?: string): ResolvedVaultDefinition;
+declare function removeLocalVaultFiles(storeRoot: string, vault?: string): Promise<void>;
 
 declare function parseYaml<T>(source: string): T;
 declare function stringifyYaml(value: unknown): string;
 
 declare function validateRuntime(runtime: CnosRuntime): Promise<ValidationSummary>;
 
-export { type SecretReference, ValidationSummary, createSecretVault, flattenObject, listSecretVaults, parseYaml, resolveConfigDocumentPath, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, stringifyYaml, validateRuntime, writeLocalSecret };
+declare const CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+declare const CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
+declare const CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
+declare function serializeRuntimeGraph(graph: ResolvedGraph): string;
+declare function deserializeRuntimeGraph(source: string): ResolvedGraph;
+declare function serializeSecretPayload(values: Record<string, unknown>): {
+    payload: string;
+    sessionKey: string;
+};
+declare function readRuntimeGraphFromEnv(processEnv?: Record<string, string | undefined>): ResolvedGraph | undefined;
+declare function graphRequiresSecretHydration(graph: ResolvedGraph): boolean;
+
+interface GeneratedCodegenContent {
+    typesContent: string;
+    runtimeContent: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function generateCodegenContent(manifest: NormalizedManifest, sourcePath: string, typeModuleImport?: string): GeneratedCodegenContent;
+
+interface WriteCodegenOutputOptions {
+    root?: string;
+    out?: string;
+}
+interface CodegenWriteResult {
+    manifestPath: string;
+    typesPath: string;
+    runtimePath: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function resolveCodegenPaths(repoRoot: string, out?: string): {
+    typesPath: string;
+    runtimePath: string;
+    typeImportPath: string;
+};
+declare function writeCodegenOutput(options?: WriteCodegenOutputOptions): Promise<CodegenWriteResult>;
+
+interface WatchSchemaOptions extends WriteCodegenOutputOptions {
+    debounceMs?: number;
+    onWrite?: (result: CodegenWriteResult) => void | Promise<void>;
+    onError?: (error: unknown) => void | Promise<void>;
+}
+interface CnosWatchHandle {
+    close(): void;
+    on(event: 'close', listener: () => void): this;
+}
+declare function watchSchema(options?: WatchSchemaOptions): Promise<CnosWatchHandle>;
+
+interface DriftIssue {
+    key: string;
+    expectedType?: string;
+    actualType?: string;
+    value?: unknown;
+    sourceFile?: string;
+}
+interface DriftReport {
+    profile: string;
+    workspace: string;
+    missing: DriftIssue[];
+    undeclared: DriftIssue[];
+    mismatches: DriftIssue[];
+    defaultsApplied: DriftIssue[];
+}
+declare function compareSchemaToGraph(runtime: CnosRuntime): DriftReport;
+
+declare function formatDriftReport(report: DriftReport): string;
+
+interface EnvMappingProposal {
+    envVar: string;
+    namespace: 'value' | 'secret';
+    logicalPath: string;
+    logicalKey: string;
+    public: boolean;
+    framework?: 'vite' | 'next';
+}
+declare function proposeMapping(envVar: string): EnvMappingProposal;
+
+interface ApplyManifestResult {
+    manifestPath: string;
+    appliedMappings: number;
+    appliedPromotions: number;
+}
+declare function applyManifestMappings(proposals: EnvMappingProposal[], root?: string): Promise<ApplyManifestResult>;
+
+interface EnvUsage {
+    filePath: string;
+    envVar: string;
+    source: string;
+    kind: 'process-env' | 'import-meta-env';
+}
+declare function scanEnvUsage(scanRoot: string): Promise<EnvUsage[]>;
+
+interface RewriteSourceResult {
+    rewrittenFiles: string[];
+    backupFiles: string[];
+    skippedUsages: string[];
+}
+declare function rewriteSourceFiles(usages: EnvUsage[], proposals: Map<string, EnvMappingProposal>): Promise<RewriteSourceResult>;
+
+declare function diffGraphs(previous: ResolvedGraph, next: ResolvedGraph): string[];
+
+interface WatchTargetSet {
+    manifestPath: string;
+    roots: string[];
+    files: string[];
+}
+declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
+
+export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };