@hubble-ventures/infisicml 1.2.1

package/dist/pull.js

@@ -0,0 +1,67 @@
+import { existsSync, writeFileSync } from "node:fs";
+import { relative } from "node:path";
+import { applyAliases } from "./aliases.js";
+import { fetchManifestSecrets, keysForCiStub, shouldSkipInfisicalPull, } from "./ci-skip.js";
+import { serializeDotenv } from "./dotenv.js";
+import { selectEmittedSecrets } from "./include.js";
+import { normalizeFolderPath, resolveFetchMode, resolveInclude, resolvePaths, resolveSecretsOutputPath, } from "./manifest.js";
+import { resolveOptionalKeys } from "./optional-keys.js";
+export function writeInjectedSecretsStub(outputPath, manifest, keys) {
+    const fromEnv = {};
+    for (const key of keys) {
+        const value = process.env[key];
+        if (value)
+            fromEnv[key] = value;
+    }
+    const header = [
+        "# Skipped Infisical pull — required build env vars already injected.",
+        `# Package: ${manifest.id}`,
+        "# Source: process.env (CI / workflow build-env-vars)",
+        `# Generated: ${new Date().toISOString()}`,
+        "",
+    ].join("\n");
+    writeFileSync(outputPath, header + serializeDotenv(fromEnv));
+}
+export async function pullManifest(options) {
+    const { manifest, repoRoot, envName, profile, force = false, turboMode = false, provider, } = options;
+    const outputName = manifest.config.output ?? ".env.secrets";
+    const outputPath = resolveSecretsOutputPath(manifest.dir, outputName);
+    const rel = relative(repoRoot, outputPath);
+    if (!turboMode && existsSync(outputPath) && !force) {
+        console.log(`⏭️  ${manifest.id}: ${rel} exists (use --force to refresh)`);
+        return "skipped";
+    }
+    if (shouldSkipInfisicalPull(manifest.config, force)) {
+        const keys = keysForCiStub(manifest.config);
+        writeInjectedSecretsStub(outputPath, manifest, keys);
+        console.log(`⏭️  ${manifest.id}: skipped Infisical pull (injected env → ${rel})`);
+        return "skipped";
+    }
+    const paths = resolvePaths(manifest.config, profile);
+    const fetchMode = resolveFetchMode(manifest.config, profile);
+    const aliased = applyAliases(await fetchManifestSecrets(provider, envName, paths, manifest.config, profile), manifest.config);
+    // Default-deny key selection: emit only the allowlisted keys when `include`
+    // is set (after aliases). Absent = emit all.
+    const include = resolveInclude(manifest.config, profile);
+    const merged = selectEmittedSecrets(aliased, include, resolveOptionalKeys(manifest.config, envName));
+    // filter(Boolean) drops the optional Profile/Include lines when absent. It
+    // would also drop a trailing "" sentinel, so append the trailing newline
+    // explicitly — otherwise the first secret gets glued onto the "# Generated"
+    // line.
+    const header = `${[
+        "# Pulled from Infisical — do not edit. Refresh: infisicml pull",
+        `# Package: ${manifest.id}`,
+        `# Environment: ${envName}`,
+        profile ? `# Profile: ${profile}` : "",
+        `# Paths: ${paths.map((p) => normalizeFolderPath(p)).join(", ")}`,
+        fetchMode === "keys" ? "# Fetch: keys (per-key least-privilege read)" : "",
+        include ? `# Include: ${include.join(", ")}` : "",
+        `# Generated: ${new Date().toISOString()}`,
+    ]
+        .filter(Boolean)
+        .join("\n")}\n`;
+    writeFileSync(outputPath, header + serializeDotenv(merged));
+    console.log(`✅ ${manifest.id}: wrote ${rel} (${Object.keys(merged).length} vars)`);
+    return "pulled";
+}
+//# sourceMappingURL=pull.js.map

package/dist/pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAgBzD,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,QAAyB,EACzB,IAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG;QACb,sEAAsE;QACtE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,sDAAsD;QACtD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B;IAE5B,MAAM,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,GAAG,KAAK,EACb,SAAS,GAAG,KAAK,EACjB,QAAQ,GACT,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC5D,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE3C,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,kCAAkC,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,EAAE,4CAA4C,GAAG,GAAG,CACrE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,QAAQ;IACR,MAAM,MAAM,GAAG,GAAG;QAChB,gEAAgE;QAChE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,kBAAkB,OAAO,EAAE;QAC3B,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QACtC,YAAY,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;QAC1E,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACjD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC3C;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAElB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,QAAQ,CACtE,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,14 @@
+import type { ResolvedConfig } from "./config.js";
+import { type SecretsManifest } from "./manifest.js";
+export type PackageManifest = {
+    id: string;
+    dir: string;
+    config: SecretsManifest;
+};
+/**
+ * Discover every `secrets.json` in the repo, driven entirely by
+ * `config.discovery` — no repo-specific directory constants. Explicit
+ * `packages` win over `roots`-discovered entries at the same directory.
+ */
+export declare function discoverManifests(config: ResolvedConfig): PackageManifest[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,EAAE,CA4B3E"}

package/dist/registry.js

@@ -0,0 +1,35 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { loadManifestJson } from "./manifest.js";
+/**
+ * Discover every `secrets.json` in the repo, driven entirely by
+ * `config.discovery` — no repo-specific directory constants. Explicit
+ * `packages` win over `roots`-discovered entries at the same directory.
+ */
+export function discoverManifests(config) {
+    const { repoRoot } = config;
+    const byDir = new Map();
+    const scanDir = (dir, id) => {
+        const manifestPath = join(dir, "secrets.json");
+        if (!existsSync(manifestPath))
+            return;
+        const parsed = loadManifestJson(JSON.parse(readFileSync(manifestPath, "utf8")));
+        byDir.set(resolve(dir), { dir, id, config: parsed });
+    };
+    for (const root of config.discovery.roots ?? []) {
+        const rootAbs = join(repoRoot, root);
+        if (!existsSync(rootAbs))
+            continue;
+        for (const entry of readdirSync(rootAbs, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            scanDir(join(rootAbs, entry.name), entry.name);
+        }
+    }
+    // Explicit packages last so a custom id/dir overrides a roots-discovered one.
+    for (const { id, dir } of config.discovery.packages ?? []) {
+        scanDir(join(repoRoot, dir), id);
+    }
+    return [...byDir.values()].sort((a, b) => a.id.localeCompare(b.id));
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAQvE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAU,EAAE,EAAE;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAC/C,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@hubble-ventures/infisicml",
+  "version": "1.2.1",
+  "description": "Infisical Secret Orchestration — federated per-package secret manifests for monorepos, unified across local dev and CI.",
+  "keywords": [
+    "infisical",
+    "secrets",
+    "monorepo",
+    "dotenv",
+    "github-actions",
+    "ci",
+    "env"
+  ],
+  "license": "MIT",
+  "author": "Hubble Ventures",
+  "homepage": "https://github.com/hubble-ventures/infisicml#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hubble-ventures/infisicml.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hubble-ventures/infisicml/issues"
+  },
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "infisicml": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./schema": "./schema/secrets.schema.json"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "smoke": "npm run build && bash scripts/smoke.sh",
+    "type-check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  }
+}

package/schema/secrets.schema.json

@@ -0,0 +1,105 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://cdn.jsdelivr.net/npm/@hubble-ventures/infisicml@1/schema/secrets.schema.json",
+  "title": "Infisicml secrets manifest",
+  "description": "Declares which Infisical vault folders to pull into a gitignored .env.secrets file next to this manifest.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["paths"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "paths": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string", "pattern": "^[a-z0-9_/-]+$" },
+      "description": "Infisical folder paths (without leading slash), e.g. clerk, vendor/app"
+    },
+    "profiles": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["paths"],
+        "properties": {
+          "paths": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "pattern": "^[a-z0-9_/-]+$" }
+          },
+          "include": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
+            "description": "Key allowlist for this profile; replaces the root include when set"
+          },
+          "fetch": {
+            "enum": ["folder", "keys"],
+            "description": "Read strategy for this profile; replaces the root fetch when set"
+          }
+        }
+      },
+      "description": "Named path sets; profile paths replace default paths when --profile is set"
+    },
+    "ci": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "skipWhenEnv": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Skip Infisical in CI when all listed env vars are already set"
+        },
+        "stubInCi": {
+          "type": "boolean",
+          "description": "When true, write a stub .env.secrets in CI without calling Infisical"
+        }
+      }
+    },
+    "output": {
+      "type": "string",
+      "default": ".env.secrets",
+      "pattern": "^[^/\\\\]+$",
+      "description": "Output filename only (no path separators), relative to this manifest directory"
+    },
+    "aliases": {
+      "type": "object",
+      "description": "Copy a pulled secret to extra env var name(s) a build/runtime expects (e.g. CLERK_PUBLISHABLE_KEY -> VITE_CLERK_PUBLISHABLE_KEY).",
+      "additionalProperties": {
+        "oneOf": [
+          { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
+          {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" }
+          }
+        ]
+      }
+    },
+    "include": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
+      "description": "Emit only these env var names from whatever the folders yielded (after aliases). Omit to emit all keys. Lets a client pull a shared vendor folder but emit only its public key, keeping server secrets out of client builds and GITHUB_ENV."
+    },
+    "fetch": {
+      "enum": ["folder", "keys"],
+      "default": "folder",
+      "description": "Read strategy. 'folder' (default) pulls whole folders and filters locally. 'keys' fetches only the keys 'include' resolves to; in CI the vault transmits nothing else (per-key REST reads), locally the CLI fetches the folder and selects them. Requires 'include'. A per-profile 'fetch' replaces this one."
+    },
+    "environments": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "optionalKeys": {
+            "type": "array",
+            "items": { "type": "string" },
+            "description": "Keys allowed to be absent in this environment; export-gha logs a notice instead of failing"
+          }
+        }
+      },
+      "description": "Per-environment policy keyed by Infisical env slug (development, preview, production)"
+    }
+  }
+}