@kitsy/cnos 1.5.1 → 1.6.0

package/dist/build/index.d.cts

@@ -1,4 +1,4 @@
-import { C as CnosCreateOptions } from '../plugin-B4xwySxw.cjs';
+import { C as CnosCreateOptions, S as ServerProjection } from '../plugin-CKrBlWGI.cjs';
 
 type BrowserDataMap = Record<string, unknown>;
 type FrameworkEnvTarget = 'generic' | 'vite' | 'next' | 'webpack' | (string & {});
@@ -9,5 +9,6 @@ declare function toFrameworkEnv(browserData: BrowserDataMap, framework?: Framewo
 declare function resolveFrameworkEnv(options?: CnosCreateOptions, framework?: FrameworkEnvTarget, envOptions?: {
     prefix?: string;
 }): Promise<Record<string, string>>;
+declare function resolveServerProjection(options?: CnosCreateOptions): Promise<ServerProjection>;
 
-export { type BrowserDataMap, type FrameworkEnvTarget, resolveBrowserData, resolveFrameworkEnv, toFrameworkEnv };
+export { type BrowserDataMap, type FrameworkEnvTarget, resolveBrowserData, resolveFrameworkEnv, resolveServerProjection, toFrameworkEnv };

package/dist/build/index.d.ts

@@ -1,4 +1,4 @@
-import { C as CnosCreateOptions } from '../plugin-B4xwySxw.js';
+import { C as CnosCreateOptions, S as ServerProjection } from '../plugin-CKrBlWGI.js';
 
 type BrowserDataMap = Record<string, unknown>;
 type FrameworkEnvTarget = 'generic' | 'vite' | 'next' | 'webpack' | (string & {});
@@ -9,5 +9,6 @@ declare function toFrameworkEnv(browserData: BrowserDataMap, framework?: Framewo
 declare function resolveFrameworkEnv(options?: CnosCreateOptions, framework?: FrameworkEnvTarget, envOptions?: {
     prefix?: string;
 }): Promise<Record<string, string>>;
+declare function resolveServerProjection(options?: CnosCreateOptions): Promise<ServerProjection>;
 
-export { type BrowserDataMap, type FrameworkEnvTarget, resolveBrowserData, resolveFrameworkEnv, toFrameworkEnv };
+export { type BrowserDataMap, type FrameworkEnvTarget, resolveBrowserData, resolveFrameworkEnv, resolveServerProjection, toFrameworkEnv };

package/dist/build/index.js

@@ -1,13 +1,13 @@
 import {
   createCnos
-} from "../chunk-CMQK2AEF.js";
-import "../chunk-SZKQVA2M.js";
-import "../chunk-EJAXWFNT.js";
-import "../chunk-H53ZRQLX.js";
-import "../chunk-F2ZAIZNH.js";
-import "../chunk-7EI3RFUE.js";
-import "../chunk-UWFE4JE2.js";
-import "../chunk-BS33AW4Y.js";
+} from "../chunk-UOKVLCFL.js";
+import "../chunk-BMAD24KC.js";
+import "../chunk-VGZREX5D.js";
+import "../chunk-UR7CHHNN.js";
+import "../chunk-UJBQS7CJ.js";
+import "../chunk-MW4OVAT3.js";
+import "../chunk-JYWQFMW5.js";
+import "../chunk-S7H2UULC.js";
 
 // src/build/index.ts
 async function resolveBrowserData(options = {}) {
@@ -66,8 +66,13 @@ async function resolveFrameworkEnv(options = {}, framework = "generic", envOptio
     ...envOptions.prefix ? { prefix: envOptions.prefix } : {}
   });
 }
+async function resolveServerProjection(options = {}) {
+  const runtime = await createCnos(options);
+  return runtime.toServerProjection();
+}
 export {
   resolveBrowserData,
   resolveFrameworkEnv,
+  resolveServerProjection,
   toFrameworkEnv
 };

package/dist/{chunk-UWFE4JE2.js → chunk-BMAD24KC.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-BS33AW4Y.js";
+} from "./chunk-S7H2UULC.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-7EI3RFUE.js → chunk-JYWQFMW5.js}

@@ -1,6 +1,6 @@
 import {
   joinConfigPath
-} from "./chunk-BS33AW4Y.js";
+} from "./chunk-S7H2UULC.js";
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/{chunk-F2ZAIZNH.js → chunk-MW4OVAT3.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-BS33AW4Y.js";
+} from "./chunk-S7H2UULC.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/chunk-QU5CXL47.js

@@ -0,0 +1,577 @@
+import {
+  deserializeServerProjection,
+  graphRequiresSecretHydration,
+  readRuntimeGraphFromEnv,
+  readServerProjectionFromEnv
+} from "./chunk-XSUP7JKH.js";
+import {
+  createCnos,
+  getBootstrappedSecretHydrationRequired,
+  getSingletonReady,
+  getSingletonRuntime,
+  setBootstrappedSecretHydrationRequired,
+  setSingletonReady,
+  setSingletonRuntime
+} from "./chunk-UOKVLCFL.js";
+import {
+  createSecretVaultProvider,
+  inspectValue,
+  readOrValue,
+  readValue,
+  requireValue,
+  resolveVaultAuth,
+  toEnv,
+  toLogicalKey,
+  toNamespaceObject,
+  toPublicEnv
+} from "./chunk-S7H2UULC.js";
+
+// src/runtime/index.ts
+import { existsSync, readFileSync } from "fs";
+import path from "path";
+var NOT_READY_MESSAGE = "CNOS not initialized. Call await cnos.ready() or use cnos run.";
+function getRuntimeOrThrow() {
+  const runtime = getSingletonRuntime();
+  if (!runtime) {
+    throw new Error(NOT_READY_MESSAGE);
+  }
+  return runtime;
+}
+function requireLogicalKey(runtime, key) {
+  return runtime.require(key);
+}
+function readLogicalKey(runtime, key) {
+  return runtime.read(key);
+}
+function stringifyLogValue(value) {
+  if (value === void 0) {
+    return "";
+  }
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function formatMessage(runtime, message) {
+  return message.replace(/\$\{([^}]+)\}/g, (match, rawKey) => {
+    const key = String(rawKey).trim();
+    if (!key) {
+      return match;
+    }
+    const value = runtime.read(key);
+    return value === void 0 ? match : stringifyLogValue(value);
+  });
+}
+function attachBootstrappedGraph(graph) {
+  if (getSingletonRuntime()) {
+    return;
+  }
+  const bootstrappedManifest = {
+    version: 1,
+    project: {
+      name: "bootstrapped"
+    },
+    workspaces: {
+      global: {
+        enabled: Boolean(graph.workspace.globalRoot),
+        ...graph.workspace.globalRoot ? {
+          root: graph.workspace.globalRoot
+        } : {},
+        allowWrite: false
+      },
+      items: {},
+      ...graph.workspace.workspaceSource === "implicit" ? {} : {
+        default: graph.workspace.workspaceId
+      }
+    },
+    profiles: {
+      default: graph.profile,
+      resolveFrom: ["default"]
+    },
+    plugins: {
+      loaders: [],
+      resolver: "profile-aware",
+      validators: [],
+      exporters: [],
+      inspectors: []
+    },
+    sources: {},
+    resolution: {
+      precedence: [],
+      arrayPolicy: "replace"
+    },
+    envMapping: {
+      explicit: {}
+    },
+    public: {
+      promote: [],
+      frameworks: {}
+    },
+    namespaces: {},
+    vaults: {},
+    writePolicy: {
+      define: {
+        defaultProfile: graph.profile,
+        targets: {
+          value: "./values/app.yml",
+          secret: "./secrets/app.yml"
+        }
+      }
+    },
+    schema: {}
+  };
+  const runtime = {
+    manifest: bootstrappedManifest,
+    plugins: [],
+    graph,
+    read(key) {
+      return readValue(graph, key);
+    },
+    require(key) {
+      return requireValue(graph, key);
+    },
+    readOr(key, fallback) {
+      return readOrValue(graph, key, fallback);
+    },
+    value(path2) {
+      return readValue(graph, toLogicalKey("value", path2));
+    },
+    secret(path2) {
+      return readValue(graph, toLogicalKey("secret", path2));
+    },
+    meta(path2) {
+      return readValue(graph, toLogicalKey("meta", path2));
+    },
+    toNamespace(namespace) {
+      return toNamespaceObject(graph, namespace);
+    },
+    toEnv(options) {
+      return toEnv(graph, bootstrappedManifest, options);
+    },
+    toPublicEnv(options) {
+      return toPublicEnv(graph, bootstrappedManifest, options);
+    },
+    inspect(key) {
+      return inspectValue(graph, key);
+    },
+    toObject() {
+      return toNamespaceObject(graph);
+    },
+    toServerProjection() {
+      throw new Error("CNOS graph bootstrap payload does not support server projection export.");
+    },
+    async refreshSecrets() {
+      return;
+    },
+    async refreshSecret() {
+      return;
+    }
+  };
+  setSingletonRuntime(runtime);
+  setBootstrappedSecretHydrationRequired(graphRequiresSecretHydration(graph));
+}
+function toBootstrappedManifest(graph) {
+  return {
+    version: 1,
+    project: {
+      name: "bootstrapped"
+    },
+    workspaces: {
+      global: {
+        enabled: false,
+        allowWrite: false
+      },
+      items: {},
+      ...graph.workspace.workspaceSource === "implicit" ? {} : {
+        default: graph.workspace.workspaceId
+      }
+    },
+    profiles: {
+      default: graph.profile,
+      resolveFrom: ["default"]
+    },
+    plugins: {
+      loaders: [],
+      resolver: "profile-aware",
+      validators: [],
+      exporters: [],
+      inspectors: []
+    },
+    sources: {},
+    resolution: {
+      precedence: [],
+      arrayPolicy: "replace"
+    },
+    envMapping: {
+      explicit: {}
+    },
+    public: {
+      promote: [],
+      frameworks: {}
+    },
+    namespaces: {
+      value: { kind: "data", shareable: true },
+      secret: { kind: "data", shareable: false, sensitive: true },
+      meta: { kind: "system", shareable: false, readonly: true },
+      public: { kind: "projection", shareable: true, readonly: true, source: "promote" }
+    },
+    vaults: {},
+    writePolicy: {
+      define: {
+        defaultProfile: graph.profile,
+        targets: {
+          value: "./values/app.yml",
+          secret: "./secrets/app.yml"
+        }
+      }
+    },
+    schema: {}
+  };
+}
+function graphFromProjection(projection) {
+  const entries = /* @__PURE__ */ new Map();
+  const now = projection.resolvedAt;
+  const explicitNamespaces = /* @__PURE__ */ new Set(["flags", "config", "process", ...projection.meta.namespaces ?? []]);
+  for (const [key, value] of Object.entries(projection.values)) {
+    const firstSegment = key.split(".")[0] ?? "";
+    const logicalKey = key.startsWith("value.") || key.startsWith("public.") || explicitNamespaces.has(firstSegment) ? key : `value.${key}`;
+    const namespace = logicalKey.slice(0, logicalKey.indexOf("."));
+    const winner = {
+      key: logicalKey,
+      value,
+      namespace,
+      sourceId: "server-projection",
+      pluginId: "cnos",
+      workspaceId: projection.workspace,
+      profile: projection.profile
+    };
+    entries.set(logicalKey, {
+      key: logicalKey,
+      value,
+      namespace,
+      winner,
+      overridden: []
+    });
+  }
+  for (const [key, ref] of Object.entries(projection.secretRefs)) {
+    const logicalKey = `secret.${key}`;
+    entries.set(logicalKey, {
+      key: logicalKey,
+      value: ref,
+      namespace: "secret",
+      winner: {
+        key: logicalKey,
+        value: ref,
+        namespace: "secret",
+        sourceId: "server-projection",
+        pluginId: "cnos",
+        workspaceId: projection.workspace,
+        profile: projection.profile
+      },
+      overridden: []
+    });
+  }
+  for (const key of projection.publicKeys) {
+    const valueKey = Object.prototype.hasOwnProperty.call(projection.values, key) ? key : `value.${key}`;
+    const publicKey = `public.${key}`;
+    const sourceEntry = entries.get(valueKey);
+    if (!sourceEntry) {
+      continue;
+    }
+    entries.set(publicKey, {
+      key: publicKey,
+      value: sourceEntry.value,
+      namespace: "public",
+      winner: {
+        key: publicKey,
+        value: sourceEntry.value,
+        namespace: "public",
+        sourceId: "server-projection",
+        pluginId: "cnos",
+        workspaceId: projection.workspace,
+        profile: projection.profile
+      },
+      overridden: []
+    });
+  }
+  entries.set("meta.profile", {
+    key: "meta.profile",
+    value: projection.profile,
+    namespace: "meta",
+    winner: {
+      key: "meta.profile",
+      value: projection.profile,
+      namespace: "meta",
+      sourceId: "server-projection",
+      pluginId: "cnos",
+      workspaceId: projection.workspace,
+      profile: projection.profile
+    },
+    overridden: []
+  });
+  return {
+    entries,
+    profile: projection.profile,
+    resolvedAt: now,
+    profileSource: "manifest-default",
+    workspace: {
+      workspaceId: projection.workspace,
+      workspaceSource: "implicit",
+      workspaceChain: [projection.workspace],
+      workspaceRoots: []
+    }
+  };
+}
+function attachBootstrappedProjection(projection, force = false) {
+  if (getSingletonRuntime() && !force) {
+    return;
+  }
+  const graph = graphFromProjection(projection);
+  const manifest = toBootstrappedManifest(graph);
+  const hydratedSecrets = /* @__PURE__ */ new Map();
+  const resolveSecretValue = async (key) => {
+    const entry = graph.entries.get(key);
+    if (!entry || entry.namespace !== "secret") {
+      return entry?.value;
+    }
+    if (hydratedSecrets.has(key)) {
+      return hydratedSecrets.get(key);
+    }
+    const ref = projection.secretRefs[key.slice("secret.".length)];
+    if (!ref) {
+      return void 0;
+    }
+    const definition = { provider: ref.provider };
+    const provider = createSecretVaultProvider(ref.vault ?? "default", definition, process.env);
+    const auth = await resolveVaultAuth(ref.vault ?? "default", definition, process.env);
+    await provider.authenticate(auth);
+    const value = await provider.get(ref.ref);
+    hydratedSecrets.set(key, value);
+    return value;
+  };
+  const runtime = {
+    manifest,
+    plugins: [],
+    graph,
+    read(key) {
+      const entry = graph.entries.get(key);
+      if (!entry) {
+        return void 0;
+      }
+      if (entry.namespace === "secret") {
+        return hydratedSecrets.get(key);
+      }
+      return entry.value;
+    },
+    require(key) {
+      const value = this.read(key);
+      if (value === void 0) {
+        throw new Error(`Missing required CNOS config key: ${key}`);
+      }
+      return value;
+    },
+    readOr(key, fallback) {
+      return this.read(key) ?? fallback;
+    },
+    value(segment) {
+      return this.read(toLogicalKey("value", segment));
+    },
+    secret(segment) {
+      return this.read(toLogicalKey("secret", segment));
+    },
+    meta(segment) {
+      return this.read(toLogicalKey("meta", segment));
+    },
+    inspect(key) {
+      return inspectValue(
+        {
+          ...graph,
+          entries: new Map(
+            Array.from(graph.entries.entries()).map(([entryKey, existing]) => [
+              entryKey,
+              entryKey === key && existing.namespace === "secret" && hydratedSecrets.has(entryKey) ? { ...existing, value: hydratedSecrets.get(entryKey) } : existing
+            ])
+          )
+        },
+        key
+      );
+    },
+    toObject() {
+      return toNamespaceObject(graph);
+    },
+    toNamespace(namespace) {
+      return toNamespaceObject(graph, namespace);
+    },
+    toEnv(options) {
+      return toEnv(graph, manifest, options);
+    },
+    toPublicEnv(options) {
+      return toPublicEnv(graph, manifest, options);
+    },
+    toServerProjection() {
+      return projection;
+    },
+    async refreshSecrets() {
+      for (const key of Object.keys(projection.secretRefs).map((segment) => `secret.${segment}`)) {
+        hydratedSecrets.delete(key);
+        await resolveSecretValue(key);
+      }
+    },
+    async refreshSecret(key) {
+      hydratedSecrets.delete(key);
+      await resolveSecretValue(key);
+    }
+  };
+  setSingletonRuntime(runtime);
+  setBootstrappedSecretHydrationRequired(Object.keys(projection.secretRefs).length > 0);
+}
+function bootstrapFromProcessEnv() {
+  if (typeof process === "undefined") {
+    return;
+  }
+  try {
+    const graph = readRuntimeGraphFromEnv(process.env);
+    if (graph) {
+      attachBootstrappedGraph(graph);
+      return;
+    }
+    const projection = readServerProjectionFromEnv(process.env);
+    if (projection) {
+      attachBootstrappedProjection(projection);
+    }
+  } catch {
+  }
+}
+function discoverProjectionPathSync() {
+  const cwd = process.cwd();
+  const directCandidates = [
+    path.join(cwd, ".cnos-server.json")
+  ];
+  for (const candidate of directCandidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  let current = cwd;
+  for (let depth = 0; depth <= 3; depth += 1) {
+    const rcCandidate = path.join(current, ".cnosrc.yml");
+    if (existsSync(rcCandidate)) {
+      const projectionCandidate = path.join(current, ".cnos-server.json");
+      if (existsSync(projectionCandidate)) {
+        return projectionCandidate;
+      }
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return void 0;
+}
+function bootstrapFromProjectionFile() {
+  if (getSingletonRuntime()) {
+    return;
+  }
+  try {
+    const projectionPath = discoverProjectionPathSync();
+    if (!projectionPath) {
+      return;
+    }
+    const projection = deserializeServerProjection(readFileSync(projectionPath, "utf8"));
+    attachBootstrappedProjection(projection);
+  } catch {
+  }
+}
+bootstrapFromProcessEnv();
+bootstrapFromProjectionFile();
+var cnos = Object.assign(
+  ((key) => readLogicalKey(getRuntimeOrThrow(), key)),
+  {
+    read(key) {
+      return readLogicalKey(getRuntimeOrThrow(), key);
+    },
+    require(key) {
+      return requireLogicalKey(getRuntimeOrThrow(), key);
+    },
+    readOr(key, fallback) {
+      return getRuntimeOrThrow().readOr(key, fallback);
+    },
+    value(path2) {
+      return getRuntimeOrThrow().value(path2);
+    },
+    secret(path2) {
+      return getRuntimeOrThrow().secret(path2);
+    },
+    meta(path2) {
+      return getRuntimeOrThrow().meta(path2);
+    },
+    inspect(key) {
+      return getRuntimeOrThrow().inspect(key);
+    },
+    toNamespace(namespace) {
+      return getRuntimeOrThrow().toNamespace(namespace);
+    },
+    toEnv(options) {
+      return getRuntimeOrThrow().toEnv(options);
+    },
+    toPublicEnv(options) {
+      return getRuntimeOrThrow().toPublicEnv(options);
+    },
+    format(message) {
+      return formatMessage(getRuntimeOrThrow(), message);
+    },
+    log(message) {
+      const formatted = formatMessage(getRuntimeOrThrow(), message);
+      console.log(formatted);
+      return formatted;
+    },
+    async loadProjection(source) {
+      const resolvedSource = path.resolve(source);
+      const projection = deserializeServerProjection(readFileSync(resolvedSource, "utf8"));
+      attachBootstrappedProjection(projection, true);
+      setBootstrappedSecretHydrationRequired(Object.keys(projection.secretRefs).length > 0);
+    },
+    async refreshSecrets() {
+      await getRuntimeOrThrow().refreshSecrets();
+      setBootstrappedSecretHydrationRequired(false);
+    },
+    async refreshSecret(key) {
+      await getRuntimeOrThrow().refreshSecret(key);
+    },
+    async ready() {
+      const runtime = getSingletonRuntime();
+      if (runtime && getBootstrappedSecretHydrationRequired()) {
+        await runtime.refreshSecrets();
+        setBootstrappedSecretHydrationRequired(false);
+        return;
+      }
+      if (runtime && !getBootstrappedSecretHydrationRequired()) {
+        return;
+      }
+      const existing = getSingletonReady();
+      if (existing && !getBootstrappedSecretHydrationRequired()) {
+        await existing;
+        return;
+      }
+      const readyPromise = createCnos().then((runtime2) => {
+        setSingletonRuntime(runtime2);
+        setBootstrappedSecretHydrationRequired(false);
+        return runtime2;
+      });
+      setSingletonReady(readyPromise);
+      await readyPromise;
+    }
+  }
+);
+var runtime_default = cnos;
+
+export {
+  runtime_default
+};