@theholocron/holocron-plugin-doppler 5.0.0-alpha.28 → 5.0.0-alpha.281

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.d.mts +29 -38
  2. package/dist/index.mjs +48 -22
  3. package/package.json +21 -19
package/dist/index.d.mts CHANGED
@@ -1,23 +1,27 @@
1
- import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
1
+ import { AuthError, EnsureResult, PluginToken, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
2
2
  import { DopplerClient, DopplerClientOptions, createDopplerClient } from "@theholocron/doppler-client";
3
- //#region src/auth.d.ts
4
- declare const resolveToken: (input?: ResolveTokenInput) => string;
5
- //#endregion
6
- //#region src/capabilities/vault.d.ts
3
+ /** Resolves the Doppler token from `--token`, `HOLOCRON_DOPPLER_TOKEN`, `DOPPLER_TOKEN` or the keyring entry for `doppler`, and throws `AuthError` when none is set. */
4
+ export declare const resolveToken: import("@theholocron/cli").TokenResolver;
5
+ /** Every token this plugin takes, for `holocron doctor tokens`. */
6
+ export declare const tokens: PluginToken[];
7
7
  interface DopplerVaultOptions {
8
8
  /** Default project — read/list/etc. operate here unless overridden. */
9
9
  project: string;
10
10
  /** Default config name — dev / stg / prd, etc. */
11
11
  config: string;
12
12
  }
13
- declare class DopplerVault implements Vault {
13
+ /** `vault` capability for Doppler, with references shaped `doppler://<project>/<config>/<name>`. */
14
+ export declare class DopplerVault implements Vault {
14
15
  private readonly client;
16
+ /** Capability key; always `"vault"`. */
15
17
  readonly key: "vault";
18
+ /** Provider name; always `"doppler"`. */
16
19
  readonly providerName = "doppler";
17
20
  private readonly project;
18
21
  private readonly config;
19
22
  constructor(client: () => DopplerClient, opts: DopplerVaultOptions);
20
23
  read(reference: string): Promise<string>;
24
+ readSecret(name: string): Promise<string>;
21
25
  write(reference: string, value: string): Promise<void>;
22
26
  list(): Promise<string[]>;
23
27
  environments(): Promise<string[]>;
@@ -25,48 +29,36 @@ declare class DopplerVault implements Vault {
25
29
  ensureProject(name: string): Promise<EnsureResult>;
26
30
  ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
27
31
  }
28
- //#endregion
29
- //#region src/verify-token.d.ts
30
- /**
31
- * `verifyToken` — plugin-level export used by `holocron auth set` +
32
- * `holocron auth check`. Hits `GET /v3/me` and translates the response
33
- * into the normalized `VerifyTokenResult` shape.
34
- *
35
- * Kept as a standalone function (not a capability method) so the auth
36
- * command can call it without initializing the full plugin — plugin
37
- * construction requires an already-resolved token, which is exactly
38
- * what we don't have yet at bootstrap time.
39
- */
40
- interface VerifyTokenSuccess {
41
- ok: true;
42
- subject: string;
43
- }
44
- interface VerifyTokenFailure {
45
- ok: false;
46
- message: string;
47
- }
48
- type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
49
32
  interface VerifyTokenOptions {
50
33
  baseUrl?: string;
51
34
  fetch?: typeof fetch;
52
35
  }
53
- declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
54
- //#endregion
55
- //#region src/index.d.ts
56
- interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
36
+ /** Checks a Doppler token by fetching the caller and reports its kind and workplace, or why it was rejected. */
37
+ export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
38
+ /** Options for the Doppler plugin: the token lookup inputs plus the default project and config. */
39
+ export interface DopplerPluginOptions extends ResolveTokenInput, DopplerVaultOptions {
57
40
  /** Override base URL for tests. */
58
41
  baseUrl?: string;
59
42
  /** Override `fetch` for tests. */
60
43
  fetch?: typeof fetch;
61
44
  }
62
- interface PluginContext {
45
+ /** Shared state for one Doppler plugin instance: its options and a lazily created client. */
46
+ export interface PluginContext {
47
+ /** The options the plugin was created with. */
63
48
  options: DopplerPluginOptions;
49
+ /** Returns the memoized Doppler client; the token is resolved on the first call, not at plugin load. */
64
50
  client: () => DopplerClient;
65
51
  }
66
- declare function createContext(options: DopplerPluginOptions): PluginContext;
67
- declare function vault(ctx: PluginContext): Vault;
68
- declare function createPlugin(options: DopplerPluginOptions): {
52
+ /** Builds the plugin context from its options. */
53
+ export declare function createContext(options: DopplerPluginOptions): PluginContext;
54
+ /** Builds the `vault` capability for the context's default project and config. */
55
+ export declare function vault(ctx: PluginContext): Vault;
56
+ /** Creates the Doppler plugin: its `connection` probe and the `vault` capability. */
57
+ export declare function createPlugin(options: DopplerPluginOptions): {
69
58
  name: string;
59
+ probes: {
60
+ connection: import("@theholocron/cli").Probe;
61
+ };
70
62
  capabilities: {
71
63
  vault: () => Vault;
72
64
  };
@@ -75,6 +67,5 @@ declare function createPlugin(options: DopplerPluginOptions): {
75
67
  * One-line hint shown by `holocron auth set doppler` when no token is
76
68
  * supplied or when the supplied token is rejected.
77
69
  */
78
- declare const AUTH_HINT: string;
79
- //#endregion
80
- export { AUTH_HINT, AuthError, type DopplerClientOptions, DopplerPluginOptions, DopplerVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
70
+ export declare const AUTH_HINT: string;
71
+ export { AuthError, type DopplerClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createDopplerClient };
package/dist/index.mjs CHANGED
@@ -1,17 +1,38 @@
1
- import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
1
+ import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
2
2
  import { createDopplerClient } from "@theholocron/doppler-client";
3
- //#region src/auth.ts
3
+ import { errorMessage } from "@theholocron/misc-utils";
4
+ // src/auth.ts
5
+ /** Resolves the Doppler token from `--token`, `HOLOCRON_DOPPLER_TOKEN`, `DOPPLER_TOKEN` or the keyring entry for `doppler`, and throws `AuthError` when none is set. */
4
6
  const resolveToken = createResolveToken({
5
7
  envName: "HOLOCRON_DOPPLER_TOKEN",
6
8
  vendorEnvName: "DOPPLER_TOKEN",
7
9
  keyringService: "doppler",
8
10
  errorMessage: "no Doppler token found. Pass --token <TOKEN>, set HOLOCRON_DOPPLER_TOKEN / DOPPLER_TOKEN, or run: holocron auth set doppler $(doppler configure get token --plain)"
9
11
  });
10
- //#endregion
11
- //#region src/capabilities/vault.ts
12
+ /** Every token this plugin takes, for `holocron doctor tokens`. */
13
+ const tokens = [resolveToken.token];
14
+ // src/capabilities/vault.ts
15
+ /**
16
+ * Doppler auto-injects these into every config's secrets download —
17
+ * bookkeeping about the config itself, not something any caller
18
+ * defined. `readEnvironment()` fans its result out to real destinations
19
+ * (`holocron secrets sync` → CI secrets, deploy env vars); shipping
20
+ * these alongside real secrets is pure noise there (theholocron/holocron#742
21
+ * — found via Sentinel's deploy picking them up as if they were its own
22
+ * env). Confirmed stable, documented Doppler behavior — not
23
+ * project/config-specific, so safe to filter by name unconditionally.
24
+ */
25
+ const DOPPLER_INJECTED_KEYS = /* @__PURE__ */ new Set([
26
+ "DOPPLER_PROJECT",
27
+ "DOPPLER_CONFIG",
28
+ "DOPPLER_ENVIRONMENT"
29
+ ]);
30
+ /** `vault` capability for Doppler, with references shaped `doppler://<project>/<config>/<name>`. */
12
31
  var DopplerVault = class {
13
32
  client;
33
+ /** Capability key; always `"vault"`. */
14
34
  key = "vault";
35
+ /** Provider name; always `"doppler"`. */
15
36
  providerName = "doppler";
16
37
  project;
17
38
  config;
@@ -27,6 +48,10 @@ var DopplerVault = class {
27
48
  const res = await this.client().secrets.get(parsed.project, parsed.config, parsed.name);
28
49
  return res.value?.computed ?? res.value?.raw ?? "";
29
50
  }
51
+ async readSecret(name) {
52
+ const res = await this.client().secrets.get(this.project, this.config, name);
53
+ return res.value?.computed ?? res.value?.raw ?? "";
54
+ }
30
55
  async write(reference, value) {
31
56
  const parsed = parseReference(reference);
32
57
  await this.client().secrets.update(parsed.project, parsed.config, { [parsed.name]: value });
@@ -41,7 +66,7 @@ var DopplerVault = class {
41
66
  async readEnvironment(environmentId) {
42
67
  const res = await this.client().secrets.download(this.project, environmentId);
43
68
  const out = {};
44
- for (const [k, v] of Object.entries(res)) if (typeof v === "string") out[k] = v;
69
+ for (const [k, v] of Object.entries(res)) if (typeof v === "string" && !DOPPLER_INJECTED_KEYS.has(k)) out[k] = v;
45
70
  return out;
46
71
  }
47
72
  async ensureProject(name) {
@@ -101,18 +126,8 @@ function hasAlreadyExistsBody(details) {
101
126
  if (typeof details !== "string") return false;
102
127
  return /already exists/i.test(details);
103
128
  }
104
- //#endregion
105
- //#region src/verify-token.ts
106
- /**
107
- * `verifyToken` — plugin-level export used by `holocron auth set` +
108
- * `holocron auth check`. Hits `GET /v3/me` and translates the response
109
- * into the normalized `VerifyTokenResult` shape.
110
- *
111
- * Kept as a standalone function (not a capability method) so the auth
112
- * command can call it without initializing the full plugin — plugin
113
- * construction requires an already-resolved token, which is exactly
114
- * what we don't have yet at bootstrap time.
115
- */
129
+ // src/verify-token.ts
130
+ /** Checks a Doppler token by fetching the caller and reports its kind and workplace, or why it was rejected. */
116
131
  async function verifyToken(token, opts = {}) {
117
132
  const client = createDopplerClient({
118
133
  token,
@@ -129,12 +144,12 @@ async function verifyToken(token, opts = {}) {
129
144
  } catch (err) {
130
145
  return {
131
146
  ok: false,
132
- message: err instanceof Error ? err.message : String(err)
147
+ message: errorMessage(err)
133
148
  };
134
149
  }
135
150
  }
136
- //#endregion
137
- //#region src/index.ts
151
+ // src/index.ts
152
+ /** Builds the plugin context from its options. */
138
153
  function createContext(options) {
139
154
  let client;
140
155
  return {
@@ -146,16 +161,28 @@ function createContext(options) {
146
161
  })
147
162
  };
148
163
  }
164
+ /** Builds the `vault` capability for the context's default project and config. */
149
165
  function vault(ctx) {
150
166
  return new DopplerVault(ctx.client, {
151
167
  project: ctx.options.project,
152
168
  config: ctx.options.config
153
169
  });
154
170
  }
171
+ /** Creates the Doppler plugin: its `connection` probe and the `vault` capability. */
155
172
  function createPlugin(options) {
156
173
  const ctx = createContext(options);
157
174
  return {
158
175
  name: "@theholocron/holocron-plugin-doppler",
176
+ probes: { connection: connectionProbe({
177
+ provider: "Doppler",
178
+ url: options.baseUrl ?? "https://api.doppler.com",
179
+ fetch: options.fetch,
180
+ token: () => resolveToken(options),
181
+ verify: (token) => verifyToken(token, {
182
+ baseUrl: options.baseUrl,
183
+ fetch: options.fetch
184
+ })
185
+ }) },
159
186
  capabilities: { vault: () => vault(ctx) }
160
187
  };
161
188
  }
@@ -164,5 +191,4 @@ function createPlugin(options) {
164
191
  * supplied or when the supplied token is rejected.
165
192
  */
166
193
  const AUTH_HINT = "install the Doppler CLI (`brew install dopplerhq/cli/doppler`), run `doppler login`, then `holocron auth set doppler $(doppler configure get token --plain)`";
167
- //#endregion
168
- export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, vault, verifyToken };
194
+ export { AUTH_HINT, AuthError, DopplerVault, createContext, createDopplerClient, createPlugin, resolveToken, tokens, vault, verifyToken };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@theholocron/holocron-plugin-doppler",
3
- "version": "5.0.0-alpha.28",
3
+ "version": "5.0.0-alpha.281",
4
4
  "description": "Holocron plugin for Doppler. Implements the vault capability against Doppler's REST API — projects, configs, secrets, plus verifyToken + AUTH_HINT for `holocron auth`.",
5
5
  "keywords": [
6
6
  "doppler",
@@ -8,12 +8,12 @@
8
8
  "plugin",
9
9
  "vault"
10
10
  ],
11
- "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-doppler#readme",
11
+ "homepage": "https://docs.theholocron.dev/holocron/plugins/doppler/",
12
12
  "bugs": "https://github.com/theholocron/holocron/issues",
13
13
  "repository": {
14
14
  "type": "git",
15
15
  "url": "git+https://github.com/theholocron/holocron.git",
16
- "directory": "packages/holocron-plugin-doppler"
16
+ "directory": "plugins/holocron-plugin-doppler"
17
17
  },
18
18
  "license": "MIT",
19
19
  "author": "Newton Koumantzelis",
@@ -30,27 +30,29 @@
30
30
  "dist"
31
31
  ],
32
32
  "devDependencies": {
33
- "@theholocron/doppler-client": "^1.23.0",
34
- "@theholocron/eslint-config": "^8.0.0",
35
- "@theholocron/http-client": "^1.23.0",
36
- "@theholocron/tsconfig": "^8.0.0",
37
- "@theholocron/tsdown-config": "^8.0.0",
38
- "@theholocron/vitest-config": "^8.0.0",
39
33
  "@types/node": "^26",
40
- "@vitest/coverage-v8": "^4.1.11",
34
+ "@vitest/coverage-v8": "^5.0.5",
41
35
  "@vitest/eslint-plugin": "^1.6.27",
42
36
  "eslint": "^10.8.1",
43
37
  "eslint-plugin-n": "^18.3.0",
44
38
  "globals": "^17.11.0",
45
- "tsdown": "^0.22.14",
46
- "tsx": "4.23.12",
39
+ "tsdown": "^0.23.3",
40
+ "tsx": "4.23.15",
47
41
  "typescript": "^5.9.3",
48
- "vitest": "^4.1.11",
49
- "@theholocron/cli": "5.0.0-alpha.28"
42
+ "vitest": "^5.0.5",
43
+ "@theholocron/cli": "5.0.0-alpha.281",
44
+ "@theholocron/eslint-config": "^8.9.0-alpha.5",
45
+ "@theholocron/http-client": "^1.58.0-alpha.3",
46
+ "@theholocron/misc-utils": "^1.16.1-alpha.3",
47
+ "@theholocron/tsconfig": "^8.9.0-alpha.5",
48
+ "@theholocron/doppler-client": "^1.58.0-alpha.3",
49
+ "@theholocron/tsdown-config": "^8.9.0-alpha.5",
50
+ "@theholocron/vitest-config": "^8.9.0-alpha.5"
50
51
  },
51
52
  "peerDependencies": {
52
- "@theholocron/doppler-client": "^1.23.0",
53
- "@theholocron/cli": "5.0.0-alpha.28"
53
+ "@theholocron/doppler-client": "^1.43.1",
54
+ "@theholocron/misc-utils": "^1.16.0",
55
+ "@theholocron/cli": "5.0.0-alpha.281"
54
56
  },
55
57
  "engines": {
56
58
  "node": ">=22"
@@ -60,10 +62,10 @@
60
62
  },
61
63
  "scripts": {
62
64
  "delivery.build": "tsdown",
63
- "sourceQuality.staticAnalysis": "holocron run sourceQuality.staticAnalysis --",
65
+ "sourceQuality.staticAnalysis": "eslint .",
64
66
  "test:watch": "vitest",
65
67
  "validate": "tsx scripts/validate.mjs",
66
- "verification.typeSafety": "holocron run verification.typeSafety --",
67
- "verification.unitTests": "holocron run verification.unitTests --"
68
+ "verification.typeSafety": "tsc --noEmit",
69
+ "verification.unitTests": "vitest run"
68
70
  }
69
71
  }