@breadstone-infrastructure/nx-tasks 0.0.230 → 0.0.232

package/executors/secrets-vercel-sync/providers/azure-keyvault.provider.js

@@ -0,0 +1,118 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureKeyVaultSecretsProvider = void 0;
+const enquirer_1 = require("enquirer");
+// #endregion
+/**
+ * Secrets provider implementation for Azure Key Vault.
+ *
+ * Uses the Key Vault REST API with a Bearer token (e.g. from `az account get-access-token`
+ * or a service principal client credential flow). The token must be provided via `apiKey`
+ * or entered interactively.
+ *
+ * @public
+ */
+class AzureKeyVaultSecretsProvider {
+    // #region Methods
+    /**
+     * @inheritdoc
+     */
+    async authenticate(apiKey, interactive) {
+        if (apiKey) {
+            return apiKey;
+        }
+        const envToken = process.env['AZURE_KEYVAULT_TOKEN'];
+        if (envToken) {
+            return envToken;
+        }
+        if (interactive) {
+            const credentials = await (0, enquirer_1.prompt)([
+                {
+                    type: 'input',
+                    name: 'token',
+                    message: 'Enter your Azure Key Vault access token:\nYou can obtain one via `az account get-access-token --resource https://vault.azure.net --query accessToken -o tsv`.'
+                }
+            ]);
+            if (!credentials.token) {
+                throw new Error('No Azure Key Vault access token provided. Aborting.');
+            }
+            return credentials.token;
+        }
+        throw new Error('AZURE_KEYVAULT_TOKEN environment variable is not set. Set it to an Azure Key Vault access token, or enable interactive mode.');
+    }
+    /**
+     * Fetches all secrets from an Azure Key Vault.
+     *
+     * The `project` and `config` parameters are ignored. The vault is identified
+     * solely by `vaultUrl`.
+     *
+     * @inheritdoc
+     */
+    async fetchSecrets(token, _project, _config, logger, vaultUrl) {
+        if (!vaultUrl) {
+            throw new Error('vaultUrl is required for the azure-keyvault provider.');
+        }
+        const normalizedVaultUrl = vaultUrl.endsWith('/') ? vaultUrl.slice(0, -1) : vaultUrl;
+        const secrets = {};
+        // Step 1: List all secrets (paged)
+        const secretItems = await this.listSecrets(token, normalizedVaultUrl);
+        logger.log(`  Found ${secretItems.length} secrets in Key Vault.`);
+        // Step 2: Fetch each secret value
+        for (const item of secretItems) {
+            const secretName = this.extractSecretName(item.id);
+            const value = await this.getSecretValue(token, normalizedVaultUrl, secretName);
+            secrets[secretName] = value;
+        }
+        logger.log(`  Fetched ${Object.keys(secrets).length} secrets from Azure Key Vault [${normalizedVaultUrl}].`);
+        return secrets;
+    }
+    // #endregion
+    // #region Private Methods
+    /**
+     * Lists all secrets in the vault (handles pagination).
+     */
+    async listSecrets(token, vaultUrl) {
+        const allItems = [];
+        let nextLink = `${vaultUrl}/secrets?api-version=7.4`;
+        while (nextLink) {
+            const response = await fetch(nextLink, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            if (!response.ok) {
+                throw new Error(`Failed to list Azure Key Vault secrets (HTTP ${response.status}): ${response.statusText}`);
+            }
+            const data = await response.json();
+            const enabledItems = data.value.filter(item => item.attributes.enabled);
+            allItems.push(...enabledItems);
+            nextLink = data.nextLink;
+        }
+        return allItems;
+    }
+    /**
+     * Fetches the current value of a single secret.
+     */
+    async getSecretValue(token, vaultUrl, secretName) {
+        const url = `${vaultUrl}/secrets/${encodeURIComponent(secretName)}?api-version=7.4`;
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch Azure Key Vault secret "${secretName}" (HTTP ${response.status}): ${response.statusText}`);
+        }
+        const data = await response.json();
+        return data.value;
+    }
+    /**
+     * Extracts the secret name from a Key Vault secret ID URL.
+     *
+     * @example
+     * `https://my-vault.vault.azure.net/secrets/MY_SECRET` → `MY_SECRET`
+     */
+    extractSecretName(secretId) {
+        const parts = secretId.split('/');
+        return parts[parts.length - 1];
+    }
+}
+exports.AzureKeyVaultSecretsProvider = AzureKeyVaultSecretsProvider;
+//# sourceMappingURL=azure-keyvault.provider.js.map

package/executors/secrets-vercel-sync/providers/azure-keyvault.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-keyvault.provider.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/azure-keyvault.provider.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;AAGlB,uCAAkC;AA6BlC,aAAa;AAEb;;;;;;;;GAQG;AACH,MAAa,4BAA4B;IAErC,kBAAkB;IAElB;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,MAAe,EAAE,WAAqB;QAC5D,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAM,EAAoB;gBAChD;oBACI,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,+JAA+J;iBAC3K;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC3E,CAAC;YAED,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IACpJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,OAAe,EAAE,MAAe,EAAE,QAAiB;QAC1G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,mCAAmC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,WAAW,WAAW,CAAC,MAAM,wBAAwB,CAAC,CAAC;QAElE,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;YAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,kCAAkC,kBAAkB,IAAI,CAAC,CAAC;QAE7G,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,aAAa;IAEb,0BAA0B;IAE1B;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QACrD,MAAM,QAAQ,GAAoC,EAAE,CAAC;QACrD,IAAI,QAAQ,GAAuB,GAAG,QAAQ,0BAA0B,CAAC;QAEzE,OAAO,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAChD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAC/B,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB;QAC5E,MAAM,GAAG,GAAG,GAAG,QAAQ,YAAY,kBAAkB,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAEpF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,WAAW,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAChI,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuC,CAAC;QAExE,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,QAAgB;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;CAGJ;AAjID,oEAiIC"}

package/executors/secrets-vercel-sync/providers/doppler.provider.d.ts

@@ -0,0 +1,18 @@
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+import type { ISecretsProvider } from './secrets-provider.interface';
+/**
+ * Secrets provider implementation for Doppler.
+ *
+ * @public
+ */
+export declare class DopplerSecretsProvider implements ISecretsProvider {
+    /**
+     * @inheritdoc
+     */
+    authenticate(apiKey?: string, interactive?: boolean): Promise<string>;
+    /**
+     * @inheritdoc
+     */
+    fetchSecrets(token: string, project: string, config: string, logger: ILogger): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=doppler.provider.d.ts.map

package/executors/secrets-vercel-sync/providers/doppler.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.provider.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/doppler.provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAiBrE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB;IAI3D;;OAEG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BlF;;OAEG;IACU,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CA2B9H"}

package/executors/secrets-vercel-sync/providers/doppler.provider.js

@@ -0,0 +1,61 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DopplerSecretsProvider = void 0;
+const enquirer_1 = require("enquirer");
+// #endregion
+/**
+ * Secrets provider implementation for Doppler.
+ *
+ * @public
+ */
+class DopplerSecretsProvider {
+    // #region Methods
+    /**
+     * @inheritdoc
+     */
+    async authenticate(apiKey, interactive) {
+        if (apiKey) {
+            return apiKey;
+        }
+        const envToken = process.env['DOPPLER_TOKEN'];
+        if (envToken) {
+            return envToken;
+        }
+        if (interactive) {
+            const credentials = await (0, enquirer_1.prompt)([
+                {
+                    type: 'input',
+                    name: 'token',
+                    message: 'Enter your Doppler API token:\nYou can find it in your Doppler account under Service Tokens or Personal Tokens.'
+                }
+            ]);
+            if (!credentials.token) {
+                throw new Error('No Doppler API token provided. Aborting.');
+            }
+            return credentials.token;
+        }
+        throw new Error('DOPPLER_TOKEN environment variable is not set. Set it to a Doppler Service Token or Personal Token, or enable interactive mode.');
+    }
+    /**
+     * @inheritdoc
+     */
+    async fetchSecrets(token, project, config, logger) {
+        const apiUrl = `https://api.doppler.com/v3/configs/config/secrets?project=${encodeURIComponent(project)}&config=${encodeURIComponent(config)}&include_dynamic_secrets=false&include_managed_secrets=true`;
+        const response = await fetch(apiUrl, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch Doppler secrets (HTTP ${response.status}): ${response.statusText}`);
+        }
+        const data = await response.json();
+        if (!data.success) {
+            throw new Error('Doppler API returned success=false.');
+        }
+        const secrets = Object.fromEntries(Object.entries(data.secrets).map(([key, value]) => [key, value.computed]));
+        logger.log(`  Fetched ${Object.keys(secrets).length} secrets from Doppler [${project}/${config}].`);
+        return secrets;
+    }
+}
+exports.DopplerSecretsProvider = DopplerSecretsProvider;
+//# sourceMappingURL=doppler.provider.js.map

package/executors/secrets-vercel-sync/providers/doppler.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.provider.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/doppler.provider.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;AAGlB,uCAAkC;AAgBlC,aAAa;AAEb;;;;GAIG;AACH,MAAa,sBAAsB;IAE/B,kBAAkB;IAElB;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,MAAe,EAAE,WAAqB;QAC5D,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAM,EAAoB;gBAChD;oBACI,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,iHAAiH;iBAC7H;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iIAAiI,CAAC,CAAC;IACvJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc,EAAE,MAAe;QACrF,MAAM,MAAM,GAAG,6DAA6D,kBAAkB,CAAC,OAAO,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,6DAA6D,CAAC;QAE1M,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC5E,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,0BAA0B,OAAO,IAAI,MAAM,IAAI,CAAC,CAAC;QAEpG,OAAO,OAAO,CAAC;IACnB,CAAC;CAGJ;AAlED,wDAkEC"}

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.d.ts

@@ -0,0 +1,17 @@
+import type { ISecretsProvider } from './secrets-provider.interface';
+/**
+ * The supported secrets provider types.
+ *
+ * @public
+ */
+export type SecretsProviderType = 'doppler' | 'azure-keyvault';
+/**
+ * Creates an {@link ISecretsProvider} instance for the given provider type.
+ *
+ * @param type - The provider type to instantiate.
+ * @returns The corresponding secrets provider.
+ *
+ * @public
+ */
+export declare function createSecretsProvider(type: SecretsProviderType): ISecretsProvider;
+//# sourceMappingURL=secrets-provider.factory.d.ts.map

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.factory.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.factory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAIrE;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,gBAAgB,CASjF"}

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.js

@@ -0,0 +1,25 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSecretsProvider = createSecretsProvider;
+const azure_keyvault_provider_1 = require("./azure-keyvault.provider");
+const doppler_provider_1 = require("./doppler.provider");
+/**
+ * Creates an {@link ISecretsProvider} instance for the given provider type.
+ *
+ * @param type - The provider type to instantiate.
+ * @returns The corresponding secrets provider.
+ *
+ * @public
+ */
+function createSecretsProvider(type) {
+    switch (type) {
+        case 'doppler':
+            return new doppler_provider_1.DopplerSecretsProvider();
+        case 'azure-keyvault':
+            return new azure_keyvault_provider_1.AzureKeyVaultSecretsProvider();
+        default:
+            throw new Error(`Unknown secrets provider type: "${type}". Supported: doppler, azure-keyvault.`);
+    }
+}
+//# sourceMappingURL=secrets-provider.factory.js.map

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.factory.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.factory.ts"],"names":[],"mappings":";AAAA,kBAAkB;;AAuBlB,sDASC;AA9BD,uEAAyE;AACzE,yDAA4D;AAY5D;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,IAAyB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,SAAS;YACV,OAAO,IAAI,yCAAsB,EAAE,CAAC;QACxC,KAAK,gBAAgB;YACjB,OAAO,IAAI,sDAA4B,EAAE,CAAC;QAC9C;YACI,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,wCAAwC,CAAC,CAAC;IACzG,CAAC;AACL,CAAC"}

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.d.ts

@@ -0,0 +1,28 @@
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+/**
+ * Abstraction for a secrets provider that can authenticate and fetch secrets.
+ *
+ * @public
+ */
+export interface ISecretsProvider {
+    /**
+     * Authenticates with the provider and returns an access token.
+     *
+     * @param apiKey - An optional API key or access token. If provided, it is used directly.
+     * @param interactive - Whether to prompt the user for credentials if none are provided.
+     * @returns The resolved access token.
+     */
+    authenticate(apiKey?: string, interactive?: boolean): Promise<string>;
+    /**
+     * Fetches all secrets from the provider.
+     *
+     * @param token - The access token obtained from {@link authenticate}.
+     * @param project - The project identifier (Doppler project name, or ignored for Azure Key Vault).
+     * @param config - The config identifier (Doppler config name, or ignored for Azure Key Vault).
+     * @param logger - Logger instance for status output.
+     * @param vaultUrl - The Azure Key Vault URL (only used by the azure-keyvault provider).
+     * @returns A flat record of secret key-value pairs.
+     */
+    fetchSecrets(token: string, project: string, config: string, logger: ILogger, vaultUrl?: string): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=secrets-provider.interface.d.ts.map

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.interface.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAIpE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAE7B;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtE;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrI"}

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.js

@@ -0,0 +1,4 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=secrets-provider.interface.js.map

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.interface.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.interface.ts"],"names":[],"mappings":";AAAA,kBAAkB"}

package/executors/secrets-vercel-sync/schema.json

@@ -0,0 +1,112 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "cli": "nx",
+  "title": "Secrets Vercel Sync",
+  "description": "Synchronizes secrets from a configurable provider (Doppler, Azure Key Vault) to a Vercel project/environment.",
+  "type": "object",
+  "properties": {
+    "provider": {
+      "type": "string",
+      "description": "The secrets provider to use.",
+      "enum": [
+        "doppler",
+        "azure-keyvault"
+      ],
+      "default": "doppler"
+    },
+    "secretsProject": {
+      "type": "string",
+      "description": "The secrets provider project identifier (e.g. Doppler project name)."
+    },
+    "secretsConfig": {
+      "type": "string",
+      "description": "The secrets provider configuration identifier (e.g. Doppler config name: dev, prev, prod)."
+    },
+    "vaultUrl": {
+      "type": "string",
+      "description": "The Azure Key Vault URL (e.g. https://my-vault.vault.azure.net). Required when provider is azure-keyvault."
+    },
+    "apiKey": {
+      "type": "string",
+      "description": "The API key or access token for the secrets provider. If omitted, resolved from environment or prompted interactively."
+    },
+    "vercelTeam": {
+      "type": "string",
+      "description": "The Vercel team slug or scope."
+    },
+    "vercelProject": {
+      "type": "string",
+      "description": "The Vercel project name or ID."
+    },
+    "vercelEnvironment": {
+      "type": "string",
+      "description": "The target Vercel environment.",
+      "enum": [
+        "development",
+        "preview",
+        "production"
+      ]
+    },
+    "vercelVariableType": {
+      "type": "string",
+      "description": "The Vercel variable type (encrypted or sensitive).",
+      "enum": [
+        "encrypted",
+        "sensitive"
+      ],
+      "default": "encrypted"
+    },
+    "conflictStrategy": {
+      "type": "string",
+      "description": "How to handle conflicts between the secrets provider and existing Vercel values.",
+      "enum": [
+        "none",
+        "prefer-source",
+        "prefer-vercel"
+      ],
+      "default": "prefer-source"
+    },
+    "dryRun": {
+      "type": "boolean",
+      "description": "If true, no changes are written to Vercel. Only a diff report is shown.",
+      "default": false
+    },
+    "deleteMissing": {
+      "type": "boolean",
+      "description": "If true, keys present in Vercel but not in the secrets provider are deleted. Must be explicitly enabled.",
+      "default": false
+    },
+    "includeKeys": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "If set, only these keys are synchronized."
+    },
+    "excludeKeys": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "If set, these keys are excluded from synchronization."
+    },
+    "redeploy": {
+      "type": "boolean",
+      "description": "If true, triggers a redeployment of the Vercel project after sync.",
+      "default": false
+    },
+    "interactive": {
+      "type": "boolean",
+      "description": "If true, prompts the user for missing tokens instead of failing.",
+      "default": false
+    }
+  },
+  "required": [
+    "secretsProject",
+    "secretsConfig",
+    "vercelTeam",
+    "vercelProject",
+    "vercelEnvironment"
+  ],
+  "additionalProperties": false
+}

package/executors/token-linter/executor.d.ts

@@ -0,0 +1,10 @@
+import type { ExecutorContext } from '@nx/devkit';
+import type { TokenLinterExecutorOptions } from './executor.options';
+/**
+ * @description Nx executor entry point for the token linter.
+ * @public
+ */
+export default function runExecutor(options: TokenLinterExecutorOptions, context: ExecutorContext): Promise<{
+    success: boolean;
+}>;
+//# sourceMappingURL=executor.d.ts.map

package/executors/token-linter/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/executors/token-linter/executor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAIrE;;;GAGG;AACH,wBAA8B,WAAW,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAuBtI"}

package/executors/token-linter/executor.js

@@ -0,0 +1,67 @@
+"use strict";
+// #region Imports
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = runExecutor;
+const getProjectRoot_1 = require("../../utils/getProjectRoot");
+const isVerbose_1 = require("../../utils/isVerbose");
+// #endregion
+/**
+ * @description Nx executor entry point for the token linter.
+ * @public
+ */
+async function runExecutor(options, context) {
+    try {
+        const task = (await Promise.resolve().then(() => __importStar(require('./executor.task')))).TokenLinterTask;
+        const verbose = (0, isVerbose_1.isVerbose)(context, options);
+        await task.run({
+            cwd: (0, getProjectRoot_1.getProjectRoot)(context),
+            tokensDir: options.tokensDir,
+            mixinsDir: options.mixinsDir,
+            themes: options.themes,
+            fix: options.fix,
+            verbose,
+            reporter: options.reporter,
+            rules: options.rules,
+            ruleOptions: options.ruleOptions,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        console.error(error);
+        return { success: false };
+    }
+}
+//# sourceMappingURL=executor.js.map

package/executors/token-linter/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/executors/token-linter/executor.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAalB,8BAuBC;AAjCD,+DAA4D;AAC5D,qDAAkD;AAGlD,aAAa;AAEb;;;GAGG;AACY,KAAK,UAAU,WAAW,CAAC,OAAmC,EAAE,OAAwB;IACnG,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,wDAAa,iBAAiB,GAAC,CAAC,CAAC,eAAe,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAA,qBAAS,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,GAAG,CAAC;YACX,GAAG,EAAE,IAAA,+BAAc,EAAC,OAAO,CAAC;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;SACnC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAErB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC"}

package/executors/token-linter/executor.options.d.ts

@@ -0,0 +1,19 @@
+import type { RuleSeverity } from '@breadstone-infrastructure/token-linter';
+/**
+ * @description Options for the token-linter executor as declared in project.json.
+ * All fields are optional - the primary config comes from `tokenlinter.config.mjs`.
+ * Any options specified here override the config file values.
+ * @public
+ */
+export interface TokenLinterExecutorOptions {
+    tokensDir?: string;
+    themes?: string[];
+    mixinsDir?: string;
+    fix?: boolean;
+    interactive?: boolean;
+    verbose?: boolean;
+    reporter?: 'console' | 'json' | 'summary';
+    rules?: Record<string, RuleSeverity | 'off'>;
+    ruleOptions?: Record<string, Record<string, unknown>>;
+}
+//# sourceMappingURL=executor.options.d.ts.map

package/executors/token-linter/executor.options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.options.d.ts","sourceRoot":"","sources":["../../../src/executors/token-linter/executor.options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAI5E;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD"}

package/executors/token-linter/executor.options.js

@@ -0,0 +1,4 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=executor.options.js.map

package/executors/token-linter/executor.options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.options.js","sourceRoot":"","sources":["../../../src/executors/token-linter/executor.options.ts"],"names":[],"mappings":";AAAA,kBAAkB"}

package/executors/token-linter/executor.task.d.ts

@@ -0,0 +1,33 @@
+import { type RuleSeverity } from '@breadstone-infrastructure/token-linter';
+/**
+ * @description Task to validate and lint Style Dictionary token JSON files across themes.
+ * Discovers `tokenlinter.config.mjs` in the project root automatically.
+ * Executor options from project.json override the config file values.
+ * @public
+ */
+export declare namespace TokenLinterTask {
+    /**
+     * @description All fields are optional - the primary configuration comes from
+     * the `tokenlinter.config.mjs` config file. Any values provided here override
+     * the config file values.
+     * @public
+     */
+    interface ITokenLinterTaskOptions {
+        cwd: string;
+        tokensDir?: string;
+        mixinsDir?: string;
+        themes?: string[];
+        fix?: boolean;
+        interactive?: boolean;
+        verbose?: boolean;
+        reporter?: 'console' | 'json' | 'summary';
+        rules?: Record<string, RuleSeverity | 'off'>;
+        ruleOptions?: Record<string, Record<string, unknown>>;
+    }
+    /**
+     * @description Discovers the config file and executes the token linter.
+     * Executor options override config file values.
+     */
+    function run(options: ITokenLinterTaskOptions): Promise<void>;
+}
+//# sourceMappingURL=executor.task.d.ts.map

package/executors/token-linter/executor.task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.task.d.ts","sourceRoot":"","sources":["../../../src/executors/token-linter/executor.task.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAIrG;;;;;GAKG;AACH,yBAAiB,eAAe,CAAC;IAI7B;;;;;OAKG;IACH,UAAiB,uBAAuB;QACpC,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;QAC1C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC;QAC7C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACzD;IAMD;;;OAGG;IACH,SAAsB,GAAG,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBzE;CAGJ"}

package/executors/token-linter/executor.task.js

@@ -0,0 +1,60 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenLinterTask = void 0;
+const token_linter_1 = require("@breadstone-infrastructure/token-linter");
+// #endregion
+/**
+ * @description Task to validate and lint Style Dictionary token JSON files across themes.
+ * Discovers `tokenlinter.config.mjs` in the project root automatically.
+ * Executor options from project.json override the config file values.
+ * @public
+ */
+var TokenLinterTask;
+(function (TokenLinterTask) {
+    // #region Interfaces
+    // #endregion
+    // #region Functions
+    /**
+     * @description Discovers the config file and executes the token linter.
+     * Executor options override config file values.
+     */
+    async function run(options) {
+        const orchestrator = new token_linter_1.TokenLinterOrchestrator();
+        const overrides = {};
+        if (options.tokensDir !== undefined) {
+            overrides['tokensDir'] = options.tokensDir;
+        }
+        if (options.mixinsDir !== undefined) {
+            overrides['mixinsDir'] = options.mixinsDir;
+        }
+        if (options.themes !== undefined) {
+            overrides['themes'] = options.themes;
+        }
+        if (options.fix !== undefined) {
+            overrides['fix'] = options.fix;
+        }
+        if (options.interactive !== undefined) {
+            overrides['interactive'] = options.interactive;
+        }
+        if (options.verbose !== undefined) {
+            overrides['verbose'] = options.verbose;
+        }
+        if (options.reporter !== undefined) {
+            overrides['reporter'] = options.reporter;
+        }
+        if (options.rules !== undefined) {
+            overrides['rules'] = options.rules;
+        }
+        if (options.ruleOptions !== undefined) {
+            overrides['ruleOptions'] = options.ruleOptions;
+        }
+        const result = await orchestrator.executeWithOverrides(options.cwd, overrides);
+        if (result.totalErrors > 0) {
+            throw new Error(`Token Linter found ${result.totalErrors} error(s).`);
+        }
+    }
+    TokenLinterTask.run = run;
+    // #endregion
+})(TokenLinterTask || (exports.TokenLinterTask = TokenLinterTask = {}));
+//# sourceMappingURL=executor.task.js.map

package/executors/token-linter/executor.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.task.js","sourceRoot":"","sources":["../../../src/executors/token-linter/executor.task.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;AAElB,0EAAqG;AAErG,aAAa;AAEb;;;;;GAKG;AACH,IAAiB,eAAe,CAqD/B;AArDD,WAAiB,eAAe;IAE5B,qBAAqB;IAqBrB,aAAa;IAEb,oBAAoB;IAEpB;;;OAGG;IACI,KAAK,UAAU,GAAG,CAAC,OAAgC;QACtD,MAAM,YAAY,GAAG,IAAI,sCAAuB,EAAE,CAAC;QACnD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAE9C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAAC,CAAC;QACpF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAAC,CAAC;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;QAAC,CAAC;QAClE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAC,CAAC;QACjF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QAAC,CAAC;QACxE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAAC,SAAS,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QAAC,CAAC;QAE1F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE/E,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,WAAW,YAAY,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IAnBqB,mBAAG,MAmBxB,CAAA;IAED,aAAa;AACjB,CAAC,EArDgB,eAAe,+BAAf,eAAe,QAqD/B"}