@kitsy/cnos 1.5.1 → 1.6.0

package/dist/plugin/env-export.cjs

@@ -68,28 +68,34 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// ../core/src/utils/path.ts
 var import_promises2 = require("fs/promises");
+var import_node_os = __toESM(require("os"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 
-// ../core/src/utils/path.ts
+// ../core/src/discovery/findCnosrc.ts
 var import_promises = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
-function stripNamespace(key) {
-  return key.split(".").slice(1).join(".");
-}
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
-// ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+// ../core/src/utils/path.ts
+function stripNamespace(key) {
+  return key.split(".").slice(1).join(".");
+}
 
-// ../core/src/profiles/expandProfileChain.ts
+// ../core/src/manifest/loadWorkspaceFile.ts
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
+// ../core/src/profiles/expandProfileChain.ts
+var import_promises5 = require("fs/promises");
+var import_node_path5 = __toESM(require("path"), 1);
+
 // ../core/src/promotions/validatePromotion.ts
 var DEFAULT_DATA_NAMESPACE = {
   kind: "data",
@@ -108,21 +114,21 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
 }
 
 // ../core/src/workspaces/resolveWorkspaceContext.ts
-var import_promises5 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/auditLog.ts
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 function isObject(value) {
@@ -136,6 +142,9 @@ function isSecretReference(value) {
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
+// ../core/src/runtime/toServerProjection.ts
+var import_node_crypto2 = require("crypto");
+
 // ../core/src/runtime/toEnv.ts
 function normalizeEnvValue(value) {
   if (value === void 0 || value === null) {
@@ -220,8 +229,8 @@ function toPublicEnv(graph, manifest, options = {}) {
 }
 
 // ../core/src/runtime/dump.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises10 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/plugin/env-export.d.cts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-B4xwySxw.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-ggmphZFs.cjs';
+import { E as ExporterPlugin } from '../plugin-CKrBlWGI.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CmBsy53P.cjs';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.d.ts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../plugin-B4xwySxw.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CvhGAfsB.js';
+import { E as ExporterPlugin } from '../plugin-CKrBlWGI.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-q6VwWxXZ.js';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-SZKQVA2M.js";
+} from "../chunk-VGZREX5D.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-BS33AW4Y.js";
+} from "../chunk-S7H2UULC.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.cjs

@@ -40,11 +40,11 @@ __export(filesystem_exports, {
 module.exports = __toCommonJS(filesystem_exports);
 
 // ../../plugins/filesystem/src/filesystemSecretsReader.ts
-var import_promises11 = require("fs/promises");
+var import_promises12 = require("fs/promises");
 
 // ../../plugins/filesystem/src/helpers.ts
-var import_promises10 = require("fs/promises");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_promises11 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
 
 // ../core/src/errors.ts
 var CnosError = class extends Error {
@@ -77,16 +77,17 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// ../core/src/utils/path.ts
 var import_promises2 = require("fs/promises");
+var import_node_os = __toESM(require("os"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 
-// ../core/src/utils/path.ts
+// ../core/src/discovery/findCnosrc.ts
 var import_promises = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
-function toPortablePath(targetPath) {
-  return targetPath.replace(/\\/g, "/");
-}
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
@@ -94,30 +95,35 @@ function parseYaml(source) {
   return (0, import_yaml.parse)(source);
 }
 
-// ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
+// ../core/src/utils/path.ts
+function toPortablePath(targetPath) {
+  return targetPath.replace(/\\/g, "/");
+}
 
-// ../core/src/profiles/expandProfileChain.ts
+// ../core/src/manifest/loadWorkspaceFile.ts
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
-// ../core/src/workspaces/resolveWorkspaceContext.ts
+// ../core/src/profiles/expandProfileChain.ts
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/workspaces/resolveWorkspaceContext.ts
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/secrets/auditLog.ts
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 function isObject(value) {
@@ -131,16 +137,19 @@ function isSecretReference(value) {
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
+// ../core/src/runtime/toServerProjection.ts
+var import_node_crypto2 = require("crypto");
+
 // ../core/src/runtime/dump.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises10 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../../plugins/filesystem/src/helpers.ts
 var YAML_EXTENSIONS = /* @__PURE__ */ new Set([".yml", ".yaml"]);
 var FILESYSTEM_PLUGIN_ID = "@kitsy/cnos/plugins/filesystem";
 async function existsDirectory(targetPath) {
   try {
-    const stat2 = await (0, import_promises10.readdir)(targetPath);
+    const stat2 = await (0, import_promises11.readdir)(targetPath);
     void stat2;
     return true;
   } catch {
@@ -148,15 +157,15 @@ async function existsDirectory(targetPath) {
   }
 }
 async function collectYamlFiles(root) {
-  const entries = await (0, import_promises10.readdir)(root, { withFileTypes: true });
+  const entries = await (0, import_promises11.readdir)(root, { withFileTypes: true });
   const results = [];
   for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-    const absolutePath = import_node_path10.default.join(root, entry.name);
+    const absolutePath = import_node_path11.default.join(root, entry.name);
     if (entry.isDirectory()) {
       results.push(...await collectYamlFiles(absolutePath));
       continue;
     }
-    if (entry.isFile() && YAML_EXTENSIONS.has(import_node_path10.default.extname(entry.name).toLowerCase())) {
+    if (entry.isFile() && YAML_EXTENSIONS.has(import_node_path11.default.extname(entry.name).toLowerCase())) {
       results.push(absolutePath);
     }
   }
@@ -164,16 +173,16 @@ async function collectYamlFiles(root) {
 }
 async function collectFilesystemLayerFiles(manifestRoot, workspaceRoots, sourceRoot, activeLayers) {
   const files = [];
-  const repoRoot = import_node_path10.default.dirname(manifestRoot);
+  const repoRoot = import_node_path11.default.dirname(manifestRoot);
   for (const workspaceRoot of workspaceRoots) {
-    const resolvedRoot = import_node_path10.default.resolve(workspaceRoot.path, sourceRoot);
+    const resolvedRoot = import_node_path11.default.resolve(workspaceRoot.path, sourceRoot);
     for (const layer of activeLayers) {
-      const layerRoot = import_node_path10.default.join(resolvedRoot, layer);
+      const layerRoot = import_node_path11.default.join(resolvedRoot, layer);
       if (!await existsDirectory(layerRoot)) {
         continue;
       }
       for (const absolutePath of await collectYamlFiles(layerRoot)) {
-        const relativePath = import_node_path10.default.relative(repoRoot, absolutePath);
+        const relativePath = import_node_path11.default.relative(repoRoot, absolutePath);
         files.push({
           absolutePath,
           relativePath: toPortablePath(relativePath.startsWith("..") ? absolutePath : relativePath),
@@ -250,7 +259,7 @@ function createFilesystemSecretsPlugin() {
       );
       const entries = [];
       for (const file of files) {
-        const document = await (0, import_promises11.readFile)(file.absolutePath, "utf8");
+        const document = await (0, import_promises12.readFile)(file.absolutePath, "utf8");
         const fileEntries = filesystemSecretsReader(file.relativePath, document, file.workspaceId);
         for (const entry of fileEntries) {
           const metadata = toSecretReferenceMetadata(entry.value);
@@ -266,7 +275,7 @@ function createFilesystemSecretsPlugin() {
 }
 
 // ../../plugins/filesystem/src/filesystemValuesReader.ts
-var import_promises12 = require("fs/promises");
+var import_promises13 = require("fs/promises");
 function filesystemValuesReader(filePath, document, workspaceId = "default") {
   return yamlObjectToEntries(document, filePath, "value", "filesystem-values", workspaceId);
 }
@@ -287,7 +296,7 @@ function createFilesystemValuesPlugin() {
       ).map(([namespace]) => namespace);
       const entries = [];
       for (const file of files) {
-        const document = await (0, import_promises12.readFile)(file.absolutePath, "utf8");
+        const document = await (0, import_promises13.readFile)(file.absolutePath, "utf8");
         entries.push(...filesystemValuesReader(file.relativePath, document, file.workspaceId));
       }
       for (const namespace of customNamespaces) {
@@ -302,7 +311,7 @@ function createFilesystemValuesPlugin() {
           layers
         );
         for (const file of namespaceFiles) {
-          const document = await (0, import_promises12.readFile)(file.absolutePath, "utf8");
+          const document = await (0, import_promises13.readFile)(file.absolutePath, "utf8");
           entries.push(...yamlObjectToEntries(document, file.relativePath, namespace, "filesystem-values", file.workspaceId));
         }
       }

package/dist/plugin/filesystem.d.cts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-B4xwySxw.cjs';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-CKrBlWGI.cjs';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.d.ts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-B4xwySxw.js';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, i as NamespaceName } from '../plugin-CKrBlWGI.js';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-EJAXWFNT.js";
-import "../chunk-BS33AW4Y.js";
+} from "../chunk-UR7CHHNN.js";
+import "../chunk-S7H2UULC.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.cjs

@@ -52,49 +52,56 @@ var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 
 // ../core/src/manifest/loadManifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// ../core/src/utils/path.ts
 var import_promises2 = require("fs/promises");
+var import_node_os = __toESM(require("os"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 
-// ../core/src/utils/path.ts
+// ../core/src/discovery/findCnosrc.ts
 var import_promises = require("fs/promises");
-var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
 
 // ../core/src/utils/yaml.ts
 var import_yaml = require("yaml");
 
 // ../core/src/manifest/loadWorkspaceFile.ts
-var import_promises3 = require("fs/promises");
-var import_node_path3 = __toESM(require("path"), 1);
-
-// ../core/src/profiles/expandProfileChain.ts
 var import_promises4 = require("fs/promises");
 var import_node_path4 = __toESM(require("path"), 1);
 
-// ../core/src/workspaces/resolveWorkspaceContext.ts
+// ../core/src/profiles/expandProfileChain.ts
 var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 
+// ../core/src/workspaces/resolveWorkspaceContext.ts
+var import_promises6 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+
 // ../core/src/secrets/auditLog.ts
-var import_promises8 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_promises9 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 
 // ../core/src/utils/secretStore.ts
 var import_node_crypto = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_promises8 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/sessionStore.ts
-var import_promises6 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
 
 // ../core/src/secrets/prompt.ts
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_stream = require("stream");
 
+// ../core/src/runtime/toServerProjection.ts
+var import_node_crypto2 = require("crypto");
+
 // ../core/src/runtime/dump.ts
-var import_promises9 = require("fs/promises");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_promises10 = require("fs/promises");
+var import_node_path10 = __toESM(require("path"), 1);
 
 // ../core/src/utils/envNaming.ts
 function normalizeMappingConfig(config = {}) {
@@ -103,8 +110,8 @@ function normalizeMappingConfig(config = {}) {
     explicit: config.explicit ?? {}
   };
 }
-function fromScreamingSnake(path10) {
-  return path10.split("_").map((segment) => segment.trim().toLowerCase()).filter(Boolean).join(".");
+function fromScreamingSnake(path11) {
+  return path11.split("_").map((segment) => segment.trim().toLowerCase()).filter(Boolean).join(".");
 }
 function envVarToLogicalKey(envVar, config = {}) {
   const normalized = normalizeMappingConfig(config);

package/dist/plugin/process-env.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.cjs';
-import { E as EnvMappingConfig } from '../envNaming-S4B-dHUx.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CKrBlWGI.cjs';
+import { E as EnvMappingConfig } from '../envNaming-gMVnPOfe.cjs';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
 declare function processNamespaceEntriesFromContext(env: Record<string, string | undefined>, workspaceId?: string): ConfigEntry[];

package/dist/plugin/process-env.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-B4xwySxw.js';
-import { E as EnvMappingConfig } from '../envNaming-Dvm_LP2D.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../plugin-CKrBlWGI.js';
+import { E as EnvMappingConfig } from '../envNaming-B7Mztkcf.js';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
 declare function processNamespaceEntriesFromContext(env: Record<string, string | undefined>, workspaceId?: string): ConfigEntry[];

package/dist/plugin/process-env.js

@@ -2,8 +2,8 @@ import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,
   processNamespaceEntriesFromContext
-} from "../chunk-H53ZRQLX.js";
-import "../chunk-BS33AW4Y.js";
+} from "../chunk-UJBQS7CJ.js";
+import "../chunk-S7H2UULC.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,

package/dist/{plugin-B4xwySxw.d.cts → plugin-CKrBlWGI.d.cts}

@@ -14,7 +14,7 @@ interface SchemaRule {
     default?: unknown;
 }
 
-type WorkspaceSource = 'cli' | 'workspace-file' | 'manifest-default' | 'implicit';
+type WorkspaceSource = 'cli' | 'workspace-file' | 'anchor-file' | 'manifest-default' | 'implicit' | 'directory-inferred';
 type GlobalRootSource = 'cli' | 'workspace-file' | 'manifest' | 'CNOS_HOME';
 interface WorkspaceFile {
     workspace?: string;
@@ -167,15 +167,43 @@ interface NormalizedManifest {
 }
 interface LoadManifestOptions {
     root?: string;
+    cwd?: string;
 }
 interface LoadedManifest {
     manifestRoot: string;
     repoRoot: string;
+    consumerRoot: string;
+    anchorPath?: string;
+    anchoredWorkspace?: string;
     manifestPath: string;
     manifest: NormalizedManifest;
     rawManifest: ManifestFile;
 }
 
+interface SecretReference {
+    provider: string;
+    ref: string;
+    vault?: string;
+}
+interface VaultAuthConfig {
+    passphrase?: string;
+    token?: string;
+    derivedKey?: Buffer;
+    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
+    config?: Record<string, unknown>;
+}
+interface SecretVaultProvider {
+    readonly vaultId: string;
+    readonly definition: VaultDefinition;
+    authenticate(authConfig: VaultAuthConfig): Promise<void>;
+    isAuthenticated(): boolean;
+    batchGet(refs: string[]): Promise<Map<string, string>>;
+    get(ref: string): Promise<string | undefined>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+
 type LogicalKey = string;
 type NamespaceName = string;
 interface ConfigOrigin {
@@ -235,11 +263,13 @@ interface InspectResult {
     }>;
 }
 interface CnosCreateOptions {
+    cwd?: string;
     root?: string;
     profile?: string;
     workspace?: string;
     globalRoot?: string;
-    secretResolution?: 'eager' | 'lazy';
+    secretResolution?: 'eager' | 'lazy' | 'refreshing';
+    secretRefreshTtl?: number;
     cnosVersion?: string;
     plugins?: CnosPlugin[];
     cliArgs?: string[];
@@ -287,6 +317,25 @@ interface CnosRuntime {
     toNamespace(namespace: NamespaceName): Record<string, unknown>;
     toEnv(options?: ToEnvOptions): Record<string, string>;
     toPublicEnv(options?: ToPublicEnvOptions): Record<string, string>;
+    toServerProjection(): ServerProjection;
+    refreshSecrets(): Promise<void>;
+    refreshSecret(key: LogicalKey): Promise<void>;
+}
+interface ServerProjection {
+    version: 1;
+    workspace: string;
+    profile: string;
+    resolvedAt: string;
+    configHash: string;
+    values: Record<string, unknown>;
+    secretRefs: Record<string, SecretReference>;
+    publicKeys: string[];
+    meta: {
+        workspace: string;
+        profile: string;
+        cnos_version: string;
+        namespaces?: string[];
+    };
 }
 
 type CnosPluginKind = 'loader' | 'resolver' | 'validator' | 'exporter' | 'inspector';
@@ -347,4 +396,4 @@ interface ExporterPlugin extends CnosPlugin {
     export(graph: ResolvedGraph, context: ExportContext): Promise<ExportResult>;
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, NamespaceDefinition as l, VaultDefinition as m, ValidationSummary as n, ValidationIssue as o, WorkspaceFile as p };
+export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ServerProjection as S, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, NamespaceDefinition as l, VaultDefinition as m, VaultAuthConfig as n, SecretVaultProvider as o, SecretReference as p, ValidationSummary as q, ValidationIssue as r, WorkspaceFile as s };

package/dist/{plugin-B4xwySxw.d.ts → plugin-CKrBlWGI.d.ts}

@@ -14,7 +14,7 @@ interface SchemaRule {
     default?: unknown;
 }
 
-type WorkspaceSource = 'cli' | 'workspace-file' | 'manifest-default' | 'implicit';
+type WorkspaceSource = 'cli' | 'workspace-file' | 'anchor-file' | 'manifest-default' | 'implicit' | 'directory-inferred';
 type GlobalRootSource = 'cli' | 'workspace-file' | 'manifest' | 'CNOS_HOME';
 interface WorkspaceFile {
     workspace?: string;
@@ -167,15 +167,43 @@ interface NormalizedManifest {
 }
 interface LoadManifestOptions {
     root?: string;
+    cwd?: string;
 }
 interface LoadedManifest {
     manifestRoot: string;
     repoRoot: string;
+    consumerRoot: string;
+    anchorPath?: string;
+    anchoredWorkspace?: string;
     manifestPath: string;
     manifest: NormalizedManifest;
     rawManifest: ManifestFile;
 }
 
+interface SecretReference {
+    provider: string;
+    ref: string;
+    vault?: string;
+}
+interface VaultAuthConfig {
+    passphrase?: string;
+    token?: string;
+    derivedKey?: Buffer;
+    method: 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
+    config?: Record<string, unknown>;
+}
+interface SecretVaultProvider {
+    readonly vaultId: string;
+    readonly definition: VaultDefinition;
+    authenticate(authConfig: VaultAuthConfig): Promise<void>;
+    isAuthenticated(): boolean;
+    batchGet(refs: string[]): Promise<Map<string, string>>;
+    get(ref: string): Promise<string | undefined>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+
 type LogicalKey = string;
 type NamespaceName = string;
 interface ConfigOrigin {
@@ -235,11 +263,13 @@ interface InspectResult {
     }>;
 }
 interface CnosCreateOptions {
+    cwd?: string;
     root?: string;
     profile?: string;
     workspace?: string;
     globalRoot?: string;
-    secretResolution?: 'eager' | 'lazy';
+    secretResolution?: 'eager' | 'lazy' | 'refreshing';
+    secretRefreshTtl?: number;
     cnosVersion?: string;
     plugins?: CnosPlugin[];
     cliArgs?: string[];
@@ -287,6 +317,25 @@ interface CnosRuntime {
     toNamespace(namespace: NamespaceName): Record<string, unknown>;
     toEnv(options?: ToEnvOptions): Record<string, string>;
     toPublicEnv(options?: ToPublicEnvOptions): Record<string, string>;
+    toServerProjection(): ServerProjection;
+    refreshSecrets(): Promise<void>;
+    refreshSecret(key: LogicalKey): Promise<void>;
+}
+interface ServerProjection {
+    version: 1;
+    workspace: string;
+    profile: string;
+    resolvedAt: string;
+    configHash: string;
+    values: Record<string, unknown>;
+    secretRefs: Record<string, SecretReference>;
+    publicKeys: string[];
+    meta: {
+        workspace: string;
+        profile: string;
+        cnos_version: string;
+        namespaces?: string[];
+    };
 }
 
 type CnosPluginKind = 'loader' | 'resolver' | 'validator' | 'exporter' | 'inspector';
@@ -347,4 +396,4 @@ interface ExporterPlugin extends CnosPlugin {
     export(graph: ResolvedGraph, context: ExportContext): Promise<ExportResult>;
 }
 
-export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, NamespaceDefinition as l, VaultDefinition as m, ValidationSummary as n, ValidationIssue as o, WorkspaceFile as p };
+export type { CnosCreateOptions as C, DumpPlanOptions as D, ExporterPlugin as E, InspectResult as I, LoaderPlugin as L, ManifestFile as M, NormalizedManifest as N, ResolvedGraph as R, ServerProjection as S, ToEnvOptions as T, ValidatorPlugin as V, WorkspaceRoot as W, ConfigEntry as a, LogicalKey as b, ToPublicEnvOptions as c, DumpPlan as d, DumpOptions as e, DumpResult as f, CnosRuntime as g, CnosPlugin as h, NamespaceName as i, LoadManifestOptions as j, LoadedManifest as k, NamespaceDefinition as l, VaultDefinition as m, VaultAuthConfig as n, SecretVaultProvider as o, SecretReference as p, ValidationSummary as q, ValidationIssue as r, WorkspaceFile as s };