@theholocron/holocron-plugin-infisical 2.0.0-alpha.52 → 2.0.0-alpha.54

package/dist/index.d.mts

@@ -1,4 +1,5 @@
-import { AuthError, EnsureResult, ResolveTokenInput, RestClient, RestClient as RestClient$1, Vault } from "@theholocron/cli";
+import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
+import { InfisicalClient, InfisicalClient as InfisicalClient$1, createInfisicalClient } from "@theholocron/infisical-client";
 
 //#region src/auth.d.ts
 declare const resolveToken: (input?: import("@theholocron/http-client").ResolveTokenInput) => string;
@@ -11,7 +12,7 @@ interface InfisicalVaultOptions {
   environment: string;
 }
 declare class InfisicalVault implements Vault {
-  private readonly rest;
+  private readonly client;
   readonly key: "vault";
   readonly providerName = "infisical";
   private readonly workspace;
@@ -19,11 +20,11 @@ declare class InfisicalVault implements Vault {
   /**
    * Cache of resolved workspace name/slug → id. `ensureEnvironment`
    * is called once per environment during `holocron setup` (dev / stg
-   * / prd), so a single \`GET /v1/workspace\` lookup covers all three
+   * / prd), so a single `GET /v1/workspace` lookup covers all three
    * calls in the same run.
    */
   private readonly workspaceIdCache;
-  constructor(rest: RestClient, opts: InfisicalVaultOptions);
+  constructor(client: InfisicalClient$1, opts: InfisicalVaultOptions);
   read(reference: string): Promise<string>;
   write(reference: string, value: string): Promise<void>;
   list(): Promise<string[]>;
@@ -31,36 +32,9 @@ declare class InfisicalVault implements Vault {
   readEnvironment(environmentId: string): Promise<Record<string, string>>;
   ensureProject(name: string): Promise<EnsureResult>;
   ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
-  /**
-   * Resolve a workspace name / slug to its Infisical workspace id.
-   *
-   * `runSetup` calls `ensureEnvironment(config.project.name, envName)`
-   * — for Doppler that's directly the API's input, but Infisical's
-   * environments endpoint takes the workspace **id** (UUID/nanoid),
-   * not the name. This helper does the translation via
-   * `GET /v1/workspace` (which the token needs org-level list scope
-   * to call).
-   *
-   * Graceful degrade: for workspace-scoped tokens that 403 on the
-   * org-level list, we fall back to treating the input as an id
-   * directly. If the operator's `holocron.config.json` names a real
-   * id, the subsequent POST works. If they named a slug, the POST
-   * 404s and the operator gets a clear "workspace not found" error
-   * from the API — better than swallowing the 403 silently.
-   *
-   * Results are cached per-instance so the 3 back-to-back
-   * `ensureEnvironment` calls in `runSetup` share one lookup.
-   */
   private resolveWorkspaceId;
 }
 //#endregion
-//#region src/rest.d.ts
-declare function createInfisicalRestClient(opts: {
-  token: string;
-  baseUrl?: string;
-  fetch?: typeof fetch;
-}): RestClient$1;
-//#endregion
 //#region src/verify-token.d.ts
 /**
  * `verifyToken` — plugin-level export used by `holocron auth set` +
@@ -77,16 +51,6 @@ declare function createInfisicalRestClient(opts: {
  *     will name the specific workspace + environment the token
  *     actually has access to.
  *   - 401 or other → token is invalid.
- *
- * The distinction matters: verifyToken answers "is this a real
- * Infisical token?", not "does it have every possible permission?"
- * — per-capability permission failures surface at the actual read /
- * write / list call sites.
- *
- * Kept as a standalone function (not a capability method) so the auth
- * command can call it without initializing the full plugin — plugin
- * construction requires an already-resolved token, which is exactly
- * what we don't have yet at bootstrap time.
  */
 interface VerifyTokenSuccess {
   ok: true;
@@ -112,7 +76,7 @@ interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOption
 }
 interface PluginContext {
   options: InfisicalPluginOptions;
-  rest: RestClient;
+  client: InfisicalClient;
 }
 declare function createContext(options: InfisicalPluginOptions): PluginContext;
 declare function vault(ctx: PluginContext): Vault;
@@ -125,14 +89,7 @@ declare function createPlugin(options: InfisicalPluginOptions): {
 /**
  * One-line hint printed by `holocron auth set infisical` when no
  * token is supplied or the supplied token is rejected.
- *
- * IMPORTANT — the token must be usable as a `Authorization: Bearer`
- * directly. Two token types work: **Personal API Token** (inherits
- * user perms) or a **Token Auth** token on a machine identity (a
- * single long-lived string). Universal Auth's Client Secret is NOT
- * a bearer — it needs a `/v1/auth/universal-auth/login` exchange
- * step this plugin doesn't yet do (Phase 2 follow-up).
  */
 declare const AUTH_HINT: string;
 //#endregion
-export { AUTH_HINT, AuthError, InfisicalPluginOptions, InfisicalVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createInfisicalRestClient, createPlugin, resolveToken, vault, verifyToken };
+export { AUTH_HINT, AuthError, type InfisicalClient, InfisicalPluginOptions, InfisicalVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };

package/dist/index.mjs

@@ -1,4 +1,5 @@
-import { AuthError, ProviderApiError, createResolveToken, createRestClient } from "@theholocron/cli";
+import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
+import { createInfisicalClient } from "@theholocron/infisical-client";
 //#region src/auth.ts
 const resolveToken = createResolveToken({
 	envName: "HOLOCRON_INFISICAL_TOKEN",
@@ -17,13 +18,6 @@ const resolveToken = createResolveToken({
 * `environment` (slug, typically `dev`/`stg`/`prd`) so `list()` /
 * `environments()` / `readEnvironment()` don't need a three-part ref.
 *
-* Infisical's data model:
-*   - Workspace (aka project) — top-level container
-*   - Environments — dev / stg / prd, scoped to a workspace
-*   - Secrets — scoped to a workspace + environment, with a path
-*     (defaults to root `/` in this plugin; a `secretPath` option
-*     would extend it but Phase 1 keeps it flat)
-*
 * Write semantics: Infisical's REST API separates CREATE (`POST`) and
 * UPDATE (`PATCH`). We attempt POST first; on the vendor's "already
 * exists" response we PATCH to upsert. The isConflict helper follows
@@ -34,7 +28,7 @@ const resolveToken = createResolveToken({
 * workspace / environment create endpoints.
 */
 var InfisicalVault = class {
-	rest;
+	client;
 	key = "vault";
 	providerName = "infisical";
 	workspace;
@@ -42,12 +36,12 @@ var InfisicalVault = class {
 	/**
 	* Cache of resolved workspace name/slug → id. `ensureEnvironment`
 	* is called once per environment during `holocron setup` (dev / stg
-	* / prd), so a single \`GET /v1/workspace\` lookup covers all three
+	* / prd), so a single `GET /v1/workspace` lookup covers all three
 	* calls in the same run.
 	*/
 	workspaceIdCache = /* @__PURE__ */ new Map();
-	constructor(rest, opts) {
-		this.rest = rest;
+	constructor(client, opts) {
+		this.client = client;
 		if (!opts.workspace) throw new Error("InfisicalVault requires `workspace` in options");
 		if (!opts.environment) throw new Error("InfisicalVault requires `environment` in options");
 		this.workspace = opts.workspace;
@@ -55,11 +49,12 @@ var InfisicalVault = class {
 	}
 	async read(reference) {
 		const parsed = parseReference(reference);
-		return (await this.rest.request(`/v3/secrets/raw/${encodeURIComponent(parsed.name)}`, { query: {
+		const { secret } = await this.client.secrets.get(parsed.name, {
 			workspaceId: parsed.workspace,
 			environment: parsed.environment,
 			secretPath: "/"
-		} })).secret?.secretValue ?? "";
+		});
+		return secret?.secretValue ?? "";
 	}
 	async write(reference, value) {
 		const parsed = parseReference(reference);
@@ -70,51 +65,40 @@ var InfisicalVault = class {
 			secretValue: value
 		};
 		try {
-			await this.rest.request(`/v3/secrets/raw/${encodeURIComponent(parsed.name)}`, {
-				method: "POST",
-				body: {
-					...scope,
-					type: "shared"
-				}
+			await this.client.secrets.create(parsed.name, {
+				...scope,
+				type: "shared"
 			});
-			return;
 		} catch (err) {
 			if (!isConflict(err)) throw err;
-			await this.rest.request(`/v3/secrets/raw/${encodeURIComponent(parsed.name)}`, {
-				method: "PATCH",
-				body: scope
-			});
+			await this.client.secrets.update(parsed.name, scope);
 		}
 	}
 	async list() {
-		return ((await this.rest.request("/v3/secrets/raw", { query: {
+		const { secrets } = await this.client.secrets.list({
 			workspaceId: this.workspace,
 			environment: this.environment,
 			secretPath: "/"
-		} })).secrets ?? []).map((s) => s.secretKey ?? "").filter(Boolean);
+		});
+		return (secrets ?? []).map((s) => s.secretKey ?? "").filter(Boolean);
 	}
 	async environments() {
-		return ((await this.rest.request(`/v1/workspace/${encodeURIComponent(this.workspace)}`)).workspace?.environments ?? []).map((e) => e.slug ?? e.name ?? "").filter(Boolean);
+		const { workspace } = await this.client.workspaces.get(this.workspace);
+		return (workspace?.environments ?? []).map((e) => e.slug ?? e.name ?? "").filter(Boolean);
 	}
 	async readEnvironment(environmentId) {
-		const res = await this.rest.request("/v3/secrets/raw", { query: {
+		const { secrets } = await this.client.secrets.list({
 			workspaceId: this.workspace,
 			environment: environmentId,
 			secretPath: "/"
-		} });
+		});
 		const out = {};
-		for (const s of res.secrets ?? []) if (s.secretKey && typeof s.secretValue === "string") out[s.secretKey] = s.secretValue;
+		for (const s of secrets ?? []) if (s.secretKey && typeof s.secretValue === "string") out[s.secretKey] = s.secretValue;
 		return out;
 	}
 	async ensureProject(name) {
 		try {
-			await this.rest.request("/v2/workspace", {
-				method: "POST",
-				body: {
-					projectName: name,
-					slug: name
-				}
-			});
+			await this.client.workspaces.create(name, name);
 			return { alreadyExists: false };
 		} catch (err) {
 			if (isConflict(err)) return { alreadyExists: true };
@@ -124,44 +108,19 @@ var InfisicalVault = class {
 	async ensureEnvironment(project, name) {
 		const workspaceId = await this.resolveWorkspaceId(project);
 		try {
-			await this.rest.request(`/v1/workspace/${encodeURIComponent(workspaceId)}/environments`, {
-				method: "POST",
-				body: {
-					environmentName: name,
-					environmentSlug: name
-				}
-			});
+			await this.client.workspaces.createEnvironment(workspaceId, name, name);
 			return { alreadyExists: false };
 		} catch (err) {
 			if (isConflict(err)) return { alreadyExists: true };
 			throw err;
 		}
 	}
-	/**
-	* Resolve a workspace name / slug to its Infisical workspace id.
-	*
-	* `runSetup` calls `ensureEnvironment(config.project.name, envName)`
-	* — for Doppler that's directly the API's input, but Infisical's
-	* environments endpoint takes the workspace **id** (UUID/nanoid),
-	* not the name. This helper does the translation via
-	* `GET /v1/workspace` (which the token needs org-level list scope
-	* to call).
-	*
-	* Graceful degrade: for workspace-scoped tokens that 403 on the
-	* org-level list, we fall back to treating the input as an id
-	* directly. If the operator's `holocron.config.json` names a real
-	* id, the subsequent POST works. If they named a slug, the POST
-	* 404s and the operator gets a clear "workspace not found" error
-	* from the API — better than swallowing the 403 silently.
-	*
-	* Results are cached per-instance so the 3 back-to-back
-	* `ensureEnvironment` calls in `runSetup` share one lookup.
-	*/
 	async resolveWorkspaceId(nameOrId) {
 		const cached = this.workspaceIdCache.get(nameOrId);
 		if (cached) return cached;
 		try {
-			const match = ((await this.rest.request("/v1/workspace"))?.workspaces ?? []).find((w) => w.name === nameOrId || w.slug === nameOrId);
+			const { workspaces } = await this.client.workspaces.list();
+			const match = (workspaces ?? []).find((w) => w.name === nameOrId || w.slug === nameOrId);
 			const resolvedId = match?._id ?? match?.id;
 			if (resolvedId) {
 				this.workspaceIdCache.set(nameOrId, resolvedId);
@@ -173,10 +132,6 @@ var InfisicalVault = class {
 		return nameOrId;
 	}
 };
-/**
-* Parse `infisical://<workspaceId>/<environment>/<name>` into its
-* parts. Throws when the shape doesn't match.
-*/
 function parseReference(reference) {
 	if (!reference.startsWith("infisical://")) throw new ProviderApiError(`Infisical references must start with "infisical://": got "${reference}"`, 400, void 0);
 	const parts = reference.slice(12).split("/");
@@ -188,13 +143,6 @@ function parseReference(reference) {
 		name: nameParts.join("/")
 	};
 }
-/**
-* Infisical returns duplicate-create errors as 400 or 409 depending
-* on the endpoint, with a body message that includes "already exists"
-* (paraphrased). The REST client wraps both as ProviderApiError. We
-* accept 409 outright and treat 400/422 with an "already exists" body
-* as idempotent conflict — same pattern as the Doppler plugin.
-*/
 function isConflict(err) {
 	if (!(err instanceof ProviderApiError)) return false;
 	if (err.status === 409) return true;
@@ -206,16 +154,6 @@ function hasAlreadyExistsBody(details) {
 	return /already exists|duplicate/i.test(details);
 }
 //#endregion
-//#region src/rest.ts
-function createInfisicalRestClient(opts) {
-	return createRestClient({
-		baseUrl: opts.baseUrl ?? "https://app.infisical.com/api",
-		token: opts.token,
-		vendor: "Infisical",
-		fetch: opts.fetch
-	});
-}
-//#endregion
 //#region src/verify-token.ts
 /**
 * `verifyToken` — plugin-level export used by `holocron auth set` +
@@ -232,27 +170,17 @@ function createInfisicalRestClient(opts) {
 *     will name the specific workspace + environment the token
 *     actually has access to.
 *   - 401 or other → token is invalid.
-*
-* The distinction matters: verifyToken answers "is this a real
-* Infisical token?", not "does it have every possible permission?"
-* — per-capability permission failures surface at the actual read /
-* write / list call sites.
-*
-* Kept as a standalone function (not a capability method) so the auth
-* command can call it without initializing the full plugin — plugin
-* construction requires an already-resolved token, which is exactly
-* what we don't have yet at bootstrap time.
 */
 async function verifyToken(token, opts = {}) {
-	const rest = createInfisicalRestClient({
+	const client = createInfisicalClient({
 		token,
 		baseUrl: opts.baseUrl,
 		fetch: opts.fetch
 	});
 	try {
-		const res = await rest.request("/v1/workspace");
-		const count = res?.workspaces?.length ?? 0;
-		const first = res?.workspaces?.[0];
+		const { workspaces } = await client.workspaces.list();
+		const count = workspaces?.length ?? 0;
+		const first = workspaces?.[0];
 		const label = first?.name ?? first?.slug ?? "no accessible workspaces";
 		return {
 			ok: true,
@@ -274,7 +202,7 @@ async function verifyToken(token, opts = {}) {
 function createContext(options) {
 	return {
 		options,
-		rest: createInfisicalRestClient({
+		client: createInfisicalClient({
 			token: resolveToken(options),
 			baseUrl: options.baseUrl,
 			fetch: options.fetch
@@ -282,7 +210,7 @@ function createContext(options) {
 	};
 }
 function vault(ctx) {
-	return new InfisicalVault(ctx.rest, {
+	return new InfisicalVault(ctx.client, {
 		workspace: ctx.options.workspace,
 		environment: ctx.options.environment
 	});
@@ -297,14 +225,7 @@ function createPlugin(options) {
 /**
 * One-line hint printed by `holocron auth set infisical` when no
 * token is supplied or the supplied token is rejected.
-*
-* IMPORTANT — the token must be usable as a `Authorization: Bearer`
-* directly. Two token types work: **Personal API Token** (inherits
-* user perms) or a **Token Auth** token on a machine identity (a
-* single long-lived string). Universal Auth's Client Secret is NOT
-* a bearer — it needs a `/v1/auth/universal-auth/login` exchange
-* step this plugin doesn't yet do (Phase 2 follow-up).
 */
 const AUTH_HINT = "generate a Token Auth token on your machine identity (organization → access control → identities → your identity → add auth method → Token Auth → create token) OR a Personal API Token, then: holocron auth set infisical <TOKEN>. NOT Universal Auth's Client Secret — that needs a login exchange this plugin doesn't do yet.";
 //#endregion
-export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalRestClient, createPlugin, resolveToken, vault, verifyToken };
+export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-infisical",
-  "version": "2.0.0-alpha.52",
+  "version": "2.0.0-alpha.54",
   "description": "Holocron plugin for Infisical. Implements the vault capability against Infisical's REST API, plus exports verifyToken + AUTH_HINT for `holocron auth`.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-infisical#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -21,9 +21,16 @@
     }
   },
   "peerDependencies": {
-    "@theholocron/cli": "2.0.0-alpha.52"
+    "@theholocron/infisical-client": "^0.10.0",
+    "@theholocron/cli": "2.0.0-alpha.54"
+  },
+  "peerDependenciesMeta": {
+    "@theholocron/infisical-client": {
+      "optional": false
+    }
   },
   "devDependencies": {
+    "@theholocron/infisical-client": "^0.10.0",
     "@types/node": "^26",
     "@theholocron/eslint-config": "^7.0.0",
     "@theholocron/tsconfig": "^7.0.0",
@@ -37,7 +44,7 @@
     "tsx": "^4.22.4",
     "typescript": "^5.9.3",
     "vitest": "^4.1.10",
-    "@theholocron/cli": "2.0.0-alpha.52"
+    "@theholocron/cli": "2.0.0-alpha.54"
   },
   "publishConfig": {
     "access": "public"