@theholocron/holocron-plugin-infisical 5.0.0-alpha.26 → 5.0.0-alpha.261
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.d.mts +15 -45
- package/dist/index.mjs +18 -11
- package/package.json +21 -19
package/README.md
CHANGED
|
@@ -160,7 +160,7 @@ Set the `baseUrl` option in `holocron.config.json`:
|
|
|
160
160
|
|
|
161
161
|
## Status
|
|
162
162
|
|
|
163
|
-
**`v2.0.0-alpha.1`** — scaffolded via `holocron plugin
|
|
163
|
+
**`v2.0.0-alpha.1`** — scaffolded via `holocron new plugin` (see
|
|
164
164
|
`docs/wiki/specifications/tool-plugin-create.spec.md` — this is the first real
|
|
165
165
|
production use of that command, doubling as its acceptance test in
|
|
166
166
|
a live scenario). Not yet published on npm; capability methods are
|
package/dist/index.d.mts
CHANGED
|
@@ -1,16 +1,13 @@
|
|
|
1
|
-
import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, EnsureResult, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
|
|
2
2
|
import { InfisicalClient, InfisicalClient as InfisicalClient$1, InfisicalClientOptions, createInfisicalClient } from "@theholocron/infisical-client";
|
|
3
|
-
|
|
4
|
-
declare const resolveToken: (input?: ResolveTokenInput) => string;
|
|
5
|
-
//#endregion
|
|
6
|
-
//#region src/capabilities/vault.d.ts
|
|
3
|
+
export declare const resolveToken: (input?: ResolveTokenInput) => string;
|
|
7
4
|
interface InfisicalVaultOptions {
|
|
8
5
|
/** Default workspace (project) id — read/list/etc. operate here unless overridden. */
|
|
9
6
|
workspace: string;
|
|
10
7
|
/** Default environment slug — e.g., "dev", "stg", "prd". */
|
|
11
8
|
environment: string;
|
|
12
9
|
}
|
|
13
|
-
declare class InfisicalVault implements Vault {
|
|
10
|
+
export declare class InfisicalVault implements Vault {
|
|
14
11
|
private readonly client;
|
|
15
12
|
readonly key: "vault";
|
|
16
13
|
readonly providerName = "infisical";
|
|
@@ -18,7 +15,7 @@ declare class InfisicalVault implements Vault {
|
|
|
18
15
|
private readonly environment;
|
|
19
16
|
/**
|
|
20
17
|
* Cache of resolved workspace name/slug → id. `ensureEnvironment`
|
|
21
|
-
* is called once per environment during `holocron setup` (dev / stg
|
|
18
|
+
* is called once per environment during `holocron repo setup` (dev / stg
|
|
22
19
|
* / prd), so a single `GET /v1/workspace` lookup covers all three
|
|
23
20
|
* calls in the same run.
|
|
24
21
|
*/
|
|
@@ -33,54 +30,28 @@ declare class InfisicalVault implements Vault {
|
|
|
33
30
|
ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
|
|
34
31
|
private resolveWorkspaceId;
|
|
35
32
|
}
|
|
36
|
-
//#endregion
|
|
37
|
-
//#region src/verify-token.d.ts
|
|
38
|
-
/**
|
|
39
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
40
|
-
* `holocron auth check`. Hits `GET /v1/workspace` and interprets the
|
|
41
|
-
* response permissively:
|
|
42
|
-
*
|
|
43
|
-
* - 200 → token is valid AND has workspace-list scope; report the
|
|
44
|
-
* workspace count + first workspace name.
|
|
45
|
-
* - 403 → token is valid (authenticated) but doesn't have scope
|
|
46
|
-
* to list workspaces at the org level. This is normal for
|
|
47
|
-
* Universal Auth machine-identity tokens that are scoped to a
|
|
48
|
-
* specific workspace rather than org-wide. Return ok with a
|
|
49
|
-
* "scope-limited" subject — the operator's `holocron.config.json`
|
|
50
|
-
* will name the specific workspace + environment the token
|
|
51
|
-
* actually has access to.
|
|
52
|
-
* - 401 or other → token is invalid.
|
|
53
|
-
*/
|
|
54
|
-
interface VerifyTokenSuccess {
|
|
55
|
-
ok: true;
|
|
56
|
-
subject: string;
|
|
57
|
-
}
|
|
58
|
-
interface VerifyTokenFailure {
|
|
59
|
-
ok: false;
|
|
60
|
-
message: string;
|
|
61
|
-
}
|
|
62
|
-
type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
|
|
63
33
|
interface VerifyTokenOptions {
|
|
64
34
|
baseUrl?: string;
|
|
65
35
|
fetch?: typeof fetch;
|
|
66
36
|
}
|
|
67
|
-
declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
|
|
68
|
-
|
|
69
|
-
//#region src/index.d.ts
|
|
70
|
-
interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
|
|
37
|
+
export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
|
|
38
|
+
export interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
|
|
71
39
|
/** Override base URL for tests (or self-hosted Infisical). */
|
|
72
40
|
baseUrl?: string;
|
|
73
41
|
/** Override `fetch` for tests. */
|
|
74
42
|
fetch?: typeof fetch;
|
|
75
43
|
}
|
|
76
|
-
interface PluginContext {
|
|
44
|
+
export interface PluginContext {
|
|
77
45
|
options: InfisicalPluginOptions;
|
|
78
46
|
client: () => InfisicalClient;
|
|
79
47
|
}
|
|
80
|
-
declare function createContext(options: InfisicalPluginOptions): PluginContext;
|
|
81
|
-
declare function vault(ctx: PluginContext): Vault;
|
|
82
|
-
declare function createPlugin(options: InfisicalPluginOptions): {
|
|
48
|
+
export declare function createContext(options: InfisicalPluginOptions): PluginContext;
|
|
49
|
+
export declare function vault(ctx: PluginContext): Vault;
|
|
50
|
+
export declare function createPlugin(options: InfisicalPluginOptions): {
|
|
83
51
|
name: string;
|
|
52
|
+
probes: {
|
|
53
|
+
connection: import("@theholocron/cli").Probe;
|
|
54
|
+
};
|
|
84
55
|
capabilities: {
|
|
85
56
|
vault: () => Vault;
|
|
86
57
|
};
|
|
@@ -89,6 +60,5 @@ declare function createPlugin(options: InfisicalPluginOptions): {
|
|
|
89
60
|
* One-line hint printed by `holocron auth set infisical` when no
|
|
90
61
|
* token is supplied or the supplied token is rejected.
|
|
91
62
|
*/
|
|
92
|
-
declare const AUTH_HINT: string;
|
|
93
|
-
|
|
94
|
-
export { AUTH_HINT, AuthError, type InfisicalClient, type InfisicalClientOptions, InfisicalPluginOptions, InfisicalVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
|
|
63
|
+
export declare const AUTH_HINT: string;
|
|
64
|
+
export { AuthError, type InfisicalClient, type InfisicalClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createInfisicalClient };
|
package/dist/index.mjs
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
|
-
import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
|
|
2
2
|
import { createInfisicalClient } from "@theholocron/infisical-client";
|
|
3
|
-
|
|
3
|
+
import { errorMessage } from "@theholocron/misc-utils";
|
|
4
|
+
// src/auth.ts
|
|
4
5
|
const resolveToken = createResolveToken({
|
|
5
6
|
envName: "HOLOCRON_INFISICAL_TOKEN",
|
|
6
7
|
vendorEnvName: "INFISICAL_TOKEN",
|
|
7
8
|
keyringService: "infisical",
|
|
8
9
|
errorMessage: "no Infisical token found. Pass --token <TOKEN>, set HOLOCRON_INFISICAL_TOKEN / INFISICAL_TOKEN, or run: holocron auth set infisical <TOKEN>"
|
|
9
10
|
});
|
|
10
|
-
|
|
11
|
-
//#region src/capabilities/vault.ts
|
|
11
|
+
// src/capabilities/vault.ts
|
|
12
12
|
var InfisicalVault = class {
|
|
13
13
|
client;
|
|
14
14
|
key = "vault";
|
|
@@ -17,7 +17,7 @@ var InfisicalVault = class {
|
|
|
17
17
|
environment;
|
|
18
18
|
/**
|
|
19
19
|
* Cache of resolved workspace name/slug → id. `ensureEnvironment`
|
|
20
|
-
* is called once per environment during `holocron setup` (dev / stg
|
|
20
|
+
* is called once per environment during `holocron repo setup` (dev / stg
|
|
21
21
|
* / prd), so a single `GET /v1/workspace` lookup covers all three
|
|
22
22
|
* calls in the same run.
|
|
23
23
|
*/
|
|
@@ -135,8 +135,7 @@ function hasAlreadyExistsBody(details) {
|
|
|
135
135
|
if (typeof details !== "string") return false;
|
|
136
136
|
return /already exists|duplicate/i.test(details);
|
|
137
137
|
}
|
|
138
|
-
|
|
139
|
-
//#region src/verify-token.ts
|
|
138
|
+
// src/verify-token.ts
|
|
140
139
|
/**
|
|
141
140
|
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
142
141
|
* `holocron auth check`. Hits `GET /v1/workspace` and interprets the
|
|
@@ -175,12 +174,11 @@ async function verifyToken(token, opts = {}) {
|
|
|
175
174
|
};
|
|
176
175
|
return {
|
|
177
176
|
ok: false,
|
|
178
|
-
message:
|
|
177
|
+
message: errorMessage(err)
|
|
179
178
|
};
|
|
180
179
|
}
|
|
181
180
|
}
|
|
182
|
-
|
|
183
|
-
//#region src/index.ts
|
|
181
|
+
// src/index.ts
|
|
184
182
|
function createContext(options) {
|
|
185
183
|
let client;
|
|
186
184
|
return {
|
|
@@ -202,6 +200,16 @@ function createPlugin(options) {
|
|
|
202
200
|
const ctx = createContext(options);
|
|
203
201
|
return {
|
|
204
202
|
name: "@theholocron/holocron-plugin-infisical",
|
|
203
|
+
probes: { connection: connectionProbe({
|
|
204
|
+
provider: "Infisical",
|
|
205
|
+
url: options.baseUrl ?? "https://app.infisical.com",
|
|
206
|
+
fetch: options.fetch,
|
|
207
|
+
token: () => resolveToken(options),
|
|
208
|
+
verify: (token) => verifyToken(token, {
|
|
209
|
+
baseUrl: options.baseUrl,
|
|
210
|
+
fetch: options.fetch
|
|
211
|
+
})
|
|
212
|
+
}) },
|
|
205
213
|
capabilities: { vault: () => vault(ctx) }
|
|
206
214
|
};
|
|
207
215
|
}
|
|
@@ -210,5 +218,4 @@ function createPlugin(options) {
|
|
|
210
218
|
* token is supplied or the supplied token is rejected.
|
|
211
219
|
*/
|
|
212
220
|
const AUTH_HINT = "generate a Token Auth token on your machine identity (organization → access control → identities → your identity → add auth method → Token Auth → create token) OR a Personal API Token, then: holocron auth set infisical <TOKEN>. NOT Universal Auth's Client Secret — that needs a login exchange this plugin doesn't do yet.";
|
|
213
|
-
//#endregion
|
|
214
221
|
export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@theholocron/holocron-plugin-infisical",
|
|
3
|
-
"version": "5.0.0-alpha.
|
|
3
|
+
"version": "5.0.0-alpha.261",
|
|
4
4
|
"description": "Holocron plugin for Infisical. Implements the vault capability against Infisical's REST API, plus exports verifyToken + AUTH_HINT for `holocron auth`.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"holocron",
|
|
@@ -8,12 +8,12 @@
|
|
|
8
8
|
"plugin",
|
|
9
9
|
"vault"
|
|
10
10
|
],
|
|
11
|
-
"homepage": "https://github.com/theholocron/holocron/tree/main/
|
|
11
|
+
"homepage": "https://github.com/theholocron/holocron/tree/main/plugins/holocron-plugin-infisical#readme",
|
|
12
12
|
"bugs": "https://github.com/theholocron/holocron/issues",
|
|
13
13
|
"repository": {
|
|
14
14
|
"type": "git",
|
|
15
15
|
"url": "git+https://github.com/theholocron/holocron.git",
|
|
16
|
-
"directory": "
|
|
16
|
+
"directory": "plugins/holocron-plugin-infisical"
|
|
17
17
|
},
|
|
18
18
|
"license": "MIT",
|
|
19
19
|
"author": "Newton Koumantzelis",
|
|
@@ -30,27 +30,29 @@
|
|
|
30
30
|
"dist"
|
|
31
31
|
],
|
|
32
32
|
"devDependencies": {
|
|
33
|
-
"@theholocron/eslint-config": "^8.0.0",
|
|
34
|
-
"@theholocron/http-client": "^1.22.0",
|
|
35
|
-
"@theholocron/infisical-client": "^1.22.0",
|
|
36
|
-
"@theholocron/tsconfig": "^8.0.0",
|
|
37
|
-
"@theholocron/tsdown-config": "^8.0.0",
|
|
38
|
-
"@theholocron/vitest-config": "^8.0.0",
|
|
39
33
|
"@types/node": "^26",
|
|
40
|
-
"@vitest/coverage-v8": "^
|
|
34
|
+
"@vitest/coverage-v8": "^5.0.5",
|
|
41
35
|
"@vitest/eslint-plugin": "^1.6.27",
|
|
42
36
|
"eslint": "^10.8.1",
|
|
43
37
|
"eslint-plugin-n": "^18.3.0",
|
|
44
38
|
"globals": "^17.11.0",
|
|
45
|
-
"tsdown": "^0.
|
|
46
|
-
"tsx": "4.23.
|
|
39
|
+
"tsdown": "^0.23.3",
|
|
40
|
+
"tsx": "4.23.15",
|
|
47
41
|
"typescript": "^5.9.3",
|
|
48
|
-
"vitest": "^
|
|
49
|
-
"@theholocron/cli": "5.0.0-alpha.
|
|
42
|
+
"vitest": "^5.0.5",
|
|
43
|
+
"@theholocron/cli": "5.0.0-alpha.261",
|
|
44
|
+
"@theholocron/http-client": "^1.57.1-alpha.2",
|
|
45
|
+
"@theholocron/tsconfig": "^8.9.0-alpha.3",
|
|
46
|
+
"@theholocron/infisical-client": "^1.57.1-alpha.2",
|
|
47
|
+
"@theholocron/eslint-config": "^8.9.0-alpha.3",
|
|
48
|
+
"@theholocron/misc-utils": "^1.16.1-alpha.1",
|
|
49
|
+
"@theholocron/tsdown-config": "^8.9.0-alpha.3",
|
|
50
|
+
"@theholocron/vitest-config": "^8.9.0-alpha.3"
|
|
50
51
|
},
|
|
51
52
|
"peerDependencies": {
|
|
52
|
-
"@theholocron/infisical-client": "^1.
|
|
53
|
-
"@theholocron/
|
|
53
|
+
"@theholocron/infisical-client": "^1.43.1",
|
|
54
|
+
"@theholocron/misc-utils": "^1.16.0",
|
|
55
|
+
"@theholocron/cli": "5.0.0-alpha.261"
|
|
54
56
|
},
|
|
55
57
|
"peerDependenciesMeta": {
|
|
56
58
|
"@theholocron/infisical-client": {}
|
|
@@ -63,10 +65,10 @@
|
|
|
63
65
|
},
|
|
64
66
|
"scripts": {
|
|
65
67
|
"delivery.build": "tsdown",
|
|
66
|
-
"sourceQuality.staticAnalysis": "
|
|
68
|
+
"sourceQuality.staticAnalysis": "eslint .",
|
|
67
69
|
"test:watch": "vitest",
|
|
68
70
|
"validate": "tsx scripts/validate.mjs",
|
|
69
|
-
"verification.typeSafety": "
|
|
70
|
-
"verification.unitTests": "
|
|
71
|
+
"verification.typeSafety": "tsc --noEmit",
|
|
72
|
+
"verification.unitTests": "vitest run"
|
|
71
73
|
}
|
|
72
74
|
}
|