@kitsy/cnos 1.6.1 → 1.7.0

package/dist/{chunk-MW4OVAT3.js → chunk-5KIQCYFH.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/{chunk-N32UN66E.js → chunk-CV3SLBYZ.js}

@@ -1,27 +1,27 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-VGZREX5D.js";
+} from "./chunk-RYIARE4M.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-UR7CHHNN.js";
+} from "./chunk-TT4NV56Z.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-UJBQS7CJ.js";
+} from "./chunk-UL63DFLS.js";
 import {
   createBasicSchemaPlugin
-} from "./chunk-MW4OVAT3.js";
+} from "./chunk-5KIQCYFH.js";
 import {
   createCliArgsPlugin
-} from "./chunk-JYWQFMW5.js";
+} from "./chunk-2DGT7N7E.js";
 import {
   createDotenvPlugin
-} from "./chunk-BMAD24KC.js";
+} from "./chunk-OA7FQGAG.js";
 import {
   createCnos,
   createProvenanceInspector
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // src/defaultPlugins.ts
 function defaultPlugins() {
@@ -68,7 +68,7 @@ function setBootstrappedSecretHydrationRequired(value) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.6.1",
+  version: "1.7.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/{chunk-XSUP7JKH.js → chunk-GHGJFRDL.js}

@@ -1,6 +1,6 @@
 import {
   isSecretReference
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // src/runtime/bootstrap.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -16,7 +16,11 @@ function deserializeServerProjection(source) {
   if (!payload || payload.version !== 1 || typeof payload.workspace !== "string" || typeof payload.profile !== "string" || typeof payload.resolvedAt !== "string" || typeof payload.configHash !== "string" || !payload.values || typeof payload.values !== "object" || Array.isArray(payload.values) || !payload.secretRefs || typeof payload.secretRefs !== "object" || Array.isArray(payload.secretRefs) || !Array.isArray(payload.publicKeys) || !payload.meta || typeof payload.meta !== "object") {
     throw new Error("Invalid CNOS server projection payload");
   }
-  return payload;
+  return {
+    ...payload,
+    derived: payload.derived && typeof payload.derived === "object" && !Array.isArray(payload.derived) ? payload.derived : {},
+    runtimeNamespaces: Array.isArray(payload.runtimeNamespaces) ? payload.runtimeNamespaces : []
+  };
 }
 function serializeRuntimeGraph(graph) {
   const payload = {

package/dist/{chunk-BMAD24KC.js → chunk-OA7FQGAG.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-6FAX2VKQ.js → chunk-PFT56ID2.js}

@@ -3,7 +3,7 @@ import {
   graphRequiresSecretHydration,
   readRuntimeGraphFromEnv,
   readServerProjectionFromEnv
-} from "./chunk-XSUP7JKH.js";
+} from "./chunk-GHGJFRDL.js";
 import {
   createCnos,
   getBootstrappedSecretHydrationRequired,
@@ -12,19 +12,23 @@ import {
   setBootstrappedSecretHydrationRequired,
   setSingletonReady,
   setSingletonRuntime
-} from "./chunk-N32UN66E.js";
+} from "./chunk-CV3SLBYZ.js";
 import {
+  createDefaultRuntimeProviders,
+  createDerivedRuntimeSupport,
   createSecretVaultProvider,
   inspectValue,
-  readOrValue,
+  isDerivedValue,
+  parseDerivation,
   readValue,
+  registerRuntimeProvider,
   requireValue,
   resolveVaultAuth,
   toEnv,
   toLogicalKey,
   toNamespaceObject,
   toPublicEnv
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // src/runtime/index.ts
 import { existsSync, readFileSync } from "fs";
@@ -68,6 +72,27 @@ function formatMessage(runtime, message) {
     return value === void 0 ? match : stringifyLogValue(value);
   });
 }
+function discoverRuntimeNamespacesFromGraph(graph) {
+  const configNamespaces = /* @__PURE__ */ new Set(["value", "secret", "meta", "public"]);
+  for (const entry of graph.entries.values()) {
+    configNamespaces.add(entry.namespace);
+  }
+  const runtimeNamespaces = /* @__PURE__ */ new Set();
+  for (const entry of graph.entries.values()) {
+    if (!isDerivedValue(entry.value)) {
+      continue;
+    }
+    const parsed = parseDerivation(entry.value);
+    for (const ref of parsed.refs) {
+      const namespace = ref.split(".")[0] ?? "";
+      if (!namespace || configNamespaces.has(namespace)) {
+        continue;
+      }
+      runtimeNamespaces.add(namespace);
+    }
+  }
+  return Array.from(runtimeNamespaces).sort((left, right) => left.localeCompare(right));
+}
 function attachBootstrappedGraph(graph) {
   if (getSingletonRuntime()) {
     return;
@@ -114,6 +139,21 @@ function attachBootstrappedGraph(graph) {
       frameworks: {}
     },
     namespaces: {},
+    runtimeNamespaces: {
+      process: {
+        description: "Live process runtime values.",
+        serverOnly: true,
+        builtIn: true
+      },
+      ...Object.fromEntries(
+        discoverRuntimeNamespacesFromGraph(graph).map((namespace) => [
+          namespace,
+          {
+            serverOnly: true
+          }
+        ])
+      )
+    },
     vaults: {},
     writePolicy: {
       define: {
@@ -126,18 +166,36 @@ function attachBootstrappedGraph(graph) {
     },
     schema: {}
   };
+  const runtimeProviders = createDefaultRuntimeProviders(bootstrappedManifest, process.env);
+  const derivedSupport = createDerivedRuntimeSupport(graph, bootstrappedManifest, runtimeProviders);
+  const resolveProjectedSourceKey = (key) => {
+    if (!key.startsWith("public.")) {
+      return key;
+    }
+    const promotedFrom = graph.entries.get(key)?.winner.metadata?.promotedFrom;
+    if (typeof promotedFrom === "string") {
+      return promotedFrom;
+    }
+    const fallback = `value.${key.slice("public.".length)}`;
+    return graph.entries.has(fallback) ? fallback : key;
+  };
   const runtime = {
     manifest: bootstrappedManifest,
     plugins: [],
     graph,
     read(key) {
-      return readValue(graph, key);
+      return derivedSupport.read(key, (ref) => readValue(graph, ref));
     },
     require(key) {
-      return requireValue(graph, key);
+      const value = this.read(key);
+      if (value === void 0) {
+        return requireValue(graph, key);
+      }
+      return value;
     },
     readOr(key, fallback) {
-      return readOrValue(graph, key, fallback);
+      const value = this.read(key);
+      return value === void 0 ? fallback : value;
     },
     value(path2) {
       return readValue(graph, toLogicalKey("value", path2));
@@ -149,23 +207,35 @@ function attachBootstrappedGraph(graph) {
       return readValue(graph, toLogicalKey("meta", path2));
     },
     toNamespace(namespace) {
-      return toNamespaceObject(graph, namespace);
+      return toNamespaceObject(graph, namespace, (key) => this.read(key));
     },
     toEnv(options) {
-      return toEnv(graph, bootstrappedManifest, options);
+      return toEnv(graph, bootstrappedManifest, options, {
+        read: (key) => this.read(key),
+        isRuntimeDependent: (key) => derivedSupport.isRuntimeDependentKey(key)
+      });
     },
     toPublicEnv(options) {
-      return toPublicEnv(graph, bootstrappedManifest, options);
+      return toPublicEnv(graph, bootstrappedManifest, options, {
+        read: (key) => derivedSupport.toConcreteValue(resolveProjectedSourceKey(key), (ref) => readValue(graph, ref), "public"),
+        isRuntimeDependent: (key) => derivedSupport.isRuntimeDependentKey(resolveProjectedSourceKey(key))
+      });
     },
     inspect(key) {
-      return inspectValue(graph, key);
+      return inspectValue(graph, key, {
+        read: (ref) => this.read(ref),
+        describeDerived: (ref) => derivedSupport.describe(ref, (candidate) => readValue(graph, candidate))
+      });
     },
     toObject() {
-      return toNamespaceObject(graph);
+      return toNamespaceObject(graph, void 0, (key) => this.read(key));
     },
     toServerProjection() {
       throw new Error("CNOS graph bootstrap payload does not support server projection export.");
     },
+    registerRuntimeProvider(namespace, provider) {
+      registerRuntimeProvider(bootstrappedManifest, runtimeProviders, namespace, provider);
+    },
     async refreshSecrets() {
       return;
     },
@@ -176,7 +246,7 @@ function attachBootstrappedGraph(graph) {
   setSingletonRuntime(runtime);
   setBootstrappedSecretHydrationRequired(graphRequiresSecretHydration(graph));
 }
-function toBootstrappedManifest(graph) {
+function toBootstrappedManifest(graph, runtimeNamespaces = []) {
   return {
     version: 1,
     project: {
@@ -219,8 +289,24 @@ function toBootstrappedManifest(graph) {
       value: { kind: "data", shareable: true },
       secret: { kind: "data", shareable: false, sensitive: true },
       meta: { kind: "system", shareable: false, readonly: true },
+      process: { kind: "system", shareable: false, readonly: true },
       public: { kind: "projection", shareable: true, readonly: true, source: "promote" }
     },
+    runtimeNamespaces: {
+      process: {
+        description: "Live process runtime values.",
+        serverOnly: true,
+        builtIn: true
+      },
+      ...Object.fromEntries(
+        runtimeNamespaces.filter((namespace) => namespace !== "process").map((namespace) => [
+          namespace,
+          {
+            serverOnly: true
+          }
+        ])
+      )
+    },
     vaults: {},
     writePolicy: {
       define: {
@@ -259,6 +345,31 @@ function graphFromProjection(projection) {
       overridden: []
     });
   }
+  for (const [key, formula] of Object.entries(projection.derived)) {
+    const firstSegment = key.split(".")[0] ?? "";
+    const logicalKey = key.startsWith("value.") || key.startsWith("public.") || explicitNamespaces.has(firstSegment) ? key : `value.${key}`;
+    const namespace = logicalKey.slice(0, logicalKey.indexOf("."));
+    const winner = {
+      key: logicalKey,
+      value: {
+        $derive: {
+          expr: formula.expr
+        }
+      },
+      namespace,
+      sourceId: "server-projection",
+      pluginId: "cnos",
+      workspaceId: projection.workspace,
+      profile: projection.profile
+    };
+    entries.set(logicalKey, {
+      key: logicalKey,
+      value: winner.value,
+      namespace,
+      winner,
+      overridden: []
+    });
+  }
   for (const [key, ref] of Object.entries(projection.secretRefs)) {
     const logicalKey = `secret.${key}`;
     entries.set(logicalKey, {
@@ -295,7 +406,10 @@ function graphFromProjection(projection) {
         sourceId: "server-projection",
         pluginId: "cnos",
         workspaceId: projection.workspace,
-        profile: projection.profile
+        profile: projection.profile,
+        metadata: {
+          promotedFrom: valueKey
+        }
       },
       overridden: []
     });
@@ -333,8 +447,21 @@ function attachBootstrappedProjection(projection, force = false) {
     return;
   }
   const graph = graphFromProjection(projection);
-  const manifest = toBootstrappedManifest(graph);
+  const manifest = toBootstrappedManifest(graph, projection.runtimeNamespaces);
   const hydratedSecrets = /* @__PURE__ */ new Map();
+  const runtimeProviders = createDefaultRuntimeProviders(manifest, process.env);
+  const derivedSupport = createDerivedRuntimeSupport(graph, manifest, runtimeProviders);
+  const resolveProjectedSourceKey = (key) => {
+    if (!key.startsWith("public.")) {
+      return key;
+    }
+    const promotedFrom = graph.entries.get(key)?.winner.metadata?.promotedFrom;
+    if (typeof promotedFrom === "string") {
+      return promotedFrom;
+    }
+    const fallback = `value.${key.slice("public.".length)}`;
+    return graph.entries.has(fallback) ? fallback : key;
+  };
   const resolveSecretValue = async (key) => {
     const entry = graph.entries.get(key);
     if (!entry || entry.namespace !== "secret") {
@@ -360,14 +487,16 @@ function attachBootstrappedProjection(projection, force = false) {
     plugins: [],
     graph,
     read(key) {
-      const entry = graph.entries.get(key);
-      if (!entry) {
-        return void 0;
-      }
-      if (entry.namespace === "secret") {
-        return hydratedSecrets.get(key);
-      }
-      return entry.value;
+      return derivedSupport.read(key, (ref) => {
+        const entry = graph.entries.get(ref);
+        if (!entry) {
+          return void 0;
+        }
+        if (entry.namespace === "secret") {
+          return hydratedSecrets.get(ref);
+        }
+        return entry.value;
+      });
     },
     require(key) {
       const value = this.read(key);
@@ -399,24 +528,59 @@ function attachBootstrappedProjection(projection, force = false) {
             ])
           )
         },
-        key
+        key,
+        {
+          read: (ref) => this.read(ref),
+          describeDerived: (ref) => derivedSupport.describe(ref, (candidate) => {
+            const entry = graph.entries.get(candidate);
+            if (!entry) {
+              return void 0;
+            }
+            if (entry.namespace === "secret") {
+              return hydratedSecrets.get(candidate);
+            }
+            return entry.value;
+          })
+        }
       );
     },
     toObject() {
-      return toNamespaceObject(graph);
+      return toNamespaceObject(graph, void 0, (key) => this.read(key));
     },
     toNamespace(namespace) {
-      return toNamespaceObject(graph, namespace);
+      return toNamespaceObject(graph, namespace, (key) => this.read(key));
     },
     toEnv(options) {
-      return toEnv(graph, manifest, options);
+      return toEnv(graph, manifest, options, {
+        read: (key) => this.read(key),
+        isRuntimeDependent: (key) => derivedSupport.isRuntimeDependentKey(key)
+      });
     },
     toPublicEnv(options) {
-      return toPublicEnv(graph, manifest, options);
+      return toPublicEnv(graph, manifest, options, {
+        read: (key) => derivedSupport.toConcreteValue(
+          resolveProjectedSourceKey(key),
+          (ref) => {
+            const entry = graph.entries.get(ref);
+            if (!entry) {
+              return void 0;
+            }
+            if (entry.namespace === "secret") {
+              return hydratedSecrets.get(ref);
+            }
+            return entry.value;
+          },
+          "public"
+        ),
+        isRuntimeDependent: (key) => derivedSupport.isRuntimeDependentKey(resolveProjectedSourceKey(key))
+      });
     },
     toServerProjection() {
       return projection;
     },
+    registerRuntimeProvider(namespace, provider) {
+      registerRuntimeProvider(manifest, runtimeProviders, namespace, provider);
+    },
     async refreshSecrets() {
       for (const key of Object.keys(projection.secretRefs).map((segment) => `secret.${segment}`)) {
         hydratedSecrets.delete(key);
@@ -538,6 +702,9 @@ var cnos = Object.assign(
       attachBootstrappedProjection(projection, true);
       setBootstrappedSecretHydrationRequired(Object.keys(projection.secretRefs).length > 0);
     },
+    registerRuntimeProvider(namespace, provider) {
+      getRuntimeOrThrow().registerRuntimeProvider(namespace, provider);
+    },
     async refreshSecrets() {
       await getRuntimeOrThrow().refreshSecrets();
       setBootstrappedSecretHydrationRequired(false);

package/dist/{chunk-VGZREX5D.js → chunk-RYIARE4M.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/{chunk-UR7CHHNN.js → chunk-TT4NV56Z.js}

@@ -1,9 +1,10 @@
 import {
   CnosManifestError,
+  isDerivedValue,
   isSecretReference,
   parseYaml,
   toPortablePath
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";
@@ -65,7 +66,7 @@ function assertObjectDocument(value, filePath) {
 function flattenConfigObject(value, options = {}, prefix = "") {
   return Object.entries(value).reduce((accumulator, [key, nestedValue]) => {
     const nextKey = prefix ? `${prefix}.${key}` : key;
-    if (nestedValue && typeof nestedValue === "object" && !Array.isArray(nestedValue) && !options.stopAtLeaf?.(nestedValue)) {
+    if (nestedValue && typeof nestedValue === "object" && !Array.isArray(nestedValue) && !isDerivedValue(nestedValue) && !options.stopAtLeaf?.(nestedValue)) {
       Object.assign(
         accumulator,
         flattenConfigObject(nestedValue, options, nextKey)

package/dist/{chunk-UJBQS7CJ.js → chunk-UL63DFLS.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-S7H2UULC.js";
+} from "./chunk-2TL42I6M.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";