Skip to content
Kitsy Docs Open CNOS
Kitsy Docs

cnos build

cnos build

Use build when a repo needs a deterministic artifact derived from CNOS.

Terminal window
cnos build server --to .cnos-server.json
cnos build browser --to .cnos-browser.json
cnos build env --profile local --to .env.local
cnos build env --profile stage --to .env.stage
cnos build env --profile prod --reveal --to .env.production.local
cnos build public --framework vite --to .env.production
cnos build env --profile local-domain --format docker-env --to .env.local-domain

Targets:

  • build server writes a server runtime projection with resolved values plus secret refs
  • build browser writes a public-only browser projection
  • build env writes explicit env mappings in formats like dotenv, shell, json, yaml, docker-env, or toml
  • build public writes promoted public env with optional framework prefixes like Vite and Next

All build artifacts are derived output. .cnos remains the source of truth.

Writing secrets into env artifacts

By default, build env masks secret env mappings as ****.

Use --reveal only when you intentionally want concrete secret values in the generated artifact:

Terminal window
cnos build env --profile prod --reveal --to .env.production.local

CNOS protects this path in two ways:

  • it verifies that the target file is gitignored before writing secrets
  • it prints explicit risk warnings and, in interactive terminals, asks Do you want to continue? before continuing