@kitsy/cnos 1.2.0 → 1.4.0

package/dist/internal.d.cts

@@ -1,5 +1,5 @@
-import { i as LoadManifestOptions, j as LoadedManifest, N as NormalizedManifest, g as LogicalKey, V as VaultDefinition, d as CnosRuntime, k as ValidationSummary, R as ResolvedGraph } from './plugin-DkOIT5uI.cjs';
-export { l as ValidationIssue, W as WorkspaceFile } from './plugin-DkOIT5uI.cjs';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, i as NamespaceName, g as CnosRuntime, n as ValidationSummary, R as ResolvedGraph } from './plugin-B4xwySxw.cjs';
+export { o as ValidationIssue, p as WorkspaceFile } from './plugin-B4xwySxw.cjs';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -7,36 +7,89 @@ declare class CnosError extends Error {
 declare class CnosSecurityError extends CnosError {
     constructor(message: string);
 }
+declare class CnosAuthenticationError extends CnosError {
+    constructor(message: string);
+}
+
+declare function readKeychain(entry: string): Promise<string | undefined>;
+declare function writeKeychain(entry: string, value: string): Promise<void>;
 
 declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
 
 type ProjectionTarget = 'public' | 'env';
+declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
 declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
-declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
-
-declare function resolveManifestRoot(root?: string): Promise<string>;
-declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
-
 interface SecretReference {
     provider: string;
     ref: string;
     vault?: string;
 }
+interface VaultAuthConfig {
+    passphrase?: string;
+    token?: string;
+    derivedKey?: Buffer;
+    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
+    config?: Record<string, unknown>;
+}
+interface SecretVaultProvider {
+    readonly vaultId: string;
+    readonly definition: VaultDefinition;
+    authenticate(authConfig: VaultAuthConfig): Promise<void>;
+    isAuthenticated(): boolean;
+    batchGet(refs: string[]): Promise<Map<string, string>>;
+    get(ref: string): Promise<string | undefined>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+
+declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
+
+declare function writeVaultSessionKey(vault: string, derivedKey: Buffer, processEnv?: Record<string, string | undefined>): Promise<string>;
+declare function clearVaultSessionKey(vault: string, processEnv?: Record<string, string | undefined>): Promise<void>;
+declare function clearAllVaultSessionKeys(processEnv?: Record<string, string | undefined>): Promise<void>;
+
+declare function createSecretVaultProvider(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
+
+declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
+
+declare function resolveManifestRoot(root?: string): Promise<string>;
+declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: NamespaceName, configPath: string, profile?: string): string;
+
 interface ResolvedVaultDefinition extends VaultDefinition {
     name: string;
-    requiresPassphrase: boolean;
+    requiresAuthentication: boolean;
+}
+interface VaultMetadata {
+    version: 1;
+    algorithm: 'aes-256-gcm';
+    kdf: 'pbkdf2-sha512';
+    iterations: number;
+    salt: string;
+    createdAt: string;
+    secretCount: number;
 }
+declare function isSecretReference(value: unknown): value is SecretReference;
 declare function resolveSecretStoreRoot(processEnv?: Record<string, string | undefined>): string;
-declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
-declare function resolveSecretPassphrase(vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
 declare function getVaultPassphraseEnvVar(vault?: string): string;
 declare function isPassphraseEnvRef(value: string | undefined): boolean;
+declare function getVaultSessionKeyEnvVar(vault?: string): string;
+declare function resolveSecretPassphrase(vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
+declare function deriveVaultKey(passphrase: string, salt: Buffer, iterations?: number): Buffer;
+declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
+declare function detectLegacyVaultFormat(storeRoot: string, vault?: string): Promise<string | undefined>;
+declare function readVaultMetadata(storeRoot: string, vault?: string): Promise<VaultMetadata | undefined>;
+declare function listSecretVaults(storeRoot: string): Promise<string[]>;
+declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
 declare function resolveConfiguredVaultPassphrase(definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
+declare function resolveVaultAccessKey(storeRoot: string, definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig | undefined>;
+declare function writeLocalSecret(storeRoot: string, ref: string, value: string, authOrPassphrase: VaultAuthConfig | string, vault?: string): Promise<string>;
+declare function deleteLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<boolean>;
+declare function readLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<string>;
+declare function listLocalSecrets(storeRoot: string, auth: VaultAuthConfig, vault?: string): Promise<string[]>;
 declare function resolveVaultDefinition(vaults: Record<string, VaultDefinition> | undefined, vault?: string): ResolvedVaultDefinition;
-declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
-declare function listSecretVaults(storeRoot: string): Promise<string[]>;
-declare function writeLocalSecret(storeRoot: string, ref: string, value: string, passphrase: string, vault?: string): Promise<string>;
+declare function removeLocalVaultFiles(storeRoot: string, vault?: string): Promise<void>;
 
 declare function parseYaml<T>(source: string): T;
 declare function stringifyYaml(value: unknown): string;
@@ -44,8 +97,112 @@ declare function stringifyYaml(value: unknown): string;
 declare function validateRuntime(runtime: CnosRuntime): Promise<ValidationSummary>;
 
 declare const CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+declare const CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
+declare const CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
 declare function serializeRuntimeGraph(graph: ResolvedGraph): string;
 declare function deserializeRuntimeGraph(source: string): ResolvedGraph;
+declare function serializeSecretPayload(values: Record<string, unknown>): {
+    payload: string;
+    sessionKey: string;
+};
 declare function readRuntimeGraphFromEnv(processEnv?: Record<string, string | undefined>): ResolvedGraph | undefined;
+declare function graphRequiresSecretHydration(graph: ResolvedGraph): boolean;
+
+interface GeneratedCodegenContent {
+    typesContent: string;
+    runtimeContent: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function generateCodegenContent(manifest: NormalizedManifest, sourcePath: string, typeModuleImport?: string): GeneratedCodegenContent;
+
+interface WriteCodegenOutputOptions {
+    root?: string;
+    out?: string;
+}
+interface CodegenWriteResult {
+    manifestPath: string;
+    typesPath: string;
+    runtimePath: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function resolveCodegenPaths(repoRoot: string, out?: string): {
+    typesPath: string;
+    runtimePath: string;
+    typeImportPath: string;
+};
+declare function writeCodegenOutput(options?: WriteCodegenOutputOptions): Promise<CodegenWriteResult>;
+
+interface WatchSchemaOptions extends WriteCodegenOutputOptions {
+    debounceMs?: number;
+    onWrite?: (result: CodegenWriteResult) => void | Promise<void>;
+    onError?: (error: unknown) => void | Promise<void>;
+}
+interface CnosWatchHandle {
+    close(): void;
+    on(event: 'close', listener: () => void): this;
+}
+declare function watchSchema(options?: WatchSchemaOptions): Promise<CnosWatchHandle>;
+
+interface DriftIssue {
+    key: string;
+    expectedType?: string;
+    actualType?: string;
+    value?: unknown;
+    sourceFile?: string;
+}
+interface DriftReport {
+    profile: string;
+    workspace: string;
+    missing: DriftIssue[];
+    undeclared: DriftIssue[];
+    mismatches: DriftIssue[];
+    defaultsApplied: DriftIssue[];
+}
+declare function compareSchemaToGraph(runtime: CnosRuntime): DriftReport;
+
+declare function formatDriftReport(report: DriftReport): string;
+
+interface EnvMappingProposal {
+    envVar: string;
+    namespace: 'value' | 'secret';
+    logicalPath: string;
+    logicalKey: string;
+    public: boolean;
+    framework?: 'vite' | 'next';
+}
+declare function proposeMapping(envVar: string): EnvMappingProposal;
+
+interface ApplyManifestResult {
+    manifestPath: string;
+    appliedMappings: number;
+    appliedPromotions: number;
+}
+declare function applyManifestMappings(proposals: EnvMappingProposal[], root?: string): Promise<ApplyManifestResult>;
+
+interface EnvUsage {
+    filePath: string;
+    envVar: string;
+    source: string;
+    kind: 'process-env' | 'import-meta-env';
+}
+declare function scanEnvUsage(scanRoot: string): Promise<EnvUsage[]>;
+
+interface RewriteSourceResult {
+    rewrittenFiles: string[];
+    backupFiles: string[];
+    skippedUsages: string[];
+}
+declare function rewriteSourceFiles(usages: EnvUsage[], proposals: Map<string, EnvMappingProposal>): Promise<RewriteSourceResult>;
+
+declare function diffGraphs(previous: ResolvedGraph, next: ResolvedGraph): string[];
+
+interface WatchTargetSet {
+    manifestPath: string;
+    roots: string[];
+    files: string[];
+}
+declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, createSecretVault, deserializeRuntimeGraph, ensureProjectionAllowed, flattenObject, getVaultPassphraseEnvVar, isPassphraseEnvRef, listSecretVaults, loadManifest, parseYaml, readRuntimeGraphFromEnv, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultDefinition, serializeRuntimeGraph, stringifyYaml, validateRuntime, writeLocalSecret };
+export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };

package/dist/internal.d.ts

@@ -1,5 +1,5 @@
-import { i as LoadManifestOptions, j as LoadedManifest, N as NormalizedManifest, g as LogicalKey, V as VaultDefinition, d as CnosRuntime, k as ValidationSummary, R as ResolvedGraph } from './plugin-DkOIT5uI.js';
-export { l as ValidationIssue, W as WorkspaceFile } from './plugin-DkOIT5uI.js';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, i as NamespaceName, g as CnosRuntime, n as ValidationSummary, R as ResolvedGraph } from './plugin-B4xwySxw.js';
+export { o as ValidationIssue, p as WorkspaceFile } from './plugin-B4xwySxw.js';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -7,36 +7,89 @@ declare class CnosError extends Error {
 declare class CnosSecurityError extends CnosError {
     constructor(message: string);
 }
+declare class CnosAuthenticationError extends CnosError {
+    constructor(message: string);
+}
+
+declare function readKeychain(entry: string): Promise<string | undefined>;
+declare function writeKeychain(entry: string, value: string): Promise<void>;
 
 declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
 
 type ProjectionTarget = 'public' | 'env';
+declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
 declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
-declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
-
-declare function resolveManifestRoot(root?: string): Promise<string>;
-declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
-
 interface SecretReference {
     provider: string;
     ref: string;
     vault?: string;
 }
+interface VaultAuthConfig {
+    passphrase?: string;
+    token?: string;
+    derivedKey?: Buffer;
+    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
+    config?: Record<string, unknown>;
+}
+interface SecretVaultProvider {
+    readonly vaultId: string;
+    readonly definition: VaultDefinition;
+    authenticate(authConfig: VaultAuthConfig): Promise<void>;
+    isAuthenticated(): boolean;
+    batchGet(refs: string[]): Promise<Map<string, string>>;
+    get(ref: string): Promise<string | undefined>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+
+declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
+
+declare function writeVaultSessionKey(vault: string, derivedKey: Buffer, processEnv?: Record<string, string | undefined>): Promise<string>;
+declare function clearVaultSessionKey(vault: string, processEnv?: Record<string, string | undefined>): Promise<void>;
+declare function clearAllVaultSessionKeys(processEnv?: Record<string, string | undefined>): Promise<void>;
+
+declare function createSecretVaultProvider(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): SecretVaultProvider;
+
+declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
+
+declare function resolveManifestRoot(root?: string): Promise<string>;
+declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: NamespaceName, configPath: string, profile?: string): string;
+
 interface ResolvedVaultDefinition extends VaultDefinition {
     name: string;
-    requiresPassphrase: boolean;
+    requiresAuthentication: boolean;
+}
+interface VaultMetadata {
+    version: 1;
+    algorithm: 'aes-256-gcm';
+    kdf: 'pbkdf2-sha512';
+    iterations: number;
+    salt: string;
+    createdAt: string;
+    secretCount: number;
 }
+declare function isSecretReference(value: unknown): value is SecretReference;
 declare function resolveSecretStoreRoot(processEnv?: Record<string, string | undefined>): string;
-declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
-declare function resolveSecretPassphrase(vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
 declare function getVaultPassphraseEnvVar(vault?: string): string;
 declare function isPassphraseEnvRef(value: string | undefined): boolean;
+declare function getVaultSessionKeyEnvVar(vault?: string): string;
+declare function resolveSecretPassphrase(vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
+declare function deriveVaultKey(passphrase: string, salt: Buffer, iterations?: number): Buffer;
+declare function resolveSecretVaultFile(storeRoot: string, vault?: string): string;
+declare function detectLegacyVaultFormat(storeRoot: string, vault?: string): Promise<string | undefined>;
+declare function readVaultMetadata(storeRoot: string, vault?: string): Promise<VaultMetadata | undefined>;
+declare function listSecretVaults(storeRoot: string): Promise<string[]>;
+declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
 declare function resolveConfiguredVaultPassphrase(definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): string | undefined;
+declare function resolveVaultAccessKey(storeRoot: string, definition: VaultDefinition | undefined, vault?: string, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig | undefined>;
+declare function writeLocalSecret(storeRoot: string, ref: string, value: string, authOrPassphrase: VaultAuthConfig | string, vault?: string): Promise<string>;
+declare function deleteLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<boolean>;
+declare function readLocalSecret(storeRoot: string, ref: string, auth: VaultAuthConfig, vault?: string): Promise<string>;
+declare function listLocalSecrets(storeRoot: string, auth: VaultAuthConfig, vault?: string): Promise<string[]>;
 declare function resolveVaultDefinition(vaults: Record<string, VaultDefinition> | undefined, vault?: string): ResolvedVaultDefinition;
-declare function createSecretVault(storeRoot: string, vault: string, passphrase: string): Promise<string>;
-declare function listSecretVaults(storeRoot: string): Promise<string[]>;
-declare function writeLocalSecret(storeRoot: string, ref: string, value: string, passphrase: string, vault?: string): Promise<string>;
+declare function removeLocalVaultFiles(storeRoot: string, vault?: string): Promise<void>;
 
 declare function parseYaml<T>(source: string): T;
 declare function stringifyYaml(value: unknown): string;
@@ -44,8 +97,112 @@ declare function stringifyYaml(value: unknown): string;
 declare function validateRuntime(runtime: CnosRuntime): Promise<ValidationSummary>;
 
 declare const CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+declare const CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
+declare const CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
 declare function serializeRuntimeGraph(graph: ResolvedGraph): string;
 declare function deserializeRuntimeGraph(source: string): ResolvedGraph;
+declare function serializeSecretPayload(values: Record<string, unknown>): {
+    payload: string;
+    sessionKey: string;
+};
 declare function readRuntimeGraphFromEnv(processEnv?: Record<string, string | undefined>): ResolvedGraph | undefined;
+declare function graphRequiresSecretHydration(graph: ResolvedGraph): boolean;
+
+interface GeneratedCodegenContent {
+    typesContent: string;
+    runtimeContent: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function generateCodegenContent(manifest: NormalizedManifest, sourcePath: string, typeModuleImport?: string): GeneratedCodegenContent;
+
+interface WriteCodegenOutputOptions {
+    root?: string;
+    out?: string;
+}
+interface CodegenWriteResult {
+    manifestPath: string;
+    typesPath: string;
+    runtimePath: string;
+    schemaEntryCount: number;
+    hasSchema: boolean;
+}
+declare function resolveCodegenPaths(repoRoot: string, out?: string): {
+    typesPath: string;
+    runtimePath: string;
+    typeImportPath: string;
+};
+declare function writeCodegenOutput(options?: WriteCodegenOutputOptions): Promise<CodegenWriteResult>;
+
+interface WatchSchemaOptions extends WriteCodegenOutputOptions {
+    debounceMs?: number;
+    onWrite?: (result: CodegenWriteResult) => void | Promise<void>;
+    onError?: (error: unknown) => void | Promise<void>;
+}
+interface CnosWatchHandle {
+    close(): void;
+    on(event: 'close', listener: () => void): this;
+}
+declare function watchSchema(options?: WatchSchemaOptions): Promise<CnosWatchHandle>;
+
+interface DriftIssue {
+    key: string;
+    expectedType?: string;
+    actualType?: string;
+    value?: unknown;
+    sourceFile?: string;
+}
+interface DriftReport {
+    profile: string;
+    workspace: string;
+    missing: DriftIssue[];
+    undeclared: DriftIssue[];
+    mismatches: DriftIssue[];
+    defaultsApplied: DriftIssue[];
+}
+declare function compareSchemaToGraph(runtime: CnosRuntime): DriftReport;
+
+declare function formatDriftReport(report: DriftReport): string;
+
+interface EnvMappingProposal {
+    envVar: string;
+    namespace: 'value' | 'secret';
+    logicalPath: string;
+    logicalKey: string;
+    public: boolean;
+    framework?: 'vite' | 'next';
+}
+declare function proposeMapping(envVar: string): EnvMappingProposal;
+
+interface ApplyManifestResult {
+    manifestPath: string;
+    appliedMappings: number;
+    appliedPromotions: number;
+}
+declare function applyManifestMappings(proposals: EnvMappingProposal[], root?: string): Promise<ApplyManifestResult>;
+
+interface EnvUsage {
+    filePath: string;
+    envVar: string;
+    source: string;
+    kind: 'process-env' | 'import-meta-env';
+}
+declare function scanEnvUsage(scanRoot: string): Promise<EnvUsage[]>;
+
+interface RewriteSourceResult {
+    rewrittenFiles: string[];
+    backupFiles: string[];
+    skippedUsages: string[];
+}
+declare function rewriteSourceFiles(usages: EnvUsage[], proposals: Map<string, EnvMappingProposal>): Promise<RewriteSourceResult>;
+
+declare function diffGraphs(previous: ResolvedGraph, next: ResolvedGraph): string[];
+
+interface WatchTargetSet {
+    manifestPath: string;
+    roots: string[];
+    files: string[];
+}
+declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, createSecretVault, deserializeRuntimeGraph, ensureProjectionAllowed, flattenObject, getVaultPassphraseEnvVar, isPassphraseEnvRef, listSecretVaults, loadManifest, parseYaml, readRuntimeGraphFromEnv, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultDefinition, serializeRuntimeGraph, stringifyYaml, validateRuntime, writeLocalSecret };
+export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };