dopplerlisted

# Doppler (env-style secrets) Doppler is the default store for every env-style secret — API keys, tokens, passwords, connection strings — in place of a plaintext `.env`. One source of truth, synced across the user's Windows and macOS machines, with nothing secret committed. The account's workplace is `sava`. ## Context - Doppler CLI: !`command -v doppler >/dev/null 2>&1 && echo INSTALLED || echo MISSING` - Existing projects: !`doppler projects --json 2>&1 | tr ',' '\n' | grep -o '"name":"[^"]*"' || echo UNAVAILABLE` - This repo's doppler.yaml: !`test -f doppler.yaml && cat doppler.yaml || echo NONE` - This directory's binding: !`doppler configure get project --plain 2>/dev/null | grep . || echo UNBOUND` ## 1. Resolve project and config — never guess them Read the coordinates off **Existing projects** (Context), which is the authoritative list: - The workplace name `sava` is **not** a project. Never `-p sava`. - Doppler's sample project `example-project` is not one of the user's. Never write to it. - The config is **`dev`**. New projects get `dev`/`stg`/`prd`, but secrets, `doppler run`, and `doppler setup` all live in `dev`. Reach for `prd` only when the task is genuinely production-facing, and say out loud that you did. - Two stores, and they don't mix: - **A per-app project**, kebab-case, named after the repo — secrets the app consumes at runtime. - **`tools` / `prd`** — credentials *Claude* uses ad hoc across projects (Porkbun, Resend, Tailscale, `TRANSCRY