Add Doppler plugin for loading secrets

[Copilot]

Adds @varlock/doppler-plugin — a new secret backend plugin for Doppler. Uses the Doppler API v3 directly via ky (no SDK/CLI dependency).

Plugin (packages/plugins/doppler/)

• @initDoppler(project, config, serviceToken) — root decorator, supports multiple named instances
• doppler() / doppler("SECRET_NAME") — single secret resolver, auto-infers name from variable key when called with no args
• dopplerBulk() — bulk resolver for @setValuesBulk
• dopplerServiceToken — sensitive data type for service tokens
• Fetches all secrets in one API call and caches, so multiple doppler() calls share a single request per config
• Detailed error handling with actionable tips for 401/403/404

Docs

• Full plugin docs page at plugins/doppler.mdx (setup steps, usage patterns, reference, troubleshooting)
• Added to plugins overview table and sidebar

Usage

# @plugin(@varlock/doppler-plugin)
# @initDoppler(project=my-app, config=dev, serviceToken=$DOPPLER_TOKEN)
# ---
# @type=dopplerServiceToken @sensitive
DOPPLER_TOKEN=

DATABASE_URL=doppler()
API_KEY=doppler("STRIPE_SECRET_KEY")

[changeset-bot]

🦋 Changeset detected

Latest commit: 9f3df10

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@varlock/doppler-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/doppler-plugin@530

commit: 9f3df10

[philmillman]

lgtm, as discussed we should consider at least supporting auth via the CLI even if the assumption is that the onus is on the user to have it installed.