@kitsy/cnos 1.8.0 → 1.8.2

package/dist/build/index.cjs

@@ -1517,7 +1517,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2621,7 +2621,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2779,8 +2779,8 @@ var SecretCache = class {
   }
 };
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2834,6 +2834,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -2929,6 +2933,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2984,7 +2991,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3170,6 +3177,9 @@ function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return (0, import_node_crypto3.createHash)("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3187,6 +3197,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3203,6 +3216,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3684,7 +3700,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.0",
+  version: "1.8.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/build/index.d.cts

@@ -1,4 +1,4 @@
-import { C as CnosCreateOptions, S as ServerProjection } from '../core-BJ8xewez.cjs';
+import { C as CnosCreateOptions, S as ServerProjection } from '../core-CXgtC4VL.cjs';
 
 type BrowserDataMap = Record<string, unknown>;
 type FrameworkEnvTarget = 'generic' | 'vite' | 'next' | 'webpack' | (string & {});

package/dist/build/index.d.ts

@@ -1,4 +1,4 @@
-import { C as CnosCreateOptions, S as ServerProjection } from '../core-BJ8xewez.js';
+import { C as CnosCreateOptions, S as ServerProjection } from '../core-CXgtC4VL.js';
 
 type BrowserDataMap = Record<string, unknown>;
 type FrameworkEnvTarget = 'generic' | 'vite' | 'next' | 'webpack' | (string & {});

package/dist/build/index.js

@@ -1,13 +1,13 @@
 import {
   createCnos
-} from "../chunk-ZD4YX6VC.js";
-import "../chunk-RYIARE4M.js";
-import "../chunk-TT4NV56Z.js";
-import "../chunk-UL63DFLS.js";
-import "../chunk-5KIQCYFH.js";
-import "../chunk-2DGT7N7E.js";
-import "../chunk-OA7FQGAG.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-J7VEEREE.js";
+import "../chunk-DQGLBF6G.js";
+import "../chunk-B5TV5O6O.js";
+import "../chunk-DAFUP7EQ.js";
+import "../chunk-4MQBH4AY.js";
+import "../chunk-FWW7F52D.js";
+import "../chunk-KU73PJSQ.js";
+import "../chunk-5XOGTE42.js";
 
 // src/build/index.ts
 async function resolveBrowserData(options = {}) {

package/dist/{chunk-UL63DFLS.js → chunk-4MQBH4AY.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";

package/dist/{chunk-2TL42I6M.js → chunk-5XOGTE42.js}

@@ -1532,7 +1532,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2019,7 +2019,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2134,8 +2134,8 @@ async function removeLocalVaultFiles(storeRoot, vault = "default") {
   await rm2(path8.join(storeRoot, "vaults", vault), { recursive: true, force: true });
 }
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2189,6 +2189,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/auditLog.ts
 import { appendFile, mkdir as mkdir5 } from "fs/promises";
 import path9 from "path";
@@ -2301,6 +2305,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2356,7 +2363,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3562,6 +3569,9 @@ function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return createHash2("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3579,6 +3589,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3595,6 +3608,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {

package/dist/{chunk-RYIARE4M.js → chunk-B5TV5O6O.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/{chunk-CW7SNVIQ.js → chunk-CP6K2DB3.js}

@@ -3,7 +3,7 @@ import {
   graphRequiresSecretHydration,
   readRuntimeGraphFromEnv,
   readServerProjectionFromEnv
-} from "./chunk-GHGJFRDL.js";
+} from "./chunk-VTUOWV3S.js";
 import {
   createCnos,
   getBootstrappedSecretHydrationRequired,
@@ -12,7 +12,7 @@ import {
   setBootstrappedSecretHydrationRequired,
   setSingletonReady,
   setSingletonRuntime
-} from "./chunk-ZD4YX6VC.js";
+} from "./chunk-J7VEEREE.js";
 import {
   createDefaultRuntimeProviders,
   createDerivedRuntimeSupport,
@@ -28,7 +28,7 @@ import {
   toLogicalKey,
   toNamespaceObject,
   toPublicEnv
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // src/runtime/index.ts
 import { existsSync, readFileSync } from "fs";

package/dist/{chunk-TT4NV56Z.js → chunk-DAFUP7EQ.js}

@@ -4,7 +4,7 @@ import {
   isSecretReference,
   parseYaml,
   toPortablePath
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";

package/dist/{chunk-OA7FQGAG.js → chunk-DQGLBF6G.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-5KIQCYFH.js → chunk-FWW7F52D.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/{chunk-ZD4YX6VC.js → chunk-J7VEEREE.js}

@@ -1,27 +1,27 @@
+import {
+  createDotenvPlugin
+} from "./chunk-DQGLBF6G.js";
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-RYIARE4M.js";
+} from "./chunk-B5TV5O6O.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-TT4NV56Z.js";
+} from "./chunk-DAFUP7EQ.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-UL63DFLS.js";
+} from "./chunk-4MQBH4AY.js";
 import {
   createBasicSchemaPlugin
-} from "./chunk-5KIQCYFH.js";
+} from "./chunk-FWW7F52D.js";
 import {
   createCliArgsPlugin
-} from "./chunk-2DGT7N7E.js";
-import {
-  createDotenvPlugin
-} from "./chunk-OA7FQGAG.js";
+} from "./chunk-KU73PJSQ.js";
 import {
   createCnos,
   createProvenanceInspector
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // src/defaultPlugins.ts
 function defaultPlugins() {
@@ -68,7 +68,7 @@ function setBootstrappedSecretHydrationRequired(value) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.0",
+  version: "1.8.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/{chunk-2DGT7N7E.js → chunk-KU73PJSQ.js}

@@ -1,6 +1,6 @@
 import {
   joinConfigPath
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/{chunk-GHGJFRDL.js → chunk-VTUOWV3S.js}

@@ -1,6 +1,6 @@
 import {
   isSecretReference
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // src/runtime/bootstrap.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

package/dist/configure/index.cjs

@@ -1519,7 +1519,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2623,7 +2623,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2781,8 +2781,8 @@ var SecretCache = class {
   }
 };
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2836,6 +2836,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -2931,6 +2935,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2986,7 +2993,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3172,6 +3179,9 @@ function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return (0, import_node_crypto3.createHash)("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3189,6 +3199,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3205,6 +3218,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3728,7 +3744,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.0",
+  version: "1.8.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/configure/index.d.cts

@@ -1,6 +1,6 @@
-import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-BJ8xewez.cjs';
-export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-BJ8xewez.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-ivRtLjcw.cjs';
+import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-CXgtC4VL.cjs';
+export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-CXgtC4VL.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-C_MbUTdV.cjs';
 
 declare function planDump(graph: ResolvedGraph, options?: DumpPlanOptions): DumpPlan;
 declare function writeDump(graph: ResolvedGraph, options: DumpOptions): Promise<DumpResult>;

package/dist/configure/index.d.ts

@@ -1,6 +1,6 @@
-import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-BJ8xewez.js';
-export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-BJ8xewez.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CCSgdvI9.js';
+import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-CXgtC4VL.js';
+export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-CXgtC4VL.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-B_dZDXDv.js';
 
 declare function planDump(graph: ResolvedGraph, options?: DumpPlanOptions): DumpPlan;
 declare function writeDump(graph: ResolvedGraph, options: DumpOptions): Promise<DumpResult>;

package/dist/configure/index.js

@@ -1,19 +1,19 @@
 import {
   createCnos,
   defaultPlugins
-} from "../chunk-ZD4YX6VC.js";
-import "../chunk-RYIARE4M.js";
-import "../chunk-TT4NV56Z.js";
-import "../chunk-UL63DFLS.js";
-import "../chunk-5KIQCYFH.js";
-import "../chunk-2DGT7N7E.js";
-import "../chunk-OA7FQGAG.js";
+} from "../chunk-J7VEEREE.js";
+import "../chunk-DQGLBF6G.js";
+import "../chunk-B5TV5O6O.js";
+import "../chunk-DAFUP7EQ.js";
+import "../chunk-4MQBH4AY.js";
+import "../chunk-FWW7F52D.js";
+import "../chunk-KU73PJSQ.js";
 import {
   planDump,
   toEnv,
   toPublicEnv,
   writeDump
-} from "../chunk-2TL42I6M.js";
+} from "../chunk-5XOGTE42.js";
 export {
   createCnos,
   defaultPlugins,

package/dist/{core-BJ8xewez.d.cts → core-CXgtC4VL.d.cts}

@@ -46,7 +46,7 @@ interface WorkspaceContext {
 type ResolutionArrayPolicy = 'replace' | 'append' | 'unique-append';
 type NamespaceKind = 'data' | 'projection' | 'system';
 type NamespaceProjectionSource = 'promote' | 'envMapping';
-type VaultProviderName = 'local' | 'github-secrets' | (string & {});
+type VaultProviderName = 'local' | 'environment' | 'github-secrets' | (string & {});
 type VaultAuthMethod = 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
 interface RuntimeNamespaceDefinition {
     description?: string;

package/dist/{core-BJ8xewez.d.ts → core-CXgtC4VL.d.ts}

@@ -46,7 +46,7 @@ interface WorkspaceContext {
 type ResolutionArrayPolicy = 'replace' | 'append' | 'unique-append';
 type NamespaceKind = 'data' | 'projection' | 'system';
 type NamespaceProjectionSource = 'promote' | 'envMapping';
-type VaultProviderName = 'local' | 'github-secrets' | (string & {});
+type VaultProviderName = 'local' | 'environment' | 'github-secrets' | (string & {});
 type VaultAuthMethod = 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
 interface RuntimeNamespaceDefinition {
     description?: string;

package/dist/{envNaming-rx71gpi0.d.cts → envNaming-BDtISWCK.d.cts}

@@ -1,4 +1,4 @@
-import { N as NormalizedManifest, b as LogicalKey } from './core-BJ8xewez.cjs';
+import { N as NormalizedManifest, b as LogicalKey } from './core-CXgtC4VL.cjs';
 
 interface EnvMappingConfig {
     convention?: NormalizedManifest['envMapping']['convention'];

package/dist/{envNaming-BRyiuPoI.d.ts → envNaming-CA6OluSg.d.ts}

@@ -1,4 +1,4 @@
-import { N as NormalizedManifest, b as LogicalKey } from './core-BJ8xewez.js';
+import { N as NormalizedManifest, b as LogicalKey } from './core-CXgtC4VL.js';
 
 interface EnvMappingConfig {
     convention?: NormalizedManifest['envMapping']['convention'];

package/dist/index.cjs

@@ -1519,7 +1519,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2623,7 +2623,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2781,8 +2781,8 @@ var SecretCache = class {
   }
 };
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2836,6 +2836,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -2931,6 +2935,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2986,7 +2993,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3172,6 +3179,9 @@ function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return (0, import_node_crypto3.createHash)("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3189,6 +3199,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3205,6 +3218,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3686,7 +3702,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.0",
+  version: "1.8.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/index.d.cts

@@ -1,2 +1,2 @@
 export { CnosSingleton, default as cnos, default } from './runtime/index.cjs';
-export { h as CnosPlugin, g as CnosRuntime, a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider } from './core-BJ8xewez.cjs';
+export { h as CnosPlugin, g as CnosRuntime, a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider } from './core-CXgtC4VL.cjs';

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 export { CnosSingleton, default as cnos, default } from './runtime/index.js';
-export { h as CnosPlugin, g as CnosRuntime, a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider } from './core-BJ8xewez.js';
+export { h as CnosPlugin, g as CnosRuntime, a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider } from './core-CXgtC4VL.js';

package/dist/index.js

@@ -1,15 +1,15 @@
 import {
   runtime_default
-} from "./chunk-CW7SNVIQ.js";
-import "./chunk-GHGJFRDL.js";
-import "./chunk-ZD4YX6VC.js";
-import "./chunk-RYIARE4M.js";
-import "./chunk-TT4NV56Z.js";
-import "./chunk-UL63DFLS.js";
-import "./chunk-5KIQCYFH.js";
-import "./chunk-2DGT7N7E.js";
-import "./chunk-OA7FQGAG.js";
-import "./chunk-2TL42I6M.js";
+} from "./chunk-CP6K2DB3.js";
+import "./chunk-VTUOWV3S.js";
+import "./chunk-J7VEEREE.js";
+import "./chunk-DQGLBF6G.js";
+import "./chunk-B5TV5O6O.js";
+import "./chunk-DAFUP7EQ.js";
+import "./chunk-4MQBH4AY.js";
+import "./chunk-FWW7F52D.js";
+import "./chunk-KU73PJSQ.js";
+import "./chunk-5XOGTE42.js";
 export {
   runtime_default as cnos,
   runtime_default as default

package/dist/internal.cjs

@@ -1210,7 +1210,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -1715,7 +1715,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -1845,8 +1845,8 @@ async function appendAuditEvent(event, processEnv = process.env) {
   );
 }
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -1900,6 +1900,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -1995,6 +1999,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2050,7 +2057,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}

package/dist/internal.d.cts

@@ -1,5 +1,5 @@
-import { j as DerivedValue, P as ParsedDerivation, N as NormalizedManifest, n as LoadManifestOptions, o as LoadedManifest, b as LogicalKey, p as NamespaceDefinition, q as VaultDefinition, r as VaultAuthConfig, s as SecretVaultProvider, t as ResolvedRoot, m as NamespaceName, u as RootResolution, v as SecretReference, g as CnosRuntime, w as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './core-BJ8xewez.cjs';
-export { l as RuntimeProvider, x as ValidationIssue, y as WorkspaceFile } from './core-BJ8xewez.cjs';
+import { j as DerivedValue, P as ParsedDerivation, N as NormalizedManifest, n as LoadManifestOptions, o as LoadedManifest, b as LogicalKey, p as NamespaceDefinition, q as VaultDefinition, r as VaultAuthConfig, s as SecretVaultProvider, t as ResolvedRoot, m as NamespaceName, u as RootResolution, v as SecretReference, g as CnosRuntime, w as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './core-CXgtC4VL.cjs';
+export { l as RuntimeProvider, x as ValidationIssue, y as WorkspaceFile } from './core-CXgtC4VL.cjs';
 
 declare class CnosError extends Error {
     constructor(message: string);

package/dist/internal.d.ts

@@ -1,5 +1,5 @@
-import { j as DerivedValue, P as ParsedDerivation, N as NormalizedManifest, n as LoadManifestOptions, o as LoadedManifest, b as LogicalKey, p as NamespaceDefinition, q as VaultDefinition, r as VaultAuthConfig, s as SecretVaultProvider, t as ResolvedRoot, m as NamespaceName, u as RootResolution, v as SecretReference, g as CnosRuntime, w as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './core-BJ8xewez.js';
-export { l as RuntimeProvider, x as ValidationIssue, y as WorkspaceFile } from './core-BJ8xewez.js';
+import { j as DerivedValue, P as ParsedDerivation, N as NormalizedManifest, n as LoadManifestOptions, o as LoadedManifest, b as LogicalKey, p as NamespaceDefinition, q as VaultDefinition, r as VaultAuthConfig, s as SecretVaultProvider, t as ResolvedRoot, m as NamespaceName, u as RootResolution, v as SecretReference, g as CnosRuntime, w as ValidationSummary, R as ResolvedGraph, S as ServerProjection } from './core-CXgtC4VL.js';
+export { l as RuntimeProvider, x as ValidationIssue, y as WorkspaceFile } from './core-CXgtC4VL.js';
 
 declare class CnosError extends Error {
     constructor(message: string);

package/dist/internal.js

@@ -11,7 +11,7 @@ import {
   serializeRuntimeGraph,
   serializeSecretPayload,
   serializeServerProjection
-} from "./chunk-GHGJFRDL.js";
+} from "./chunk-VTUOWV3S.js";
 import {
   CnosAuthenticationError,
   CnosSecurityError,
@@ -64,7 +64,7 @@ import {
   writeLocalSecret,
   writeRemoteRootCacheMetadata,
   writeVaultSessionKey
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-5XOGTE42.js";
 
 // src/codegen/generateTypes.ts
 function toPascalCase(value) {

package/dist/plugin/basic-schema.d.cts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../core-BJ8xewez.cjs';
+import { V as ValidatorPlugin } from '../core-CXgtC4VL.cjs';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.d.ts

@@ -1,4 +1,4 @@
-import { V as ValidatorPlugin } from '../core-BJ8xewez.js';
+import { V as ValidatorPlugin } from '../core-CXgtC4VL.js';
 
 declare function createBasicSchemaPlugin(): ValidatorPlugin;
 

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-5KIQCYFH.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-FWW7F52D.js";
+import "../chunk-5XOGTE42.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.d.cts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../core-BJ8xewez.cjs';
+import { a as ConfigEntry, L as LoaderPlugin } from '../core-CXgtC4VL.cjs';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.d.ts

@@ -1,4 +1,4 @@
-import { a as ConfigEntry, L as LoaderPlugin } from '../core-BJ8xewez.js';
+import { a as ConfigEntry, L as LoaderPlugin } from '../core-CXgtC4VL.js';
 
 interface ParsedCliArg {
     key: string;

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-2DGT7N7E.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-KU73PJSQ.js";
+import "../chunk-5XOGTE42.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../core-BJ8xewez.cjs';
-import { E as EnvMappingConfig } from '../envNaming-rx71gpi0.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../core-CXgtC4VL.cjs';
+import { E as EnvMappingConfig } from '../envNaming-BDtISWCK.cjs';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../core-BJ8xewez.js';
-import { E as EnvMappingConfig } from '../envNaming-BRyiuPoI.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../core-CXgtC4VL.js';
+import { E as EnvMappingConfig } from '../envNaming-CA6OluSg.js';
 
 declare function parseDotenv(document: string): Record<string, string>;
 declare function dotenvEntriesFromObject(values: Record<string, string>, mapping?: EnvMappingConfig, originFile?: string, workspaceId?: string): ConfigEntry[];

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-OA7FQGAG.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-DQGLBF6G.js";
+import "../chunk-5XOGTE42.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.d.cts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../core-BJ8xewez.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-ivRtLjcw.cjs';
+import { E as ExporterPlugin } from '../core-CXgtC4VL.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-C_MbUTdV.cjs';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.d.ts

@@ -1,5 +1,5 @@
-import { E as ExporterPlugin } from '../core-BJ8xewez.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CCSgdvI9.js';
+import { E as ExporterPlugin } from '../core-CXgtC4VL.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-B_dZDXDv.js';
 
 declare function createEnvExportPlugin(): ExporterPlugin;
 declare function createPublicEnvExportPlugin(): ExporterPlugin;

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-RYIARE4M.js";
+} from "../chunk-B5TV5O6O.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-2TL42I6M.js";
+} from "../chunk-5XOGTE42.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.d.cts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, m as NamespaceName } from '../core-BJ8xewez.cjs';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, m as NamespaceName } from '../core-CXgtC4VL.cjs';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.d.ts

@@ -1,4 +1,4 @@
-import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, m as NamespaceName } from '../core-BJ8xewez.js';
+import { L as LoaderPlugin, a as ConfigEntry, W as WorkspaceRoot, m as NamespaceName } from '../core-CXgtC4VL.js';
 
 declare function filesystemSecretsReader(filePath: string, document: string, workspaceId?: string): ConfigEntry[];
 declare function createFilesystemSecretsPlugin(): LoaderPlugin;

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-TT4NV56Z.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-DAFUP7EQ.js";
+import "../chunk-5XOGTE42.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.d.cts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../core-BJ8xewez.cjs';
-import { E as EnvMappingConfig } from '../envNaming-rx71gpi0.cjs';
+import { L as LoaderPlugin, a as ConfigEntry } from '../core-CXgtC4VL.cjs';
+import { E as EnvMappingConfig } from '../envNaming-BDtISWCK.cjs';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
 declare function processNamespaceEntriesFromContext(env: Record<string, string | undefined>, workspaceId?: string): ConfigEntry[];

package/dist/plugin/process-env.d.ts

@@ -1,5 +1,5 @@
-import { L as LoaderPlugin, a as ConfigEntry } from '../core-BJ8xewez.js';
-import { E as EnvMappingConfig } from '../envNaming-BRyiuPoI.js';
+import { L as LoaderPlugin, a as ConfigEntry } from '../core-CXgtC4VL.js';
+import { E as EnvMappingConfig } from '../envNaming-CA6OluSg.js';
 
 declare function processEnvEntriesFromObject(env: Record<string, string | undefined>, mapping?: EnvMappingConfig, workspaceId?: string): ConfigEntry[];
 declare function processNamespaceEntriesFromContext(env: Record<string, string | undefined>, workspaceId?: string): ConfigEntry[];

package/dist/plugin/process-env.js

@@ -2,8 +2,8 @@ import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,
   processNamespaceEntriesFromContext
-} from "../chunk-UL63DFLS.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-4MQBH4AY.js";
+import "../chunk-5XOGTE42.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,

package/dist/runtime/index.cjs

@@ -1516,7 +1516,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2620,7 +2620,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2778,8 +2778,8 @@ var SecretCache = class {
   }
 };
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2833,6 +2833,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -2928,6 +2932,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2983,7 +2990,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3169,6 +3176,9 @@ function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return (0, import_node_crypto3.createHash)("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3186,6 +3196,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3202,6 +3215,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3683,7 +3699,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.0",
+  version: "1.8.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/runtime/index.d.cts

@@ -1,4 +1,4 @@
-import { b as LogicalKey, g as CnosRuntime, I as InspectResult } from '../core-BJ8xewez.cjs';
+import { b as LogicalKey, g as CnosRuntime, I as InspectResult } from '../core-CXgtC4VL.cjs';
 
 interface CnosSingleton {
     <T = unknown>(key: LogicalKey): T | undefined;

package/dist/runtime/index.d.ts

@@ -1,4 +1,4 @@
-import { b as LogicalKey, g as CnosRuntime, I as InspectResult } from '../core-BJ8xewez.js';
+import { b as LogicalKey, g as CnosRuntime, I as InspectResult } from '../core-CXgtC4VL.js';
 
 interface CnosSingleton {
     <T = unknown>(key: LogicalKey): T | undefined;

package/dist/runtime/index.js

@@ -1,15 +1,15 @@
 import {
   runtime_default
-} from "../chunk-CW7SNVIQ.js";
-import "../chunk-GHGJFRDL.js";
-import "../chunk-ZD4YX6VC.js";
-import "../chunk-RYIARE4M.js";
-import "../chunk-TT4NV56Z.js";
-import "../chunk-UL63DFLS.js";
-import "../chunk-5KIQCYFH.js";
-import "../chunk-2DGT7N7E.js";
-import "../chunk-OA7FQGAG.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-CP6K2DB3.js";
+import "../chunk-VTUOWV3S.js";
+import "../chunk-J7VEEREE.js";
+import "../chunk-DQGLBF6G.js";
+import "../chunk-B5TV5O6O.js";
+import "../chunk-DAFUP7EQ.js";
+import "../chunk-4MQBH4AY.js";
+import "../chunk-FWW7F52D.js";
+import "../chunk-KU73PJSQ.js";
+import "../chunk-5XOGTE42.js";
 export {
   runtime_default as default
 };

package/dist/{toPublicEnv-CCSgdvI9.d.ts → toPublicEnv-B_dZDXDv.d.ts}

@@ -1,4 +1,4 @@
-import { R as ResolvedGraph, N as NormalizedManifest, T as ToEnvOptions, c as ToPublicEnvOptions } from './core-BJ8xewez.js';
+import { R as ResolvedGraph, N as NormalizedManifest, T as ToEnvOptions, c as ToPublicEnvOptions } from './core-CXgtC4VL.js';
 
 declare function toEnv(graph: ResolvedGraph, manifest: NormalizedManifest, options?: ToEnvOptions, helpers?: {
     read?: (key: string) => unknown;

package/dist/{toPublicEnv-ivRtLjcw.d.cts → toPublicEnv-C_MbUTdV.d.cts}

@@ -1,4 +1,4 @@
-import { R as ResolvedGraph, N as NormalizedManifest, T as ToEnvOptions, c as ToPublicEnvOptions } from './core-BJ8xewez.cjs';
+import { R as ResolvedGraph, N as NormalizedManifest, T as ToEnvOptions, c as ToPublicEnvOptions } from './core-CXgtC4VL.cjs';
 
 declare function toEnv(graph: ResolvedGraph, manifest: NormalizedManifest, options?: ToEnvOptions, helpers?: {
     read?: (key: string) => unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "Batteries-included CNOS runtime package wired with the official plugins.",
   "type": "module",
   "main": "./dist/index.cjs",