@theholocron/holocron-plugin-doppler 5.0.0-alpha.27 → 5.0.0-alpha.270
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +15 -38
- package/dist/index.mjs +37 -21
- package/package.json +21 -19
package/dist/index.d.mts
CHANGED
|
@@ -1,16 +1,13 @@
|
|
|
1
|
-
import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, EnsureResult, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
|
|
2
2
|
import { DopplerClient, DopplerClientOptions, createDopplerClient } from "@theholocron/doppler-client";
|
|
3
|
-
|
|
4
|
-
declare const resolveToken: (input?: ResolveTokenInput) => string;
|
|
5
|
-
//#endregion
|
|
6
|
-
//#region src/capabilities/vault.d.ts
|
|
3
|
+
export declare const resolveToken: (input?: ResolveTokenInput) => string;
|
|
7
4
|
interface DopplerVaultOptions {
|
|
8
5
|
/** Default project — read/list/etc. operate here unless overridden. */
|
|
9
6
|
project: string;
|
|
10
7
|
/** Default config name — dev / stg / prd, etc. */
|
|
11
8
|
config: string;
|
|
12
9
|
}
|
|
13
|
-
declare class DopplerVault implements Vault {
|
|
10
|
+
export declare class DopplerVault implements Vault {
|
|
14
11
|
private readonly client;
|
|
15
12
|
readonly key: "vault";
|
|
16
13
|
readonly providerName = "doppler";
|
|
@@ -18,6 +15,7 @@ declare class DopplerVault implements Vault {
|
|
|
18
15
|
private readonly config;
|
|
19
16
|
constructor(client: () => DopplerClient, opts: DopplerVaultOptions);
|
|
20
17
|
read(reference: string): Promise<string>;
|
|
18
|
+
readSecret(name: string): Promise<string>;
|
|
21
19
|
write(reference: string, value: string): Promise<void>;
|
|
22
20
|
list(): Promise<string[]>;
|
|
23
21
|
environments(): Promise<string[]>;
|
|
@@ -25,48 +23,28 @@ declare class DopplerVault implements Vault {
|
|
|
25
23
|
ensureProject(name: string): Promise<EnsureResult>;
|
|
26
24
|
ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
|
|
27
25
|
}
|
|
28
|
-
//#endregion
|
|
29
|
-
//#region src/verify-token.d.ts
|
|
30
|
-
/**
|
|
31
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
32
|
-
* `holocron auth check`. Hits `GET /v3/me` and translates the response
|
|
33
|
-
* into the normalized `VerifyTokenResult` shape.
|
|
34
|
-
*
|
|
35
|
-
* Kept as a standalone function (not a capability method) so the auth
|
|
36
|
-
* command can call it without initializing the full plugin — plugin
|
|
37
|
-
* construction requires an already-resolved token, which is exactly
|
|
38
|
-
* what we don't have yet at bootstrap time.
|
|
39
|
-
*/
|
|
40
|
-
interface VerifyTokenSuccess {
|
|
41
|
-
ok: true;
|
|
42
|
-
subject: string;
|
|
43
|
-
}
|
|
44
|
-
interface VerifyTokenFailure {
|
|
45
|
-
ok: false;
|
|
46
|
-
message: string;
|
|
47
|
-
}
|
|
48
|
-
type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
|
|
49
26
|
interface VerifyTokenOptions {
|
|
50
27
|
baseUrl?: string;
|
|
51
28
|
fetch?: typeof fetch;
|
|
52
29
|
}
|
|
53
|
-
declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
|
|
54
|
-
|
|
55
|
-
//#region src/index.d.ts
|
|
56
|
-
interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
|
|
30
|
+
export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
|
|
31
|
+
export interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
|
|
57
32
|
/** Override base URL for tests. */
|
|
58
33
|
baseUrl?: string;
|
|
59
34
|
/** Override `fetch` for tests. */
|
|
60
35
|
fetch?: typeof fetch;
|
|
61
36
|
}
|
|
62
|
-
interface PluginContext {
|
|
37
|
+
export interface PluginContext {
|
|
63
38
|
options: DopplerPluginOptions;
|
|
64
39
|
client: () => DopplerClient;
|
|
65
40
|
}
|
|
66
|
-
declare function createContext(options: DopplerPluginOptions): PluginContext;
|
|
67
|
-
declare function vault(ctx: PluginContext): Vault;
|
|
68
|
-
declare function createPlugin(options: DopplerPluginOptions): {
|
|
41
|
+
export declare function createContext(options: DopplerPluginOptions): PluginContext;
|
|
42
|
+
export declare function vault(ctx: PluginContext): Vault;
|
|
43
|
+
export declare function createPlugin(options: DopplerPluginOptions): {
|
|
69
44
|
name: string;
|
|
45
|
+
probes: {
|
|
46
|
+
connection: import("@theholocron/cli").Probe;
|
|
47
|
+
};
|
|
70
48
|
capabilities: {
|
|
71
49
|
vault: () => Vault;
|
|
72
50
|
};
|
|
@@ -75,6 +53,5 @@ declare function createPlugin(options: DopplerPluginOptions): {
|
|
|
75
53
|
* One-line hint shown by `holocron auth set doppler` when no token is
|
|
76
54
|
* supplied or when the supplied token is rejected.
|
|
77
55
|
*/
|
|
78
|
-
declare const AUTH_HINT: string;
|
|
79
|
-
|
|
80
|
-
export { AUTH_HINT, AuthError, type DopplerClientOptions, DopplerPluginOptions, DopplerVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
|
|
56
|
+
export declare const AUTH_HINT: string;
|
|
57
|
+
export { AuthError, type DopplerClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createDopplerClient };
|
package/dist/index.mjs
CHANGED
|
@@ -1,14 +1,29 @@
|
|
|
1
|
-
import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
|
|
2
2
|
import { createDopplerClient } from "@theholocron/doppler-client";
|
|
3
|
-
|
|
3
|
+
import { errorMessage } from "@theholocron/misc-utils";
|
|
4
|
+
// src/auth.ts
|
|
4
5
|
const resolveToken = createResolveToken({
|
|
5
6
|
envName: "HOLOCRON_DOPPLER_TOKEN",
|
|
6
7
|
vendorEnvName: "DOPPLER_TOKEN",
|
|
7
8
|
keyringService: "doppler",
|
|
8
9
|
errorMessage: "no Doppler token found. Pass --token <TOKEN>, set HOLOCRON_DOPPLER_TOKEN / DOPPLER_TOKEN, or run: holocron auth set doppler $(doppler configure get token --plain)"
|
|
9
10
|
});
|
|
10
|
-
|
|
11
|
-
|
|
11
|
+
// src/capabilities/vault.ts
|
|
12
|
+
/**
|
|
13
|
+
* Doppler auto-injects these into every config's secrets download —
|
|
14
|
+
* bookkeeping about the config itself, not something any caller
|
|
15
|
+
* defined. `readEnvironment()` fans its result out to real destinations
|
|
16
|
+
* (`holocron secrets sync` → CI secrets, deploy env vars); shipping
|
|
17
|
+
* these alongside real secrets is pure noise there (theholocron/holocron#742
|
|
18
|
+
* — found via Sentinel's deploy picking them up as if they were its own
|
|
19
|
+
* env). Confirmed stable, documented Doppler behavior — not
|
|
20
|
+
* project/config-specific, so safe to filter by name unconditionally.
|
|
21
|
+
*/
|
|
22
|
+
const DOPPLER_INJECTED_KEYS = /* @__PURE__ */ new Set([
|
|
23
|
+
"DOPPLER_PROJECT",
|
|
24
|
+
"DOPPLER_CONFIG",
|
|
25
|
+
"DOPPLER_ENVIRONMENT"
|
|
26
|
+
]);
|
|
12
27
|
var DopplerVault = class {
|
|
13
28
|
client;
|
|
14
29
|
key = "vault";
|
|
@@ -27,6 +42,10 @@ var DopplerVault = class {
|
|
|
27
42
|
const res = await this.client().secrets.get(parsed.project, parsed.config, parsed.name);
|
|
28
43
|
return res.value?.computed ?? res.value?.raw ?? "";
|
|
29
44
|
}
|
|
45
|
+
async readSecret(name) {
|
|
46
|
+
const res = await this.client().secrets.get(this.project, this.config, name);
|
|
47
|
+
return res.value?.computed ?? res.value?.raw ?? "";
|
|
48
|
+
}
|
|
30
49
|
async write(reference, value) {
|
|
31
50
|
const parsed = parseReference(reference);
|
|
32
51
|
await this.client().secrets.update(parsed.project, parsed.config, { [parsed.name]: value });
|
|
@@ -41,7 +60,7 @@ var DopplerVault = class {
|
|
|
41
60
|
async readEnvironment(environmentId) {
|
|
42
61
|
const res = await this.client().secrets.download(this.project, environmentId);
|
|
43
62
|
const out = {};
|
|
44
|
-
for (const [k, v] of Object.entries(res)) if (typeof v === "string") out[k] = v;
|
|
63
|
+
for (const [k, v] of Object.entries(res)) if (typeof v === "string" && !DOPPLER_INJECTED_KEYS.has(k)) out[k] = v;
|
|
45
64
|
return out;
|
|
46
65
|
}
|
|
47
66
|
async ensureProject(name) {
|
|
@@ -101,18 +120,7 @@ function hasAlreadyExistsBody(details) {
|
|
|
101
120
|
if (typeof details !== "string") return false;
|
|
102
121
|
return /already exists/i.test(details);
|
|
103
122
|
}
|
|
104
|
-
|
|
105
|
-
//#region src/verify-token.ts
|
|
106
|
-
/**
|
|
107
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
108
|
-
* `holocron auth check`. Hits `GET /v3/me` and translates the response
|
|
109
|
-
* into the normalized `VerifyTokenResult` shape.
|
|
110
|
-
*
|
|
111
|
-
* Kept as a standalone function (not a capability method) so the auth
|
|
112
|
-
* command can call it without initializing the full plugin — plugin
|
|
113
|
-
* construction requires an already-resolved token, which is exactly
|
|
114
|
-
* what we don't have yet at bootstrap time.
|
|
115
|
-
*/
|
|
123
|
+
// src/verify-token.ts
|
|
116
124
|
async function verifyToken(token, opts = {}) {
|
|
117
125
|
const client = createDopplerClient({
|
|
118
126
|
token,
|
|
@@ -129,12 +137,11 @@ async function verifyToken(token, opts = {}) {
|
|
|
129
137
|
} catch (err) {
|
|
130
138
|
return {
|
|
131
139
|
ok: false,
|
|
132
|
-
message:
|
|
140
|
+
message: errorMessage(err)
|
|
133
141
|
};
|
|
134
142
|
}
|
|
135
143
|
}
|
|
136
|
-
|
|
137
|
-
//#region src/index.ts
|
|
144
|
+
// src/index.ts
|
|
138
145
|
function createContext(options) {
|
|
139
146
|
let client;
|
|
140
147
|
return {
|
|
@@ -156,6 +163,16 @@ function createPlugin(options) {
|
|
|
156
163
|
const ctx = createContext(options);
|
|
157
164
|
return {
|
|
158
165
|
name: "@theholocron/holocron-plugin-doppler",
|
|
166
|
+
probes: { connection: connectionProbe({
|
|
167
|
+
provider: "Doppler",
|
|
168
|
+
url: options.baseUrl ?? "https://api.doppler.com",
|
|
169
|
+
fetch: options.fetch,
|
|
170
|
+
token: () => resolveToken(options),
|
|
171
|
+
verify: (token) => verifyToken(token, {
|
|
172
|
+
baseUrl: options.baseUrl,
|
|
173
|
+
fetch: options.fetch
|
|
174
|
+
})
|
|
175
|
+
}) },
|
|
159
176
|
capabilities: { vault: () => vault(ctx) }
|
|
160
177
|
};
|
|
161
178
|
}
|
|
@@ -164,5 +181,4 @@ function createPlugin(options) {
|
|
|
164
181
|
* supplied or when the supplied token is rejected.
|
|
165
182
|
*/
|
|
166
183
|
const AUTH_HINT = "install the Doppler CLI (`brew install dopplerhq/cli/doppler`), run `doppler login`, then `holocron auth set doppler $(doppler configure get token --plain)`";
|
|
167
|
-
//#endregion
|
|
168
184
|
export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@theholocron/holocron-plugin-doppler",
|
|
3
|
-
"version": "5.0.0-alpha.
|
|
3
|
+
"version": "5.0.0-alpha.270",
|
|
4
4
|
"description": "Holocron plugin for Doppler. Implements the vault capability against Doppler's REST API — projects, configs, secrets, plus verifyToken + AUTH_HINT for `holocron auth`.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"doppler",
|
|
@@ -8,12 +8,12 @@
|
|
|
8
8
|
"plugin",
|
|
9
9
|
"vault"
|
|
10
10
|
],
|
|
11
|
-
"homepage": "https://
|
|
11
|
+
"homepage": "https://docs.theholocron.dev/holocron/plugins/doppler/",
|
|
12
12
|
"bugs": "https://github.com/theholocron/holocron/issues",
|
|
13
13
|
"repository": {
|
|
14
14
|
"type": "git",
|
|
15
15
|
"url": "git+https://github.com/theholocron/holocron.git",
|
|
16
|
-
"directory": "
|
|
16
|
+
"directory": "plugins/holocron-plugin-doppler"
|
|
17
17
|
},
|
|
18
18
|
"license": "MIT",
|
|
19
19
|
"author": "Newton Koumantzelis",
|
|
@@ -30,27 +30,29 @@
|
|
|
30
30
|
"dist"
|
|
31
31
|
],
|
|
32
32
|
"devDependencies": {
|
|
33
|
-
"@theholocron/doppler-client": "^1.23.0",
|
|
34
|
-
"@theholocron/eslint-config": "^8.0.0",
|
|
35
|
-
"@theholocron/http-client": "^1.23.0",
|
|
36
|
-
"@theholocron/tsconfig": "^8.0.0",
|
|
37
|
-
"@theholocron/tsdown-config": "^8.0.0",
|
|
38
|
-
"@theholocron/vitest-config": "^8.0.0",
|
|
39
33
|
"@types/node": "^26",
|
|
40
|
-
"@vitest/coverage-v8": "^
|
|
34
|
+
"@vitest/coverage-v8": "^5.0.5",
|
|
41
35
|
"@vitest/eslint-plugin": "^1.6.27",
|
|
42
36
|
"eslint": "^10.8.1",
|
|
43
37
|
"eslint-plugin-n": "^18.3.0",
|
|
44
38
|
"globals": "^17.11.0",
|
|
45
|
-
"tsdown": "^0.
|
|
46
|
-
"tsx": "4.23.
|
|
39
|
+
"tsdown": "^0.23.3",
|
|
40
|
+
"tsx": "4.23.15",
|
|
47
41
|
"typescript": "^5.9.3",
|
|
48
|
-
"vitest": "^
|
|
49
|
-
"@theholocron/cli": "5.0.0-alpha.
|
|
42
|
+
"vitest": "^5.0.5",
|
|
43
|
+
"@theholocron/cli": "5.0.0-alpha.270",
|
|
44
|
+
"@theholocron/eslint-config": "^8.9.0-alpha.3",
|
|
45
|
+
"@theholocron/doppler-client": "^1.58.0-alpha.2",
|
|
46
|
+
"@theholocron/http-client": "^1.58.0-alpha.2",
|
|
47
|
+
"@theholocron/tsdown-config": "^8.9.0-alpha.3",
|
|
48
|
+
"@theholocron/tsconfig": "^8.9.0-alpha.3",
|
|
49
|
+
"@theholocron/misc-utils": "^1.16.1-alpha.1",
|
|
50
|
+
"@theholocron/vitest-config": "^8.9.0-alpha.3"
|
|
50
51
|
},
|
|
51
52
|
"peerDependencies": {
|
|
52
|
-
"@theholocron/doppler-client": "^1.
|
|
53
|
-
"@theholocron/
|
|
53
|
+
"@theholocron/doppler-client": "^1.43.1",
|
|
54
|
+
"@theholocron/misc-utils": "^1.16.0",
|
|
55
|
+
"@theholocron/cli": "5.0.0-alpha.270"
|
|
54
56
|
},
|
|
55
57
|
"engines": {
|
|
56
58
|
"node": ">=22"
|
|
@@ -60,10 +62,10 @@
|
|
|
60
62
|
},
|
|
61
63
|
"scripts": {
|
|
62
64
|
"delivery.build": "tsdown",
|
|
63
|
-
"sourceQuality.staticAnalysis": "
|
|
65
|
+
"sourceQuality.staticAnalysis": "eslint .",
|
|
64
66
|
"test:watch": "vitest",
|
|
65
67
|
"validate": "tsx scripts/validate.mjs",
|
|
66
|
-
"verification.typeSafety": "
|
|
67
|
-
"verification.unitTests": "
|
|
68
|
+
"verification.typeSafety": "tsc --noEmit",
|
|
69
|
+
"verification.unitTests": "vitest run"
|
|
68
70
|
}
|
|
69
71
|
}
|