@theholocron/holocron-plugin-infisical 5.0.0-alpha.27 → 5.0.0-alpha.271
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.d.mts +17 -45
- package/dist/index.mjs +21 -12
- package/package.json +21 -19
package/README.md
CHANGED
|
@@ -160,7 +160,7 @@ Set the `baseUrl` option in `holocron.config.json`:
|
|
|
160
160
|
|
|
161
161
|
## Status
|
|
162
162
|
|
|
163
|
-
**`v2.0.0-alpha.1`** — scaffolded via `holocron plugin
|
|
163
|
+
**`v2.0.0-alpha.1`** — scaffolded via `holocron new plugin` (see
|
|
164
164
|
`docs/wiki/specifications/tool-plugin-create.spec.md` — this is the first real
|
|
165
165
|
production use of that command, doubling as its acceptance test in
|
|
166
166
|
a live scenario). Not yet published on npm; capability methods are
|
package/dist/index.d.mts
CHANGED
|
@@ -1,16 +1,15 @@
|
|
|
1
|
-
import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, EnsureResult, PluginToken, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
|
|
2
2
|
import { InfisicalClient, InfisicalClient as InfisicalClient$1, InfisicalClientOptions, createInfisicalClient } from "@theholocron/infisical-client";
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
//#region src/capabilities/vault.d.ts
|
|
3
|
+
export declare const resolveToken: import("@theholocron/cli").TokenResolver;
|
|
4
|
+
/** Every token this plugin takes, for `holocron doctor tokens`. */
|
|
5
|
+
export declare const tokens: PluginToken[];
|
|
7
6
|
interface InfisicalVaultOptions {
|
|
8
7
|
/** Default workspace (project) id — read/list/etc. operate here unless overridden. */
|
|
9
8
|
workspace: string;
|
|
10
9
|
/** Default environment slug — e.g., "dev", "stg", "prd". */
|
|
11
10
|
environment: string;
|
|
12
11
|
}
|
|
13
|
-
declare class InfisicalVault implements Vault {
|
|
12
|
+
export declare class InfisicalVault implements Vault {
|
|
14
13
|
private readonly client;
|
|
15
14
|
readonly key: "vault";
|
|
16
15
|
readonly providerName = "infisical";
|
|
@@ -18,7 +17,7 @@ declare class InfisicalVault implements Vault {
|
|
|
18
17
|
private readonly environment;
|
|
19
18
|
/**
|
|
20
19
|
* Cache of resolved workspace name/slug → id. `ensureEnvironment`
|
|
21
|
-
* is called once per environment during `holocron setup` (dev / stg
|
|
20
|
+
* is called once per environment during `holocron repo setup` (dev / stg
|
|
22
21
|
* / prd), so a single `GET /v1/workspace` lookup covers all three
|
|
23
22
|
* calls in the same run.
|
|
24
23
|
*/
|
|
@@ -33,54 +32,28 @@ declare class InfisicalVault implements Vault {
|
|
|
33
32
|
ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
|
|
34
33
|
private resolveWorkspaceId;
|
|
35
34
|
}
|
|
36
|
-
//#endregion
|
|
37
|
-
//#region src/verify-token.d.ts
|
|
38
|
-
/**
|
|
39
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
40
|
-
* `holocron auth check`. Hits `GET /v1/workspace` and interprets the
|
|
41
|
-
* response permissively:
|
|
42
|
-
*
|
|
43
|
-
* - 200 → token is valid AND has workspace-list scope; report the
|
|
44
|
-
* workspace count + first workspace name.
|
|
45
|
-
* - 403 → token is valid (authenticated) but doesn't have scope
|
|
46
|
-
* to list workspaces at the org level. This is normal for
|
|
47
|
-
* Universal Auth machine-identity tokens that are scoped to a
|
|
48
|
-
* specific workspace rather than org-wide. Return ok with a
|
|
49
|
-
* "scope-limited" subject — the operator's `holocron.config.json`
|
|
50
|
-
* will name the specific workspace + environment the token
|
|
51
|
-
* actually has access to.
|
|
52
|
-
* - 401 or other → token is invalid.
|
|
53
|
-
*/
|
|
54
|
-
interface VerifyTokenSuccess {
|
|
55
|
-
ok: true;
|
|
56
|
-
subject: string;
|
|
57
|
-
}
|
|
58
|
-
interface VerifyTokenFailure {
|
|
59
|
-
ok: false;
|
|
60
|
-
message: string;
|
|
61
|
-
}
|
|
62
|
-
type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
|
|
63
35
|
interface VerifyTokenOptions {
|
|
64
36
|
baseUrl?: string;
|
|
65
37
|
fetch?: typeof fetch;
|
|
66
38
|
}
|
|
67
|
-
declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
|
|
68
|
-
|
|
69
|
-
//#region src/index.d.ts
|
|
70
|
-
interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
|
|
39
|
+
export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
|
|
40
|
+
export interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
|
|
71
41
|
/** Override base URL for tests (or self-hosted Infisical). */
|
|
72
42
|
baseUrl?: string;
|
|
73
43
|
/** Override `fetch` for tests. */
|
|
74
44
|
fetch?: typeof fetch;
|
|
75
45
|
}
|
|
76
|
-
interface PluginContext {
|
|
46
|
+
export interface PluginContext {
|
|
77
47
|
options: InfisicalPluginOptions;
|
|
78
48
|
client: () => InfisicalClient;
|
|
79
49
|
}
|
|
80
|
-
declare function createContext(options: InfisicalPluginOptions): PluginContext;
|
|
81
|
-
declare function vault(ctx: PluginContext): Vault;
|
|
82
|
-
declare function createPlugin(options: InfisicalPluginOptions): {
|
|
50
|
+
export declare function createContext(options: InfisicalPluginOptions): PluginContext;
|
|
51
|
+
export declare function vault(ctx: PluginContext): Vault;
|
|
52
|
+
export declare function createPlugin(options: InfisicalPluginOptions): {
|
|
83
53
|
name: string;
|
|
54
|
+
probes: {
|
|
55
|
+
connection: import("@theholocron/cli").Probe;
|
|
56
|
+
};
|
|
84
57
|
capabilities: {
|
|
85
58
|
vault: () => Vault;
|
|
86
59
|
};
|
|
@@ -89,6 +62,5 @@ declare function createPlugin(options: InfisicalPluginOptions): {
|
|
|
89
62
|
* One-line hint printed by `holocron auth set infisical` when no
|
|
90
63
|
* token is supplied or the supplied token is rejected.
|
|
91
64
|
*/
|
|
92
|
-
declare const AUTH_HINT: string;
|
|
93
|
-
|
|
94
|
-
export { AUTH_HINT, AuthError, type InfisicalClient, type InfisicalClientOptions, InfisicalPluginOptions, InfisicalVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
|
|
65
|
+
export declare const AUTH_HINT: string;
|
|
66
|
+
export { AuthError, type InfisicalClient, type InfisicalClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createInfisicalClient };
|
package/dist/index.mjs
CHANGED
|
@@ -1,14 +1,16 @@
|
|
|
1
|
-
import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
|
|
2
2
|
import { createInfisicalClient } from "@theholocron/infisical-client";
|
|
3
|
-
|
|
3
|
+
import { errorMessage } from "@theholocron/misc-utils";
|
|
4
|
+
// src/auth.ts
|
|
4
5
|
const resolveToken = createResolveToken({
|
|
5
6
|
envName: "HOLOCRON_INFISICAL_TOKEN",
|
|
6
7
|
vendorEnvName: "INFISICAL_TOKEN",
|
|
7
8
|
keyringService: "infisical",
|
|
8
9
|
errorMessage: "no Infisical token found. Pass --token <TOKEN>, set HOLOCRON_INFISICAL_TOKEN / INFISICAL_TOKEN, or run: holocron auth set infisical <TOKEN>"
|
|
9
10
|
});
|
|
10
|
-
|
|
11
|
-
|
|
11
|
+
/** Every token this plugin takes, for `holocron doctor tokens`. */
|
|
12
|
+
const tokens = [resolveToken.token];
|
|
13
|
+
// src/capabilities/vault.ts
|
|
12
14
|
var InfisicalVault = class {
|
|
13
15
|
client;
|
|
14
16
|
key = "vault";
|
|
@@ -17,7 +19,7 @@ var InfisicalVault = class {
|
|
|
17
19
|
environment;
|
|
18
20
|
/**
|
|
19
21
|
* Cache of resolved workspace name/slug → id. `ensureEnvironment`
|
|
20
|
-
* is called once per environment during `holocron setup` (dev / stg
|
|
22
|
+
* is called once per environment during `holocron repo setup` (dev / stg
|
|
21
23
|
* / prd), so a single `GET /v1/workspace` lookup covers all three
|
|
22
24
|
* calls in the same run.
|
|
23
25
|
*/
|
|
@@ -135,8 +137,7 @@ function hasAlreadyExistsBody(details) {
|
|
|
135
137
|
if (typeof details !== "string") return false;
|
|
136
138
|
return /already exists|duplicate/i.test(details);
|
|
137
139
|
}
|
|
138
|
-
|
|
139
|
-
//#region src/verify-token.ts
|
|
140
|
+
// src/verify-token.ts
|
|
140
141
|
/**
|
|
141
142
|
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
142
143
|
* `holocron auth check`. Hits `GET /v1/workspace` and interprets the
|
|
@@ -175,12 +176,11 @@ async function verifyToken(token, opts = {}) {
|
|
|
175
176
|
};
|
|
176
177
|
return {
|
|
177
178
|
ok: false,
|
|
178
|
-
message:
|
|
179
|
+
message: errorMessage(err)
|
|
179
180
|
};
|
|
180
181
|
}
|
|
181
182
|
}
|
|
182
|
-
|
|
183
|
-
//#region src/index.ts
|
|
183
|
+
// src/index.ts
|
|
184
184
|
function createContext(options) {
|
|
185
185
|
let client;
|
|
186
186
|
return {
|
|
@@ -202,6 +202,16 @@ function createPlugin(options) {
|
|
|
202
202
|
const ctx = createContext(options);
|
|
203
203
|
return {
|
|
204
204
|
name: "@theholocron/holocron-plugin-infisical",
|
|
205
|
+
probes: { connection: connectionProbe({
|
|
206
|
+
provider: "Infisical",
|
|
207
|
+
url: options.baseUrl ?? "https://app.infisical.com",
|
|
208
|
+
fetch: options.fetch,
|
|
209
|
+
token: () => resolveToken(options),
|
|
210
|
+
verify: (token) => verifyToken(token, {
|
|
211
|
+
baseUrl: options.baseUrl,
|
|
212
|
+
fetch: options.fetch
|
|
213
|
+
})
|
|
214
|
+
}) },
|
|
205
215
|
capabilities: { vault: () => vault(ctx) }
|
|
206
216
|
};
|
|
207
217
|
}
|
|
@@ -210,5 +220,4 @@ function createPlugin(options) {
|
|
|
210
220
|
* token is supplied or the supplied token is rejected.
|
|
211
221
|
*/
|
|
212
222
|
const AUTH_HINT = "generate a Token Auth token on your machine identity (organization → access control → identities → your identity → add auth method → Token Auth → create token) OR a Personal API Token, then: holocron auth set infisical <TOKEN>. NOT Universal Auth's Client Secret — that needs a login exchange this plugin doesn't do yet.";
|
|
213
|
-
|
|
214
|
-
export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
|
|
223
|
+
export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, tokens, vault, verifyToken };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@theholocron/holocron-plugin-infisical",
|
|
3
|
-
"version": "5.0.0-alpha.
|
|
3
|
+
"version": "5.0.0-alpha.271",
|
|
4
4
|
"description": "Holocron plugin for Infisical. Implements the vault capability against Infisical's REST API, plus exports verifyToken + AUTH_HINT for `holocron auth`.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"holocron",
|
|
@@ -8,12 +8,12 @@
|
|
|
8
8
|
"plugin",
|
|
9
9
|
"vault"
|
|
10
10
|
],
|
|
11
|
-
"homepage": "https://
|
|
11
|
+
"homepage": "https://docs.theholocron.dev/holocron/plugins/infisical/",
|
|
12
12
|
"bugs": "https://github.com/theholocron/holocron/issues",
|
|
13
13
|
"repository": {
|
|
14
14
|
"type": "git",
|
|
15
15
|
"url": "git+https://github.com/theholocron/holocron.git",
|
|
16
|
-
"directory": "
|
|
16
|
+
"directory": "plugins/holocron-plugin-infisical"
|
|
17
17
|
},
|
|
18
18
|
"license": "MIT",
|
|
19
19
|
"author": "Newton Koumantzelis",
|
|
@@ -30,27 +30,29 @@
|
|
|
30
30
|
"dist"
|
|
31
31
|
],
|
|
32
32
|
"devDependencies": {
|
|
33
|
-
"@theholocron/eslint-config": "^8.0.0",
|
|
34
|
-
"@theholocron/http-client": "^1.23.0",
|
|
35
|
-
"@theholocron/infisical-client": "^1.23.0",
|
|
36
|
-
"@theholocron/tsconfig": "^8.0.0",
|
|
37
|
-
"@theholocron/tsdown-config": "^8.0.0",
|
|
38
|
-
"@theholocron/vitest-config": "^8.0.0",
|
|
39
33
|
"@types/node": "^26",
|
|
40
|
-
"@vitest/coverage-v8": "^
|
|
34
|
+
"@vitest/coverage-v8": "^5.0.5",
|
|
41
35
|
"@vitest/eslint-plugin": "^1.6.27",
|
|
42
36
|
"eslint": "^10.8.1",
|
|
43
37
|
"eslint-plugin-n": "^18.3.0",
|
|
44
38
|
"globals": "^17.11.0",
|
|
45
|
-
"tsdown": "^0.
|
|
46
|
-
"tsx": "4.23.
|
|
39
|
+
"tsdown": "^0.23.3",
|
|
40
|
+
"tsx": "4.23.15",
|
|
47
41
|
"typescript": "^5.9.3",
|
|
48
|
-
"vitest": "^
|
|
49
|
-
"@theholocron/
|
|
42
|
+
"vitest": "^5.0.5",
|
|
43
|
+
"@theholocron/tsconfig": "^8.9.0-alpha.3",
|
|
44
|
+
"@theholocron/misc-utils": "^1.16.1-alpha.1",
|
|
45
|
+
"@theholocron/eslint-config": "^8.9.0-alpha.3",
|
|
46
|
+
"@theholocron/cli": "5.0.0-alpha.271",
|
|
47
|
+
"@theholocron/vitest-config": "^8.9.0-alpha.3",
|
|
48
|
+
"@theholocron/http-client": "^1.58.0-alpha.2",
|
|
49
|
+
"@theholocron/tsdown-config": "^8.9.0-alpha.3",
|
|
50
|
+
"@theholocron/infisical-client": "^1.58.0-alpha.2"
|
|
50
51
|
},
|
|
51
52
|
"peerDependencies": {
|
|
52
|
-
"@theholocron/infisical-client": "^1.
|
|
53
|
-
"@theholocron/
|
|
53
|
+
"@theholocron/infisical-client": "^1.43.1",
|
|
54
|
+
"@theholocron/misc-utils": "^1.16.0",
|
|
55
|
+
"@theholocron/cli": "5.0.0-alpha.271"
|
|
54
56
|
},
|
|
55
57
|
"peerDependenciesMeta": {
|
|
56
58
|
"@theholocron/infisical-client": {}
|
|
@@ -63,10 +65,10 @@
|
|
|
63
65
|
},
|
|
64
66
|
"scripts": {
|
|
65
67
|
"delivery.build": "tsdown",
|
|
66
|
-
"sourceQuality.staticAnalysis": "
|
|
68
|
+
"sourceQuality.staticAnalysis": "eslint .",
|
|
67
69
|
"test:watch": "vitest",
|
|
68
70
|
"validate": "tsx scripts/validate.mjs",
|
|
69
|
-
"verification.typeSafety": "
|
|
70
|
-
"verification.unitTests": "
|
|
71
|
+
"verification.typeSafety": "tsc --noEmit",
|
|
72
|
+
"verification.unitTests": "vitest run"
|
|
71
73
|
}
|
|
72
74
|
}
|