@theholocron/holocron-plugin-doppler 5.0.0-alpha.25 → 5.0.0-alpha.250

package/dist/index.d.mts

@@ -1,16 +1,13 @@
-import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
+import { AuthError, EnsureResult, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
 import { DopplerClient, DopplerClientOptions, createDopplerClient } from "@theholocron/doppler-client";
-//#region src/auth.d.ts
-declare const resolveToken: (input?: ResolveTokenInput) => string;
-//#endregion
-//#region src/capabilities/vault.d.ts
+export declare const resolveToken: (input?: ResolveTokenInput) => string;
 interface DopplerVaultOptions {
   /** Default project — read/list/etc. operate here unless overridden. */
   project: string;
   /** Default config name — dev / stg / prd, etc. */
   config: string;
 }
-declare class DopplerVault implements Vault {
+export declare class DopplerVault implements Vault {
   private readonly client;
   readonly key: "vault";
   readonly providerName = "doppler";
@@ -18,6 +15,7 @@ declare class DopplerVault implements Vault {
   private readonly config;
   constructor(client: () => DopplerClient, opts: DopplerVaultOptions);
   read(reference: string): Promise<string>;
+  readSecret(name: string): Promise<string>;
   write(reference: string, value: string): Promise<void>;
   list(): Promise<string[]>;
   environments(): Promise<string[]>;
@@ -25,48 +23,28 @@ declare class DopplerVault implements Vault {
   ensureProject(name: string): Promise<EnsureResult>;
   ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
 }
-//#endregion
-//#region src/verify-token.d.ts
-/**
- * `verifyToken` — plugin-level export used by `holocron auth set` +
- * `holocron auth check`. Hits `GET /v3/me` and translates the response
- * into the normalized `VerifyTokenResult` shape.
- *
- * Kept as a standalone function (not a capability method) so the auth
- * command can call it without initializing the full plugin — plugin
- * construction requires an already-resolved token, which is exactly
- * what we don't have yet at bootstrap time.
- */
-interface VerifyTokenSuccess {
-  ok: true;
-  subject: string;
-}
-interface VerifyTokenFailure {
-  ok: false;
-  message: string;
-}
-type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
 interface VerifyTokenOptions {
   baseUrl?: string;
   fetch?: typeof fetch;
 }
-declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
-//#endregion
-//#region src/index.d.ts
-interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
+export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
+export interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
   /** Override base URL for tests. */
   baseUrl?: string;
   /** Override `fetch` for tests. */
   fetch?: typeof fetch;
 }
-interface PluginContext {
+export interface PluginContext {
   options: DopplerPluginOptions;
   client: () => DopplerClient;
 }
-declare function createContext(options: DopplerPluginOptions): PluginContext;
-declare function vault(ctx: PluginContext): Vault;
-declare function createPlugin(options: DopplerPluginOptions): {
+export declare function createContext(options: DopplerPluginOptions): PluginContext;
+export declare function vault(ctx: PluginContext): Vault;
+export declare function createPlugin(options: DopplerPluginOptions): {
   name: string;
+  probes: {
+    connection: import("@theholocron/cli").Probe;
+  };
   capabilities: {
     vault: () => Vault;
   };
@@ -75,6 +53,5 @@ declare function createPlugin(options: DopplerPluginOptions): {
  * One-line hint shown by `holocron auth set doppler` when no token is
  * supplied or when the supplied token is rejected.
  */
-declare const AUTH_HINT: string;
-//#endregion
-export { AUTH_HINT, AuthError, type DopplerClientOptions, DopplerPluginOptions, DopplerVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
+export declare const AUTH_HINT: string;
+export { AuthError, type DopplerClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createDopplerClient };

package/dist/index.mjs

@@ -1,14 +1,29 @@
-import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
+import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
 import { createDopplerClient } from "@theholocron/doppler-client";
-//#region src/auth.ts
+import { errorMessage } from "@theholocron/misc-utils";
+// src/auth.ts
 const resolveToken = createResolveToken({
 	envName: "HOLOCRON_DOPPLER_TOKEN",
 	vendorEnvName: "DOPPLER_TOKEN",
 	keyringService: "doppler",
 	errorMessage: "no Doppler token found. Pass --token <TOKEN>, set HOLOCRON_DOPPLER_TOKEN / DOPPLER_TOKEN, or run: holocron auth set doppler $(doppler configure get token --plain)"
 });
-//#endregion
-//#region src/capabilities/vault.ts
+// src/capabilities/vault.ts
+/**
+* Doppler auto-injects these into every config's secrets download —
+* bookkeeping about the config itself, not something any caller
+* defined. `readEnvironment()` fans its result out to real destinations
+* (`holocron secrets sync` → CI secrets, deploy env vars); shipping
+* these alongside real secrets is pure noise there (theholocron/holocron#742
+* — found via Sentinel's deploy picking them up as if they were its own
+* env). Confirmed stable, documented Doppler behavior — not
+* project/config-specific, so safe to filter by name unconditionally.
+*/
+const DOPPLER_INJECTED_KEYS = /* @__PURE__ */ new Set([
+	"DOPPLER_PROJECT",
+	"DOPPLER_CONFIG",
+	"DOPPLER_ENVIRONMENT"
+]);
 var DopplerVault = class {
 	client;
 	key = "vault";
@@ -27,6 +42,10 @@ var DopplerVault = class {
 		const res = await this.client().secrets.get(parsed.project, parsed.config, parsed.name);
 		return res.value?.computed ?? res.value?.raw ?? "";
 	}
+	async readSecret(name) {
+		const res = await this.client().secrets.get(this.project, this.config, name);
+		return res.value?.computed ?? res.value?.raw ?? "";
+	}
 	async write(reference, value) {
 		const parsed = parseReference(reference);
 		await this.client().secrets.update(parsed.project, parsed.config, { [parsed.name]: value });
@@ -41,7 +60,7 @@ var DopplerVault = class {
 	async readEnvironment(environmentId) {
 		const res = await this.client().secrets.download(this.project, environmentId);
 		const out = {};
-		for (const [k, v] of Object.entries(res)) if (typeof v === "string") out[k] = v;
+		for (const [k, v] of Object.entries(res)) if (typeof v === "string" && !DOPPLER_INJECTED_KEYS.has(k)) out[k] = v;
 		return out;
 	}
 	async ensureProject(name) {
@@ -101,18 +120,7 @@ function hasAlreadyExistsBody(details) {
 	if (typeof details !== "string") return false;
 	return /already exists/i.test(details);
 }
-//#endregion
-//#region src/verify-token.ts
-/**
-* `verifyToken` — plugin-level export used by `holocron auth set` +
-* `holocron auth check`. Hits `GET /v3/me` and translates the response
-* into the normalized `VerifyTokenResult` shape.
-*
-* Kept as a standalone function (not a capability method) so the auth
-* command can call it without initializing the full plugin — plugin
-* construction requires an already-resolved token, which is exactly
-* what we don't have yet at bootstrap time.
-*/
+// src/verify-token.ts
 async function verifyToken(token, opts = {}) {
 	const client = createDopplerClient({
 		token,
@@ -129,12 +137,11 @@ async function verifyToken(token, opts = {}) {
 	} catch (err) {
 		return {
 			ok: false,
-			message: err instanceof Error ? err.message : String(err)
+			message: errorMessage(err)
 		};
 	}
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 function createContext(options) {
 	let client;
 	return {
@@ -156,6 +163,16 @@ function createPlugin(options) {
 	const ctx = createContext(options);
 	return {
 		name: "@theholocron/holocron-plugin-doppler",
+		probes: { connection: connectionProbe({
+			provider: "Doppler",
+			url: options.baseUrl ?? "https://api.doppler.com",
+			fetch: options.fetch,
+			token: () => resolveToken(options),
+			verify: (token) => verifyToken(token, {
+				baseUrl: options.baseUrl,
+				fetch: options.fetch
+			})
+		}) },
 		capabilities: { vault: () => vault(ctx) }
 	};
 }
@@ -164,5 +181,4 @@ function createPlugin(options) {
 * supplied or when the supplied token is rejected.
 */
 const AUTH_HINT = "install the Doppler CLI (`brew install dopplerhq/cli/doppler`), run `doppler login`, then `holocron auth set doppler $(doppler configure get token --plain)`";
-//#endregion
 export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-doppler",
-  "version": "5.0.0-alpha.25",
+  "version": "5.0.0-alpha.250",
   "description": "Holocron plugin for Doppler. Implements the vault capability against Doppler's REST API — projects, configs, secrets, plus verifyToken + AUTH_HINT for `holocron auth`.",
   "keywords": [
     "doppler",
@@ -8,12 +8,12 @@
     "plugin",
     "vault"
   ],
-  "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-doppler#readme",
+  "homepage": "https://github.com/theholocron/holocron/tree/main/plugins/holocron-plugin-doppler#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/theholocron/holocron.git",
-    "directory": "packages/holocron-plugin-doppler"
+    "directory": "plugins/holocron-plugin-doppler"
   },
   "license": "MIT",
   "author": "Newton Koumantzelis",
@@ -30,27 +30,29 @@
     "dist"
   ],
   "devDependencies": {
-    "@theholocron/doppler-client": "^1.22.0",
-    "@theholocron/eslint-config": "^8.0.0",
-    "@theholocron/http-client": "^1.22.0",
-    "@theholocron/tsconfig": "^8.0.0",
-    "@theholocron/tsdown-config": "^8.0.0",
-    "@theholocron/vitest-config": "^8.0.0",
+    "@theholocron/doppler-client": "^1.43.1",
+    "@theholocron/eslint-config": "^8.8.2",
+    "@theholocron/http-client": "^1.57.0",
+    "@theholocron/misc-utils": "^1.16.0",
+    "@theholocron/tsconfig": "^8.8.2",
+    "@theholocron/tsdown-config": "^8.8.2",
+    "@theholocron/vitest-config": "^8.8.2",
     "@types/node": "^26",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^5.0.5",
     "@vitest/eslint-plugin": "^1.6.27",
     "eslint": "^10.8.1",
     "eslint-plugin-n": "^18.3.0",
     "globals": "^17.11.0",
-    "tsdown": "^0.22.14",
-    "tsx": "4.23.12",
+    "tsdown": "^0.23.3",
+    "tsx": "4.23.15",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.11",
-    "@theholocron/cli": "5.0.0-alpha.25"
+    "vitest": "^5.0.5",
+    "@theholocron/cli": "5.0.0-alpha.250"
   },
   "peerDependencies": {
-    "@theholocron/doppler-client": "^1.22.0",
-    "@theholocron/cli": "5.0.0-alpha.25"
+    "@theholocron/doppler-client": "^1.43.1",
+    "@theholocron/misc-utils": "^1.16.0",
+    "@theholocron/cli": "5.0.0-alpha.250"
   },
   "engines": {
     "node": ">=22"