@kitsy/cnos 1.3.0 → 1.5.0

package/dist/internal.d.cts

@@ -1,5 +1,5 @@
-import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as VaultDefinition, g as CnosRuntime, m as ValidationSummary, R as ResolvedGraph } from './plugin-CyNkf7Dm.cjs';
-export { n as ValidationIssue, o as WorkspaceFile } from './plugin-CyNkf7Dm.cjs';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, i as NamespaceName, g as CnosRuntime, n as ValidationSummary, R as ResolvedGraph } from './plugin-B4xwySxw.cjs';
+export { o as ValidationIssue, p as WorkspaceFile } from './plugin-B4xwySxw.cjs';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -17,6 +17,7 @@ declare function writeKeychain(entry: string, value: string): Promise<void>;
 declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
 
 type ProjectionTarget = 'public' | 'env';
+declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
 declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
 interface SecretReference {
@@ -54,7 +55,7 @@ declare function createSecretVaultProvider(vaultId: string, definition: VaultDef
 declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 
 declare function resolveManifestRoot(root?: string): Promise<string>;
-declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
+declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: NamespaceName, configPath: string, profile?: string): string;
 
 interface ResolvedVaultDefinition extends VaultDefinition {
     name: string;
@@ -204,4 +205,4 @@ interface WatchTargetSet {
 }
 declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };
+export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };

package/dist/internal.d.ts

@@ -1,5 +1,5 @@
-import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as VaultDefinition, g as CnosRuntime, m as ValidationSummary, R as ResolvedGraph } from './plugin-CyNkf7Dm.js';
-export { n as ValidationIssue, o as WorkspaceFile } from './plugin-CyNkf7Dm.js';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, i as NamespaceName, g as CnosRuntime, n as ValidationSummary, R as ResolvedGraph } from './plugin-B4xwySxw.js';
+export { o as ValidationIssue, p as WorkspaceFile } from './plugin-B4xwySxw.js';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -17,6 +17,7 @@ declare function writeKeychain(entry: string, value: string): Promise<void>;
 declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
 
 type ProjectionTarget = 'public' | 'env';
+declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
 declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
 interface SecretReference {
@@ -54,7 +55,7 @@ declare function createSecretVaultProvider(vaultId: string, definition: VaultDef
 declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 
 declare function resolveManifestRoot(root?: string): Promise<string>;
-declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: 'value' | 'secret', configPath: string, profile?: string): string;
+declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: NamespaceName, configPath: string, profile?: string): string;
 
 interface ResolvedVaultDefinition extends VaultDefinition {
     name: string;
@@ -204,4 +205,4 @@ interface WatchTargetSet {
 }
 declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };
+export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };

package/dist/internal.js

@@ -7,7 +7,7 @@ import {
   readRuntimeGraphFromEnv,
   serializeRuntimeGraph,
   serializeSecretPayload
-} from "./chunk-K6QYI2T4.js";
+} from "./chunk-EQSKV3DP.js";
 import {
   CnosAuthenticationError,
   CnosSecurityError,
@@ -20,6 +20,7 @@ import {
   detectLegacyVaultFormat,
   ensureProjectionAllowed,
   flattenObject,
+  getNamespaceDefinition,
   getVaultPassphraseEnvVar,
   getVaultSessionKeyEnvVar,
   isPassphraseEnvRef,
@@ -46,7 +47,7 @@ import {
   writeKeychain,
   writeLocalSecret,
   writeVaultSessionKey
-} from "./chunk-DRKDNY4I.js";
+} from "./chunk-APIU4GTB.js";
 
 // src/codegen/generateTypes.ts
 function toPascalCase(value) {
@@ -279,6 +280,9 @@ function isSchemaDefault(entry) {
 function shouldTrackKey(key) {
   return key.startsWith("value.") || key.startsWith("secret.");
 }
+function isTransientRuntimeSource(entry) {
+  return entry.winner.sourceId === "process-env" || entry.winner.sourceId === "cli-args";
+}
 function compareSchemaToGraph(runtime) {
   const schema = runtime.manifest.schema;
   const missing = [];
@@ -318,7 +322,9 @@ function compareSchemaToGraph(runtime) {
       });
     }
   }
-  const undeclared = Array.from(runtime.graph.entries.values()).filter((entry) => shouldTrackKey(entry.key) && !schema[entry.key] && !isSchemaDefault(entry)).map((entry) => {
+  const undeclared = Array.from(runtime.graph.entries.values()).filter(
+    (entry) => shouldTrackKey(entry.key) && !schema[entry.key] && !isSchemaDefault(entry) && !isTransientRuntimeSource(entry)
+  ).map((entry) => {
     const issue = {
       key: entry.key,
       value: entry.winner.value,
@@ -652,6 +658,7 @@ export {
   flattenObject,
   formatDriftReport,
   generateCodegenContent,
+  getNamespaceDefinition,
   getVaultPassphraseEnvVar,
   getVaultSessionKeyEnvVar,
   graphRequiresSecretHydration,

package/dist/plugin/basic-schema.d.cts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../plugin-CyNkf7Dm.cjs';
+import { V as ValidatorPlugin } from '../plugin-B4xwySxw.cjs';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.d.ts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../plugin-CyNkf7Dm.js';
+import { V as ValidatorPlugin } from '../plugin-B4xwySxw.js';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-JDII6O72.js";
-import "../chunk-DRKDNY4I.js";
+} from "../chunk-FWJC4Y2D.js";
+import "../chunk-APIU4GTB.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.d.cts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-CyNkf7Dm.cjs';
+import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-B4xwySxw.cjs';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.d.ts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-CyNkf7Dm.js';
+import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-B4xwySxw.js';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-OWUZQ4OH.js";
-import "../chunk-DRKDNY4I.js";
+} from "../chunk-ZTPSFXWP.js";
+import "../chunk-APIU4GTB.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CyNkf7Dm.cjs';
-import { E as EnvMappingConfig } from '../envNaming-D6k66myh.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.cjs';
+import { E as EnvMappingConfig } from '../envNaming-S4B-dHUx.cjs';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CyNkf7Dm.js';
-import { E as EnvMappingConfig } from '../envNaming-Dy3WYiGK.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.js';
+import { E as EnvMappingConfig } from '../envNaming-Dvm_LP2D.js';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-QTKXPY3N.js";
-import "../chunk-DRKDNY4I.js";
+} from "../chunk-HMM76UYZ.js";
+import "../chunk-APIU4GTB.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.d.cts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-CyNkf7Dm.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-Cz72m6y0.cjs';
+import { E as ExporterPlugin } from '../plugin-B4xwySxw.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-ggmphZFs.cjs';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.d.ts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-CyNkf7Dm.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-D2PZkaN-.js';
+import { E as ExporterPlugin } from '../plugin-B4xwySxw.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CvhGAfsB.js';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-OOKFRWTN.js";
+} from "../chunk-J4K4JUJL.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-DRKDNY4I.js";
+} from "../chunk-APIU4GTB.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.cjs

@@ -282,11 +282,30 @@ function createFilesystemValuesPlugin() {
         sourceRoot,
         context.profileActivation.values
       );
+      const customNamespaces = Object.entries(context.manifest.namespaces).filter(
+        ([namespace, definition]) => namespace !== "value" && namespace !== "secret" && definition.kind === "data" && !definition.sensitive
+      ).map(([namespace]) => namespace);
       const entries = [];
       for (const file of files) {
         const document = await (0, import_promises12.readFile)(file.absolutePath, "utf8");
         entries.push(...filesystemValuesReader(file.relativePath, document, file.workspaceId));
       }
+      for (const namespace of customNamespaces) {
+        const layers = [
+          namespace,
+          ...context.profileChain.filter((profile) => profile !== "base").map((profile) => `profiles/${profile}/${namespace}`)
+        ];
+        const namespaceFiles = await collectFilesystemLayerFiles(
+          context.manifestRoot,
+          context.workspace.workspaceRoots,
+          sourceRoot,
+          layers
+        );
+        for (const file of namespaceFiles) {
+          const document = await (0, import_promises12.readFile)(file.absolutePath, "utf8");
+          entries.push(...yamlObjectToEntries(document, file.relativePath, namespace, "filesystem-values", file.workspaceId));
+        }
+      }
       return entries;
     }
   };

package/dist/plugin/filesystem.d.cts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-CyNkf7Dm.cjs';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-B4xwySxw.cjs';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.d.ts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-CyNkf7Dm.js';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-B4xwySxw.js';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-FC3IV6A7.js";
-import "../chunk-DRKDNY4I.js";
+} from "../chunk-T6Y57KTT.js";
+import "../chunk-APIU4GTB.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.cjs

@@ -31,7 +31,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var process_env_exports = {};
 __export(process_env_exports, {
   createProcessEnvPlugin: () => createProcessEnvPlugin,
-  processEnvEntriesFromObject: () => processEnvEntriesFromObject
+  processEnvEntriesFromObject: () => processEnvEntriesFromObject,
+  processNamespaceEntriesFromContext: () => processNamespaceEntriesFromContext
 });
 module.exports = __toCommonJS(process_env_exports);
 
@@ -129,6 +130,11 @@ function envVarToLogicalKey(envVar, config = {}) {
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";
+var PROCESS_GRAPH_OMIT = /* @__PURE__ */ new Set([
+  "__CNOS_GRAPH__",
+  "__CNOS_SECRET_PAYLOAD__",
+  "__CNOS_SESSION_KEY__"
+]);
 function processEnvEntriesFromObject(env, mapping = {}, workspaceId = "default") {
   return Object.entries(env).flatMap(([envVar, value]) => {
     if (typeof value !== "string") {
@@ -153,22 +159,83 @@ function processEnvEntriesFromObject(env, mapping = {}, workspaceId = "default")
     ];
   });
 }
+function processNamespaceEntriesFromContext(env, workspaceId = "default") {
+  const envEntries = Object.entries(env).filter((entry) => typeof entry[1] === "string").filter(([envVar]) => !PROCESS_GRAPH_OMIT.has(envVar)).map(([envVar, value]) => ({
+    key: `process.env.${envVar}`,
+    value,
+    namespace: "process",
+    sourceId: "process-runtime",
+    pluginId: PROCESS_ENV_PLUGIN_ID,
+    workspaceId,
+    origin: {
+      envVar
+    }
+  }));
+  const runtimeEntries = [
+    {
+      key: "process.cwd",
+      value: process.cwd(),
+      namespace: "process",
+      sourceId: "process-runtime",
+      pluginId: PROCESS_ENV_PLUGIN_ID,
+      workspaceId
+    },
+    {
+      key: "process.platform",
+      value: process.platform,
+      namespace: "process",
+      sourceId: "process-runtime",
+      pluginId: PROCESS_ENV_PLUGIN_ID,
+      workspaceId
+    },
+    {
+      key: "process.arch",
+      value: process.arch,
+      namespace: "process",
+      sourceId: "process-runtime",
+      pluginId: PROCESS_ENV_PLUGIN_ID,
+      workspaceId
+    },
+    {
+      key: "process.node.version",
+      value: process.version,
+      namespace: "process",
+      sourceId: "process-runtime",
+      pluginId: PROCESS_ENV_PLUGIN_ID,
+      workspaceId
+    },
+    {
+      key: "process.args.raw",
+      value: process.argv.slice(2),
+      namespace: "process",
+      sourceId: "process-runtime",
+      pluginId: PROCESS_ENV_PLUGIN_ID,
+      workspaceId
+    }
+  ];
+  return [...runtimeEntries, ...envEntries];
+}
 function createProcessEnvPlugin() {
   return {
     id: "process-env",
     kind: "loader",
     async load(context) {
       const config = context.manifestConfig;
-      return processEnvEntriesFromObject(
-        context.processEnv ?? process.env,
-        config.envMapping,
-        context.workspace.workspaceId
-      );
+      const env = context.processEnv ?? process.env;
+      return [
+        ...processEnvEntriesFromObject(
+          env,
+          config.envMapping,
+          context.workspace.workspaceId
+        ),
+        ...processNamespaceEntriesFromContext(env, context.workspace.workspaceId)
+      ];
     }
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createProcessEnvPlugin,
-  processEnvEntriesFromObject
+  processEnvEntriesFromObject,
+  processNamespaceEntriesFromContext
 });

package/dist/plugin/process-env.d.cts

@@ -1,7 +1,8 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CyNkf7Dm.cjs';
-import { E as EnvMappingConfig } from '../envNaming-D6k66myh.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.cjs';
+import { E as EnvMappingConfig } from '../envNaming-S4B-dHUx.cjs';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
+declare function processNamespaceEntriesFromContext(env: Record<string, string | undefined>, workspaceId?: string): ConfigEntry[];
 declare function createProcessEnvPlugin(): LoaderPlugin;
 
-export { createProcessEnvPlugin, processEnvEntriesFromObject };
+export { createProcessEnvPlugin, processEnvEntriesFromObject, processNamespaceEntriesFromContext };

package/dist/plugin/process-env.d.ts

@@ -1,7 +1,8 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CyNkf7Dm.js';
-import { E as EnvMappingConfig } from '../envNaming-Dy3WYiGK.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.js';
+import { E as EnvMappingConfig } from '../envNaming-Dvm_LP2D.js';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
+declare function processNamespaceEntriesFromContext(env: Record<string, string | undefined>, workspaceId?: string): ConfigEntry[];
 declare function createProcessEnvPlugin(): LoaderPlugin;
 
-export { createProcessEnvPlugin, processEnvEntriesFromObject };
+export { createProcessEnvPlugin, processEnvEntriesFromObject, processNamespaceEntriesFromContext };

package/dist/plugin/process-env.js

@@ -1,9 +1,11 @@
 import {
   createProcessEnvPlugin,
-  processEnvEntriesFromObject
-} from "../chunk-CDXJISGB.js";
-import "../chunk-DRKDNY4I.js";
+  processEnvEntriesFromObject,
+  processNamespaceEntriesFromContext
+} from "../chunk-WCHX2QFY.js";
+import "../chunk-APIU4GTB.js";
 export {
   createProcessEnvPlugin,
-  processEnvEntriesFromObject
+  processEnvEntriesFromObject,
+  processNamespaceEntriesFromContext
 };

package/dist/{plugin-CyNkf7Dm.d.cts → plugin-B4xwySxw.d.cts}

@@ -295,6 +295,7 @@ interface CnosPlugin {
     kind: CnosPluginKind;
 }
 interface LoaderContext {
+    manifest: NormalizedManifest;
     manifestConfig: Record<string, unknown>;
     profile: string;
     profileChain: string[];
@@ -346,4 +347,4 @@ interface ExporterPlugin extends CnosPlugin {
     export(graph: ResolvedGraph, context: ExportContext): Promise<ExportResult>;
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, VaultDefinition as l, ValidationSummary as m, ValidationIssue as n, WorkspaceFile as o };
+export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, NamespaceDefinition as l, VaultDefinition as m, ValidationSummary as n, ValidationIssue as o, WorkspaceFile as p };

package/dist/{plugin-CyNkf7Dm.d.ts → plugin-B4xwySxw.d.ts}

@@ -295,6 +295,7 @@ interface CnosPlugin {
     kind: CnosPluginKind;
 }
 interface LoaderContext {
+    manifest: NormalizedManifest;
     manifestConfig: Record<string, unknown>;
     profile: string;
     profileChain: string[];
@@ -346,4 +347,4 @@ interface ExporterPlugin extends CnosPlugin {
     export(graph: ResolvedGraph, context: ExportContext): Promise<ExportResult>;
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, VaultDefinition as l, ValidationSummary as m, ValidationIssue as n, WorkspaceFile as o };
+export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, NamespaceDefinition as l, VaultDefinition as m, ValidationSummary as n, ValidationIssue as o, WorkspaceFile as p };