@breadstone-infrastructure/nx-tasks 0.0.231 → 0.0.232

package/executors/secrets-vercel-sync/providers/azure-keyvault.provider.js

@@ -0,0 +1,118 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureKeyVaultSecretsProvider = void 0;
+const enquirer_1 = require("enquirer");
+// #endregion
+/**
+ * Secrets provider implementation for Azure Key Vault.
+ *
+ * Uses the Key Vault REST API with a Bearer token (e.g. from `az account get-access-token`
+ * or a service principal client credential flow). The token must be provided via `apiKey`
+ * or entered interactively.
+ *
+ * @public
+ */
+class AzureKeyVaultSecretsProvider {
+    // #region Methods
+    /**
+     * @inheritdoc
+     */
+    async authenticate(apiKey, interactive) {
+        if (apiKey) {
+            return apiKey;
+        }
+        const envToken = process.env['AZURE_KEYVAULT_TOKEN'];
+        if (envToken) {
+            return envToken;
+        }
+        if (interactive) {
+            const credentials = await (0, enquirer_1.prompt)([
+                {
+                    type: 'input',
+                    name: 'token',
+                    message: 'Enter your Azure Key Vault access token:\nYou can obtain one via `az account get-access-token --resource https://vault.azure.net --query accessToken -o tsv`.'
+                }
+            ]);
+            if (!credentials.token) {
+                throw new Error('No Azure Key Vault access token provided. Aborting.');
+            }
+            return credentials.token;
+        }
+        throw new Error('AZURE_KEYVAULT_TOKEN environment variable is not set. Set it to an Azure Key Vault access token, or enable interactive mode.');
+    }
+    /**
+     * Fetches all secrets from an Azure Key Vault.
+     *
+     * The `project` and `config` parameters are ignored. The vault is identified
+     * solely by `vaultUrl`.
+     *
+     * @inheritdoc
+     */
+    async fetchSecrets(token, _project, _config, logger, vaultUrl) {
+        if (!vaultUrl) {
+            throw new Error('vaultUrl is required for the azure-keyvault provider.');
+        }
+        const normalizedVaultUrl = vaultUrl.endsWith('/') ? vaultUrl.slice(0, -1) : vaultUrl;
+        const secrets = {};
+        // Step 1: List all secrets (paged)
+        const secretItems = await this.listSecrets(token, normalizedVaultUrl);
+        logger.log(`  Found ${secretItems.length} secrets in Key Vault.`);
+        // Step 2: Fetch each secret value
+        for (const item of secretItems) {
+            const secretName = this.extractSecretName(item.id);
+            const value = await this.getSecretValue(token, normalizedVaultUrl, secretName);
+            secrets[secretName] = value;
+        }
+        logger.log(`  Fetched ${Object.keys(secrets).length} secrets from Azure Key Vault [${normalizedVaultUrl}].`);
+        return secrets;
+    }
+    // #endregion
+    // #region Private Methods
+    /**
+     * Lists all secrets in the vault (handles pagination).
+     */
+    async listSecrets(token, vaultUrl) {
+        const allItems = [];
+        let nextLink = `${vaultUrl}/secrets?api-version=7.4`;
+        while (nextLink) {
+            const response = await fetch(nextLink, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            if (!response.ok) {
+                throw new Error(`Failed to list Azure Key Vault secrets (HTTP ${response.status}): ${response.statusText}`);
+            }
+            const data = await response.json();
+            const enabledItems = data.value.filter(item => item.attributes.enabled);
+            allItems.push(...enabledItems);
+            nextLink = data.nextLink;
+        }
+        return allItems;
+    }
+    /**
+     * Fetches the current value of a single secret.
+     */
+    async getSecretValue(token, vaultUrl, secretName) {
+        const url = `${vaultUrl}/secrets/${encodeURIComponent(secretName)}?api-version=7.4`;
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch Azure Key Vault secret "${secretName}" (HTTP ${response.status}): ${response.statusText}`);
+        }
+        const data = await response.json();
+        return data.value;
+    }
+    /**
+     * Extracts the secret name from a Key Vault secret ID URL.
+     *
+     * @example
+     * `https://my-vault.vault.azure.net/secrets/MY_SECRET` → `MY_SECRET`
+     */
+    extractSecretName(secretId) {
+        const parts = secretId.split('/');
+        return parts[parts.length - 1];
+    }
+}
+exports.AzureKeyVaultSecretsProvider = AzureKeyVaultSecretsProvider;
+//# sourceMappingURL=azure-keyvault.provider.js.map

package/executors/secrets-vercel-sync/providers/azure-keyvault.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-keyvault.provider.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/azure-keyvault.provider.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;AAGlB,uCAAkC;AA6BlC,aAAa;AAEb;;;;;;;;GAQG;AACH,MAAa,4BAA4B;IAErC,kBAAkB;IAElB;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,MAAe,EAAE,WAAqB;QAC5D,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAM,EAAoB;gBAChD;oBACI,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,+JAA+J;iBAC3K;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC3E,CAAC;YAED,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IACpJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,OAAe,EAAE,MAAe,EAAE,QAAiB;QAC1G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,mCAAmC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,WAAW,WAAW,CAAC,MAAM,wBAAwB,CAAC,CAAC;QAElE,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;YAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,kCAAkC,kBAAkB,IAAI,CAAC,CAAC;QAE7G,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,aAAa;IAEb,0BAA0B;IAE1B;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QACrD,MAAM,QAAQ,GAAoC,EAAE,CAAC;QACrD,IAAI,QAAQ,GAAuB,GAAG,QAAQ,0BAA0B,CAAC;QAEzE,OAAO,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAChD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAC/B,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB;QAC5E,MAAM,GAAG,GAAG,GAAG,QAAQ,YAAY,kBAAkB,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAEpF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,WAAW,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAChI,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuC,CAAC;QAExE,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,QAAgB;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;CAGJ;AAjID,oEAiIC"}

package/executors/secrets-vercel-sync/providers/doppler.provider.d.ts

@@ -0,0 +1,18 @@
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+import type { ISecretsProvider } from './secrets-provider.interface';
+/**
+ * Secrets provider implementation for Doppler.
+ *
+ * @public
+ */
+export declare class DopplerSecretsProvider implements ISecretsProvider {
+    /**
+     * @inheritdoc
+     */
+    authenticate(apiKey?: string, interactive?: boolean): Promise<string>;
+    /**
+     * @inheritdoc
+     */
+    fetchSecrets(token: string, project: string, config: string, logger: ILogger): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=doppler.provider.d.ts.map

package/executors/secrets-vercel-sync/providers/doppler.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.provider.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/doppler.provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAiBrE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB;IAI3D;;OAEG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BlF;;OAEG;IACU,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CA2B9H"}

package/executors/secrets-vercel-sync/providers/doppler.provider.js

@@ -0,0 +1,61 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DopplerSecretsProvider = void 0;
+const enquirer_1 = require("enquirer");
+// #endregion
+/**
+ * Secrets provider implementation for Doppler.
+ *
+ * @public
+ */
+class DopplerSecretsProvider {
+    // #region Methods
+    /**
+     * @inheritdoc
+     */
+    async authenticate(apiKey, interactive) {
+        if (apiKey) {
+            return apiKey;
+        }
+        const envToken = process.env['DOPPLER_TOKEN'];
+        if (envToken) {
+            return envToken;
+        }
+        if (interactive) {
+            const credentials = await (0, enquirer_1.prompt)([
+                {
+                    type: 'input',
+                    name: 'token',
+                    message: 'Enter your Doppler API token:\nYou can find it in your Doppler account under Service Tokens or Personal Tokens.'
+                }
+            ]);
+            if (!credentials.token) {
+                throw new Error('No Doppler API token provided. Aborting.');
+            }
+            return credentials.token;
+        }
+        throw new Error('DOPPLER_TOKEN environment variable is not set. Set it to a Doppler Service Token or Personal Token, or enable interactive mode.');
+    }
+    /**
+     * @inheritdoc
+     */
+    async fetchSecrets(token, project, config, logger) {
+        const apiUrl = `https://api.doppler.com/v3/configs/config/secrets?project=${encodeURIComponent(project)}&config=${encodeURIComponent(config)}&include_dynamic_secrets=false&include_managed_secrets=true`;
+        const response = await fetch(apiUrl, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch Doppler secrets (HTTP ${response.status}): ${response.statusText}`);
+        }
+        const data = await response.json();
+        if (!data.success) {
+            throw new Error('Doppler API returned success=false.');
+        }
+        const secrets = Object.fromEntries(Object.entries(data.secrets).map(([key, value]) => [key, value.computed]));
+        logger.log(`  Fetched ${Object.keys(secrets).length} secrets from Doppler [${project}/${config}].`);
+        return secrets;
+    }
+}
+exports.DopplerSecretsProvider = DopplerSecretsProvider;
+//# sourceMappingURL=doppler.provider.js.map

package/executors/secrets-vercel-sync/providers/doppler.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.provider.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/doppler.provider.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;AAGlB,uCAAkC;AAgBlC,aAAa;AAEb;;;;GAIG;AACH,MAAa,sBAAsB;IAE/B,kBAAkB;IAElB;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,MAAe,EAAE,WAAqB;QAC5D,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAM,EAAoB;gBAChD;oBACI,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,iHAAiH;iBAC7H;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iIAAiI,CAAC,CAAC;IACvJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc,EAAE,MAAe;QACrF,MAAM,MAAM,GAAG,6DAA6D,kBAAkB,CAAC,OAAO,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,6DAA6D,CAAC;QAE1M,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC5E,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,0BAA0B,OAAO,IAAI,MAAM,IAAI,CAAC,CAAC;QAEpG,OAAO,OAAO,CAAC;IACnB,CAAC;CAGJ;AAlED,wDAkEC"}

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.d.ts

@@ -0,0 +1,17 @@
+import type { ISecretsProvider } from './secrets-provider.interface';
+/**
+ * The supported secrets provider types.
+ *
+ * @public
+ */
+export type SecretsProviderType = 'doppler' | 'azure-keyvault';
+/**
+ * Creates an {@link ISecretsProvider} instance for the given provider type.
+ *
+ * @param type - The provider type to instantiate.
+ * @returns The corresponding secrets provider.
+ *
+ * @public
+ */
+export declare function createSecretsProvider(type: SecretsProviderType): ISecretsProvider;
+//# sourceMappingURL=secrets-provider.factory.d.ts.map

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.factory.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.factory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAIrE;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,gBAAgB,CASjF"}

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.js

@@ -0,0 +1,25 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSecretsProvider = createSecretsProvider;
+const azure_keyvault_provider_1 = require("./azure-keyvault.provider");
+const doppler_provider_1 = require("./doppler.provider");
+/**
+ * Creates an {@link ISecretsProvider} instance for the given provider type.
+ *
+ * @param type - The provider type to instantiate.
+ * @returns The corresponding secrets provider.
+ *
+ * @public
+ */
+function createSecretsProvider(type) {
+    switch (type) {
+        case 'doppler':
+            return new doppler_provider_1.DopplerSecretsProvider();
+        case 'azure-keyvault':
+            return new azure_keyvault_provider_1.AzureKeyVaultSecretsProvider();
+        default:
+            throw new Error(`Unknown secrets provider type: "${type}". Supported: doppler, azure-keyvault.`);
+    }
+}
+//# sourceMappingURL=secrets-provider.factory.js.map

package/executors/secrets-vercel-sync/providers/secrets-provider.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.factory.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.factory.ts"],"names":[],"mappings":";AAAA,kBAAkB;;AAuBlB,sDASC;AA9BD,uEAAyE;AACzE,yDAA4D;AAY5D;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,IAAyB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,SAAS;YACV,OAAO,IAAI,yCAAsB,EAAE,CAAC;QACxC,KAAK,gBAAgB;YACjB,OAAO,IAAI,sDAA4B,EAAE,CAAC;QAC9C;YACI,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,wCAAwC,CAAC,CAAC;IACzG,CAAC;AACL,CAAC"}

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.d.ts

@@ -0,0 +1,28 @@
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+/**
+ * Abstraction for a secrets provider that can authenticate and fetch secrets.
+ *
+ * @public
+ */
+export interface ISecretsProvider {
+    /**
+     * Authenticates with the provider and returns an access token.
+     *
+     * @param apiKey - An optional API key or access token. If provided, it is used directly.
+     * @param interactive - Whether to prompt the user for credentials if none are provided.
+     * @returns The resolved access token.
+     */
+    authenticate(apiKey?: string, interactive?: boolean): Promise<string>;
+    /**
+     * Fetches all secrets from the provider.
+     *
+     * @param token - The access token obtained from {@link authenticate}.
+     * @param project - The project identifier (Doppler project name, or ignored for Azure Key Vault).
+     * @param config - The config identifier (Doppler config name, or ignored for Azure Key Vault).
+     * @param logger - Logger instance for status output.
+     * @param vaultUrl - The Azure Key Vault URL (only used by the azure-keyvault provider).
+     * @returns A flat record of secret key-value pairs.
+     */
+    fetchSecrets(token: string, project: string, config: string, logger: ILogger, vaultUrl?: string): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=secrets-provider.interface.d.ts.map

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.interface.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAIpE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAE7B;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtE;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrI"}

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.js

@@ -0,0 +1,4 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=secrets-provider.interface.js.map

package/executors/secrets-vercel-sync/providers/secrets-provider.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.interface.js","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/secrets-provider.interface.ts"],"names":[],"mappings":";AAAA,kBAAkB"}

package/executors/secrets-vercel-sync/schema.json

@@ -0,0 +1,112 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "cli": "nx",
+  "title": "Secrets Vercel Sync",
+  "description": "Synchronizes secrets from a configurable provider (Doppler, Azure Key Vault) to a Vercel project/environment.",
+  "type": "object",
+  "properties": {
+    "provider": {
+      "type": "string",
+      "description": "The secrets provider to use.",
+      "enum": [
+        "doppler",
+        "azure-keyvault"
+      ],
+      "default": "doppler"
+    },
+    "secretsProject": {
+      "type": "string",
+      "description": "The secrets provider project identifier (e.g. Doppler project name)."
+    },
+    "secretsConfig": {
+      "type": "string",
+      "description": "The secrets provider configuration identifier (e.g. Doppler config name: dev, prev, prod)."
+    },
+    "vaultUrl": {
+      "type": "string",
+      "description": "The Azure Key Vault URL (e.g. https://my-vault.vault.azure.net). Required when provider is azure-keyvault."
+    },
+    "apiKey": {
+      "type": "string",
+      "description": "The API key or access token for the secrets provider. If omitted, resolved from environment or prompted interactively."
+    },
+    "vercelTeam": {
+      "type": "string",
+      "description": "The Vercel team slug or scope."
+    },
+    "vercelProject": {
+      "type": "string",
+      "description": "The Vercel project name or ID."
+    },
+    "vercelEnvironment": {
+      "type": "string",
+      "description": "The target Vercel environment.",
+      "enum": [
+        "development",
+        "preview",
+        "production"
+      ]
+    },
+    "vercelVariableType": {
+      "type": "string",
+      "description": "The Vercel variable type (encrypted or sensitive).",
+      "enum": [
+        "encrypted",
+        "sensitive"
+      ],
+      "default": "encrypted"
+    },
+    "conflictStrategy": {
+      "type": "string",
+      "description": "How to handle conflicts between the secrets provider and existing Vercel values.",
+      "enum": [
+        "none",
+        "prefer-source",
+        "prefer-vercel"
+      ],
+      "default": "prefer-source"
+    },
+    "dryRun": {
+      "type": "boolean",
+      "description": "If true, no changes are written to Vercel. Only a diff report is shown.",
+      "default": false
+    },
+    "deleteMissing": {
+      "type": "boolean",
+      "description": "If true, keys present in Vercel but not in the secrets provider are deleted. Must be explicitly enabled.",
+      "default": false
+    },
+    "includeKeys": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "If set, only these keys are synchronized."
+    },
+    "excludeKeys": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "If set, these keys are excluded from synchronization."
+    },
+    "redeploy": {
+      "type": "boolean",
+      "description": "If true, triggers a redeployment of the Vercel project after sync.",
+      "default": false
+    },
+    "interactive": {
+      "type": "boolean",
+      "description": "If true, prompts the user for missing tokens instead of failing.",
+      "default": false
+    }
+  },
+  "required": [
+    "secretsProject",
+    "secretsConfig",
+    "vercelTeam",
+    "vercelProject",
+    "vercelEnvironment"
+  ],
+  "additionalProperties": false
+}

package/executors/token-linter/executor.options.d.ts

@@ -1,7 +1,7 @@
 import type { RuleSeverity } from '@breadstone-infrastructure/token-linter';
 /**
  * @description Options for the token-linter executor as declared in project.json.
- * All fields are optional — the primary config comes from `tokenlinter.config.mjs`.
+ * All fields are optional - the primary config comes from `tokenlinter.config.mjs`.
  * Any options specified here override the config file values.
  * @public
  */

package/executors/token-linter/executor.task.d.ts

@@ -7,7 +7,7 @@ import { type RuleSeverity } from '@breadstone-infrastructure/token-linter';
  */
 export declare namespace TokenLinterTask {
     /**
-     * @description All fields are optional — the primary configuration comes from
+     * @description All fields are optional - the primary configuration comes from
      * the `tokenlinter.config.mjs` config file. Any values provided here override
      * the config file values.
      * @public

package/executors/token-linter/schema.json

@@ -1,6 +1,6 @@
 {
   "type": "object",
-  "description": "Token linter executor options. All fields are optional — the primary config comes from `tokenlinter.config.mjs` in the project root. Options specified here override the config file values.",
+  "description": "Token linter executor options. All fields are optional - the primary config comes from `tokenlinter.config.mjs` in the project root. Options specified here override the config file values.",
   "properties": {
     "tokensDir": {
       "type": "string",

package/executors.json

@@ -1,139 +1,149 @@
 {
   "executors": {
     "alias-replace": {
-      "description": "alias-replace task executor",
+      "description": "Replaces alias placeholders in build output files with resolved values from environment, package.json, or custom expressions.",
       "implementation": "./executors/alias-replace/executor",
       "schema": "./executors/alias-replace/schema.json"
     },
     "clean": {
-      "description": "clean task executor",
+      "description": "Removes build artifacts, caches, and temporary files from a project directory.",
       "implementation": "./executors/clean/executor",
       "schema": "./executors/clean/schema.json"
     },
     "copy": {
-      "description": "copy task executor",
+      "description": "Copies files or directories from a source to a destination path.",
       "implementation": "./executors/copy/executor",
       "schema": "./executors/copy/schema.json"
     },
     "copy2": {
-      "description": "copy2 task executor",
+      "description": "Copies files or directories with extended options and glob pattern support.",
       "implementation": "./executors/copy2/executor",
       "schema": "./executors/copy2/schema.json"
     },
     "docs": {
-      "description": "docs task executor",
+      "description": "Generates API documentation using API Extractor and outputs it to the docs directory.",
       "implementation": "./executors/docs/executor",
       "schema": "./executors/docs/schema.json"
     },
-    "doppler-config-sync": {
-      "description": "doppler-config-sync task executor",
-      "implementation": "./executors/doppler-config-sync/executor",
-      "schema": "./executors/doppler-config-sync/schema.json"
+    "secrets-config-sync": {
+      "description": "Fetches secrets from a configurable provider (Doppler, Azure Key Vault) and writes them to local .env files.",
+      "implementation": "./executors/secrets-config-sync/executor",
+      "schema": "./executors/secrets-config-sync/schema.json"
+    },
+    "secrets-vercel-sync": {
+      "description": "Synchronizes secrets from a configurable provider (Doppler, Azure Key Vault) to a Vercel project/environment.",
+      "implementation": "./executors/secrets-vercel-sync/executor",
+      "schema": "./executors/secrets-vercel-sync/schema.json"
     },
     "icon-collection-builder": {
-      "description": "icon-collection-builder task executor",
+      "description": "Builds optimized icon collection bundles from downloaded SVG icon sources.",
       "implementation": "./executors/icon-collection-builder/executor",
       "schema": "./executors/icon-collection-builder/schema.json"
     },
     "icon-collection-downloader": {
-      "description": "icon-collection-downloader task executor",
+      "description": "Downloads icon collections from configured providers (Fluent UI, Lucide, etc.) into the project.",
       "implementation": "./executors/icon-collection-downloader/executor",
       "schema": "./executors/icon-collection-downloader/schema.json"
     },
     "lit-style-transform": {
-      "description": "lit-style-transform task executor",
+      "description": "Transforms SCSS files into Lit-compatible CSSResult TypeScript modules.",
       "implementation": "./executors/lit-style-transform/executor",
       "schema": "./executors/lit-style-transform/schema.json"
     },
     "lit-docs": {
-      "description": "lit-docs task executor",
+      "description": "Generates documentation for Lit web components using Web Component Analyzer.",
       "implementation": "./executors/lit-docs/executor",
       "schema": "./executors/lit-docs/schema.json"
     },
     "localizator": {
-      "description": "localizator task executor",
+      "description": "Detects, analyzes, transforms, sorts, and generates localization resources for frontend applications.",
       "implementation": "./executors/localizator/executor",
       "schema": "./executors/localizator/schema.json"
     },
     "markdown-to-typescript-transform": {
-      "description": "markdown-to-typescript-transform task executor",
+      "description": "Converts Markdown files into TypeScript modules using a configurable template.",
       "implementation": "./executors/markdown-to-typescript-transform/executor",
       "schema": "./executors/markdown-to-typescript-transform/schema.json"
     },
     "ng-packagr-build": {
-      "description": "ng-packagr-build task executor",
+      "description": "Builds Angular libraries using ng-packagr with extended configuration support.",
       "implementation": "./executors/ng-packagr-build/executor",
       "schema": "./executors/ng-packagr-build/schema.json"
     },
     "ng-api-extractor": {
-      "description": "ng-api-extractor task executor",
+      "description": "Runs API Extractor on Angular library builds to generate API reports and documentation.",
       "implementation": "./executors/ng-api-extractor/executor",
       "schema": "./executors/ng-api-extractor/schema.json"
     },
     "ng-proxy-transform": {
-      "description": "ng-proxy-transform task executor",
+      "description": "Generates Angular wrapper components from Lit web component manifests.",
       "implementation": "./executors/ng-proxy-transform/executor",
       "schema": "./executors/ng-proxy-transform/schema.json"
     },
     "openapi-generator": {
-      "description": "openapi-generator task executor",
+      "description": "Generates typed API client code from an OpenAPI specification endpoint.",
       "implementation": "./executors/openapi-generator/executor",
       "schema": "./executors/openapi-generator/schema.json"
     },
     "react-proxy-transform": {
-      "description": "react-proxy-transform task executor",
+      "description": "Generates React wrapper components from Lit web component manifests.",
       "implementation": "./executors/react-proxy-transform/executor",
       "schema": "./executors/react-proxy-transform/schema.json"
     },
     "release-package": {
-      "description": "release package task executor",
+      "description": "Publishes a built package to the npm registry as part of the release workflow.",
       "implementation": "./executors/release-package/executor",
       "schema": "./executors/release-package/schema.json"
     },
     "release-package-json": {
-      "description": "release-package-json task executor",
+      "description": "Prepares and patches package.json for publishing during the release process.",
       "implementation": "./executors/release-package-json/executor",
       "schema": "./executors/release-package-json/schema.json"
     },
     "scss-style-bundle": {
-      "description": "scss-style-bundle task executor",
+      "description": "Bundles multiple SCSS files into a single consolidated stylesheet output.",
       "implementation": "./executors/scss-style-bundle/executor",
       "schema": "./executors/scss-style-bundle/schema.json"
     },
     "scss-style-transform": {
-      "description": "scss-style-transform task executor",
+      "description": "Compiles SCSS files into CSS and outputs them alongside the source files.",
       "implementation": "./executors/scss-style-transform/executor",
       "schema": "./executors/scss-style-transform/schema.json"
     },
     "svelte-proxy-transform": {
-      "description": "svelte-proxy-transform task executor",
+      "description": "Generates Svelte wrapper components from Lit web component manifests.",
       "implementation": "./executors/svelte-proxy-transform/executor",
       "schema": "./executors/svelte-proxy-transform/schema.json"
     },
     "unrelease-package": {
-      "description": "unrelease package task executor",
+      "description": "Unpublishes a package version from the npm registry to revert a release.",
       "implementation": "./executors/unrelease-package/executor",
       "schema": "./executors/unrelease-package/schema.json"
     },
     "vercel-edge-config-sync": {
-      "description": "vercel-edge-config-sync task executor",
+      "description": "Fetches Vercel Edge Config values and writes them to a local app.json file.",
       "implementation": "./executors/vercel-edge-config-sync/executor",
       "schema": "./executors/vercel-edge-config-sync/schema.json"
     },
     "vue-proxy-transform": {
-      "description": "vue-proxy-transform task executor",
+      "description": "Generates Vue wrapper components from Lit web component manifests.",
       "implementation": "./executors/vue-proxy-transform/executor",
       "schema": "./executors/vue-proxy-transform/schema.json"
     },
     "token-linter": {
-      "description": "token-linter task executor",
+      "description": "Lints Style Dictionary design token JSON files against configurable rules and conventions.",
       "implementation": "./executors/token-linter/executor",
       "schema": "./executors/token-linter/schema.json"
     },
     "prisma-seeds": {
-      "description": "prisma-seeds task executor",
+      "description": "Seeds the PostgreSQL database with initial or test data via Prisma.",
       "implementation": "./executors/prisma-seeds/executor",
       "schema": "./executors/prisma-seeds/schema.json"
+    },
+    "generate-package-docs": {
+      "description": "Generates API documentation for a library package using TypeDoc with Markdown output and configurable post-processing.",
+      "implementation": "./executors/generate-package-docs/executor",
+      "schema": "./executors/generate-package-docs/schema.json"
     }
   }
 }