@voxgig/sdkgen 4.6.0 → 4.8.0

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/Registry.ts

@@ -0,0 +1,90 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/Registry.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+// THE PROVIDER REGISTRY — the seam that replaced the `makeprovider`
+// switch, and the reason an SDK no longer carries thirteen providers to
+// use two.
+//
+// The switch named every kind in one function, so every kind was
+// statically reachable from `Sekreto` and no bundler could drop one. Its
+// replacement is a map that a provider ADDS ITSELF to. A kind that is
+// never imported is never registered, is never reachable, and is not in
+// the build — which is the whole point.
+//
+// The vocabulary is voxgig/plugin's (docs/design/plugin-providers.md): a
+// provider kind is a plugin `Definition`, a configured provider is an
+// instance addressed by name+tag. What sekreto does NOT route through
+// plugin is the lookup itself: `Provider.lookup` is async, and plugin's
+// dispatch is synchronous by design — twenty ports, many with no
+// async/await. So plugin owns the catalog, the instances and their
+// order; sekreto walks them in each language's own idiom.
+//
+// `define` is the definition's factory: spec in, Provider out. It is
+// separate from the plugin `Definition.define` callback on purpose —
+// this one runs at construction and returns a value, while plugin's runs
+// at load and binds. They are bridged in Catalog.ts.
+
+import { Provider, ProviderSpec, SekretoError } from './support'
+
+export type ProviderDefinition = {
+  /** The `kind` a ProviderSpec names. */
+  name: string
+  /** What this provider needs of its runtime, so a host can refuse or
+   * report before a lookup fails: 'fs', 'fetch', 'crypto', 'process'. */
+  needs?: string[]
+  /** Build the provider from its declarative spec. */
+  define: (spec: ProviderSpec) => Provider
+}
+
+const registry: { [kind: string]: ProviderDefinition } = {}
+
+/** Register a provider kind. Called by each provider module at import,
+ * so importing the module IS installing it. Re-registering the same name
+ * replaces it, which is how a host substitutes an implementation. */
+export function register(def: ProviderDefinition): void {
+  if (null == def || 'string' !== typeof def.name || '' === def.name) {
+    throw new SekretoError('sekreto: invalid provider definition')
+  }
+  registry[def.name] = def
+}
+
+export function registered(kind: string): ProviderDefinition | undefined {
+  return registry[kind]
+}
+
+export function kinds(): string[] {
+  return Object.keys(registry).sort()
+}
+
+/** Build a provider from its spec.
+ *
+ * An UNREGISTERED kind is not the same failure as an unknown one, and the
+ * message says which: a kind sekreto has never heard of is a typo, while
+ * a known kind that was not imported is the leanness mechanism working as
+ * designed and telling you to import it. Collapsing the two was the first
+ * thing that made the split confusing to use. */
+export function makeprovider(spec: ProviderSpec): Provider {
+  const kind = null == spec ? undefined : (spec as any).kind
+  const def = registry[kind as string]
+
+  if (null == def) {
+    throw new SekretoError(
+      'sekreto: unknown provider kind: ' + String(kind) +
+      ' (registered: ' + (kinds().join(', ') || 'none') + ')' +
+      (KNOWN.indexOf(String(kind)) < 0 ? '' :
+        " - that kind exists but its module was not imported; import" +
+        " '@voxgig/sekreto/provider/" + String(kind) + "' to register it"))
+  }
+
+  return def.define(spec)
+}
+
+/** Every kind this library ships, registered or not. Used only to tell a
+ * typo from a module that was not imported. */
+const KNOWN = [
+  'env', 'memory', 'dotenv', 'file', 'hashicorp', 'boru',
+  'awssecrets', 'awsparams', 'gcpsecrets', 'azuresecrets',
+  'onepassword', 'doppler', 'infisical',
+]

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/addr.ts

@@ -0,0 +1,48 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/addr.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { SekretoError } from './support'
+
+export function checkaddr(addr: string): void {
+  if (addr.startsWith('https://')) {
+    return
+  }
+
+  if (!addr.startsWith('http://')) {
+    throw new SekretoError('sekreto: not an http(s) address: ' + addr)
+  }
+
+  // Parsed, not split on ':'. Splitting the authority on the first colon
+  // yields '[' for a bracketed IPv6 address, so `http://[::1]:8200` could
+  // never match — which made the '::1' and '[::1]' entries below
+  // unreachable, and refused a legitimate local vault.
+  //
+  // The ALLOWLIST is unchanged. URL only fixes what the host IS: it strips
+  // userinfo (so `http://127.0.0.1@evil.com/` reads as evil.com, as
+  // before), lowercases, and normalises numeric forms — `0177.0.0.1` is
+  // 127.0.0.1 and is now recognised as the loopback it actually is.
+  // IPv4-mapped IPv6 (`[::ffff:127.0.0.1]`) is deliberately still refused:
+  // widening the set is a separate decision from parsing it correctly.
+  let host: string
+  try {
+    host = new URL(addr).hostname
+  } catch (err: any) {
+    throw new SekretoError('sekreto: not a valid http(s) address: ' + addr)
+  }
+
+  if ('localhost' === host || '127.0.0.1' === host || '::1' === host || '[::1]' === host) {
+    return
+  }
+
+  throw new SekretoError(
+    'sekreto: refusing to send a token in plaintext to ' + addr + ' (use https)',
+  )
+}
+
+/** How long any single vault round-trip may take before it is treated as
+ * unreachable. Ports carry the same bound. */
+
+/** One JSON round-trip. Network failure is always an error - an
+ * unreachable store is a store that could not answer. */

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/aws.ts

@@ -0,0 +1,219 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/aws.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import {
+  ProviderSpec, Provider, SekretoError, awsparam, flatname, vaultref,
+} from './support'
+import { checkaddr } from './addr'
+import { sigv4 } from '../Sigv4'
+import { fetchjson } from './http'
+
+function awsnow(): string {
+  return new Date()
+    .toISOString()
+    .replace(/[-:]/g, '')
+    .replace(/\.\d+Z$/, 'Z')
+}
+
+type Awsopts = {
+  region?: string
+  keyid?: string
+  secret?: string
+  session?: string
+  addr?: string
+  prefix?: string
+}
+
+/** Region and credentials, from config first and the standard AWS_*
+ * environment variables second - those are AWS's own convention, and a
+ * pod or CI job that has them set should just work. Missing either is
+ * an error: an AWS store with no credentials could not answer. */
+function awsauth(opts: Awsopts): {
+  region: string
+  keyid: string
+  secret: string
+  session?: string
+} {
+  const env = process.env
+
+  const region = opts.region || env.AWS_REGION || env.AWS_DEFAULT_REGION || ''
+  const keyid = opts.keyid || env.AWS_ACCESS_KEY_ID || ''
+  const secret = opts.secret || env.AWS_SECRET_ACCESS_KEY || ''
+  const session = opts.session || env.AWS_SESSION_TOKEN || undefined
+
+  if ('' === region) {
+    throw new SekretoError('sekreto: aws: no region (set region or AWS_REGION)')
+  }
+  if ('' === keyid || '' === secret) {
+    throw new SekretoError(
+      'sekreto: aws: no credentials (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)',
+    )
+  }
+
+  return { region, keyid, secret, session }
+}
+
+/** One signed call to an AWS JSON-1.1 API. */
+async function awscall(
+  opts: Awsopts,
+  service: string,
+  target: string,
+  payload: any,
+): Promise<{ status: number; body: any }> {
+  const auth = awsauth(opts)
+  // The China partition lives under its own suffix; every other
+  // commercial region is plain amazonaws.com.
+  const suffix = auth.region.startsWith('cn-') ? '.amazonaws.com.cn' : '.amazonaws.com'
+  const addr = opts.addr || 'https://' + service + '.' + auth.region + suffix
+  checkaddr(addr)
+
+  const url = addr.replace(/\/$/, '') + '/'
+  const body = JSON.stringify(payload)
+  const headers: Record<string, string> = {
+    'content-type': 'application/x-amz-json-1.1',
+    'x-amz-target': target,
+  }
+
+  const signed = sigv4({
+    method: 'POST',
+    url,
+    headers,
+    body,
+    service,
+    region: auth.region,
+    keyid: auth.keyid,
+    secret: auth.secret,
+    session: auth.session,
+    datetime: awsnow(),
+  })
+
+  return fetchjson('POST', url, { ...headers, ...signed }, body)
+}
+
+/** Does this AWS error body name one of the not-found types? Those are
+ * a miss; every other failure is a store that could not answer. */
+function awsmiss(body: any, types: string[]): boolean {
+  const errtype = body && 'string' === typeof body.__type ? body.__type : ''
+  return types.some((name) => errtype.includes(name))
+}
+
+/** AWS Secrets Manager.
+ *
+ * `api.token` reads the secret named `api` (the vaultref path, so
+ * `db.pass.main` reads `db/pass`) and takes the `token` field of its
+ * JSON SecretString - the AWS idiom of one JSON map per secret. A
+ * SecretString that is not JSON is the value itself, under the
+ * conventional field `value`. Requests are SigV4-signed in-tree; see
+ * Sigv4.ts. */
+export function awssecretsprovider(options?: Awsopts): Provider {
+  const opts = options || {}
+
+  return {
+    lookup: async (name: string) => {
+      const ref = vaultref(name)
+
+      const res = await awscall(opts, 'secretsmanager', 'secretsmanager.GetSecretValue', {
+        SecretId: ref.path,
+      })
+
+      if (400 === res.status && awsmiss(res.body, ['ResourceNotFoundException'])) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: aws secretsmanager error: ' + res.status)
+      }
+
+      const text = res.body && res.body.SecretString
+
+      if ('string' !== typeof text) {
+        // A binary secret has no fields to address; only the conventional
+        // `value` field can mean "the bytes themselves".
+        const bin = res.body && res.body.SecretBinary
+        if ('string' === typeof bin && 'value' === ref.field) {
+          return Buffer.from(bin, 'base64').toString('utf8')
+        }
+        return undefined
+      }
+
+      let parsed: any
+      try {
+        parsed = JSON.parse(text)
+      } catch (err: any) {
+        parsed = undefined
+      }
+
+      if (parsed && 'object' === typeof parsed && !Array.isArray(parsed)) {
+        const value = parsed[ref.field]
+        return undefined === value || null === value ? undefined : String(value)
+      }
+
+      // A plain-string secret is the whole value; it has no named fields.
+      return 'value' === ref.field ? text : undefined
+    },
+    // Config only, never the environment: describe() feeds the spec's
+    // sources group, which must answer the same everywhere.
+    describe: () => 'awssecrets:' + (opts.region || ''),
+  }
+}
+
+/** AWS SSM Parameter Store.
+ *
+ * `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+ * prefix path), decrypted. Parameter Store carries flat strings, so
+ * there is no field indirection. */
+export function awsparamsprovider(options?: Awsopts): Provider {
+  const opts = options || {}
+
+  return {
+    lookup: async (name: string) => {
+      const res = await awscall(opts, 'ssm', 'AmazonSSM.GetParameter', {
+        Name: awsparam(name, opts.prefix),
+        WithDecryption: true,
+      })
+
+      if (400 === res.status && awsmiss(res.body, ['ParameterNotFound'])) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: aws ssm error: ' + res.status)
+      }
+
+      const value = res.body && res.body.Parameter && res.body.Parameter.Value
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'awsparams:' + (opts.region || '') + (opts.prefix || ''),
+  }
+}
+
+/** GCP Secret Manager.
+ *
+ * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+ * Manager ids have no hierarchy and reject dots), latest version. The
+ * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+ * GCE/GKE metadata server - so on Google's own platform no credential
+ * configuration is needed at all.
+ *
+ * The metadata call itself is plain http to a link-local host by
+ * platform design; no credential rides on it, so `checkaddr` guards the
+ * Secret Manager address instead. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'awssecrets',
+  needs: ['fetch', 'crypto'],
+  define: (spec: ProviderSpec) => awssecretsprovider(spec),
+})
+
+register({
+  name: 'awsparams',
+  needs: ['fetch', 'crypto'],
+  define: (spec: ProviderSpec) => awsparamsprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/azuresecrets.ts

@@ -0,0 +1,144 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/azuresecrets.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, flatname } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function azuresecretsprovider(options?: {
+  vault?: string
+  token?: string
+  tenant?: string
+  clientid?: string
+  clientsecret?: string
+  loginaddr?: string
+  imdsaddr?: string
+  apiversion?: string
+}): Provider {
+  const opts = options || {}
+  const resource = 'https://vault.azure.net'
+
+  // A configured token is kept forever; logged-in and IMDS tokens carry
+  // expires_in and are renewed shortly before they run out.
+  let livetoken: string | undefined
+  let renewat = Infinity
+
+  const expiry = (expires: any): number => {
+    const seconds = Number(expires)
+    return 0 < seconds ? Date.now() + Math.max(seconds - 60, 1) * 1000 : Infinity
+  }
+
+  const login = async (): Promise<string> => {
+    if (opts.token) {
+      return opts.token
+    }
+
+    if (opts.tenant && opts.clientid && opts.clientsecret) {
+      const loginaddr = opts.loginaddr || 'https://login.microsoftonline.com'
+      checkaddr(loginaddr)
+
+      const url = loginaddr.replace(/\/$/, '') + '/' + opts.tenant + '/oauth2/v2.0/token'
+      const form =
+        'grant_type=client_credentials&client_id=' +
+        encodeURIComponent(opts.clientid) +
+        '&client_secret=' +
+        encodeURIComponent(opts.clientsecret) +
+        '&scope=' +
+        encodeURIComponent(resource + '/.default')
+
+      const res = await fetchjson(
+        'POST',
+        url,
+        { 'content-type': 'application/x-www-form-urlencoded' },
+        form,
+      )
+
+      const got = res.body && res.body.access_token
+      if (200 !== res.status || !got) {
+        throw new SekretoError('sekreto: azure login failed: ' + res.status)
+      }
+
+      renewat = expiry(res.body.expires_in)
+      return String(got)
+    }
+
+    const imds =
+      (opts.imdsaddr || 'http://169.254.169.254').replace(/\/$/, '') +
+      '/metadata/identity/oauth2/token?api-version=2018-02-01&resource=' +
+      encodeURIComponent(resource)
+
+    const res = await fetchjson('GET', imds, { Metadata: 'true' })
+
+    const got = res.body && res.body.access_token
+    if (200 !== res.status || !got) {
+      throw new SekretoError(
+        'sekreto: azure: no token, no client credentials, and IMDS did not answer',
+      )
+    }
+
+    renewat = expiry(res.body.expires_in)
+    return String(got)
+  }
+
+  return {
+    lookup: async (name: string) => {
+      const vault = opts.vault || ''
+      if ('' === vault) {
+        throw new SekretoError('sekreto: azure: no vault')
+      }
+
+      // Only an explicit scheme is a URL; a vault NAMED httpvault must
+      // still become https://httpvault.vault.azure.net.
+      const vaulturl =
+        vault.startsWith('http://') || vault.startsWith('https://')
+          ? vault
+          : 'https://' + vault + '.vault.azure.net'
+      checkaddr(vaulturl)
+
+      if (undefined === livetoken || Date.now() >= renewat) {
+        livetoken = await login()
+      }
+
+      const url =
+        vaulturl.replace(/\/$/, '') +
+        '/secrets/' +
+        flatname(name, '-') +
+        '?api-version=' +
+        (opts.apiversion || '7.4')
+
+      const res = await fetchjson('GET', url, { authorization: 'Bearer ' + livetoken })
+
+      if (404 === res.status) {
+        return undefined
+      }
+
+      if (200 !== res.status) {
+        throw new SekretoError('sekreto: azure error: ' + res.status + ': ' + url.split('?')[0])
+      }
+
+      const value = res.body && res.body.value
+      return undefined === value || null === value ? undefined : String(value)
+    },
+    describe: () => 'azuresecrets:' + (opts.vault || ''),
+  }
+}
+
+/** 1Password, through a Connect server.
+ *
+ * The item titled `api.token` (titles keep their dots), in the named
+ * vault. The value is the field with purpose PASSWORD, or the field
+ * labelled `value`. A vault that cannot be found is an error - config
+ * names it, so its absence is a broken store, not a missing secret. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'azuresecrets',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => azuresecretsprovider(spec),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/boru.ts

@@ -0,0 +1,113 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/boru.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, checkname, nodemod } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function boruprovider(options?: {
+  command?: string
+  namespace?: string
+  home?: string
+  addr?: string
+  token?: string
+  mount?: string
+}): Provider {
+  const opts = options || {}
+  const command = opts.command || 'boru'
+
+  if (opts.addr) {
+    const addr = opts.addr.replace(/\/$/, '')
+    const mount = opts.mount || 'secret'
+
+    return {
+      lookup: async (name: string) => {
+        checkname(name)
+        checkaddr(addr)
+
+        const alias = opts.namespace ? opts.namespace + '/' + name : name
+        const url = addr + '/v1/' + mount + '/data/' + alias
+
+        const res = await fetchjson('GET', url, { 'X-Vault-Token': opts.token || '' })
+
+        if (404 === res.status) {
+          return undefined
+        }
+
+        if (200 !== res.status) {
+          throw new SekretoError('sekreto: boru serve error: ' + res.status + ': ' + url)
+        }
+
+        const data = res.body && res.body.data && res.body.data.data
+        const value = data ? data['value'] : undefined
+        return undefined === value || null === value ? undefined : String(value)
+      },
+      describe: () => 'boru:' + addr,
+    }
+  }
+
+  return {
+    lookup: (name: string) => {
+      checkname(name)
+
+      const alias = opts.namespace ? opts.namespace + ':' + name : name
+      const env = opts.home ? { ...process.env, BORU_HOME: opts.home } : process.env
+
+      const { spawnSync } = nodemod<typeof import('node:child_process')>('node:child_process')
+      const run = spawnSync(command, ['vault', 'get', '--reveal', alias], {
+        encoding: 'utf8',
+        env,
+      })
+
+      if (run.error) {
+        throw new SekretoError('sekreto: cannot run ' + command + ': ' + run.error.message)
+      }
+
+      if (0 === run.status) {
+        // boru prints the value and one newline, and nothing else.
+        return run.stdout.replace(/\n$/, '')
+      }
+
+      const why = (run.stderr || '').trim()
+
+      // "no alias named" is boru saying it does not hold this secret, which
+      // is a miss: the chain carries on to the next provider. A locked vault
+      // or a wrong passphrase is not a miss - treating it as one would fall
+      // through to a weaker store without saying so.
+      if (borumiss(why)) {
+        return undefined
+      }
+
+      throw new SekretoError('sekreto: boru vault error: ' + (why || 'exit ' + run.status))
+    },
+    describe: () => 'boru' + (opts.namespace ? ':' + opts.namespace : ''),
+  }
+}
+
+/** Does this boru failure mean "no such secret" rather than "I could not
+ * answer"? Matched on boru's own wording for a missing alias. */
+function borumiss(why: string): boolean {
+  return /no alias named/.test(why)
+}
+
+/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'boru',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => boruprovider({
+    command: spec.command,
+    namespace: spec.namespace,
+    home: spec.home,
+    addr: spec.addr,
+    token: spec.token,
+    mount: spec.mount,
+  }),
+})

package/project/.sdk/tm/ts/src/feature/secrets/sekreto/provider/doppler.ts

@@ -0,0 +1,77 @@
+// VENDORED: @voxgig/sekreto 0.1.2 (typescript/src/provider/doppler.ts)
+// Source: https://github.com/voxgig/sekreto @ 65009cb5758850db767785ab666e71895f86086b
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Copyright (c) 2025 Voxgig Ltd, MIT License */
+
+import { ProviderSpec, Provider, SekretoError, envkey } from './support'
+import { checkaddr } from './addr'
+import { fetchjson } from './http'
+
+export function dopplerprovider(options?: {
+  token?: string
+  project?: string
+  config?: string
+  addr?: string
+}): Provider {
+  const opts = options || {}
+
+  let values: Record<string, string> | undefined
+
+  const load = async (): Promise<Record<string, string>> => {
+    if (undefined !== values) {
+      return values
+    }
+
+    const addr = (opts.addr || 'https://api.doppler.com').replace(/\/$/, '')
+    checkaddr(addr)
+
+    let url = addr + '/v3/configs/config/secrets/download?format=json'
+    if (opts.project) {
+      url += '&project=' + encodeURIComponent(opts.project)
+    }
+    if (opts.config) {
+      url += '&config=' + encodeURIComponent(opts.config)
+    }
+
+    const res = await fetchjson('GET', url, {
+      authorization: 'Bearer ' + (opts.token || ''),
+    })
+
+    if (200 !== res.status || !res.body || 'object' !== typeof res.body) {
+      throw new SekretoError('sekreto: doppler error: ' + res.status)
+    }
+
+    values = {}
+    for (const [key, value] of Object.entries(res.body)) {
+      if (null !== value && undefined !== value) {
+        values[key] = String(value)
+      }
+    }
+
+    return values
+  }
+
+  return {
+    lookup: async (name: string) => (await load())[envkey(name)],
+    describe: () =>
+      'doppler' + (opts.project ? ':' + opts.project + '/' + (opts.config || '') : ''),
+  }
+}
+
+/** Infisical.
+ *
+ * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+ * convention is environment-style keys) at a secret path in one
+ * environment of a project. Auth is a token, or a universal-auth
+ * (machine identity) login with clientid/clientsecret. */
+
+
+// Registering at import is what makes this module's presence the only
+// thing that decides whether the kind exists in a build.
+import { register } from './Registry'
+
+register({
+  name: 'doppler',
+  needs: ['fetch'],
+  define: (spec: ProviderSpec) => dopplerprovider(spec),
+})