@kitsy/cnos 1.10.0 → 1.11.1

package/dist/configure/index.js

@@ -1,19 +1,19 @@
 import {
   createCnos,
   defaultPlugins
-} from "../chunk-CSA4L64V.js";
-import "../chunk-3EZGPQCE.js";
-import "../chunk-RTHKUGJV.js";
-import "../chunk-ESBHCFC6.js";
-import "../chunk-UGLATJJD.js";
-import "../chunk-A5U7EZCJ.js";
-import "../chunk-FHXLOWAB.js";
+} from "../chunk-V3USPV5U.js";
+import "../chunk-DPC2BV3S.js";
+import "../chunk-5JGNRADB.js";
+import "../chunk-NU25VFA2.js";
+import "../chunk-RNTTPI5S.js";
+import "../chunk-2DMCB3PK.js";
+import "../chunk-KJ57PF47.js";
 import {
   planDump,
   toEnv,
   toPublicEnv,
   writeDump
-} from "../chunk-MQ4WG3K6.js";
+} from "../chunk-WPB4HB2K.js";
 export {
   createCnos,
   defaultPlugins,

package/dist/{core-Ud1o2MBn.d.cts → core-CGJObpyy.d.cts}

@@ -87,6 +87,11 @@ interface VaultAuthDefinition {
     token?: VaultAuthSourceConfig;
     config?: Record<string, unknown>;
 }
+interface VaultFallbackDefinition {
+    provider: VaultProviderName;
+    auth?: VaultAuthDefinition;
+    mapping?: Record<string, string>;
+}
 interface NamespaceDefinition {
     kind: NamespaceKind;
     shareable: boolean;
@@ -98,6 +103,7 @@ interface VaultDefinition {
     provider: VaultProviderName;
     auth?: VaultAuthDefinition;
     mapping?: Record<string, string>;
+    fallback?: VaultFallbackDefinition[];
 }
 interface ManifestFile {
     version?: number;
@@ -280,10 +286,28 @@ interface ExporterPlugin extends CnosPlugin {
 }
 
 interface SecretReference {
-    provider: string;
+    provider?: string;
     ref: string;
     vault?: string;
 }
+/** Auth metadata safe to serialize into server projections. */
+interface ProjectedVaultAuthDefinition {
+    method?: VaultAuthConfig['method'];
+    passphrase?: {
+        from: string[];
+    };
+    token?: {
+        from: string[];
+    };
+    config?: Record<string, unknown>;
+}
+/** Vault metadata required by runtimes to hydrate projected secret refs. */
+interface ProjectedVaultDefinition {
+    provider: string;
+    auth?: ProjectedVaultAuthDefinition;
+    mapping?: Record<string, string>;
+    fallback?: ProjectedVaultDefinition[];
+}
 interface VaultAuthConfig {
     passphrase?: string;
     token?: string;
@@ -302,6 +326,17 @@ interface SecretVaultProvider {
     delete(ref: string): Promise<void>;
     list(): Promise<string[]>;
 }
+/** Factory used by runtimes and provider packages to construct vault clients. */
+interface SecretVaultProviderFactory {
+    readonly provider: string;
+    create(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
+}
+interface RemoteSecretVaultProvider extends SecretVaultProvider {
+    healthCheck(): Promise<{
+        ok: boolean;
+        message?: string;
+    }>;
+}
 
 type LogicalKey = string;
 type NamespaceName = string;
@@ -413,6 +448,8 @@ interface CnosCreateOptions {
     plugins?: CnosPlugin[];
     cliArgs?: string[];
     processEnv?: Record<string, string | undefined>;
+    /** Additional secret vault provider factories, usually supplied by provider packages. */
+    secretVaultProviders?: SecretVaultProviderFactory[];
 }
 interface ToEnvOptions {
     includeSecrets?: boolean;
@@ -477,6 +514,7 @@ interface ServerProjection {
     secretRefs: Record<string, SecretReference & {
         envVar?: string;
     }>;
+    vaults?: Record<string, ProjectedVaultDefinition>;
     publicKeys: string[];
     runtimeNamespaces: string[];
     meta: {
@@ -487,4 +525,4 @@ interface ServerProjection {
     };
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ParsedDerivation as P, ResolvedGraph as R, ServerProjection as S, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, DerivedFormula as i, DerivedValue as j, ExprNode as k, RuntimeProvider as l, NamespaceName as m, LoadManifestOptions as n, LoadedManifest as o, NamespaceDefinition as p, VaultDefinition as q, VaultAuthConfig as r, SecretVaultProvider as s, ResolvedRoot as t, RootResolution as u, SecretReference as v, ValidationSummary as w, ValidationIssue as x, WorkspaceFile as y };
+export type { RemoteSecretVaultProvider as A, CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ParsedDerivation as P, ResolvedGraph as R, ServerProjection as S, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, DerivedFormula as i, DerivedValue as j, ExprNode as k, RuntimeProvider as l, NamespaceName as m, LoadManifestOptions as n, LoadedManifest as o, NamespaceDefinition as p, VaultDefinition as q, VaultAuthConfig as r, SecretVaultProviderFactory as s, SecretVaultProvider as t, ResolvedRoot as u, RootResolution as v, SecretReference as w, ValidationSummary as x, ValidationIssue as y, WorkspaceFile as z };

package/dist/{core-Ud1o2MBn.d.ts → core-CGJObpyy.d.ts}

@@ -87,6 +87,11 @@ interface VaultAuthDefinition {
     token?: VaultAuthSourceConfig;
     config?: Record<string, unknown>;
 }
+interface VaultFallbackDefinition {
+    provider: VaultProviderName;
+    auth?: VaultAuthDefinition;
+    mapping?: Record<string, string>;
+}
 interface NamespaceDefinition {
     kind: NamespaceKind;
     shareable: boolean;
@@ -98,6 +103,7 @@ interface VaultDefinition {
     provider: VaultProviderName;
     auth?: VaultAuthDefinition;
     mapping?: Record<string, string>;
+    fallback?: VaultFallbackDefinition[];
 }
 interface ManifestFile {
     version?: number;
@@ -280,10 +286,28 @@ interface ExporterPlugin extends CnosPlugin {
 }
 
 interface SecretReference {
-    provider: string;
+    provider?: string;
     ref: string;
     vault?: string;
 }
+/** Auth metadata safe to serialize into server projections. */
+interface ProjectedVaultAuthDefinition {
+    method?: VaultAuthConfig['method'];
+    passphrase?: {
+        from: string[];
+    };
+    token?: {
+        from: string[];
+    };
+    config?: Record<string, unknown>;
+}
+/** Vault metadata required by runtimes to hydrate projected secret refs. */
+interface ProjectedVaultDefinition {
+    provider: string;
+    auth?: ProjectedVaultAuthDefinition;
+    mapping?: Record<string, string>;
+    fallback?: ProjectedVaultDefinition[];
+}
 interface VaultAuthConfig {
     passphrase?: string;
     token?: string;
@@ -302,6 +326,17 @@ interface SecretVaultProvider {
     delete(ref: string): Promise<void>;
     list(): Promise<string[]>;
 }
+/** Factory used by runtimes and provider packages to construct vault clients. */
+interface SecretVaultProviderFactory {
+    readonly provider: string;
+    create(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
+}
+interface RemoteSecretVaultProvider extends SecretVaultProvider {
+    healthCheck(): Promise<{
+        ok: boolean;
+        message?: string;
+    }>;
+}
 
 type LogicalKey = string;
 type NamespaceName = string;
@@ -413,6 +448,8 @@ interface CnosCreateOptions {
     plugins?: CnosPlugin[];
     cliArgs?: string[];
     processEnv?: Record<string, string | undefined>;
+    /** Additional secret vault provider factories, usually supplied by provider packages. */
+    secretVaultProviders?: SecretVaultProviderFactory[];
 }
 interface ToEnvOptions {
     includeSecrets?: boolean;
@@ -477,6 +514,7 @@ interface ServerProjection {
     secretRefs: Record<string, SecretReference & {
         envVar?: string;
     }>;
+    vaults?: Record<string, ProjectedVaultDefinition>;
     publicKeys: string[];
     runtimeNamespaces: string[];
     meta: {
@@ -487,4 +525,4 @@ interface ServerProjection {
     };
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ParsedDerivation as P, ResolvedGraph as R, ServerProjection as S, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, DerivedFormula as i, DerivedValue as j, ExprNode as k, RuntimeProvider as l, NamespaceName as m, LoadManifestOptions as n, LoadedManifest as o, NamespaceDefinition as p, VaultDefinition as q, VaultAuthConfig as r, SecretVaultProvider as s, ResolvedRoot as t, RootResolution as u, SecretReference as v, ValidationSummary as w, ValidationIssue as x, WorkspaceFile as y };
+export type { RemoteSecretVaultProvider as A, CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ParsedDerivation as P, ResolvedGraph as R, ServerProjection as S, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, DerivedFormula as i, DerivedValue as j, ExprNode as k, RuntimeProvider as l, NamespaceName as m, LoadManifestOptions as n, LoadedManifest as o, NamespaceDefinition as p, VaultDefinition as q, VaultAuthConfig as r, SecretVaultProviderFactory as s, SecretVaultProvider as t, ResolvedRoot as u, RootResolution as v, SecretReference as w, ValidationSummary as x, ValidationIssue as y, WorkspaceFile as z };

package/dist/{envNaming-DxxqiGKN.d.cts → envNaming-DIaBgT6E.d.cts}

@@ -1,4 +1,4 @@
-import { N as NormalizedManifest, b as LogicalKey } from './core-Ud1o2MBn.cjs';
+import { N as NormalizedManifest, b as LogicalKey } from './core-CGJObpyy.cjs';
 
 interface EnvMappingConfig {
     convention?: NormalizedManifest['envMapping']['convention'];

package/dist/{envNaming-CPwXl4I6.d.ts → envNaming-_WD9sLZI.d.ts}

@@ -1,4 +1,4 @@
-import { N as NormalizedManifest, b as LogicalKey } from './core-Ud1o2MBn.js';
+import { N as NormalizedManifest, b as LogicalKey } from './core-CGJObpyy.js';
 
 interface EnvMappingConfig {
     convention?: NormalizedManifest['envMapping']['convention'];