@theholocron/holocron-plugin-doppler 2.0.0-alpha.8 → 2.0.0

package/README.md

@@ -8,8 +8,10 @@ plus exports `verifyToken` + `AUTH_HINT` for use by `holocron auth`.
 
 ## Install
 
+<!-- prettier-ignore -->
 ```bash
 pnpm add -D @theholocron/holocron-plugin-doppler@alpha
+
 ```
 
 ## Auth
@@ -28,6 +30,7 @@ Token resolution order (matches the standard 4-step precedence set by
 Doppler's free tier does not expose Service Accounts (Team+ only). Use
 a Personal Token or CLI token instead.
 
+<!-- prettier-ignore -->
 ```bash
 # 1. Install the Doppler CLI
 brew install dopplerhq/cli/doppler
@@ -43,6 +46,7 @@ holocron auth set doppler $(doppler configure get token --plain)
 
 # 4. Verify:
 holocron auth check doppler
+
 ```
 
 **CI**: the keyring is not available in headless containers. Expose
@@ -52,12 +56,14 @@ precedence still work; step 4 quietly falls through.
 
 ## Config
 
+<!-- prettier-ignore -->
 ```jsonc
 {
-	"providers": {
-		"vault": ["doppler", { "project": "my-app", "config": "dev" }],
-	},
+  "providers": {
+    "vault": ["doppler", { "project": "my-app", "config": "dev" }],
+  },
 }
+
 ```
 
 - `project` (required) — Doppler project name. `read` / `list` /
@@ -67,8 +73,10 @@ precedence still work; step 4 quietly falls through.
 
 Individual `read` / `write` calls take a fully-qualified reference:
 
+<!-- prettier-ignore -->
 ```
 doppler://<project>/<config>/<name>
+
 ```
 
 The default project + config in options apply to `list()`,

package/dist/index.d.mts

@@ -1,58 +1,8 @@
-import { EnsureResult, Vault } from "@theholocron/cli";
+import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
+import { DopplerClient, createDopplerClient } from "@theholocron/doppler-client";
 
 //#region src/auth.d.ts
-/**
- * Token resolution for the Doppler plugin.
- *
- * Resolution order (matches the standard 4-step precedence set by
- * `.notes/tech-auth-bootstrap.spec.md`):
- *   1. explicit `cliToken` argument (from `--token` flag)
- *   2. HOLOCRON_DOPPLER_TOKEN env var (preferred — explicit intent)
- *   3. DOPPLER_TOKEN env var (Doppler-native, works in CI)
- *   4. keyring (com.theholocron.cli / "doppler")
- *   5. AuthError with a hint pointing at `doppler configure`
- */
-declare class AuthError extends Error {
-  name: string;
-}
-interface ResolveTokenInput {
-  /** From `--token` CLI flag. */
-  cliToken?: string;
-  /** Env vars; passed in for testability. Defaults to `process.env`. */
-  env?: NodeJS.ProcessEnv;
-  /** Keyring lookup fn; passed in for testability. Defaults to `getToken(provider)`. */
-  keyring?: (provider: string) => string | null;
-}
-declare function resolveToken(input?: ResolveTokenInput): string;
-//#endregion
-//#region src/rest.d.ts
-/**
- * Thin REST wrapper around api.doppler.com/v3.
- *
- * Same pattern as the GitHub / Vercel / Neon REST clients — bearer
- * auth, JSON-only bodies, transport-failure wrapping with `status: 0`
- * so the orchestrator's soft-skip path sees a clear "Doppler GET /path
- * failed" message instead of a generic `TypeError: fetch failed`.
- */
-interface RestClientOptions {
-  token: string;
-  fetch?: typeof fetch;
-  baseUrl?: string;
-}
-interface RequestOptions {
-  method?: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
-  body?: unknown;
-  query?: Record<string, string>;
-  /** Treat this response as void even if 200 is returned. */
-  expectNoContent?: boolean;
-}
-declare class DopplerRestClient {
-  private readonly token;
-  private readonly fetchImpl;
-  readonly baseUrl: string;
-  constructor(opts: RestClientOptions);
-  request<T>(path: string, opts?: RequestOptions): Promise<T>;
-}
+declare const resolveToken: (input?: import("@theholocron/http-client").ResolveTokenInput) => string;
 //#endregion
 //#region src/capabilities/vault.d.ts
 interface DopplerVaultOptions {
@@ -62,12 +12,12 @@ interface DopplerVaultOptions {
   config: string;
 }
 declare class DopplerVault implements Vault {
-  private readonly rest;
+  private readonly client;
   readonly key: "vault";
   readonly providerName = "doppler";
   private readonly project;
   private readonly config;
-  constructor(rest: DopplerRestClient, opts: DopplerVaultOptions);
+  constructor(client: DopplerClient, opts: DopplerVaultOptions);
   read(reference: string): Promise<string>;
   write(reference: string, value: string): Promise<void>;
   list(): Promise<string[]>;
@@ -112,7 +62,7 @@ interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
 }
 interface PluginContext {
   options: DopplerPluginOptions;
-  rest: DopplerRestClient;
+  client: DopplerClient;
 }
 declare function createContext(options: DopplerPluginOptions): PluginContext;
 declare function vault(ctx: PluginContext): Vault;
@@ -128,4 +78,4 @@ declare function createPlugin(options: DopplerPluginOptions): {
  */
 declare const AUTH_HINT: string;
 //#endregion
-export { AUTH_HINT, AuthError, DopplerPluginOptions, DopplerRestClient, DopplerVault, PluginContext, ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createPlugin, resolveToken, vault, verifyToken };
+export { AUTH_HINT, AuthError, DopplerPluginOptions, DopplerVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };

package/dist/index.mjs

@@ -1,26 +1,12 @@
-import { ProviderApiError, getToken } from "@theholocron/cli";
+import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
+import { createDopplerClient } from "@theholocron/doppler-client";
 //#region src/auth.ts
-/**
-* Token resolution for the Doppler plugin.
-*
-* Resolution order (matches the standard 4-step precedence set by
-* `.notes/tech-auth-bootstrap.spec.md`):
-*   1. explicit `cliToken` argument (from `--token` flag)
-*   2. HOLOCRON_DOPPLER_TOKEN env var (preferred — explicit intent)
-*   3. DOPPLER_TOKEN env var (Doppler-native, works in CI)
-*   4. keyring (com.theholocron.cli / "doppler")
-*   5. AuthError with a hint pointing at `doppler configure`
-*/
-var AuthError = class extends Error {
-	name = "AuthError";
-};
-function resolveToken(input = {}) {
-	const env = input.env ?? process.env;
-	const keyring = input.keyring ?? getToken;
-	const token = input.cliToken || env.HOLOCRON_DOPPLER_TOKEN || env.DOPPLER_TOKEN || keyring("doppler");
-	if (!token) throw new AuthError("no Doppler token found. Pass --token <TOKEN>, set HOLOCRON_DOPPLER_TOKEN / DOPPLER_TOKEN, or run: holocron auth set doppler $(doppler configure get token --plain)");
-	return token;
-}
+const resolveToken = createResolveToken({
+	envName: "HOLOCRON_DOPPLER_TOKEN",
+	vendorEnvName: "DOPPLER_TOKEN",
+	keyringService: "doppler",
+	errorMessage: "no Doppler token found. Pass --token <TOKEN>, set HOLOCRON_DOPPLER_TOKEN / DOPPLER_TOKEN, or run: holocron auth set doppler $(doppler configure get token --plain)"
+});
 //#endregion
 //#region src/capabilities/vault.ts
 /**
@@ -48,13 +34,13 @@ function resolveToken(input = {}) {
 * ProviderApiError with `status: 409` which we catch and swallow.
 */
 var DopplerVault = class {
-	rest;
+	client;
 	key = "vault";
 	providerName = "doppler";
 	project;
 	config;
-	constructor(rest, opts) {
-		this.rest = rest;
+	constructor(client, opts) {
+		this.client = client;
 		if (!opts.project) throw new Error("DopplerVault requires `project` in options");
 		if (!opts.config) throw new Error("DopplerVault requires `config` in options");
 		this.project = opts.project;
@@ -62,53 +48,29 @@ var DopplerVault = class {
 	}
 	async read(reference) {
 		const parsed = parseReference(reference);
-		const res = await this.rest.request("/configs/config/secret", { query: {
-			project: parsed.project,
-			config: parsed.config,
-			name: parsed.name
-		} });
+		const res = await this.client.secrets.get(parsed.project, parsed.config, parsed.name);
 		return res.value?.computed ?? res.value?.raw ?? "";
 	}
 	async write(reference, value) {
 		const parsed = parseReference(reference);
-		await this.rest.request("/configs/config/secrets", {
-			method: "POST",
-			body: {
-				project: parsed.project,
-				config: parsed.config,
-				secrets: { [parsed.name]: value }
-			}
-		});
+		await this.client.secrets.update(parsed.project, parsed.config, { [parsed.name]: value });
 	}
 	async list() {
-		const res = await this.rest.request("/configs/config/secrets", { query: {
-			project: this.project,
-			config: this.config
-		} });
+		const res = await this.client.secrets.list(this.project, this.config);
 		return Object.keys(res.secrets ?? {});
 	}
 	async environments() {
-		return ((await this.rest.request("/environments", { query: { project: this.project } })).environments ?? []).map((e) => e.slug ?? e.name ?? "").filter(Boolean);
+		return ((await this.client.environments.list(this.project)).environments ?? []).map((e) => e.slug ?? e.name ?? "").filter(Boolean);
 	}
 	async readEnvironment(environmentId) {
-		const res = await this.rest.request("/configs/config/secrets/download", { query: {
-			project: this.project,
-			config: environmentId,
-			format: "json"
-		} });
+		const res = await this.client.secrets.download(this.project, environmentId);
 		const out = {};
 		for (const [k, v] of Object.entries(res)) if (typeof v === "string") out[k] = v;
 		return out;
 	}
 	async ensureProject(name) {
 		try {
-			await this.rest.request("/projects", {
-				method: "POST",
-				body: {
-					name,
-					description: `Managed by holocron`
-				}
-			});
+			await this.client.projects.create(name, "Managed by holocron");
 			return { alreadyExists: false };
 		} catch (err) {
 			if (isConflict(err)) return { alreadyExists: true };
@@ -117,14 +79,7 @@ var DopplerVault = class {
 	}
 	async ensureEnvironment(project, name) {
 		try {
-			await this.rest.request("/environments", {
-				method: "POST",
-				body: {
-					project,
-					name,
-					slug: name
-				}
-			});
+			await this.client.environments.create(project, name, name);
 			return { alreadyExists: false };
 		} catch (err) {
 			if (isConflict(err)) return { alreadyExists: true };
@@ -171,60 +126,6 @@ function hasAlreadyExistsBody(details) {
 	return /already exists/i.test(details);
 }
 //#endregion
-//#region src/rest.ts
-/**
-* Thin REST wrapper around api.doppler.com/v3.
-*
-* Same pattern as the GitHub / Vercel / Neon REST clients — bearer
-* auth, JSON-only bodies, transport-failure wrapping with `status: 0`
-* so the orchestrator's soft-skip path sees a clear "Doppler GET /path
-* failed" message instead of a generic `TypeError: fetch failed`.
-*/
-var DopplerRestClient = class {
-	token;
-	fetchImpl;
-	baseUrl;
-	constructor(opts) {
-		this.token = opts.token;
-		this.fetchImpl = opts.fetch ?? globalThis.fetch;
-		let url = opts.baseUrl ?? "https://api.doppler.com/v3";
-		while (url.endsWith("/")) url = url.slice(0, -1);
-		this.baseUrl = url;
-	}
-	async request(path, opts = {}) {
-		const url = new URL(`${this.baseUrl}${path.startsWith("/") ? path : "/" + path}`);
-		for (const [k, v] of Object.entries(opts.query ?? {})) url.searchParams.set(k, v);
-		const fullUrl = url.toString();
-		const headers = {
-			authorization: `Bearer ${this.token}`,
-			accept: "application/json"
-		};
-		const init = {
-			method: opts.method ?? "GET",
-			headers
-		};
-		if (opts.body !== void 0) {
-			headers["content-type"] = "application/json";
-			init.body = JSON.stringify(opts.body);
-		}
-		let res;
-		try {
-			res = await this.fetchImpl(fullUrl, init);
-		} catch (err) {
-			const detail = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
-			throw new ProviderApiError(`Doppler ${init.method} ${path} failed: ${detail}`, 0, void 0);
-		}
-		if (!res.ok) {
-			const body = await res.text().catch(() => "");
-			throw new ProviderApiError(`Doppler ${init.method} ${path} → ${res.status}`, res.status, body);
-		}
-		if (opts.expectNoContent || res.status === 204) return void 0;
-		const text = await res.text();
-		if (!text) return void 0;
-		return JSON.parse(text);
-	}
-};
-//#endregion
 //#region src/verify-token.ts
 /**
 * `verifyToken` — plugin-level export used by `holocron auth set` +
@@ -237,12 +138,13 @@ var DopplerRestClient = class {
 * what we don't have yet at bootstrap time.
 */
 async function verifyToken(token, opts = {}) {
-	const restOpts = { token };
-	if (opts.baseUrl !== void 0) restOpts.baseUrl = opts.baseUrl;
-	if (opts.fetch !== void 0) restOpts.fetch = opts.fetch;
-	const rest = new DopplerRestClient(restOpts);
+	const client = createDopplerClient({
+		token,
+		baseUrl: opts.baseUrl,
+		fetch: opts.fetch
+	});
 	try {
-		const me = await rest.request("/me");
+		const me = await client.me.get();
 		const workplace = me.workplace?.name ?? me.slug ?? "unknown";
 		return {
 			ok: true,
@@ -258,16 +160,17 @@ async function verifyToken(token, opts = {}) {
 //#endregion
 //#region src/index.ts
 function createContext(options) {
-	const restOpts = { token: resolveToken(options) };
-	if (options.baseUrl !== void 0) restOpts.baseUrl = options.baseUrl;
-	if (options.fetch !== void 0) restOpts.fetch = options.fetch;
 	return {
 		options,
-		rest: new DopplerRestClient(restOpts)
+		client: createDopplerClient({
+			token: resolveToken(options),
+			baseUrl: options.baseUrl,
+			fetch: options.fetch
+		})
 	};
 }
 function vault(ctx) {
-	return new DopplerVault(ctx.rest, {
+	return new DopplerVault(ctx.client, {
 		project: ctx.options.project,
 		config: ctx.options.config
 	});
@@ -285,4 +188,4 @@ function createPlugin(options) {
 */
 const AUTH_HINT = "install the Doppler CLI (`brew install dopplerhq/cli/doppler`), run `doppler login`, then `holocron auth set doppler $(doppler configure get token --plain)`";
 //#endregion
-export { AUTH_HINT, AuthError, DopplerRestClient, DopplerVault, createContext, createPlugin, resolveToken, vault, verifyToken };
+export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-doppler",
-  "version": "2.0.0-alpha.8",
+  "version": "2.0.0",
   "description": "Holocron plugin for Doppler. Implements the vault capability against Doppler's REST API — projects, configs, secrets, plus verifyToken + AUTH_HINT for `holocron auth`.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-doppler#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -21,19 +21,26 @@
     }
   },
   "peerDependencies": {
-    "@theholocron/cli": "2.0.0-alpha.8"
+    "@theholocron/doppler-client": "^1.1.0",
+    "@theholocron/cli": "2.0.0"
   },
   "devDependencies": {
-    "@theholocron/tsconfig": "^4.1.0",
-    "@tsconfig/node-lts": "^24.0.0",
-    "@vitest/coverage-v8": "^3.2.6",
-    "eslint": "^9.36.0",
-    "globals": "^16.5.0",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.6",
+    "@theholocron/doppler-client": "^1.1.0",
+    "@theholocron/eslint-config": "^7.3.0",
+    "@theholocron/tsconfig": "^7.3.0",
+    "@theholocron/tsdown-config": "^7.3.0",
+    "@theholocron/vitest-config": "^7.3.0",
+    "@types/node": "^26",
+    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/eslint-plugin": "^1.6.23",
+    "eslint": "^10.7.0",
+    "eslint-plugin-n": "^18.2.2",
+    "globals": "^17.7.0",
     "tsdown": "^0.22.3",
     "tsx": "^4.22.4",
-    "@theholocron/cli": "2.0.0-alpha.8"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10",
+    "@theholocron/cli": "2.0.0"
   },
   "publishConfig": {
     "access": "public"