@kitsy/cnos 1.8.1 → 1.8.3

package/dist/build/index.cjs

@@ -1517,7 +1517,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2621,7 +2621,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2779,8 +2779,8 @@ var SecretCache = class {
   }
 };
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2834,6 +2834,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -2929,6 +2933,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2984,7 +2991,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3166,10 +3173,20 @@ function stableSortObject(value) {
 function stripValuePrefix(key) {
   return key.startsWith("value.") ? key.slice("value.".length) : key;
 }
+function resolveProjectedEnvVar(manifest, vaultId, ref) {
+  const mapping = manifest.vaults[vaultId]?.mapping;
+  if (!mapping) {
+    return void 0;
+  }
+  return Object.entries(mapping).find(([, logicalRef]) => logicalRef === ref)?.[0];
+}
 function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return (0, import_node_crypto3.createHash)("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3179,14 +3196,22 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
   const publicKeys = Array.from(graph.entries.values()).filter((entry) => entry.namespace === "public").map((entry) => entry.key.slice("public.".length)).sort((left, right) => left.localeCompare(right));
   for (const [key, entry] of graph.entries) {
     if (entry.namespace === "secret" && isSecretReference(entry.value)) {
+      const vaultId = entry.value.vault ?? "default";
+      const envVar = resolveProjectedEnvVar(manifest, vaultId, entry.value.ref);
       secretRefs[key.slice("secret.".length)] = {
         provider: entry.value.provider,
-        vault: entry.value.vault ?? "default",
-        ref: entry.value.ref
+        vault: vaultId,
+        ref: entry.value.ref,
+        ...envVar ? {
+          envVar
+        } : {}
       };
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3203,6 +3228,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3631,7 +3659,7 @@ async function createCnos(options = {}) {
   });
   const schemaApplied = applySchemaRules(graph, loadedManifest.manifest.schema);
   const promotedGraph = promoteToPublic(schemaApplied.graph, loadedManifest.manifest);
-  const secretCache = options.secretResolution === "lazy" ? void 0 : await batchResolveSecrets(promotedGraph, loadedManifest.manifest, options.processEnv);
+  const secretCache = options.secretResolution === "lazy" ? new SecretCache() : await batchResolveSecrets(promotedGraph, loadedManifest.manifest, options.processEnv);
   return createRuntime(
     loadedManifest.manifest,
     appendMetaEntries({
@@ -3684,7 +3712,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.1",
+  version: "1.8.3",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/build/index.d.cts

@@ -1,4 +1,4 @@
-import { C as CnosCreateOptions, S as ServerProjection } from '../core-BJ8xewez.cjs';
+import { C as CnosCreateOptions, S as ServerProjection } from '../core-zDTUSVx9.cjs';
 
 type BrowserDataMap = Record<string, unknown>;
 type FrameworkEnvTarget = 'generic' | 'vite' | 'next' | 'webpack' | (string & {});

package/dist/build/index.d.ts

@@ -1,4 +1,4 @@
-import { C as CnosCreateOptions, S as ServerProjection } from '../core-BJ8xewez.js';
+import { C as CnosCreateOptions, S as ServerProjection } from '../core-zDTUSVx9.js';
 
 type BrowserDataMap = Record<string, unknown>;
 type FrameworkEnvTarget = 'generic' | 'vite' | 'next' | 'webpack' | (string & {});

package/dist/build/index.js

@@ -1,13 +1,13 @@
 import {
   createCnos
-} from "../chunk-FJOOJGUD.js";
-import "../chunk-OA7FQGAG.js";
-import "../chunk-RYIARE4M.js";
-import "../chunk-TT4NV56Z.js";
-import "../chunk-UL63DFLS.js";
-import "../chunk-5KIQCYFH.js";
-import "../chunk-2DGT7N7E.js";
-import "../chunk-2TL42I6M.js";
+} from "../chunk-7MUDEJSP.js";
+import "../chunk-JQLV4OQU.js";
+import "../chunk-4AAA2RHV.js";
+import "../chunk-UMVFSHP2.js";
+import "../chunk-N5DX5QEB.js";
+import "../chunk-36AR262B.js";
+import "../chunk-EJT2VJTM.js";
+import "../chunk-ZH5QZQ7C.js";
 
 // src/build/index.ts
 async function resolveBrowserData(options = {}) {

package/dist/{chunk-2DGT7N7E.js → chunk-36AR262B.js}

@@ -1,6 +1,6 @@
 import {
   joinConfigPath
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/{chunk-TT4NV56Z.js → chunk-4AAA2RHV.js}

@@ -4,7 +4,7 @@ import {
   isSecretReference,
   parseYaml,
   toPortablePath
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";

package/dist/{chunk-FJOOJGUD.js → chunk-7MUDEJSP.js}

@@ -1,27 +1,27 @@
-import {
-  createDotenvPlugin
-} from "./chunk-OA7FQGAG.js";
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-RYIARE4M.js";
+} from "./chunk-JQLV4OQU.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-TT4NV56Z.js";
+} from "./chunk-4AAA2RHV.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-UL63DFLS.js";
+} from "./chunk-UMVFSHP2.js";
 import {
   createBasicSchemaPlugin
-} from "./chunk-5KIQCYFH.js";
+} from "./chunk-N5DX5QEB.js";
 import {
   createCliArgsPlugin
-} from "./chunk-2DGT7N7E.js";
+} from "./chunk-36AR262B.js";
+import {
+  createDotenvPlugin
+} from "./chunk-EJT2VJTM.js";
 import {
   createCnos,
   createProvenanceInspector
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // src/defaultPlugins.ts
 function defaultPlugins() {
@@ -68,7 +68,7 @@ function setBootstrappedSecretHydrationRequired(value) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.1",
+  version: "1.8.3",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/{chunk-GHGJFRDL.js → chunk-DL5G3QSZ.js}

@@ -1,6 +1,6 @@
 import {
   isSecretReference
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // src/runtime/bootstrap.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

package/dist/{chunk-OA7FQGAG.js → chunk-EJT2VJTM.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-RYIARE4M.js → chunk-JQLV4OQU.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/{chunk-5KIQCYFH.js → chunk-N5DX5QEB.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/{chunk-6IYR3LVA.js → chunk-SUMWGMRA.js}

@@ -3,7 +3,7 @@ import {
   graphRequiresSecretHydration,
   readRuntimeGraphFromEnv,
   readServerProjectionFromEnv
-} from "./chunk-GHGJFRDL.js";
+} from "./chunk-DL5G3QSZ.js";
 import {
   createCnos,
   getBootstrappedSecretHydrationRequired,
@@ -12,7 +12,7 @@ import {
   setBootstrappedSecretHydrationRequired,
   setSingletonReady,
   setSingletonRuntime
-} from "./chunk-FJOOJGUD.js";
+} from "./chunk-7MUDEJSP.js";
 import {
   createDefaultRuntimeProviders,
   createDerivedRuntimeSupport,
@@ -28,7 +28,7 @@ import {
   toLogicalKey,
   toNamespaceObject,
   toPublicEnv
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // src/runtime/index.ts
 import { existsSync, readFileSync } from "fs";
@@ -474,7 +474,14 @@ function attachBootstrappedProjection(projection, force = false) {
     if (!ref) {
       return void 0;
     }
-    const definition = { provider: ref.provider };
+    const definition = {
+      provider: ref.provider,
+      ...ref.envVar ? {
+        mapping: {
+          [ref.envVar]: ref.ref
+        }
+      } : {}
+    };
     const provider = createSecretVaultProvider(ref.vault ?? "default", definition, process.env);
     const auth = await resolveVaultAuth(ref.vault ?? "default", definition, process.env);
     await provider.authenticate(auth);

package/dist/{chunk-UL63DFLS.js → chunk-UMVFSHP2.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-2TL42I6M.js";
+} from "./chunk-ZH5QZQ7C.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";

package/dist/{chunk-2TL42I6M.js → chunk-ZH5QZQ7C.js}

@@ -1532,7 +1532,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2019,7 +2019,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2134,8 +2134,8 @@ async function removeLocalVaultFiles(storeRoot, vault = "default") {
   await rm2(path8.join(storeRoot, "vaults", vault), { recursive: true, force: true });
 }
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2189,6 +2189,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/auditLog.ts
 import { appendFile, mkdir as mkdir5 } from "fs/promises";
 import path9 from "path";
@@ -2301,6 +2305,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2356,7 +2363,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3558,10 +3565,20 @@ function stableSortObject(value) {
 function stripValuePrefix(key) {
   return key.startsWith("value.") ? key.slice("value.".length) : key;
 }
+function resolveProjectedEnvVar(manifest, vaultId, ref) {
+  const mapping = manifest.vaults[vaultId]?.mapping;
+  if (!mapping) {
+    return void 0;
+  }
+  return Object.entries(mapping).find(([, logicalRef]) => logicalRef === ref)?.[0];
+}
 function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return createHash2("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3571,14 +3588,22 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
   const publicKeys = Array.from(graph.entries.values()).filter((entry) => entry.namespace === "public").map((entry) => entry.key.slice("public.".length)).sort((left, right) => left.localeCompare(right));
   for (const [key, entry] of graph.entries) {
     if (entry.namespace === "secret" && isSecretReference(entry.value)) {
+      const vaultId = entry.value.vault ?? "default";
+      const envVar = resolveProjectedEnvVar(manifest, vaultId, entry.value.ref);
       secretRefs[key.slice("secret.".length)] = {
         provider: entry.value.provider,
-        vault: entry.value.vault ?? "default",
-        ref: entry.value.ref
+        vault: vaultId,
+        ref: entry.value.ref,
+        ...envVar ? {
+          envVar
+        } : {}
       };
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3595,6 +3620,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3926,7 +3954,7 @@ async function createCnos(options = {}) {
   });
   const schemaApplied = applySchemaRules(graph, loadedManifest.manifest.schema);
   const promotedGraph = promoteToPublic(schemaApplied.graph, loadedManifest.manifest);
-  const secretCache = options.secretResolution === "lazy" ? void 0 : await batchResolveSecrets(promotedGraph, loadedManifest.manifest, options.processEnv);
+  const secretCache = options.secretResolution === "lazy" ? new SecretCache() : await batchResolveSecrets(promotedGraph, loadedManifest.manifest, options.processEnv);
   return createRuntime(
     loadedManifest.manifest,
     appendMetaEntries({

package/dist/configure/index.cjs

@@ -1519,7 +1519,7 @@ function normalizeVaultAuth(vaultName, provider, auth) {
       ...auth?.config ? { config: auth.config } : {}
     };
   }
-  if (provider === "github-secrets") {
+  if (provider === "github-secrets" || provider === "environment") {
     return {
       method: auth?.method ?? "environment",
       ...auth?.config ? { config: auth.config } : {}
@@ -2623,7 +2623,7 @@ function resolveConfiguredVaultPassphrase(definition, vault = "default", process
 }
 async function resolveVaultAccessKey(storeRoot, definition, vault = "default", processEnv = process.env) {
   if (definition?.provider !== "local") {
-    return definition?.provider === "github-secrets" ? {
+    return definition?.provider === "github-secrets" || definition?.provider === "environment" ? {
       method: definition.auth?.method ?? "environment",
       ...definition?.auth?.config ? { config: definition.auth.config } : {}
     } : void 0;
@@ -2781,8 +2781,8 @@ var SecretCache = class {
   }
 };
 
-// ../core/src/secrets/providers/github.ts
-var GithubSecretsVaultProvider = class {
+// ../core/src/secrets/providers/environment.ts
+var EnvironmentSecretsVaultProvider = class {
   constructor(vaultId, definition, processEnv = process.env) {
     this.vaultId = vaultId;
     this.definition = definition;
@@ -2836,6 +2836,10 @@ var GithubSecretsVaultProvider = class {
   }
 };
 
+// ../core/src/secrets/providers/github.ts
+var GithubSecretsVaultProvider = class extends EnvironmentSecretsVaultProvider {
+};
+
 // ../core/src/secrets/providers/local.ts
 var LocalSecretVaultProvider = class _LocalSecretVaultProvider {
   constructor(vaultId, definition, processEnv = process.env, storeRoot = resolveSecretStoreRoot(processEnv)) {
@@ -2931,6 +2935,9 @@ function createSecretVaultProvider(vaultId, definition, processEnv) {
   if (definition.provider === "local") {
     return new LocalSecretVaultProvider(vaultId, definition, processEnv);
   }
+  if (definition.provider === "environment") {
+    return new EnvironmentSecretsVaultProvider(vaultId, definition, processEnv);
+  }
   if (definition.provider === "github-secrets") {
     return new GithubSecretsVaultProvider(vaultId, definition, processEnv);
   }
@@ -2986,7 +2993,7 @@ async function resolveVaultAuth(vaultId, definition, processEnv = process.env) {
       ...definition.auth?.config ? { config: definition.auth.config } : {}
     };
   }
-  if (definition.provider === "github-secrets") {
+  if (definition.provider === "github-secrets" || definition.provider === "environment") {
     return {
       method: definition.auth?.method ?? "environment",
       ...definition.auth?.config ? { config: definition.auth.config } : {}
@@ -3168,10 +3175,20 @@ function stableSortObject(value) {
 function stripValuePrefix(key) {
   return key.startsWith("value.") ? key.slice("value.".length) : key;
 }
+function resolveProjectedEnvVar(manifest, vaultId, ref) {
+  const mapping = manifest.vaults[vaultId]?.mapping;
+  if (!mapping) {
+    return void 0;
+  }
+  return Object.entries(mapping).find(([, logicalRef]) => logicalRef === ref)?.[0];
+}
 function configHash(values) {
   const serialized = JSON.stringify(stableSortObject(values));
   return (0, import_node_crypto3.createHash)("sha256").update(serialized).digest("hex");
 }
+function shouldProjectResolvedValue(sourceId) {
+  return sourceId !== "process-env";
+}
 function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers = {}) {
   const values = {};
   const derived = {};
@@ -3181,14 +3198,22 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
   const publicKeys = Array.from(graph.entries.values()).filter((entry) => entry.namespace === "public").map((entry) => entry.key.slice("public.".length)).sort((left, right) => left.localeCompare(right));
   for (const [key, entry] of graph.entries) {
     if (entry.namespace === "secret" && isSecretReference(entry.value)) {
+      const vaultId = entry.value.vault ?? "default";
+      const envVar = resolveProjectedEnvVar(manifest, vaultId, entry.value.ref);
       secretRefs[key.slice("secret.".length)] = {
         provider: entry.value.provider,
-        vault: entry.value.vault ?? "default",
-        ref: entry.value.ref
+        vault: vaultId,
+        ref: entry.value.ref,
+        ...envVar ? {
+          envVar
+        } : {}
       };
       continue;
     }
     if (entry.namespace === "value") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3205,6 +3230,9 @@ function toServerProjection(graph, manifest, cnosVersion = "0.0.0-dev", helpers
     }
     const namespaceDefinition = manifest.namespaces[entry.namespace];
     if (namespaceDefinition && namespaceDefinition.kind === "data" && !namespaceDefinition.sensitive && entry.namespace !== "public") {
+      if (!shouldProjectResolvedValue(entry.winner.sourceId)) {
+        continue;
+      }
       if (helpers.isRuntimeDependent?.(key)) {
         const formula = helpers.toServerFormula?.(key);
         if (formula) {
@@ -3633,7 +3661,7 @@ async function createCnos(options = {}) {
   });
   const schemaApplied = applySchemaRules(graph, loadedManifest.manifest.schema);
   const promotedGraph = promoteToPublic(schemaApplied.graph, loadedManifest.manifest);
-  const secretCache = options.secretResolution === "lazy" ? void 0 : await batchResolveSecrets(promotedGraph, loadedManifest.manifest, options.processEnv);
+  const secretCache = options.secretResolution === "lazy" ? new SecretCache() : await batchResolveSecrets(promotedGraph, loadedManifest.manifest, options.processEnv);
   return createRuntime(
     loadedManifest.manifest,
     appendMetaEntries({
@@ -3728,7 +3756,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.1",
+  version: "1.8.3",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/configure/index.d.cts

@@ -1,6 +1,6 @@
-import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-BJ8xewez.cjs';
-export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-BJ8xewez.cjs';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-ivRtLjcw.cjs';
+import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-zDTUSVx9.cjs';
+export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-zDTUSVx9.cjs';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-Ds1DRwCX.cjs';
 
 declare function planDump(graph: ResolvedGraph, options?: DumpPlanOptions): DumpPlan;
 declare function writeDump(graph: ResolvedGraph, options: DumpOptions): Promise<DumpResult>;

package/dist/configure/index.d.ts

@@ -1,6 +1,6 @@
-import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-BJ8xewez.js';
-export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-BJ8xewez.js';
-export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CCSgdvI9.js';
+import { R as ResolvedGraph, D as DumpPlanOptions, d as DumpPlan, e as DumpOptions, f as DumpResult, C as CnosCreateOptions, g as CnosRuntime, h as CnosPlugin } from '../core-zDTUSVx9.js';
+export { a as ConfigEntry, i as DerivedFormula, j as DerivedValue, k as ExprNode, I as InspectResult, L as LoaderPlugin, b as LogicalKey, M as ManifestFile, N as NormalizedManifest, P as ParsedDerivation, l as RuntimeProvider, T as ToEnvOptions, c as ToPublicEnvOptions } from '../core-zDTUSVx9.js';
+export { t as toEnv, a as toPublicEnv } from '../toPublicEnv-CT265rzS.js';
 
 declare function planDump(graph: ResolvedGraph, options?: DumpPlanOptions): DumpPlan;
 declare function writeDump(graph: ResolvedGraph, options: DumpOptions): Promise<DumpResult>;

package/dist/configure/index.js

@@ -1,19 +1,19 @@
 import {
   createCnos,
   defaultPlugins
-} from "../chunk-FJOOJGUD.js";
-import "../chunk-OA7FQGAG.js";
-import "../chunk-RYIARE4M.js";
-import "../chunk-TT4NV56Z.js";
-import "../chunk-UL63DFLS.js";
-import "../chunk-5KIQCYFH.js";
-import "../chunk-2DGT7N7E.js";
+} from "../chunk-7MUDEJSP.js";
+import "../chunk-JQLV4OQU.js";
+import "../chunk-4AAA2RHV.js";
+import "../chunk-UMVFSHP2.js";
+import "../chunk-N5DX5QEB.js";
+import "../chunk-36AR262B.js";
+import "../chunk-EJT2VJTM.js";
 import {
   planDump,
   toEnv,
   toPublicEnv,
   writeDump
-} from "../chunk-2TL42I6M.js";
+} from "../chunk-ZH5QZQ7C.js";
 export {
   createCnos,
   defaultPlugins,

package/dist/{core-BJ8xewez.d.cts → core-zDTUSVx9.d.cts}

@@ -46,7 +46,7 @@ interface WorkspaceContext {
 type ResolutionArrayPolicy = 'replace' | 'append' | 'unique-append';
 type NamespaceKind = 'data' | 'projection' | 'system';
 type NamespaceProjectionSource = 'promote' | 'envMapping';
-type VaultProviderName = 'local' | 'github-secrets' | (string & {});
+type VaultProviderName = 'local' | 'environment' | 'github-secrets' | (string & {});
 type VaultAuthMethod = 'passphrase' | 'environment' | 'token' | 'iam' | 'keychain';
 interface RuntimeNamespaceDefinition {
     description?: string;
@@ -467,7 +467,9 @@ interface ServerProjection {
     configHash: string;
     values: Record<string, unknown>;
     derived: Record<string, DerivedFormula>;
-    secretRefs: Record<string, SecretReference>;
+    secretRefs: Record<string, SecretReference & {
+        envVar?: string;
+    }>;
     publicKeys: string[];
     runtimeNamespaces: string[];
     meta: {