@theholocron/holocron-plugin-infisical 5.0.0-alpha.31 → 5.0.0-alpha.326

package/README.md

@@ -160,7 +160,7 @@ Set the `baseUrl` option in `holocron.config.json`:
 
 ## Status
 
-**`v2.0.0-alpha.1`** — scaffolded via `holocron plugin create` (see
+**`v2.0.0-alpha.1`** — scaffolded via `holocron new plugin` (see
 `docs/wiki/specifications/tool-plugin-create.spec.md` — this is the first real
 production use of that command, doubling as its acceptance test in
 a live scenario). Not yet published on npm; capability methods are

package/dist/index.d.mts

@@ -1,24 +1,27 @@
-import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
+import { AuthError, EnsureResult, PluginToken, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
 import { InfisicalClient, InfisicalClient as InfisicalClient$1, InfisicalClientOptions, createInfisicalClient } from "@theholocron/infisical-client";
-//#region src/auth.d.ts
-declare const resolveToken: (input?: ResolveTokenInput) => string;
-//#endregion
-//#region src/capabilities/vault.d.ts
+/** Resolves the Infisical token from `--token`, `HOLOCRON_INFISICAL_TOKEN`, `INFISICAL_TOKEN` or the keyring entry for `infisical`, and throws `AuthError` when none is set. */
+export declare const resolveToken: import("@theholocron/cli").TokenResolver;
+/** Every token this plugin takes, for `holocron doctor tokens`. */
+export declare const tokens: PluginToken[];
 interface InfisicalVaultOptions {
   /** Default workspace (project) id — read/list/etc. operate here unless overridden. */
   workspace: string;
   /** Default environment slug — e.g., "dev", "stg", "prd". */
   environment: string;
 }
-declare class InfisicalVault implements Vault {
+/** `vault` capability for Infisical, with references shaped `infisical://<workspaceId>/<environment>/<name>`. */
+export declare class InfisicalVault implements Vault {
   private readonly client;
+  /** Capability key; always `"vault"`. */
   readonly key: "vault";
+  /** Provider name; always `"infisical"`. */
   readonly providerName = "infisical";
   private readonly workspace;
   private readonly environment;
   /**
    * Cache of resolved workspace name/slug → id. `ensureEnvironment`
-   * is called once per environment during `holocron setup` (dev / stg
+   * is called once per environment during `holocron repo setup` (dev / stg
    * / prd), so a single `GET /v1/workspace` lookup covers all three
    * calls in the same run.
    */
@@ -33,54 +36,36 @@ declare class InfisicalVault implements Vault {
   ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
   private resolveWorkspaceId;
 }
-//#endregion
-//#region src/verify-token.d.ts
-/**
- * `verifyToken` — plugin-level export used by `holocron auth set` +
- * `holocron auth check`. Hits `GET /v1/workspace` and interprets the
- * response permissively:
- *
- *   - 200 → token is valid AND has workspace-list scope; report the
- *     workspace count + first workspace name.
- *   - 403 → token is valid (authenticated) but doesn't have scope
- *     to list workspaces at the org level. This is normal for
- *     Universal Auth machine-identity tokens that are scoped to a
- *     specific workspace rather than org-wide. Return ok with a
- *     "scope-limited" subject — the operator's `holocron.config.json`
- *     will name the specific workspace + environment the token
- *     actually has access to.
- *   - 401 or other → token is invalid.
- */
-interface VerifyTokenSuccess {
-  ok: true;
-  subject: string;
-}
-interface VerifyTokenFailure {
-  ok: false;
-  message: string;
-}
-type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
 interface VerifyTokenOptions {
   baseUrl?: string;
   fetch?: typeof fetch;
 }
-declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
-//#endregion
-//#region src/index.d.ts
-interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
+/** Checks an Infisical token by listing workspaces; a 403 is reported as a valid but scope-limited token. */
+export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
+/** Options for the Infisical plugin: the token lookup inputs plus the default workspace and environment. */
+export interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
   /** Override base URL for tests (or self-hosted Infisical). */
   baseUrl?: string;
   /** Override `fetch` for tests. */
   fetch?: typeof fetch;
 }
-interface PluginContext {
+/** Shared state for one Infisical plugin instance: its options and a lazily created client. */
+export interface PluginContext {
+  /** The options the plugin was created with. */
   options: InfisicalPluginOptions;
+  /** Returns the memoized Infisical client; the token is resolved on the first call, not at plugin load. */
   client: () => InfisicalClient;
 }
-declare function createContext(options: InfisicalPluginOptions): PluginContext;
-declare function vault(ctx: PluginContext): Vault;
-declare function createPlugin(options: InfisicalPluginOptions): {
+/** Builds the plugin context from its options. */
+export declare function createContext(options: InfisicalPluginOptions): PluginContext;
+/** Builds the `vault` capability for the context's default workspace and environment. */
+export declare function vault(ctx: PluginContext): Vault;
+/** Creates the Infisical plugin: its `connection` probe and the `vault` capability. */
+export declare function createPlugin(options: InfisicalPluginOptions): {
   name: string;
+  probes: {
+    connection: import("@theholocron/cli").Probe;
+  };
   capabilities: {
     vault: () => Vault;
   };
@@ -89,6 +74,5 @@ declare function createPlugin(options: InfisicalPluginOptions): {
  * One-line hint printed by `holocron auth set infisical` when no
  * token is supplied or the supplied token is rejected.
  */
-declare const AUTH_HINT: string;
-//#endregion
-export { AUTH_HINT, AuthError, type InfisicalClient, type InfisicalClientOptions, InfisicalPluginOptions, InfisicalVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
+export declare const AUTH_HINT: string;
+export { AuthError, type InfisicalClient, type InfisicalClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createInfisicalClient };

package/dist/index.mjs

@@ -1,23 +1,29 @@
-import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
+import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
 import { createInfisicalClient } from "@theholocron/infisical-client";
-//#region src/auth.ts
+import { errorMessage } from "@theholocron/misc-utils";
+// src/auth.ts
+/** Resolves the Infisical token from `--token`, `HOLOCRON_INFISICAL_TOKEN`, `INFISICAL_TOKEN` or the keyring entry for `infisical`, and throws `AuthError` when none is set. */
 const resolveToken = createResolveToken({
 	envName: "HOLOCRON_INFISICAL_TOKEN",
 	vendorEnvName: "INFISICAL_TOKEN",
 	keyringService: "infisical",
 	errorMessage: "no Infisical token found. Pass --token <TOKEN>, set HOLOCRON_INFISICAL_TOKEN / INFISICAL_TOKEN, or run: holocron auth set infisical <TOKEN>"
 });
-//#endregion
-//#region src/capabilities/vault.ts
+/** Every token this plugin takes, for `holocron doctor tokens`. */
+const tokens = [resolveToken.token];
+// src/capabilities/vault.ts
+/** `vault` capability for Infisical, with references shaped `infisical://<workspaceId>/<environment>/<name>`. */
 var InfisicalVault = class {
 	client;
+	/** Capability key; always `"vault"`. */
 	key = "vault";
+	/** Provider name; always `"infisical"`. */
 	providerName = "infisical";
 	workspace;
 	environment;
 	/**
 	* Cache of resolved workspace name/slug → id. `ensureEnvironment`
-	* is called once per environment during `holocron setup` (dev / stg
+	* is called once per environment during `holocron repo setup` (dev / stg
 	* / prd), so a single `GET /v1/workspace` lookup covers all three
 	* calls in the same run.
 	*/
@@ -135,8 +141,7 @@ function hasAlreadyExistsBody(details) {
 	if (typeof details !== "string") return false;
 	return /already exists|duplicate/i.test(details);
 }
-//#endregion
-//#region src/verify-token.ts
+// src/verify-token.ts
 /**
 * `verifyToken` — plugin-level export used by `holocron auth set` +
 * `holocron auth check`. Hits `GET /v1/workspace` and interprets the
@@ -153,6 +158,7 @@ function hasAlreadyExistsBody(details) {
 *     actually has access to.
 *   - 401 or other → token is invalid.
 */
+/** Checks an Infisical token by listing workspaces; a 403 is reported as a valid but scope-limited token. */
 async function verifyToken(token, opts = {}) {
 	const client = createInfisicalClient({
 		token,
@@ -175,12 +181,12 @@ async function verifyToken(token, opts = {}) {
 		};
 		return {
 			ok: false,
-			message: err instanceof Error ? err.message : String(err)
+			message: errorMessage(err)
 		};
 	}
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
+/** Builds the plugin context from its options. */
 function createContext(options) {
 	let client;
 	return {
@@ -192,16 +198,28 @@ function createContext(options) {
 		})
 	};
 }
+/** Builds the `vault` capability for the context's default workspace and environment. */
 function vault(ctx) {
 	return new InfisicalVault(ctx.client, {
 		workspace: ctx.options.workspace,
 		environment: ctx.options.environment
 	});
 }
+/** Creates the Infisical plugin: its `connection` probe and the `vault` capability. */
 function createPlugin(options) {
 	const ctx = createContext(options);
 	return {
 		name: "@theholocron/holocron-plugin-infisical",
+		probes: { connection: connectionProbe({
+			provider: "Infisical",
+			url: options.baseUrl ?? "https://app.infisical.com",
+			fetch: options.fetch,
+			token: () => resolveToken(options),
+			verify: (token) => verifyToken(token, {
+				baseUrl: options.baseUrl,
+				fetch: options.fetch
+			})
+		}) },
 		capabilities: { vault: () => vault(ctx) }
 	};
 }
@@ -210,5 +228,4 @@ function createPlugin(options) {
 * token is supplied or the supplied token is rejected.
 */
 const AUTH_HINT = "generate a Token Auth token on your machine identity (organization → access control → identities → your identity → add auth method → Token Auth → create token) OR a Personal API Token, then: holocron auth set infisical <TOKEN>. NOT Universal Auth's Client Secret — that needs a login exchange this plugin doesn't do yet.";
-//#endregion
-export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
+export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, tokens, vault, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-infisical",
-  "version": "5.0.0-alpha.31",
+  "version": "5.0.0-alpha.326",
   "description": "Holocron plugin for Infisical. Implements the vault capability against Infisical's REST API, plus exports verifyToken + AUTH_HINT for `holocron auth`.",
   "keywords": [
     "holocron",
@@ -8,12 +8,12 @@
     "plugin",
     "vault"
   ],
-  "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-infisical#readme",
+  "homepage": "https://docs.theholocron.dev/holocron/plugins/infisical/",
   "bugs": "https://github.com/theholocron/holocron/issues",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/theholocron/holocron.git",
-    "directory": "packages/holocron-plugin-infisical"
+    "directory": "plugins/holocron-plugin-infisical"
   },
   "license": "MIT",
   "author": "Newton Koumantzelis",
@@ -30,27 +30,29 @@
     "dist"
   ],
   "devDependencies": {
-    "@theholocron/eslint-config": "^8.0.0",
-    "@theholocron/http-client": "^1.24.0",
-    "@theholocron/infisical-client": "^1.24.0",
-    "@theholocron/tsconfig": "^8.0.0",
-    "@theholocron/tsdown-config": "^8.0.0",
-    "@theholocron/vitest-config": "^8.0.0",
     "@types/node": "^26",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^5.0.5",
     "@vitest/eslint-plugin": "^1.6.27",
     "eslint": "^10.8.1",
     "eslint-plugin-n": "^18.3.0",
     "globals": "^17.11.0",
-    "tsdown": "^0.22.14",
-    "tsx": "4.23.12",
+    "tsdown": "^0.23.3",
+    "tsx": "4.23.15",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.11",
-    "@theholocron/cli": "5.0.0-alpha.31"
+    "vitest": "^5.0.5",
+    "@theholocron/cli": "5.0.0-alpha.326",
+    "@theholocron/misc-utils": "^1.17.0-alpha.1",
+    "@theholocron/http-client": "^1.58.0-alpha.7",
+    "@theholocron/eslint-config": "^8.9.0-alpha.8",
+    "@theholocron/tsdown-config": "^8.9.0-alpha.8",
+    "@theholocron/tsconfig": "^8.9.0-alpha.8",
+    "@theholocron/vitest-config": "^8.9.0-alpha.8",
+    "@theholocron/infisical-client": "^1.58.0-alpha.7"
   },
   "peerDependencies": {
-    "@theholocron/infisical-client": "^1.24.0",
-    "@theholocron/cli": "5.0.0-alpha.31"
+    "@theholocron/infisical-client": "^1.43.1",
+    "@theholocron/misc-utils": "^1.16.0",
+    "@theholocron/cli": "5.0.0-alpha.326"
   },
   "peerDependenciesMeta": {
     "@theholocron/infisical-client": {}
@@ -62,11 +64,11 @@
     "access": "public"
   },
   "scripts": {
-    "delivery.build": "tsdown",
-    "sourceQuality.staticAnalysis": "holocron run sourceQuality.staticAnalysis --",
+    "build": "tsdown",
+    "lint:code": "eslint .",
+    "test:unit": "vitest run --coverage",
     "test:watch": "vitest",
-    "validate": "tsx scripts/validate.mjs",
-    "verification.typeSafety": "holocron run verification.typeSafety --",
-    "verification.unitTests": "holocron run verification.unitTests --"
+    "typecheck": "tsc --noEmit",
+    "validate:plugin": "tsx scripts/validate.mjs"
   }
 }