@theholocron/holocron-plugin-doppler 5.0.0-alpha.27 → 5.0.0-alpha.271
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +17 -38
- package/dist/index.mjs +40 -22
- package/package.json +21 -19
package/dist/index.d.mts
CHANGED
|
@@ -1,16 +1,15 @@
|
|
|
1
|
-
import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, EnsureResult, PluginToken, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
|
|
2
2
|
import { DopplerClient, DopplerClientOptions, createDopplerClient } from "@theholocron/doppler-client";
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
//#region src/capabilities/vault.d.ts
|
|
3
|
+
export declare const resolveToken: import("@theholocron/cli").TokenResolver;
|
|
4
|
+
/** Every token this plugin takes, for `holocron doctor tokens`. */
|
|
5
|
+
export declare const tokens: PluginToken[];
|
|
7
6
|
interface DopplerVaultOptions {
|
|
8
7
|
/** Default project — read/list/etc. operate here unless overridden. */
|
|
9
8
|
project: string;
|
|
10
9
|
/** Default config name — dev / stg / prd, etc. */
|
|
11
10
|
config: string;
|
|
12
11
|
}
|
|
13
|
-
declare class DopplerVault implements Vault {
|
|
12
|
+
export declare class DopplerVault implements Vault {
|
|
14
13
|
private readonly client;
|
|
15
14
|
readonly key: "vault";
|
|
16
15
|
readonly providerName = "doppler";
|
|
@@ -18,6 +17,7 @@ declare class DopplerVault implements Vault {
|
|
|
18
17
|
private readonly config;
|
|
19
18
|
constructor(client: () => DopplerClient, opts: DopplerVaultOptions);
|
|
20
19
|
read(reference: string): Promise<string>;
|
|
20
|
+
readSecret(name: string): Promise<string>;
|
|
21
21
|
write(reference: string, value: string): Promise<void>;
|
|
22
22
|
list(): Promise<string[]>;
|
|
23
23
|
environments(): Promise<string[]>;
|
|
@@ -25,48 +25,28 @@ declare class DopplerVault implements Vault {
|
|
|
25
25
|
ensureProject(name: string): Promise<EnsureResult>;
|
|
26
26
|
ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
|
|
27
27
|
}
|
|
28
|
-
//#endregion
|
|
29
|
-
//#region src/verify-token.d.ts
|
|
30
|
-
/**
|
|
31
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
32
|
-
* `holocron auth check`. Hits `GET /v3/me` and translates the response
|
|
33
|
-
* into the normalized `VerifyTokenResult` shape.
|
|
34
|
-
*
|
|
35
|
-
* Kept as a standalone function (not a capability method) so the auth
|
|
36
|
-
* command can call it without initializing the full plugin — plugin
|
|
37
|
-
* construction requires an already-resolved token, which is exactly
|
|
38
|
-
* what we don't have yet at bootstrap time.
|
|
39
|
-
*/
|
|
40
|
-
interface VerifyTokenSuccess {
|
|
41
|
-
ok: true;
|
|
42
|
-
subject: string;
|
|
43
|
-
}
|
|
44
|
-
interface VerifyTokenFailure {
|
|
45
|
-
ok: false;
|
|
46
|
-
message: string;
|
|
47
|
-
}
|
|
48
|
-
type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
|
|
49
28
|
interface VerifyTokenOptions {
|
|
50
29
|
baseUrl?: string;
|
|
51
30
|
fetch?: typeof fetch;
|
|
52
31
|
}
|
|
53
|
-
declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
|
|
54
|
-
|
|
55
|
-
//#region src/index.d.ts
|
|
56
|
-
interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
|
|
32
|
+
export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
|
|
33
|
+
export interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
|
|
57
34
|
/** Override base URL for tests. */
|
|
58
35
|
baseUrl?: string;
|
|
59
36
|
/** Override `fetch` for tests. */
|
|
60
37
|
fetch?: typeof fetch;
|
|
61
38
|
}
|
|
62
|
-
interface PluginContext {
|
|
39
|
+
export interface PluginContext {
|
|
63
40
|
options: DopplerPluginOptions;
|
|
64
41
|
client: () => DopplerClient;
|
|
65
42
|
}
|
|
66
|
-
declare function createContext(options: DopplerPluginOptions): PluginContext;
|
|
67
|
-
declare function vault(ctx: PluginContext): Vault;
|
|
68
|
-
declare function createPlugin(options: DopplerPluginOptions): {
|
|
43
|
+
export declare function createContext(options: DopplerPluginOptions): PluginContext;
|
|
44
|
+
export declare function vault(ctx: PluginContext): Vault;
|
|
45
|
+
export declare function createPlugin(options: DopplerPluginOptions): {
|
|
69
46
|
name: string;
|
|
47
|
+
probes: {
|
|
48
|
+
connection: import("@theholocron/cli").Probe;
|
|
49
|
+
};
|
|
70
50
|
capabilities: {
|
|
71
51
|
vault: () => Vault;
|
|
72
52
|
};
|
|
@@ -75,6 +55,5 @@ declare function createPlugin(options: DopplerPluginOptions): {
|
|
|
75
55
|
* One-line hint shown by `holocron auth set doppler` when no token is
|
|
76
56
|
* supplied or when the supplied token is rejected.
|
|
77
57
|
*/
|
|
78
|
-
declare const AUTH_HINT: string;
|
|
79
|
-
|
|
80
|
-
export { AUTH_HINT, AuthError, type DopplerClientOptions, DopplerPluginOptions, DopplerVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
|
|
58
|
+
export declare const AUTH_HINT: string;
|
|
59
|
+
export { AuthError, type DopplerClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createDopplerClient };
|
package/dist/index.mjs
CHANGED
|
@@ -1,14 +1,31 @@
|
|
|
1
|
-
import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
|
|
2
2
|
import { createDopplerClient } from "@theholocron/doppler-client";
|
|
3
|
-
|
|
3
|
+
import { errorMessage } from "@theholocron/misc-utils";
|
|
4
|
+
// src/auth.ts
|
|
4
5
|
const resolveToken = createResolveToken({
|
|
5
6
|
envName: "HOLOCRON_DOPPLER_TOKEN",
|
|
6
7
|
vendorEnvName: "DOPPLER_TOKEN",
|
|
7
8
|
keyringService: "doppler",
|
|
8
9
|
errorMessage: "no Doppler token found. Pass --token <TOKEN>, set HOLOCRON_DOPPLER_TOKEN / DOPPLER_TOKEN, or run: holocron auth set doppler $(doppler configure get token --plain)"
|
|
9
10
|
});
|
|
10
|
-
|
|
11
|
-
|
|
11
|
+
/** Every token this plugin takes, for `holocron doctor tokens`. */
|
|
12
|
+
const tokens = [resolveToken.token];
|
|
13
|
+
// src/capabilities/vault.ts
|
|
14
|
+
/**
|
|
15
|
+
* Doppler auto-injects these into every config's secrets download —
|
|
16
|
+
* bookkeeping about the config itself, not something any caller
|
|
17
|
+
* defined. `readEnvironment()` fans its result out to real destinations
|
|
18
|
+
* (`holocron secrets sync` → CI secrets, deploy env vars); shipping
|
|
19
|
+
* these alongside real secrets is pure noise there (theholocron/holocron#742
|
|
20
|
+
* — found via Sentinel's deploy picking them up as if they were its own
|
|
21
|
+
* env). Confirmed stable, documented Doppler behavior — not
|
|
22
|
+
* project/config-specific, so safe to filter by name unconditionally.
|
|
23
|
+
*/
|
|
24
|
+
const DOPPLER_INJECTED_KEYS = /* @__PURE__ */ new Set([
|
|
25
|
+
"DOPPLER_PROJECT",
|
|
26
|
+
"DOPPLER_CONFIG",
|
|
27
|
+
"DOPPLER_ENVIRONMENT"
|
|
28
|
+
]);
|
|
12
29
|
var DopplerVault = class {
|
|
13
30
|
client;
|
|
14
31
|
key = "vault";
|
|
@@ -27,6 +44,10 @@ var DopplerVault = class {
|
|
|
27
44
|
const res = await this.client().secrets.get(parsed.project, parsed.config, parsed.name);
|
|
28
45
|
return res.value?.computed ?? res.value?.raw ?? "";
|
|
29
46
|
}
|
|
47
|
+
async readSecret(name) {
|
|
48
|
+
const res = await this.client().secrets.get(this.project, this.config, name);
|
|
49
|
+
return res.value?.computed ?? res.value?.raw ?? "";
|
|
50
|
+
}
|
|
30
51
|
async write(reference, value) {
|
|
31
52
|
const parsed = parseReference(reference);
|
|
32
53
|
await this.client().secrets.update(parsed.project, parsed.config, { [parsed.name]: value });
|
|
@@ -41,7 +62,7 @@ var DopplerVault = class {
|
|
|
41
62
|
async readEnvironment(environmentId) {
|
|
42
63
|
const res = await this.client().secrets.download(this.project, environmentId);
|
|
43
64
|
const out = {};
|
|
44
|
-
for (const [k, v] of Object.entries(res)) if (typeof v === "string") out[k] = v;
|
|
65
|
+
for (const [k, v] of Object.entries(res)) if (typeof v === "string" && !DOPPLER_INJECTED_KEYS.has(k)) out[k] = v;
|
|
45
66
|
return out;
|
|
46
67
|
}
|
|
47
68
|
async ensureProject(name) {
|
|
@@ -101,18 +122,7 @@ function hasAlreadyExistsBody(details) {
|
|
|
101
122
|
if (typeof details !== "string") return false;
|
|
102
123
|
return /already exists/i.test(details);
|
|
103
124
|
}
|
|
104
|
-
|
|
105
|
-
//#region src/verify-token.ts
|
|
106
|
-
/**
|
|
107
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
108
|
-
* `holocron auth check`. Hits `GET /v3/me` and translates the response
|
|
109
|
-
* into the normalized `VerifyTokenResult` shape.
|
|
110
|
-
*
|
|
111
|
-
* Kept as a standalone function (not a capability method) so the auth
|
|
112
|
-
* command can call it without initializing the full plugin — plugin
|
|
113
|
-
* construction requires an already-resolved token, which is exactly
|
|
114
|
-
* what we don't have yet at bootstrap time.
|
|
115
|
-
*/
|
|
125
|
+
// src/verify-token.ts
|
|
116
126
|
async function verifyToken(token, opts = {}) {
|
|
117
127
|
const client = createDopplerClient({
|
|
118
128
|
token,
|
|
@@ -129,12 +139,11 @@ async function verifyToken(token, opts = {}) {
|
|
|
129
139
|
} catch (err) {
|
|
130
140
|
return {
|
|
131
141
|
ok: false,
|
|
132
|
-
message:
|
|
142
|
+
message: errorMessage(err)
|
|
133
143
|
};
|
|
134
144
|
}
|
|
135
145
|
}
|
|
136
|
-
|
|
137
|
-
//#region src/index.ts
|
|
146
|
+
// src/index.ts
|
|
138
147
|
function createContext(options) {
|
|
139
148
|
let client;
|
|
140
149
|
return {
|
|
@@ -156,6 +165,16 @@ function createPlugin(options) {
|
|
|
156
165
|
const ctx = createContext(options);
|
|
157
166
|
return {
|
|
158
167
|
name: "@theholocron/holocron-plugin-doppler",
|
|
168
|
+
probes: { connection: connectionProbe({
|
|
169
|
+
provider: "Doppler",
|
|
170
|
+
url: options.baseUrl ?? "https://api.doppler.com",
|
|
171
|
+
fetch: options.fetch,
|
|
172
|
+
token: () => resolveToken(options),
|
|
173
|
+
verify: (token) => verifyToken(token, {
|
|
174
|
+
baseUrl: options.baseUrl,
|
|
175
|
+
fetch: options.fetch
|
|
176
|
+
})
|
|
177
|
+
}) },
|
|
159
178
|
capabilities: { vault: () => vault(ctx) }
|
|
160
179
|
};
|
|
161
180
|
}
|
|
@@ -164,5 +183,4 @@ function createPlugin(options) {
|
|
|
164
183
|
* supplied or when the supplied token is rejected.
|
|
165
184
|
*/
|
|
166
185
|
const AUTH_HINT = "install the Doppler CLI (`brew install dopplerhq/cli/doppler`), run `doppler login`, then `holocron auth set doppler $(doppler configure get token --plain)`";
|
|
167
|
-
|
|
168
|
-
export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
|
|
186
|
+
export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, tokens, vault, verifyToken };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@theholocron/holocron-plugin-doppler",
|
|
3
|
-
"version": "5.0.0-alpha.
|
|
3
|
+
"version": "5.0.0-alpha.271",
|
|
4
4
|
"description": "Holocron plugin for Doppler. Implements the vault capability against Doppler's REST API — projects, configs, secrets, plus verifyToken + AUTH_HINT for `holocron auth`.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"doppler",
|
|
@@ -8,12 +8,12 @@
|
|
|
8
8
|
"plugin",
|
|
9
9
|
"vault"
|
|
10
10
|
],
|
|
11
|
-
"homepage": "https://
|
|
11
|
+
"homepage": "https://docs.theholocron.dev/holocron/plugins/doppler/",
|
|
12
12
|
"bugs": "https://github.com/theholocron/holocron/issues",
|
|
13
13
|
"repository": {
|
|
14
14
|
"type": "git",
|
|
15
15
|
"url": "git+https://github.com/theholocron/holocron.git",
|
|
16
|
-
"directory": "
|
|
16
|
+
"directory": "plugins/holocron-plugin-doppler"
|
|
17
17
|
},
|
|
18
18
|
"license": "MIT",
|
|
19
19
|
"author": "Newton Koumantzelis",
|
|
@@ -30,27 +30,29 @@
|
|
|
30
30
|
"dist"
|
|
31
31
|
],
|
|
32
32
|
"devDependencies": {
|
|
33
|
-
"@theholocron/doppler-client": "^1.23.0",
|
|
34
|
-
"@theholocron/eslint-config": "^8.0.0",
|
|
35
|
-
"@theholocron/http-client": "^1.23.0",
|
|
36
|
-
"@theholocron/tsconfig": "^8.0.0",
|
|
37
|
-
"@theholocron/tsdown-config": "^8.0.0",
|
|
38
|
-
"@theholocron/vitest-config": "^8.0.0",
|
|
39
33
|
"@types/node": "^26",
|
|
40
|
-
"@vitest/coverage-v8": "^
|
|
34
|
+
"@vitest/coverage-v8": "^5.0.5",
|
|
41
35
|
"@vitest/eslint-plugin": "^1.6.27",
|
|
42
36
|
"eslint": "^10.8.1",
|
|
43
37
|
"eslint-plugin-n": "^18.3.0",
|
|
44
38
|
"globals": "^17.11.0",
|
|
45
|
-
"tsdown": "^0.
|
|
46
|
-
"tsx": "4.23.
|
|
39
|
+
"tsdown": "^0.23.3",
|
|
40
|
+
"tsx": "4.23.15",
|
|
47
41
|
"typescript": "^5.9.3",
|
|
48
|
-
"vitest": "^
|
|
49
|
-
"@theholocron/cli": "5.0.0-alpha.
|
|
42
|
+
"vitest": "^5.0.5",
|
|
43
|
+
"@theholocron/cli": "5.0.0-alpha.271",
|
|
44
|
+
"@theholocron/eslint-config": "^8.9.0-alpha.3",
|
|
45
|
+
"@theholocron/http-client": "^1.58.0-alpha.2",
|
|
46
|
+
"@theholocron/tsconfig": "^8.9.0-alpha.3",
|
|
47
|
+
"@theholocron/tsdown-config": "^8.9.0-alpha.3",
|
|
48
|
+
"@theholocron/vitest-config": "^8.9.0-alpha.3",
|
|
49
|
+
"@theholocron/doppler-client": "^1.58.0-alpha.2",
|
|
50
|
+
"@theholocron/misc-utils": "^1.16.1-alpha.1"
|
|
50
51
|
},
|
|
51
52
|
"peerDependencies": {
|
|
52
|
-
"@theholocron/doppler-client": "^1.
|
|
53
|
-
"@theholocron/
|
|
53
|
+
"@theholocron/doppler-client": "^1.43.1",
|
|
54
|
+
"@theholocron/misc-utils": "^1.16.0",
|
|
55
|
+
"@theholocron/cli": "5.0.0-alpha.271"
|
|
54
56
|
},
|
|
55
57
|
"engines": {
|
|
56
58
|
"node": ">=22"
|
|
@@ -60,10 +62,10 @@
|
|
|
60
62
|
},
|
|
61
63
|
"scripts": {
|
|
62
64
|
"delivery.build": "tsdown",
|
|
63
|
-
"sourceQuality.staticAnalysis": "
|
|
65
|
+
"sourceQuality.staticAnalysis": "eslint .",
|
|
64
66
|
"test:watch": "vitest",
|
|
65
67
|
"validate": "tsx scripts/validate.mjs",
|
|
66
|
-
"verification.typeSafety": "
|
|
67
|
-
"verification.unitTests": "
|
|
68
|
+
"verification.typeSafety": "tsc --noEmit",
|
|
69
|
+
"verification.unitTests": "vitest run"
|
|
68
70
|
}
|
|
69
71
|
}
|