@kitsy/cnos 1.9.0 → 1.9.2

package/dist/build/index.cjs

@@ -1857,7 +1857,7 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
   const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
   return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
 }
-function ensureProjectionAllowed(manifest, key, target) {
+function ensureProjectionAllowed(manifest, key, target, options = {}) {
   const namespace = getNamespaceNameForKey(key);
   const definition = getNamespaceDefinition(manifest, namespace);
   if (definition.kind !== "data") {
@@ -1866,6 +1866,9 @@ function ensureProjectionAllowed(manifest, key, target) {
     );
   }
   if (definition.sensitive) {
+    if (target === "env" && namespace === "secret" && options.allowSecretForEnv) {
+      return;
+    }
     throw new CnosSecurityError(
       `Cannot promote ${key} to ${target} because namespace "${namespace}" is sensitive.`
     );
@@ -3717,7 +3720,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.9.0",
+  version: "1.9.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/build/index.js

@@ -1,17 +1,17 @@
 import {
   createCnos
-} from "../chunk-FSGSOF5Q.js";
-import "../chunk-ZTDPBZ7R.js";
-import "../chunk-YLFA2KTF.js";
-import "../chunk-4JFSS3DN.js";
-import "../chunk-HZYH2DQ4.js";
-import "../chunk-PC5C3CBB.js";
-import "../chunk-4WT5RCA6.js";
+} from "../chunk-CPGRRZLP.js";
+import "../chunk-LURQ4LAK.js";
+import "../chunk-A2WG3ZKW.js";
+import "../chunk-L7JVECPE.js";
+import "../chunk-6QQPHDUI.js";
+import "../chunk-7JZO6XN3.js";
+import "../chunk-2JBA2LXU.js";
 import {
   CnosManifestError,
   createSecretVaultProvider,
   isSecretReference
-} from "../chunk-O4YQMDFY.js";
+} from "../chunk-7KVM5PUW.js";
 
 // src/build/index.ts
 async function resolveBrowserData(options = {}) {

package/dist/{chunk-4WT5RCA6.js → chunk-2JBA2LXU.js}

@@ -2,7 +2,7 @@ import {
   envVarToLogicalKey,
   resolveWorkspaceScopedPath,
   toPortablePath
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // ../../plugins/dotenv/src/index.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-HZYH2DQ4.js → chunk-6QQPHDUI.js}

@@ -1,6 +1,6 @@
 import {
   applySchemaRules
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // ../../plugins/basic-schema/src/index.ts
 function createBasicSchemaPlugin() {

package/dist/{chunk-PC5C3CBB.js → chunk-7JZO6XN3.js}

@@ -1,6 +1,6 @@
 import {
   joinConfigPath
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // ../../plugins/cli-args/src/index.ts
 var CLI_ARGS_PLUGIN_ID = "@kitsy/cnos/plugins/cli-args";

package/dist/{chunk-O4YQMDFY.js → chunk-7KVM5PUW.js}

@@ -1705,7 +1705,7 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
   const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
   return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
 }
-function ensureProjectionAllowed(manifest, key, target) {
+function ensureProjectionAllowed(manifest, key, target, options = {}) {
   const namespace = getNamespaceNameForKey(key);
   const definition = getNamespaceDefinition(manifest, namespace);
   if (definition.kind !== "data") {
@@ -1714,6 +1714,9 @@ function ensureProjectionAllowed(manifest, key, target) {
     );
   }
   if (definition.sensitive) {
+    if (target === "env" && namespace === "secret" && options.allowSecretForEnv) {
+      return;
+    }
     throw new CnosSecurityError(
       `Cannot promote ${key} to ${target} because namespace "${namespace}" is sensitive.`
     );

package/dist/{chunk-YLFA2KTF.js → chunk-A2WG3ZKW.js}

@@ -4,7 +4,7 @@ import {
   isSecretReference,
   parseYaml,
   toPortablePath
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // ../../plugins/filesystem/src/helpers.ts
 import { readdir } from "fs/promises";

package/dist/{chunk-FSGSOF5Q.js → chunk-CPGRRZLP.js}

@@ -1,27 +1,27 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "./chunk-ZTDPBZ7R.js";
+} from "./chunk-LURQ4LAK.js";
 import {
   createFilesystemSecretsPlugin,
   createFilesystemValuesPlugin
-} from "./chunk-YLFA2KTF.js";
+} from "./chunk-A2WG3ZKW.js";
 import {
   createProcessEnvPlugin
-} from "./chunk-4JFSS3DN.js";
+} from "./chunk-L7JVECPE.js";
 import {
   createBasicSchemaPlugin
-} from "./chunk-HZYH2DQ4.js";
+} from "./chunk-6QQPHDUI.js";
 import {
   createCliArgsPlugin
-} from "./chunk-PC5C3CBB.js";
+} from "./chunk-7JZO6XN3.js";
 import {
   createDotenvPlugin
-} from "./chunk-4WT5RCA6.js";
+} from "./chunk-2JBA2LXU.js";
 import {
   createCnos,
   createProvenanceInspector
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // src/defaultPlugins.ts
 function defaultPlugins() {
@@ -68,7 +68,7 @@ function setBootstrappedSecretHydrationRequired(value) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.9.0",
+  version: "1.9.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/{chunk-4JFSS3DN.js → chunk-L7JVECPE.js}

@@ -1,6 +1,6 @@
 import {
   envVarToLogicalKey
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // ../../plugins/process-env/src/index.ts
 var PROCESS_ENV_PLUGIN_ID = "@kitsy/cnos/plugins/process-env";

package/dist/{chunk-ZTDPBZ7R.js → chunk-LURQ4LAK.js}

@@ -1,7 +1,7 @@
 import {
   toEnv,
   toPublicEnv
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // ../../plugins/env-export/src/index.ts
 function createEnvExportPlugin() {

package/dist/{chunk-DKHI52KZ.js → chunk-NVFACB64.js}

@@ -1,6 +1,6 @@
 import {
   isSecretReference
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // src/runtime/bootstrap.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

package/dist/{chunk-6YY3U7WB.js → chunk-QK7BMU47.js}

@@ -3,7 +3,7 @@ import {
   graphRequiresSecretHydration,
   readRuntimeGraphFromEnv,
   readServerProjectionFromEnv
-} from "./chunk-DKHI52KZ.js";
+} from "./chunk-NVFACB64.js";
 import {
   createCnos,
   getBootstrappedSecretHydrationRequired,
@@ -12,7 +12,7 @@ import {
   setBootstrappedSecretHydrationRequired,
   setSingletonReady,
   setSingletonRuntime
-} from "./chunk-FSGSOF5Q.js";
+} from "./chunk-CPGRRZLP.js";
 import {
   createDefaultRuntimeProviders,
   createDerivedRuntimeSupport,
@@ -28,7 +28,7 @@ import {
   toLogicalKey,
   toNamespaceObject,
   toPublicEnv
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // src/runtime/index.ts
 import { existsSync, readFileSync } from "fs";

package/dist/configure/index.cjs

@@ -1859,7 +1859,7 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
   const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
   return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
 }
-function ensureProjectionAllowed(manifest, key, target) {
+function ensureProjectionAllowed(manifest, key, target, options = {}) {
   const namespace = getNamespaceNameForKey(key);
   const definition = getNamespaceDefinition(manifest, namespace);
   if (definition.kind !== "data") {
@@ -1868,6 +1868,9 @@ function ensureProjectionAllowed(manifest, key, target) {
     );
   }
   if (definition.sensitive) {
+    if (target === "env" && namespace === "secret" && options.allowSecretForEnv) {
+      return;
+    }
     throw new CnosSecurityError(
       `Cannot promote ${key} to ${target} because namespace "${namespace}" is sensitive.`
     );
@@ -3761,7 +3764,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.9.0",
+  version: "1.9.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/configure/index.js

@@ -1,19 +1,19 @@
 import {
   createCnos,
   defaultPlugins
-} from "../chunk-FSGSOF5Q.js";
-import "../chunk-ZTDPBZ7R.js";
-import "../chunk-YLFA2KTF.js";
-import "../chunk-4JFSS3DN.js";
-import "../chunk-HZYH2DQ4.js";
-import "../chunk-PC5C3CBB.js";
-import "../chunk-4WT5RCA6.js";
+} from "../chunk-CPGRRZLP.js";
+import "../chunk-LURQ4LAK.js";
+import "../chunk-A2WG3ZKW.js";
+import "../chunk-L7JVECPE.js";
+import "../chunk-6QQPHDUI.js";
+import "../chunk-7JZO6XN3.js";
+import "../chunk-2JBA2LXU.js";
 import {
   planDump,
   toEnv,
   toPublicEnv,
   writeDump
-} from "../chunk-O4YQMDFY.js";
+} from "../chunk-7KVM5PUW.js";
 export {
   createCnos,
   defaultPlugins,

package/dist/index.cjs

@@ -1859,7 +1859,7 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
   const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
   return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
 }
-function ensureProjectionAllowed(manifest, key, target) {
+function ensureProjectionAllowed(manifest, key, target, options = {}) {
   const namespace = getNamespaceNameForKey(key);
   const definition = getNamespaceDefinition(manifest, namespace);
   if (definition.kind !== "data") {
@@ -1868,6 +1868,9 @@ function ensureProjectionAllowed(manifest, key, target) {
     );
   }
   if (definition.sensitive) {
+    if (target === "env" && namespace === "secret" && options.allowSecretForEnv) {
+      return;
+    }
     throw new CnosSecurityError(
       `Cannot promote ${key} to ${target} because namespace "${namespace}" is sensitive.`
     );
@@ -3719,7 +3722,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.9.0",
+  version: "1.9.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/index.js

@@ -1,15 +1,15 @@
 import {
   runtime_default
-} from "./chunk-6YY3U7WB.js";
-import "./chunk-DKHI52KZ.js";
-import "./chunk-FSGSOF5Q.js";
-import "./chunk-ZTDPBZ7R.js";
-import "./chunk-YLFA2KTF.js";
-import "./chunk-4JFSS3DN.js";
-import "./chunk-HZYH2DQ4.js";
-import "./chunk-PC5C3CBB.js";
-import "./chunk-4WT5RCA6.js";
-import "./chunk-O4YQMDFY.js";
+} from "./chunk-QK7BMU47.js";
+import "./chunk-NVFACB64.js";
+import "./chunk-CPGRRZLP.js";
+import "./chunk-LURQ4LAK.js";
+import "./chunk-A2WG3ZKW.js";
+import "./chunk-L7JVECPE.js";
+import "./chunk-6QQPHDUI.js";
+import "./chunk-7JZO6XN3.js";
+import "./chunk-2JBA2LXU.js";
+import "./chunk-7KVM5PUW.js";
 export {
   runtime_default as cnos,
   runtime_default as default

package/dist/internal.cjs

@@ -1391,7 +1391,7 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
   const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
   return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
 }
-function ensureProjectionAllowed(manifest, key, target) {
+function ensureProjectionAllowed(manifest, key, target, options = {}) {
   const namespace = getNamespaceNameForKey(key);
   const definition = getNamespaceDefinition(manifest, namespace);
   if (definition.kind !== "data") {
@@ -1400,6 +1400,9 @@ function ensureProjectionAllowed(manifest, key, target) {
     );
   }
   if (definition.sensitive) {
+    if (target === "env" && namespace === "secret" && options.allowSecretForEnv) {
+      return;
+    }
     throw new CnosSecurityError(
       `Cannot promote ${key} to ${target} because namespace "${namespace}" is sensitive.`
     );

package/dist/internal.d.cts

@@ -24,8 +24,11 @@ declare function writeKeychain(entry: string, value: string): Promise<void>;
 declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
 
 type ProjectionTarget = 'public' | 'env';
+interface ProjectionPolicyOptions {
+    allowSecretForEnv?: boolean;
+}
 declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
-declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
+declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget, options?: ProjectionPolicyOptions): void;
 
 declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
 

package/dist/internal.d.ts

@@ -24,8 +24,11 @@ declare function writeKeychain(entry: string, value: string): Promise<void>;
 declare function loadManifest(options?: LoadManifestOptions): Promise<LoadedManifest>;
 
 type ProjectionTarget = 'public' | 'env';
+interface ProjectionPolicyOptions {
+    allowSecretForEnv?: boolean;
+}
 declare function getNamespaceDefinition(manifest: NormalizedManifest, namespaceOrKey: string): NamespaceDefinition;
-declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget): void;
+declare function ensureProjectionAllowed(manifest: NormalizedManifest, key: LogicalKey, target: ProjectionTarget, options?: ProjectionPolicyOptions): void;
 
 declare function resolveVaultAuth(vaultId: string, definition: VaultDefinition, processEnv?: Record<string, string | undefined>): Promise<VaultAuthConfig>;
 

package/dist/internal.js

@@ -11,7 +11,7 @@ import {
   serializeRuntimeGraph,
   serializeSecretPayload,
   serializeServerProjection
-} from "./chunk-DKHI52KZ.js";
+} from "./chunk-NVFACB64.js";
 import {
   CnosAuthenticationError,
   CnosSecurityError,
@@ -64,7 +64,7 @@ import {
   writeLocalSecret,
   writeRemoteRootCacheMetadata,
   writeVaultSessionKey
-} from "./chunk-O4YQMDFY.js";
+} from "./chunk-7KVM5PUW.js";
 
 // src/codegen/generateTypes.ts
 function toPascalCase(value) {

package/dist/plugin/basic-schema.js

@@ -1,7 +1,7 @@
 import {
   createBasicSchemaPlugin
-} from "../chunk-HZYH2DQ4.js";
-import "../chunk-O4YQMDFY.js";
+} from "../chunk-6QQPHDUI.js";
+import "../chunk-7KVM5PUW.js";
 export {
   createBasicSchemaPlugin
 };

package/dist/plugin/cli-args.js

@@ -2,8 +2,8 @@ import {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,
   parseCliArgs
-} from "../chunk-PC5C3CBB.js";
-import "../chunk-O4YQMDFY.js";
+} from "../chunk-7JZO6XN3.js";
+import "../chunk-7KVM5PUW.js";
 export {
   cliArgEntriesFromArgs,
   createCliArgsPlugin,

package/dist/plugin/dotenv.js

@@ -2,8 +2,8 @@ import {
   createDotenvPlugin,
   dotenvEntriesFromObject,
   parseDotenv
-} from "../chunk-4WT5RCA6.js";
-import "../chunk-O4YQMDFY.js";
+} from "../chunk-2JBA2LXU.js";
+import "../chunk-7KVM5PUW.js";
 export {
   createDotenvPlugin,
   dotenvEntriesFromObject,

package/dist/plugin/env-export.js

@@ -1,11 +1,11 @@
 import {
   createEnvExportPlugin,
   createPublicEnvExportPlugin
-} from "../chunk-ZTDPBZ7R.js";
+} from "../chunk-LURQ4LAK.js";
 import {
   toEnv,
   toPublicEnv
-} from "../chunk-O4YQMDFY.js";
+} from "../chunk-7KVM5PUW.js";
 export {
   createEnvExportPlugin,
   createPublicEnvExportPlugin,

package/dist/plugin/filesystem.js

@@ -5,8 +5,8 @@ import {
   filesystemSecretsReader,
   filesystemValuesReader,
   yamlObjectToEntries
-} from "../chunk-YLFA2KTF.js";
-import "../chunk-O4YQMDFY.js";
+} from "../chunk-A2WG3ZKW.js";
+import "../chunk-7KVM5PUW.js";
 export {
   collectFilesystemLayerFiles,
   createFilesystemSecretsPlugin,

package/dist/plugin/process-env.js

@@ -2,8 +2,8 @@ import {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,
   processNamespaceEntriesFromContext
-} from "../chunk-4JFSS3DN.js";
-import "../chunk-O4YQMDFY.js";
+} from "../chunk-L7JVECPE.js";
+import "../chunk-7KVM5PUW.js";
 export {
   createProcessEnvPlugin,
   processEnvEntriesFromObject,

package/dist/runtime/index.cjs

@@ -1856,7 +1856,7 @@ function getNamespaceDefinition(manifest, namespaceOrKey) {
   const namespace = namespaceOrKey.includes(".") ? getNamespaceNameForKey(namespaceOrKey) : namespaceOrKey;
   return manifest.namespaces[namespace] ?? DEFAULT_DATA_NAMESPACE;
 }
-function ensureProjectionAllowed(manifest, key, target) {
+function ensureProjectionAllowed(manifest, key, target, options = {}) {
   const namespace = getNamespaceNameForKey(key);
   const definition = getNamespaceDefinition(manifest, namespace);
   if (definition.kind !== "data") {
@@ -1865,6 +1865,9 @@ function ensureProjectionAllowed(manifest, key, target) {
     );
   }
   if (definition.sensitive) {
+    if (target === "env" && namespace === "secret" && options.allowSecretForEnv) {
+      return;
+    }
     throw new CnosSecurityError(
       `Cannot promote ${key} to ${target} because namespace "${namespace}" is sensitive.`
     );
@@ -3716,7 +3719,7 @@ function envVarToLogicalKey(envVar, config = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos",
-  version: "1.9.0",
+  version: "1.9.2",
   description: "Batteries-included CNOS runtime package wired with the official plugins.",
   type: "module",
   main: "./dist/index.cjs",

package/dist/runtime/index.js

@@ -1,15 +1,15 @@
 import {
   runtime_default
-} from "../chunk-6YY3U7WB.js";
-import "../chunk-DKHI52KZ.js";
-import "../chunk-FSGSOF5Q.js";
-import "../chunk-ZTDPBZ7R.js";
-import "../chunk-YLFA2KTF.js";
-import "../chunk-4JFSS3DN.js";
-import "../chunk-HZYH2DQ4.js";
-import "../chunk-PC5C3CBB.js";
-import "../chunk-4WT5RCA6.js";
-import "../chunk-O4YQMDFY.js";
+} from "../chunk-QK7BMU47.js";
+import "../chunk-NVFACB64.js";
+import "../chunk-CPGRRZLP.js";
+import "../chunk-LURQ4LAK.js";
+import "../chunk-A2WG3ZKW.js";
+import "../chunk-L7JVECPE.js";
+import "../chunk-6QQPHDUI.js";
+import "../chunk-7JZO6XN3.js";
+import "../chunk-2JBA2LXU.js";
+import "../chunk-7KVM5PUW.js";
 export {
   runtime_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Batteries-included CNOS runtime package wired with the official plugins.",
   "type": "module",
   "main": "./dist/index.cjs",