@kitsy/cnos 1.5.0 → 1.6.0

package/dist/{chunk-WCHX2QFY.js → chunk-UJBQS7CJ.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-APIU4GTB.js";
+} from "./chunk-S7H2UULC.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";

package/dist/{chunk-RYGSG3GR.js → chunk-UOKVLCFL.js}

@@ -1,27 +1,27 @@
+import {
+  createDotenvPlugin
+} from "./chunk-BMAD24KC.js";
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-J4K4JUJL.js";
+} from "./chunk-VGZREX5D.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-T6Y57KTT.js";
+} from "./chunk-UR7CHHNN.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-WCHX2QFY.js";
+} from "./chunk-UJBQS7CJ.js";
 import {
   createBasicSchemaPlugin
-} from "./chunk-FWJC4Y2D.js";
+} from "./chunk-MW4OVAT3.js";
 import {
   createCliArgsPlugin
-} from "./chunk-ZTPSFXWP.js";
-import {
-  createDotenvPlugin
-} from "./chunk-HMM76UYZ.js";
+} from "./chunk-JYWQFMW5.js";
 import {
   createCnos,
   createProvenanceInspector
-} from "./chunk-APIU4GTB.js";
+} from "./chunk-S7H2UULC.js";
 
 // src/defaultPlugins.ts
 function defaultPlugins() {
@@ -68,7 +68,7 @@ function setBootstrappedSecretHydrationRequired(value) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.5.0",
+  version: "1.6.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/{chunk-T6Y57KTT.js → chunk-UR7CHHNN.js}

@@ -3,7 +3,7 @@ import {
   isSecretReference,
   parseYaml,
   toPortablePath
-} from "./chunk-APIU4GTB.js";
+} from "./chunk-S7H2UULC.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";

package/dist/{chunk-J4K4JUJL.js → chunk-VGZREX5D.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-APIU4GTB.js";
+} from "./chunk-S7H2UULC.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/{chunk-EQSKV3DP.js → chunk-XSUP7JKH.js}

@@ -1,12 +1,23 @@
 import {
   isSecretReference
-} from "./chunk-APIU4GTB.js";
+} from "./chunk-S7H2UULC.js";
 
 // src/runtime/bootstrap.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
 var CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+var CNOS_PROJECTION_ENV_VAR = "__CNOS_PROJECTION__";
 var CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
 var CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
+function serializeServerProjection(projection) {
+  return JSON.stringify(projection);
+}
+function deserializeServerProjection(source) {
+  const payload = JSON.parse(source);
+  if (!payload || payload.version !== 1 || typeof payload.workspace !== "string" || typeof payload.profile !== "string" || typeof payload.resolvedAt !== "string" || typeof payload.configHash !== "string" || !payload.values || typeof payload.values !== "object" || Array.isArray(payload.values) || !payload.secretRefs || typeof payload.secretRefs !== "object" || Array.isArray(payload.secretRefs) || !Array.isArray(payload.publicKeys) || !payload.meta || typeof payload.meta !== "object") {
+    throw new Error("Invalid CNOS server projection payload");
+  }
+  return payload;
+}
 function serializeRuntimeGraph(graph) {
   const payload = {
     entries: Array.from(graph.entries.values()),
@@ -89,17 +100,28 @@ function readRuntimeGraphFromEnv(processEnv = process.env) {
   }
   return graph;
 }
+function readServerProjectionFromEnv(processEnv = process.env) {
+  const serialized = processEnv[CNOS_PROJECTION_ENV_VAR];
+  if (!serialized) {
+    return void 0;
+  }
+  return deserializeServerProjection(serialized);
+}
 function graphRequiresSecretHydration(graph) {
   return Array.from(graph.entries.values()).some((entry) => entry.namespace === "secret" && isSecretReference(entry.value));
 }
 
 export {
   CNOS_GRAPH_ENV_VAR,
+  CNOS_PROJECTION_ENV_VAR,
   CNOS_SECRET_PAYLOAD_ENV_VAR,
   CNOS_SESSION_KEY_ENV_VAR,
+  serializeServerProjection,
+  deserializeServerProjection,
   serializeRuntimeGraph,
   deserializeRuntimeGraph,
   serializeSecretPayload,
   readRuntimeGraphFromEnv,
+  readServerProjectionFromEnv,
   graphRequiresSecretHydration
 };