@kitsy/cnos 1.8.3 → 1.9.0

package/dist/build/index.cjs

@@ -3279,7 +3279,7 @@ function normalizeEnvValue(value) {
   return JSON.stringify(value);
 }
 function toEnv(graph, manifest, options = {}, helpers = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
+  const includeSecrets = options.includeSecrets ?? false;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
     ([left], [right]) => left.localeCompare(right)
@@ -3290,19 +3290,24 @@ function toEnv(graph, manifest, options = {}, helpers = {}) {
       continue;
     }
     const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
-    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+    const isSecretNamespace = entry.namespace === "secret";
+    if (namespaceDefinition.kind !== "data") {
       continue;
     }
-    if (entry.namespace === "secret" && !includeSecrets) {
-      continue;
-    }
-    if (isSecretReference(entry.value)) {
+    if (isSecretNamespace) {
+      if (!includeSecrets) {
+        continue;
+      }
+    } else if (!namespaceDefinition.shareable || namespaceDefinition.sensitive) {
       continue;
     }
     const value = helpers.read ? helpers.read(logicalKey) : entry.value;
     if (value === void 0) {
       continue;
     }
+    if (isSecretReference(value) || !isSecretNamespace && isSecretReference(entry.value)) {
+      continue;
+    }
     output[envVar] = normalizeEnvValue(value);
   }
   return output;
@@ -3712,7 +3717,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.3",
+  version: "1.9.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",
@@ -4436,12 +4441,33 @@ async function resolveFrameworkEnv(options = {}, framework = "generic", envOptio
   });
 }
 async function resolveServerProjection(options = {}) {
+  const secretResolution = options.secretResolution ?? "lazy";
   const runtime = await createCnos2({
     ...options,
-    cacheMode: options.cacheMode ?? "build"
+    cacheMode: options.cacheMode ?? "build",
+    secretResolution
   });
+  validateServerProjectionSecretRefs(runtime);
   return runtime.toServerProjection();
 }
+function validateServerProjectionSecretRefs(runtime) {
+  for (const entry of runtime.graph.entries.values()) {
+    if (entry.namespace !== "secret" || !isSecretReference(entry.value)) {
+      continue;
+    }
+    const vaultId = entry.value.vault ?? "default";
+    const definition = runtime.manifest.vaults[vaultId];
+    if (!definition) {
+      throw new CnosManifestError(`Unknown vault "${vaultId}" for secret ref "${entry.key}"`);
+    }
+    if (entry.value.provider !== definition.provider) {
+      throw new CnosManifestError(
+        `Secret ref "${entry.key}" declares provider "${entry.value.provider}" but vault "${vaultId}" uses provider "${definition.provider}"`
+      );
+    }
+    createSecretVaultProvider(vaultId, definition);
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   resolveBrowserData,

package/dist/build/index.js

@@ -1,13 +1,17 @@
 import {
   createCnos
-} from "../chunk-7MUDEJSP.js";
-import "../chunk-JQLV4OQU.js";
-import "../chunk-4AAA2RHV.js";
-import "../chunk-UMVFSHP2.js";
-import "../chunk-N5DX5QEB.js";
-import "../chunk-36AR262B.js";
-import "../chunk-EJT2VJTM.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-FSGSOF5Q.js";
+import "../chunk-ZTDPBZ7R.js";
+import "../chunk-YLFA2KTF.js";
+import "../chunk-4JFSS3DN.js";
+import "../chunk-HZYH2DQ4.js";
+import "../chunk-PC5C3CBB.js";
+import "../chunk-4WT5RCA6.js";
+import {
+  CnosManifestError,
+  createSecretVaultProvider,
+  isSecretReference
+} from "../chunk-O4YQMDFY.js";
 
 // src/build/index.ts
 async function resolveBrowserData(options = {}) {
@@ -86,12 +90,33 @@ async function resolveFrameworkEnv(options = {}, framework = "generic", envOptio
   });
 }
 async function resolveServerProjection(options = {}) {
+  const secretResolution = options.secretResolution ?? "lazy";
   const runtime = await createCnos({
     ...options,
-    cacheMode: options.cacheMode ?? "build"
+    cacheMode: options.cacheMode ?? "build",
+    secretResolution
   });
+  validateServerProjectionSecretRefs(runtime);
   return runtime.toServerProjection();
 }
+function validateServerProjectionSecretRefs(runtime) {
+  for (const entry of runtime.graph.entries.values()) {
+    if (entry.namespace !== "secret" || !isSecretReference(entry.value)) {
+      continue;
+    }
+    const vaultId = entry.value.vault ?? "default";
+    const definition = runtime.manifest.vaults[vaultId];
+    if (!definition) {
+      throw new CnosManifestError(`Unknown vault "${vaultId}" for secret ref "${entry.key}"`);
+    }
+    if (entry.value.provider !== definition.provider) {
+      throw new CnosManifestError(
+        `Secret ref "${entry.key}" declares provider "${entry.value.provider}" but vault "${vaultId}" uses provider "${definition.provider}"`
+      );
+    }
+    createSecretVaultProvider(vaultId, definition);
+  }
+}
 export {
   resolveBrowserData,
   resolveFrameworkEnv,

package/dist/{chunk-UMVFSHP2.js → chunk-4JFSS3DN.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";

package/dist/{chunk-EJT2VJTM.js → chunk-4WT5RCA6.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-SUMWGMRA.js → chunk-6YY3U7WB.js}

@@ -3,7 +3,7 @@ import {
   graphRequiresSecretHydration,
   readRuntimeGraphFromEnv,
   readServerProjectionFromEnv
-} from "./chunk-DL5G3QSZ.js";
+} from "./chunk-DKHI52KZ.js";
 import {
   createCnos,
   getBootstrappedSecretHydrationRequired,
@@ -12,7 +12,7 @@ import {
   setBootstrappedSecretHydrationRequired,
   setSingletonReady,
   setSingletonRuntime
-} from "./chunk-7MUDEJSP.js";
+} from "./chunk-FSGSOF5Q.js";
 import {
   createDefaultRuntimeProviders,
   createDerivedRuntimeSupport,
@@ -28,7 +28,7 @@ import {
   toLogicalKey,
   toNamespaceObject,
   toPublicEnv
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // src/runtime/index.ts
 import { existsSync, readFileSync } from "fs";

package/dist/{chunk-DL5G3QSZ.js → chunk-DKHI52KZ.js}

@@ -1,6 +1,6 @@
 import {
   isSecretReference
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // src/runtime/bootstrap.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

package/dist/{chunk-7MUDEJSP.js → chunk-FSGSOF5Q.js}

@@ -1,27 +1,27 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-JQLV4OQU.js";
+} from "./chunk-ZTDPBZ7R.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-4AAA2RHV.js";
+} from "./chunk-YLFA2KTF.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-UMVFSHP2.js";
+} from "./chunk-4JFSS3DN.js";
 import {
   createBasicSchemaPlugin
-} from "./chunk-N5DX5QEB.js";
+} from "./chunk-HZYH2DQ4.js";
 import {
   createCliArgsPlugin
-} from "./chunk-36AR262B.js";
+} from "./chunk-PC5C3CBB.js";
 import {
   createDotenvPlugin
-} from "./chunk-EJT2VJTM.js";
+} from "./chunk-4WT5RCA6.js";
 import {
   createCnos,
   createProvenanceInspector
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // src/defaultPlugins.ts
 function defaultPlugins() {
@@ -68,7 +68,7 @@ function setBootstrappedSecretHydrationRequired(value) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.3",
+  version: "1.9.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/{chunk-N5DX5QEB.js → chunk-HZYH2DQ4.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/{chunk-ZH5QZQ7C.js → chunk-O4YQMDFY.js}

@@ -2505,7 +2505,7 @@ function normalizeEnvValue(value) {
   return JSON.stringify(value);
 }
 function toEnv(graph, manifest, options = {}, helpers = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
+  const includeSecrets = options.includeSecrets ?? false;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
     ([left], [right]) => left.localeCompare(right)
@@ -2516,19 +2516,24 @@ function toEnv(graph, manifest, options = {}, helpers = {}) {
       continue;
     }
     const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
-    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+    const isSecretNamespace = entry.namespace === "secret";
+    if (namespaceDefinition.kind !== "data") {
       continue;
     }
-    if (entry.namespace === "secret" && !includeSecrets) {
-      continue;
-    }
-    if (isSecretReference(entry.value)) {
+    if (isSecretNamespace) {
+      if (!includeSecrets) {
+        continue;
+      }
+    } else if (!namespaceDefinition.shareable || namespaceDefinition.sensitive) {
       continue;
     }
     const value = helpers.read ? helpers.read(logicalKey) : entry.value;
     if (value === void 0) {
       continue;
     }
+    if (isSecretReference(value) || !isSecretNamespace && isSecretReference(entry.value)) {
+      continue;
+    }
     output[envVar] = normalizeEnvValue(value);
   }
   return output;

package/dist/{chunk-36AR262B.js → chunk-PC5C3CBB.js}

@@ -1,6 +1,6 @@
 import {
   joinConfigPath
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/{chunk-4AAA2RHV.js → chunk-YLFA2KTF.js}

@@ -4,7 +4,7 @@ import {
   isSecretReference,
   parseYaml,
   toPortablePath
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";

package/dist/{chunk-JQLV4OQU.js → chunk-ZTDPBZ7R.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/configure/index.cjs

@@ -3281,7 +3281,7 @@ function normalizeEnvValue(value) {
   return JSON.stringify(value);
 }
 function toEnv(graph, manifest, options = {}, helpers = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
+  const includeSecrets = options.includeSecrets ?? false;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
     ([left], [right]) => left.localeCompare(right)
@@ -3292,19 +3292,24 @@ function toEnv(graph, manifest, options = {}, helpers = {}) {
       continue;
     }
     const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
-    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+    const isSecretNamespace = entry.namespace === "secret";
+    if (namespaceDefinition.kind !== "data") {
       continue;
     }
-    if (entry.namespace === "secret" && !includeSecrets) {
-      continue;
-    }
-    if (isSecretReference(entry.value)) {
+    if (isSecretNamespace) {
+      if (!includeSecrets) {
+        continue;
+      }
+    } else if (!namespaceDefinition.shareable || namespaceDefinition.sensitive) {
       continue;
     }
     const value = helpers.read ? helpers.read(logicalKey) : entry.value;
     if (value === void 0) {
       continue;
     }
+    if (isSecretReference(value) || !isSecretNamespace && isSecretReference(entry.value)) {
+      continue;
+    }
     output[envVar] = normalizeEnvValue(value);
   }
   return output;
@@ -3756,7 +3761,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.3",
+  version: "1.9.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/configure/index.js

@@ -1,19 +1,19 @@
 import {
   createCnos,
   defaultPlugins
-} from "../chunk-7MUDEJSP.js";
-import "../chunk-JQLV4OQU.js";
-import "../chunk-4AAA2RHV.js";
-import "../chunk-UMVFSHP2.js";
-import "../chunk-N5DX5QEB.js";
-import "../chunk-36AR262B.js";
-import "../chunk-EJT2VJTM.js";
+} from "../chunk-FSGSOF5Q.js";
+import "../chunk-ZTDPBZ7R.js";
+import "../chunk-YLFA2KTF.js";
+import "../chunk-4JFSS3DN.js";
+import "../chunk-HZYH2DQ4.js";
+import "../chunk-PC5C3CBB.js";
+import "../chunk-4WT5RCA6.js";
 import {
   planDump,
   toEnv,
   toPublicEnv,
   writeDump
-} from "../chunk-ZH5QZQ7C.js";
+} from "../chunk-O4YQMDFY.js";
 export {
   createCnos,
   defaultPlugins,

package/dist/index.cjs

@@ -3281,7 +3281,7 @@ function normalizeEnvValue(value) {
   return JSON.stringify(value);
 }
 function toEnv(graph, manifest, options = {}, helpers = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
+  const includeSecrets = options.includeSecrets ?? false;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
     ([left], [right]) => left.localeCompare(right)
@@ -3292,19 +3292,24 @@ function toEnv(graph, manifest, options = {}, helpers = {}) {
       continue;
     }
     const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
-    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+    const isSecretNamespace = entry.namespace === "secret";
+    if (namespaceDefinition.kind !== "data") {
       continue;
     }
-    if (entry.namespace === "secret" && !includeSecrets) {
-      continue;
-    }
-    if (isSecretReference(entry.value)) {
+    if (isSecretNamespace) {
+      if (!includeSecrets) {
+        continue;
+      }
+    } else if (!namespaceDefinition.shareable || namespaceDefinition.sensitive) {
       continue;
     }
     const value = helpers.read ? helpers.read(logicalKey) : entry.value;
     if (value === void 0) {
       continue;
     }
+    if (isSecretReference(value) || !isSecretNamespace && isSecretReference(entry.value)) {
+      continue;
+    }
     output[envVar] = normalizeEnvValue(value);
   }
   return output;
@@ -3714,7 +3719,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.3",
+  version: "1.9.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/index.js

@@ -1,15 +1,15 @@
 import {
   runtime_default
-} from "./chunk-SUMWGMRA.js";
-import "./chunk-DL5G3QSZ.js";
-import "./chunk-7MUDEJSP.js";
-import "./chunk-JQLV4OQU.js";
-import "./chunk-4AAA2RHV.js";
-import "./chunk-UMVFSHP2.js";
-import "./chunk-N5DX5QEB.js";
-import "./chunk-36AR262B.js";
-import "./chunk-EJT2VJTM.js";
-import "./chunk-ZH5QZQ7C.js";
+} from "./chunk-6YY3U7WB.js";
+import "./chunk-DKHI52KZ.js";
+import "./chunk-FSGSOF5Q.js";
+import "./chunk-ZTDPBZ7R.js";
+import "./chunk-YLFA2KTF.js";
+import "./chunk-4JFSS3DN.js";
+import "./chunk-HZYH2DQ4.js";
+import "./chunk-PC5C3CBB.js";
+import "./chunk-4WT5RCA6.js";
+import "./chunk-O4YQMDFY.js";
 export {
   runtime_default as cnos,
   runtime_default as default

package/dist/internal.js

@@ -11,7 +11,7 @@ import {
   serializeRuntimeGraph,
   serializeSecretPayload,
   serializeServerProjection
-} from "./chunk-DL5G3QSZ.js";
+} from "./chunk-DKHI52KZ.js";
 import {
   CnosAuthenticationError,
   CnosSecurityError,
@@ -64,7 +64,7 @@ import {
   writeLocalSecret,
   writeRemoteRootCacheMetadata,
   writeVaultSessionKey
-} from "./chunk-ZH5QZQ7C.js";
+} from "./chunk-O4YQMDFY.js";
 
 // src/codegen/generateTypes.ts
 function toPascalCase(value) {

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-N5DX5QEB.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-HZYH2DQ4.js";
+import "../chunk-O4YQMDFY.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-36AR262B.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-PC5C3CBB.js";
+import "../chunk-O4YQMDFY.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-EJT2VJTM.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-4WT5RCA6.js";
+import "../chunk-O4YQMDFY.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.cjs

@@ -174,7 +174,7 @@ function normalizeEnvValue(value) {
   return JSON.stringify(value);
 }
 function toEnv(graph, manifest, options = {}, helpers = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
+  const includeSecrets = options.includeSecrets ?? false;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
     ([left], [right]) => left.localeCompare(right)
@@ -185,19 +185,24 @@ function toEnv(graph, manifest, options = {}, helpers = {}) {
       continue;
     }
     const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
-    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+    const isSecretNamespace = entry.namespace === "secret";
+    if (namespaceDefinition.kind !== "data") {
       continue;
     }
-    if (entry.namespace === "secret" && !includeSecrets) {
-      continue;
-    }
-    if (isSecretReference(entry.value)) {
+    if (isSecretNamespace) {
+      if (!includeSecrets) {
+        continue;
+      }
+    } else if (!namespaceDefinition.shareable || namespaceDefinition.sensitive) {
       continue;
     }
     const value = helpers.read ? helpers.read(logicalKey) : entry.value;
     if (value === void 0) {
       continue;
     }
+    if (isSecretReference(value) || !isSecretNamespace && isSecretReference(entry.value)) {
+      continue;
+    }
     output[envVar] = normalizeEnvValue(value);
   }
   return output;

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-JQLV4OQU.js";
+} from "../chunk-ZTDPBZ7R.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-ZH5QZQ7C.js";
+} from "../chunk-O4YQMDFY.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-4AAA2RHV.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-YLFA2KTF.js";
+import "../chunk-O4YQMDFY.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.js

@@ -2,8 +2,8 @@ import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,
   processNamespaceEntriesFromContext
-} from "../chunk-UMVFSHP2.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-4JFSS3DN.js";
+import "../chunk-O4YQMDFY.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,

package/dist/runtime/index.cjs

@@ -3278,7 +3278,7 @@ function normalizeEnvValue(value) {
   return JSON.stringify(value);
 }
 function toEnv(graph, manifest, options = {}, helpers = {}) {
-  const includeSecrets = options.includeSecrets ?? true;
+  const includeSecrets = options.includeSecrets ?? false;
   const output = {};
   const mappedEntries = Object.entries(manifest.envMapping.explicit).sort(
     ([left], [right]) => left.localeCompare(right)
@@ -3289,19 +3289,24 @@ function toEnv(graph, manifest, options = {}, helpers = {}) {
       continue;
     }
     const namespaceDefinition = getNamespaceDefinition(manifest, entry.namespace);
-    if (namespaceDefinition.kind !== "data" || !namespaceDefinition.shareable || namespaceDefinition.sensitive) {
+    const isSecretNamespace = entry.namespace === "secret";
+    if (namespaceDefinition.kind !== "data") {
       continue;
     }
-    if (entry.namespace === "secret" && !includeSecrets) {
-      continue;
-    }
-    if (isSecretReference(entry.value)) {
+    if (isSecretNamespace) {
+      if (!includeSecrets) {
+        continue;
+      }
+    } else if (!namespaceDefinition.shareable || namespaceDefinition.sensitive) {
       continue;
     }
     const value = helpers.read ? helpers.read(logicalKey) : entry.value;
     if (value === void 0) {
       continue;
     }
+    if (isSecretReference(value) || !isSecretNamespace && isSecretReference(entry.value)) {
+      continue;
+    }
     output[envVar] = normalizeEnvValue(value);
   }
   return output;
@@ -3711,7 +3716,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.8.3",
+  version: "1.9.0",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/runtime/index.js

@@ -1,15 +1,15 @@
 import {
   runtime_default
-} from "../chunk-SUMWGMRA.js";
-import "../chunk-DL5G3QSZ.js";
-import "../chunk-7MUDEJSP.js";
-import "../chunk-JQLV4OQU.js";
-import "../chunk-4AAA2RHV.js";
-import "../chunk-UMVFSHP2.js";
-import "../chunk-N5DX5QEB.js";
-import "../chunk-36AR262B.js";
-import "../chunk-EJT2VJTM.js";
-import "../chunk-ZH5QZQ7C.js";
+} from "../chunk-6YY3U7WB.js";
+import "../chunk-DKHI52KZ.js";
+import "../chunk-FSGSOF5Q.js";
+import "../chunk-ZTDPBZ7R.js";
+import "../chunk-YLFA2KTF.js";
+import "../chunk-4JFSS3DN.js";
+import "../chunk-HZYH2DQ4.js";
+import "../chunk-PC5C3CBB.js";
+import "../chunk-4WT5RCA6.js";
+import "../chunk-O4YQMDFY.js";
 export {
   runtime_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos",
-  "version": "1.8.3",
+  "version": "1.9.0",
   "description": "Batteries-included CNOS runtime package wired with the official plugins.",
   "type": "module",
   "main": "./dist/index.cjs",