@kitsy/cnos 1.5.1 → 1.6.0

package/dist/internal.d.cts

@@ -1,5 +1,5 @@
-import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, i as NamespaceName, g as CnosRuntime, n as ValidationSummary, R as ResolvedGraph } from './plugin-B4xwySxw.cjs';
-export { o as ValidationIssue, p as WorkspaceFile } from './plugin-B4xwySxw.cjs';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, n as VaultAuthConfig, o as SecretVaultProvider, i as NamespaceName, p as SecretReference, g as CnosRuntime, q as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './plugin-CKrBlWGI.cjs';
+export { r as ValidationIssue, s as WorkspaceFile } from './plugin-CKrBlWGI.cjs';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -20,30 +20,6 @@ type ProjectionTarget = 'public' | 'env';
 declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
 declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
-interface SecretReference {
-    provider: string;
-    ref: string;
-    vault?: string;
-}
-interface VaultAuthConfig {
-    passphrase?: string;
-    token?: string;
-    derivedKey?: Buffer;
-    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
-    config?: Record<string, unknown>;
-}
-interface SecretVaultProvider {
-    readonly vaultId: string;
-    readonly definition: VaultDefinition;
-    authenticate(authConfig: VaultAuthConfig): Promise<void>;
-    isAuthenticated(): boolean;
-    batchGet(refs: string[]): Promise<Map<string, string>>;
-    get(ref: string): Promise<string | undefined>;
-    set(ref: string, value: string): Promise<void>;
-    delete(ref: string): Promise<void>;
-    list(): Promise<string[]>;
-}
-
 declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
 
 declare function writeVaultSessionKey(vault: string, derivedKey: Buffer, processEnv?: Record<string, string | undefined>): Promise<string>;
@@ -54,7 +30,15 @@ declare function createSecretVaultProvider(vaultId: string, definition: VaultDef
 
 declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 
-declare function resolveManifestRoot(root?: string): Promise<string>;
+declare function resolveManifestRoot(options?: {
+    root?: string;
+    cwd?: string;
+}): Promise<{
+    manifestRoot: string;
+    consumerRoot: string;
+    anchorPath?: string;
+    workspace?: string;
+}>;
 declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: NamespaceName, configPath: string, profile?: string): string;
 
 interface ResolvedVaultDefinition extends VaultDefinition {
@@ -97,8 +81,11 @@ declare function stringifyYaml(value: unknown): string;
 declare function validateRuntime(runtime: CnosRuntime): Promise<ValidationSummary>;
 
 declare const CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+declare const CNOS_PROJECTION_ENV_VAR = "__CNOS_PROJECTION__";
 declare const CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
 declare const CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
+declare function serializeServerProjection(projection: ServerProjection): string;
+declare function deserializeServerProjection(source: string): ServerProjection;
 declare function serializeRuntimeGraph(graph: ResolvedGraph): string;
 declare function deserializeRuntimeGraph(source: string): ResolvedGraph;
 declare function serializeSecretPayload(values: Record<string, unknown>): {
@@ -106,6 +93,7 @@ declare function serializeSecretPayload(values: Record<string, unknown>): {
     sessionKey: string;
 };
 declare function readRuntimeGraphFromEnv(processEnv?: Record<string, string | undefined>): ResolvedGraph | undefined;
+declare function readServerProjectionFromEnv(processEnv?: Record<string, string | undefined>): ServerProjection | undefined;
 declare function graphRequiresSecretHydration(graph: ResolvedGraph): boolean;
 
 interface GeneratedCodegenContent {
@@ -205,4 +193,4 @@ interface WatchTargetSet {
 }
 declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };
+export { CNOS_GRAPH_ENV_VAR, CNOS_PROJECTION_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, deserializeServerProjection, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readServerProjectionFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, serializeServerProjection, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };

package/dist/internal.d.ts

@@ -1,5 +1,5 @@
-import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, i as NamespaceName, g as CnosRuntime, n as ValidationSummary, R as ResolvedGraph } from './plugin-B4xwySxw.js';
-export { o as ValidationIssue, p as WorkspaceFile } from './plugin-B4xwySxw.js';
+import { j as LoadManifestOptions, k as LoadedManifest, N as NormalizedManifest, b as LogicalKey, l as NamespaceDefinition, m as VaultDefinition, n as VaultAuthConfig, o as SecretVaultProvider, i as NamespaceName, p as SecretReference, g as CnosRuntime, q as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './plugin-CKrBlWGI.js';
+export { r as ValidationIssue, s as WorkspaceFile } from './plugin-CKrBlWGI.js';
 
 declare class CnosError extends Error {
     constructor(message: string);
@@ -20,30 +20,6 @@ type ProjectionTarget = 'public' | 'env';
 declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
 declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
 
-interface SecretReference {
-    provider: string;
-    ref: string;
-    vault?: string;
-}
-interface VaultAuthConfig {
-    passphrase?: string;
-    token?: string;
-    derivedKey?: Buffer;
-    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
-    config?: Record<string, unknown>;
-}
-interface SecretVaultProvider {
-    readonly vaultId: string;
-    readonly definition: VaultDefinition;
-    authenticate(authConfig: VaultAuthConfig): Promise<void>;
-    isAuthenticated(): boolean;
-    batchGet(refs: string[]): Promise<Map<string, string>>;
-    get(ref: string): Promise<string | undefined>;
-    set(ref: string, value: string): Promise<void>;
-    delete(ref: string): Promise<void>;
-    list(): Promise<string[]>;
-}
-
 declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
 
 declare function writeVaultSessionKey(vault: string, derivedKey: Buffer, processEnv?: Record<string, string | undefined>): Promise<string>;
@@ -54,7 +30,15 @@ declare function createSecretVaultProvider(vaultId: string, definition: VaultDef
 
 declare function flattenObject(value: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 
-declare function resolveManifestRoot(root?: string): Promise<string>;
+declare function resolveManifestRoot(options?: {
+    root?: string;
+    cwd?: string;
+}): Promise<{
+    manifestRoot: string;
+    consumerRoot: string;
+    anchorPath?: string;
+    workspace?: string;
+}>;
 declare function resolveConfigDocumentPath(workspaceRoot: string, namespace: NamespaceName, configPath: string, profile?: string): string;
 
 interface ResolvedVaultDefinition extends VaultDefinition {
@@ -97,8 +81,11 @@ declare function stringifyYaml(value: unknown): string;
 declare function validateRuntime(runtime: CnosRuntime): Promise<ValidationSummary>;
 
 declare const CNOS_GRAPH_ENV_VAR = "__CNOS_GRAPH__";
+declare const CNOS_PROJECTION_ENV_VAR = "__CNOS_PROJECTION__";
 declare const CNOS_SECRET_PAYLOAD_ENV_VAR = "__CNOS_SECRET_PAYLOAD__";
 declare const CNOS_SESSION_KEY_ENV_VAR = "__CNOS_SESSION_KEY__";
+declare function serializeServerProjection(projection: ServerProjection): string;
+declare function deserializeServerProjection(source: string): ServerProjection;
 declare function serializeRuntimeGraph(graph: ResolvedGraph): string;
 declare function deserializeRuntimeGraph(source: string): ResolvedGraph;
 declare function serializeSecretPayload(values: Record<string, unknown>): {
@@ -106,6 +93,7 @@ declare function serializeSecretPayload(values: Record<string, unknown>): {
     sessionKey: string;
 };
 declare function readRuntimeGraphFromEnv(processEnv?: Record<string, string | undefined>): ResolvedGraph | undefined;
+declare function readServerProjectionFromEnv(processEnv?: Record<string, string | undefined>): ServerProjection | undefined;
 declare function graphRequiresSecretHydration(graph: ResolvedGraph): boolean;
 
 interface GeneratedCodegenContent {
@@ -205,4 +193,4 @@ interface WatchTargetSet {
 }
 declare function watchFiles(runtime: CnosRuntime, root?: string): Promise<WatchTargetSet>;
 
-export { CNOS_GRAPH_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, type SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };
+export { CNOS_GRAPH_ENV_VAR, CNOS_PROJECTION_ENV_VAR, CNOS_SECRET_PAYLOAD_ENV_VAR, CNOS_SESSION_KEY_ENV_VAR, CnosAuthenticationError, CnosSecurityError, type ResolvedVaultDefinition, SecretReference, ValidationSummary, VaultDefinition, applyManifestMappings, clearAllVaultSessionKeys, clearVaultSessionKey, compareSchemaToGraph, createSecretVault, createSecretVaultProvider, deleteLocalSecret, deriveVaultKey, deserializeRuntimeGraph, deserializeServerProjection, detectLegacyVaultFormat, diffGraphs, ensureProjectionAllowed, flattenObject, formatDriftReport, generateCodegenContent, getNamespaceDefinition, getVaultPassphraseEnvVar, getVaultSessionKeyEnvVar, graphRequiresSecretHydration, isPassphraseEnvRef, isSecretReference, listLocalSecrets, listSecretVaults, loadManifest, parseYaml, proposeMapping, readKeychain, readLocalSecret, readRuntimeGraphFromEnv, readServerProjectionFromEnv, readVaultMetadata, removeLocalVaultFiles, resolveCodegenPaths, resolveConfigDocumentPath, resolveConfiguredVaultPassphrase, resolveManifestRoot, resolveSecretPassphrase, resolveSecretStoreRoot, resolveSecretVaultFile, resolveVaultAccessKey, resolveVaultAuth, resolveVaultDefinition, rewriteSourceFiles, scanEnvUsage, serializeRuntimeGraph, serializeSecretPayload, serializeServerProjection, stringifyYaml, validateRuntime, watchFiles, watchSchema, writeCodegenOutput, writeKeychain, writeLocalSecret, writeVaultSessionKey };

package/dist/internal.js

@@ -1,13 +1,17 @@
 import {
   CNOS_GRAPH_ENV_VAR,
+  CNOS_PROJECTION_ENV_VAR,
   CNOS_SECRET_PAYLOAD_ENV_VAR,
   CNOS_SESSION_KEY_ENV_VAR,
   deserializeRuntimeGraph,
+  deserializeServerProjection,
   graphRequiresSecretHydration,
   readRuntimeGraphFromEnv,
+  readServerProjectionFromEnv,
   serializeRuntimeGraph,
-  serializeSecretPayload
-} from "./chunk-5F2OFKND.js";
+  serializeSecretPayload,
+  serializeServerProjection
+} from "./chunk-XSUP7JKH.js";
 import {
   CnosAuthenticationError,
   CnosSecurityError,
@@ -47,7 +51,7 @@ import {
   writeKeychain,
   writeLocalSecret,
   writeVaultSessionKey
-} from "./chunk-BS33AW4Y.js";
+} from "./chunk-S7H2UULC.js";
 
 // src/codegen/generateTypes.ts
 function toPascalCase(value) {
@@ -639,6 +643,7 @@ async function watchFiles(runtime, root) {
 }
 export {
   CNOS_GRAPH_ENV_VAR,
+  CNOS_PROJECTION_ENV_VAR,
   CNOS_SECRET_PAYLOAD_ENV_VAR,
   CNOS_SESSION_KEY_ENV_VAR,
   CnosAuthenticationError,
@@ -652,6 +657,7 @@ export {
   deleteLocalSecret,
   deriveVaultKey,
   deserializeRuntimeGraph,
+  deserializeServerProjection,
   detectLegacyVaultFormat,
   diffGraphs,
   ensureProjectionAllowed,
@@ -672,6 +678,7 @@ export {
   readKeychain,
   readLocalSecret,
   readRuntimeGraphFromEnv,
+  readServerProjectionFromEnv,
   readVaultMetadata,
   removeLocalVaultFiles,
   resolveCodegenPaths,
@@ -688,6 +695,7 @@ export {
   scanEnvUsage,
   serializeRuntimeGraph,
   serializeSecretPayload,
+  serializeServerProjection,
   stringifyYaml,
   validateRuntime,
   watchFiles,

package/dist/plugin/basic-schema.cjs

@@ -50,29 +50,33 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// ../core/src/utils/path.ts
 var import_promises2 = require("fs/promises");
+var import_node_os = __toESM(require("os"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 
-// ../core/src/utils/path.ts
+// ../core/src/discovery/findCnosrc.ts
 var import_promises = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
-
-// ../core/src/profiles/expandProfileChain.ts
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
-// ../core/src/workspaces/resolveWorkspaceContext.ts
+// ../core/src/profiles/expandProfileChain.ts
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/workspaces/resolveWorkspaceContext.ts
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/validation/basicSchema.ts
 function describeValueType(value) {
   if (Array.isArray(value)) {
@@ -221,25 +225,28 @@ function applySchemaRules(graph, schema) {
 }
 
 // ../core/src/secrets/auditLog.ts
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
+// ../core/src/runtime/toServerProjection.ts
+var import_node_crypto2 = require("crypto");
+
 // ../core/src/runtime/dump.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises10 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/plugin/basic-schema.d.cts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../plugin-B4xwySxw.cjs';
+import { V as ValidatorPlugin } from '../plugin-CKrBlWGI.cjs';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.d.ts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../plugin-B4xwySxw.js';
+import { V as ValidatorPlugin } from '../plugin-CKrBlWGI.js';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-F2ZAIZNH.js";
-import "../chunk-BS33AW4Y.js";
+} from "../chunk-MW4OVAT3.js";
+import "../chunk-S7H2UULC.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.cjs

@@ -52,52 +52,61 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// ../core/src/utils/path.ts
 var import_promises2 = require("fs/promises");
+var import_node_os = __toESM(require("os"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 
-// ../core/src/utils/path.ts
+// ../core/src/discovery/findCnosrc.ts
 var import_promises = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
-function joinConfigPath(...parts) {
-  return parts.flatMap((part) => part.split(".")).map((part) => part.trim()).filter(Boolean).join(".");
-}
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
-// ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+// ../core/src/utils/path.ts
+function joinConfigPath(...parts) {
+  return parts.flatMap((part) => part.split(".")).map((part) => part.trim()).filter(Boolean).join(".");
+}
 
-// ../core/src/profiles/expandProfileChain.ts
+// ../core/src/manifest/loadWorkspaceFile.ts
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
-// ../core/src/workspaces/resolveWorkspaceContext.ts
+// ../core/src/profiles/expandProfileChain.ts
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/workspaces/resolveWorkspaceContext.ts
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/secrets/auditLog.ts
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
+// ../core/src/runtime/toServerProjection.ts
+var import_node_crypto2 = require("crypto");
+
 // ../core/src/runtime/dump.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises10 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/plugin/cli-args.d.cts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-B4xwySxw.cjs';
+import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-CKrBlWGI.cjs';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.d.ts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-B4xwySxw.js';
+import { a as ConfigEntry, L as LoaderPlugin } from '../plugin-CKrBlWGI.js';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-7EI3RFUE.js";
-import "../chunk-BS33AW4Y.js";
+} from "../chunk-JYWQFMW5.js";
+import "../chunk-S7H2UULC.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.cjs

@@ -37,8 +37,8 @@ __export(dotenv_exports, {
 module.exports = __toCommonJS(dotenv_exports);
 
 // ../../plugins/dotenv/src/index.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/keychain/linux.ts
 var import_node_child_process = require("child_process");
@@ -56,13 +56,22 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// ../core/src/utils/path.ts
 var import_promises2 = require("fs/promises");
+var import_node_os = __toESM(require("os"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 
-// ../core/src/utils/path.ts
+// ../core/src/discovery/findCnosrc.ts
 var import_promises = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
+
+// ../core/src/utils/yaml.ts
+var import_yaml = require("yaml");
+
+// ../core/src/utils/path.ts
 function interpolatePathTemplate(template, tokens) {
   return Object.entries(tokens).reduce(
     (result, [token, value]) => result.replaceAll(`{${token}}`, value),
@@ -83,47 +92,47 @@ function stripWorkspaceTemplatePrefix(template) {
 function resolveWorkspaceScopedPath(workspaceRoot, template, tokens) {
   const relativeTemplate = stripWorkspaceTemplatePrefix(template);
   const interpolated = interpolatePathTemplate(relativeTemplate, tokens);
-  return import_node_path.default.resolve(workspaceRoot, interpolated);
+  return import_node_path2.default.resolve(workspaceRoot, interpolated);
 }
 function toPortablePath(targetPath) {
   return targetPath.replace(/\\/g, "/");
 }
 
-// ../core/src/utils/yaml.ts
-var import_yaml = require("yaml");
-
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
-
-// ../core/src/profiles/expandProfileChain.ts
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
-// ../core/src/workspaces/resolveWorkspaceContext.ts
+// ../core/src/profiles/expandProfileChain.ts
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/workspaces/resolveWorkspaceContext.ts
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/secrets/auditLog.ts
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
+// ../core/src/runtime/toServerProjection.ts
+var import_node_crypto2 = require("crypto");
+
 // ../core/src/runtime/dump.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises10 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
@@ -132,8 +141,8 @@ function normalizeMappingConfig(config = {}) {
     explicit: config.explicit ?? {}
   };
 }
-function fromScreamingSnake(path11) {
-  return path11.split("_").map((segment) => segment.trim().toLowerCase()).filter(Boolean).join(".");
+function fromScreamingSnake(path12) {
+  return path12.split("_").map((segment) => segment.trim().toLowerCase()).filter(Boolean).join(".");
 }
 function envVarToLogicalKey(envVar, config = {}) {
   const normalized = normalizeMappingConfig(config);
@@ -214,7 +223,7 @@ function dotenvEntriesFromObject(values, mapping = {}, originFile, workspaceId =
 }
 async function readIfPresent(filePath) {
   try {
-    return await (0, import_promises10.readFile)(filePath, "utf8");
+    return await (0, import_promises11.readFile)(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -233,7 +242,7 @@ function createDotenvPlugin() {
           workspace: workspaceRoot.workspaceId
         });
         for (const fileName of fileNames) {
-          const absolutePath = import_node_path10.default.join(envRoot, fileName);
+          const absolutePath = import_node_path11.default.join(envRoot, fileName);
           const document = await readIfPresent(absolutePath);
           if (!document) {
             continue;
@@ -242,7 +251,7 @@ function createDotenvPlugin() {
             ...dotenvEntriesFromObject(
               parseDotenv(document),
               config.envMapping,
-              toPortablePath(import_node_path10.default.relative(import_node_path10.default.dirname(context.manifestRoot), absolutePath)),
+              toPortablePath(import_node_path11.default.relative(import_node_path11.default.dirname(context.manifestRoot), absolutePath)),
               workspaceRoot.workspaceId
             )
           );

package/dist/plugin/dotenv.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.cjs';
-import { E as EnvMappingConfig } from '../envNaming-S4B-dHUx.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CKrBlWGI.cjs';
+import { E as EnvMappingConfig } from '../envNaming-gMVnPOfe.cjs';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.js';
-import { E as EnvMappingConfig } from '../envNaming-Dvm_LP2D.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CKrBlWGI.js';
+import { E as EnvMappingConfig } from '../envNaming-B7Mztkcf.js';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-UWFE4JE2.js";
-import "../chunk-BS33AW4Y.js";
+} from "../chunk-BMAD24KC.js";
+import "../chunk-S7H2UULC.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,