Doctrine Secrets

Decrypt Doctrine encrypted text files from CI or other Node.js runtimes.

CLI

Store the external recipient secret in your CI secret manager:

doctrine-secrets decrypt secrets.enc.json > secrets.json

The CLI reads the recipient secret from DOCTRINE_RECIPIENT_SECRET by default.

DOCTRINE_RECIPIENT_SECRET='doctrine-recipient-v1_...' doctrine-secrets decrypt secrets.enc.json

Library

import { decryptDoctrineEncryptedFileText } from "@mp-lb/doctrine-secrets";

const plaintext = await decryptDoctrineEncryptedFileText({
  encryptedText,
  recipientSecret: process.env.DOCTRINE_RECIPIENT_SECRET!,
});