@distilled.cloud/doppler 1.0.0-rc.12 → 1.0.0-rc.13

package/README.md

@@ -0,0 +1,34 @@
+# @distilled.cloud/doppler
+
+Effect-native SDK for [doppler](https://www.npmjs.com/package/@distilled.cloud/doppler).
+
+## Installation
+
+```bash
+npm install @distilled.cloud/doppler effect
+```
+
+## Quick start
+
+```ts
+import { Effect, Layer } from "effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Doppler from "@distilled.cloud/doppler";
+
+const program = Effect.gen(function* () {
+  const result = yield* Doppler.projectsList({});
+  return result;
+});
+
+const Live = Layer.mergeAll(
+  FetchHttpClient.layer,
+  Doppler.CredentialsFromEnv,
+  Doppler.DopplerProtocol,
+);
+
+program.pipe(Effect.provide(Live), Effect.runPromise);
+```
+
+## Auth
+
+Required: `DOPPLER_API_KEY`, `DOPPLER_TOKEN`. Optional: `DOPPLER_API_BASE_URL`. Sent as `Authorization: Bearer`.

package/lib/credentials.d.ts

@@ -18,9 +18,9 @@ export interface Config {
 declare const Credentials_base: Context.ServiceClass<Credentials, "DopplerCredentials", Effect.Effect<Config, never, never>>;
 export declare class Credentials extends Credentials_base {
 }
-/** Layer from a plain API token + optional base URL. */
+/** Layer from a plain or redacted API token and optional base URL. */
 export declare const fromApiKey: (config: {
-    readonly apiKey: string;
+    readonly apiKey: string | Redacted.Redacted<string>;
     readonly apiBaseUrl?: string;
 }) => Layer.Layer<Credentials>;
 /**

package/lib/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;;AAED,qBAAa,WAAY,SAAQ,gBAGR;CAAG;AAE5B,wDAAwD;AACxD,eAAO,MAAM,UAAU,WAAY;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAOxB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAiBvD,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;;AAED,qBAAa,WAAY,SAAQ,gBAGR;CAAG;AAE5B,sEAAsE;AACtE,eAAO,MAAM,UAAU,WAAY;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CASxB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAiBvD,CAAC"}

package/lib/credentials.js

@@ -14,9 +14,11 @@ import { ConfigError } from "@distilled.cloud/core/errors";
 export const DEFAULT_API_BASE_URL = "https://api.doppler.com";
 export class Credentials extends Context.Service()("DopplerCredentials") {
 }
-/** Layer from a plain API token + optional base URL. */
+/** Layer from a plain or redacted API token and optional base URL. */
 export const fromApiKey = (config) => Layer.succeed(Credentials, Effect.succeed({
-    apiKey: Redacted.make(config.apiKey),
+    apiKey: Redacted.isRedacted(config.apiKey)
+        ? config.apiKey
+        : Redacted.make(config.apiKey),
     apiBaseUrl: config.apiBaseUrl ?? DEFAULT_API_BASE_URL,
 }));
 /**

package/lib/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAO9D,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAG7C,CAAC,oBAAoB,CAAC;CAAG;AAE5B,wDAAwD;AACxD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAG1B,EAA4B,EAAE,CAC7B,KAAK,CAAC,OAAO,CACX,WAAW,EACX,MAAM,CAAC,OAAO,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,oBAAoB;CACtD,CAAC,CACH,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,KAAK,CAAC,OAAO,CACvE,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAExE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;YAC5B,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,oBAAoB;KACrE,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CACtB,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAO9D,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAG7C,CAAC,oBAAoB,CAAC;CAAG;AAE5B,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAG1B,EAA4B,EAAE,CAC7B,KAAK,CAAC,OAAO,CACX,WAAW,EACX,MAAM,CAAC,OAAO,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,oBAAoB;CACtD,CAAC,CACH,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,KAAK,CAAC,OAAO,CACvE,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAExE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;YAC5B,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,oBAAoB;KACrE,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CACtB,CAAC"}

package/lib/protocol.d.ts

@@ -1,18 +1,21 @@
 import type * as Layer from "effect/Layer";
-import type * as HttpClient from "effect/unstable/http/HttpClient";
-import type * as HttpClientError from "effect/unstable/http/HttpClientError";
+import type * as HttpClient from "effect/http/HttpClient";
+import type * as HttpClientError from "effect/http/HttpClientError";
 import type * as API from "@distilled.cloud/core/api";
 import type { API_ERRORS, ConfigError } from "@distilled.cloud/core/errors";
 import { Credentials } from "./credentials.ts";
-import { UnknownDopplerError } from "./errors.ts";
+import { UnknownDopplerError, DopplerParseError } from "./errors.ts";
 /**
  * Error channel shared by every generated Doppler operation. Generated
  * service files annotate operations with `API.OperationMethod<I, O,
  * DopplerOpError, DopplerOpContext>` explicitly so the compiler never
  * infers these back out of the schema generics.
  */
-export type DopplerOpError = InstanceType<(typeof API_ERRORS)[number]> | UnknownDopplerError | ConfigError | HttpClientError.HttpClientError;
+export type DopplerOpError = InstanceType<(typeof API_ERRORS)[number]> | UnknownDopplerError | ConfigError | HttpClientError.HttpClientError | DopplerParseError;
 /** Context (requirements) shared by every generated Doppler operation. */
 export type DopplerOpContext = Credentials | HttpClient.HttpClient;
 export declare const DopplerProtocol: Layer.Layer<API.Protocol>;
+/** Unauthenticated browser-login operations never resolve or send credentials. */
+export type DopplerPublicOpContext = HttpClient.HttpClient;
+export declare const DopplerPublicProtocol: Layer.Layer<API.Protocol>;
 //# sourceMappingURL=protocol.d.ts.map

package/lib/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,KAAK,eAAe,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,KAAK,GAAG,MAAM,2BAA2B,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,YAAY,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GACzC,mBAAmB,GACnB,WAAW,GACX,eAAe,CAAC,eAAe,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;AAEnE,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CA+ClD,CAAC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,KAAK,eAAe,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,KAAK,GAAG,MAAM,2BAA2B,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,YAAY,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GACzC,mBAAmB,GACnB,WAAW,GACX,eAAe,CAAC,eAAe,GAC/B,iBAAiB,CAAC;AAEtB,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;AAEnE,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAmDlD,CAAC;AAEL,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,UAAU,CAAC;AAC3D,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAYxD,CAAC"}

package/lib/protocol.js

@@ -19,7 +19,7 @@ import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import { makeRestProtocol } from "@distilled.cloud/core/protocol-rest";
 import { Credentials } from "./credentials.js";
-import { UnknownDopplerError } from "./errors.js";
+import { UnknownDopplerError, DopplerParseError } from "./errors.js";
 export const DopplerProtocol = makeRestProtocol({
     // The Credentials service holds an effect — resolving it here (per
     // request, on the calling fiber) picks up context-provided credentials.
@@ -30,6 +30,9 @@ export const DopplerProtocol = makeRestProtocol({
     baseUrl: (creds) => creds.apiBaseUrl,
     headers: (creds) => ({
         Authorization: `Bearer ${Redacted.value(creds.apiKey)}`,
+        // Download negotiates its default format from Accept; without it the
+        // API returns 415 unless the caller explicitly supplies format=json.
+        Accept: "application/json",
     }),
     // Doppler's error body is `{ messages?: string[], message?: string,
     // success?: boolean }`. The factory's default envelope covers `message`;
@@ -64,5 +67,17 @@ export const DopplerProtocol = makeRestProtocol({
         message,
         body,
     }),
+    parseError: ({ body, cause }) => new DopplerParseError({ body, cause }),
+});
+export const DopplerPublicProtocol = makeRestProtocol({
+    credentials: Effect.succeed(undefined),
+    baseUrl: () => "https://api.doppler.com",
+    headers: () => ({ Accept: "application/json" }),
+    unknownError: ({ code, message }) => new UnknownDopplerError({
+        code: code === undefined ? undefined : String(code),
+        message,
+        body: undefined,
+    }),
+    parseError: ({ body, cause }) => new DopplerParseError({ body, cause }),
 });
 //# sourceMappingURL=protocol.js.map

package/lib/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAiBlD,MAAM,CAAC,MAAM,eAAe,GAC1B,gBAAgB,CAAS;IACvB,mEAAmE;IACnE,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;KACxD,CAAC;IACF,oEAAoE;IACpE,yEAAyE;IACzE,0DAA0D;IAC1D,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;QACtB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAC7B,CAAC,CAAC,GAAG,CAAC,KAAK;gBACX,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAC7B,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,OAAO,YAAY,KAAK,QAAQ;gBAChC,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CACxC,IAAI,mBAAmB,CAAC;QACtB,IAAI,EACF,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,SAAS;QACjB,OAAO;QACP,IAAI;KACL,CAAC;CACL,CAAC,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAkBrE,MAAM,CAAC,MAAM,eAAe,GAC1B,gBAAgB,CAAS;IACvB,mEAAmE;IACnE,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QACvD,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,oEAAoE;IACpE,yEAAyE;IACzE,0DAA0D;IAC1D,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;QACtB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAC7B,CAAC,CAAC,GAAG,CAAC,KAAK;gBACX,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAC7B,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,OAAO,YAAY,KAAK,QAAQ;gBAChC,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CACxC,IAAI,mBAAmB,CAAC;QACtB,IAAI,EACF,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,SAAS;QACjB,OAAO;QACP,IAAI;KACL,CAAC;IACJ,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;CACxE,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,qBAAqB,GAChC,gBAAgB,CAAC;IACf,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,CAAC,yBAAyB;IACxC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC/C,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAClC,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACnD,OAAO;QACP,IAAI,EAAE,SAAS;KAChB,CAAC;IACJ,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;CACxE,CAAC,CAAC"}

package/lib/response-validation.test.d.ts

@@ -0,0 +1,4 @@
+import { DopplerParseError } from "./errors.ts";
+import type { DopplerOpError } from "./protocol.ts";
+export declare const parseErrorIsDeclared: [DopplerParseError] extends [DopplerOpError] ? true : false;
+//# sourceMappingURL=response-validation.test.d.ts.map

package/lib/response-validation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-validation.test.d.ts","sourceRoot":"","sources":["../src/response-validation.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAkDpD,eAAO,MAAM,oBAAoB,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,GAC3E,IAAI,GACJ,KAAY,CAAC"}

package/lib/response-validation.test.js

@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import { runValidationModes } from "@distilled.cloud/core/testing";
+import * as Redacted from "effect/Redacted";
+import { DopplerParseError } from "./errors.js";
+import * as Retry from "./retry.js";
+import { generateCliAuth } from "./services/doppler.js";
+// generateCliAuth declares required `code`, `polling_code` (sensitive), and
+// `auth_url`. It uses the unauthenticated protocol, so no credentials.
+const run = (body) => runValidationModes(generateCliAuth({
+    hostname: "host",
+    version: "3.0.0",
+    os: "linux",
+    arch: "x64",
+}).pipe(Retry.none), { body });
+describe("Doppler response validation", () => {
+    test("a matching body succeeds unchanged in both modes", async () => {
+        const body = {
+            code: "abc",
+            polling_code: "secret",
+            auth_url: "https://dashboard.doppler.com/workplace/auth/cli",
+        };
+        const { lenient, strict } = await run(JSON.stringify(body));
+        for (const result of [lenient, strict]) {
+            expect(result).toMatchObject({
+                _tag: "Success",
+                success: { code: body.code, auth_url: body.auth_url },
+            });
+            const pollingCode = result.success
+                .polling_code;
+            expect(Redacted.value(pollingCode)).toBe("secret");
+        }
+    });
+    test("a body missing required members: lenient returns it, strict fails", async () => {
+        const body = { code: "abc" };
+        const { lenient, strict } = await run(JSON.stringify(body));
+        expect(lenient).toMatchObject({ _tag: "Success", success: body });
+        expect(strict._tag).toBe("Failure");
+        expect(strict.failure).toBeInstanceOf(DopplerParseError);
+    });
+    test("a non-JSON body: lenient returns the text, strict fails", async () => {
+        const { lenient, strict } = await run("not json");
+        expect(lenient).toMatchObject({ _tag: "Success", success: "not json" });
+        expect(strict.failure).toBeInstanceOf(DopplerParseError);
+    });
+});
+// DopplerParseError is part of every operation's declared error type.
+export const parseErrorIsDeclared = true;
+//# sourceMappingURL=response-validation.test.js.map

package/lib/response-validation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-validation.test.js","sourceRoot":"","sources":["../src/response-validation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAC3B,kBAAkB,CAChB,eAAe,CAAC;IACd,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,OAAO;IAChB,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,KAAK;CACZ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EACnB,EAAE,IAAI,EAAE,CACT,CAAC;AAEJ,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,QAAQ;YACtB,QAAQ,EAAE,kDAAkD;SAC7D,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;gBAC3B,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,WAAW,GAA+B,MAAc,CAAC,OAAO;iBACnE,YAAY,CAAC;YAChB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAE,MAAc,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,CAAE,MAAc,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAErB,IAAI,CAAC"}

package/lib/services/doppler.d.ts

@@ -1,7 +1,7 @@
 import * as S from "@distilled.cloud/core/schema";
 import * as Redacted from "effect/Redacted";
 import * as API from "@distilled.cloud/core/api";
-import { type DopplerOpError, type DopplerOpContext } from "../protocol.ts";
+import { type DopplerPublicOpContext, type DopplerOpError, type DopplerOpContext } from "../protocol.ts";
 export type { DopplerOpError, DopplerOpContext };
 declare const BadRequest_base: S.Class<BadRequest, S.TaggedStruct<"BadRequest", {
     readonly code: any;
@@ -171,10 +171,20 @@ export interface AuthOidcRequest {
 }
 export declare const AuthOidcRequest: S.Schema<AuthOidcRequest>;
 export interface AuthOidcResponse {
-    token?: string;
-    expires_at?: string;
+    token: string | Redacted.Redacted<string>;
+    expires_at: string;
 }
 export declare const AuthOidcResponse: S.Schema<AuthOidcResponse>;
+export interface AuthorizeCliAuthRequest {
+    code: string | Redacted.Redacted<string>;
+}
+export declare const AuthorizeCliAuthRequest: S.Schema<AuthorizeCliAuthRequest>;
+export interface AuthorizeCliAuthResponse {
+    token: string | Redacted.Redacted<string>;
+    name: string;
+    dashboard_url: string;
+}
+export declare const AuthorizeCliAuthResponse: S.Schema<AuthorizeCliAuthResponse>;
 export interface CloneConfigRequest {
     /** Unique identifier for the project object. */
     project: string;
@@ -568,10 +578,31 @@ export interface CreateIntegrationRequest {
     data?: unknown;
 }
 export declare const CreateIntegrationRequest: S.Schema<CreateIntegrationRequest>;
+export interface CreateIntegrationResponseIntegrationFederationCase0 {
+    kind: string;
+    /** The IAM principal to grant roles to. */
+    principal: string;
+}
+export declare const CreateIntegrationResponseIntegrationFederationCase0: S.Schema<CreateIntegrationResponseIntegrationFederationCase0>;
+export interface CreateIntegrationResponseIntegrationFederationCase1 {
+    kind: string;
+    /** The issuer to enter on the app registration's federated credential. */
+    issuer: string;
+    /** The subject identifier to enter on the federated credential. */
+    subject: string;
+    /** The audience to enter on the federated credential. */
+    audience: string;
+}
+export declare const CreateIntegrationResponseIntegrationFederationCase1: S.Schema<CreateIntegrationResponseIntegrationFederationCase1>;
+/** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+export type CreateIntegrationResponseIntegrationFederation = CreateIntegrationResponseIntegrationFederationCase0 | CreateIntegrationResponseIntegrationFederationCase1;
+export declare const CreateIntegrationResponseIntegrationFederation: S.Schema<CreateIntegrationResponseIntegrationFederation>;
 export interface CreateIntegrationResponseIntegration {
     slug?: string;
     name?: string;
     type?: string;
+    /** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+    federation?: CreateIntegrationResponseIntegrationFederation | null;
 }
 export declare const CreateIntegrationResponseIntegration: S.Schema<CreateIntegrationResponseIntegration>;
 export interface CreateIntegrationResponse {
@@ -790,9 +821,9 @@ export type DownloadSecretRequestNameTransformer = "camel" | "upper-camel" | "lo
 export declare const DownloadSecretRequestNameTransformer: any;
 export interface DownloadSecretRequest {
     /** Unique identifier for the project object. Not required if using a Service Token. */
-    project: string;
+    project?: string;
     /** Name of the config object. Not required if using a Service Token. */
-    config: string;
+    config?: string;
     format?: DownloadSecretRequestFormat | (string & {});
     /** Transform secret names to a different case */
     name_transformer?: DownloadSecretRequestNameTransformer | (string & {});
@@ -804,12 +835,11 @@ export interface DownloadSecretRequest {
     secrets?: string;
 }
 export declare const DownloadSecretRequest: S.Schema<DownloadSecretRequest>;
-export interface DownloadSecretResponse {
-    STRIPE?: string;
-    ALGOLIA?: string;
-    DATABASE?: string;
-    USER?: string;
-}
+export type DownloadSecretResponseBodyMap = {
+    [key: string]: string | undefined;
+};
+export declare const DownloadSecretResponseBodyMap: S.Schema<DownloadSecretResponseBodyMap>;
+export type DownloadSecretResponse = DownloadSecretResponseBodyMap;
 export declare const DownloadSecretResponse: S.Schema<DownloadSecretResponse>;
 export interface DynamicSecretsIssueLeaseRequest {
     /** The project where the dynamic secret is located */
@@ -853,6 +883,20 @@ export interface EnableWebhookRequest {
 export declare const EnableWebhookRequest: S.Schema<EnableWebhookRequest>;
 export type EnableWebhookResponse = unknown;
 export declare const EnableWebhookResponse: S.Schema<EnableWebhookResponse>;
+export interface GenerateCliAuthRequest {
+    hostname: string;
+    /** CLI version in vMAJOR.MINOR.PATCH format. Other formats, including prerelease suffixes, are rejected. */
+    version: string;
+    os: string;
+    arch: string;
+}
+export declare const GenerateCliAuthRequest: S.Schema<GenerateCliAuthRequest>;
+export interface GenerateCliAuthResponse {
+    code: string;
+    polling_code: string | Redacted.Redacted<string>;
+    auth_url: string;
+}
+export declare const GenerateCliAuthResponse: S.Schema<GenerateCliAuthResponse>;
 export interface GetChangeRequestPolicyRequest {
     /** Unique id of the policy */
     slug: string;
@@ -936,10 +980,23 @@ export interface GetIntegrationRequest {
     integration: string;
 }
 export declare const GetIntegrationRequest: S.Schema<GetIntegrationRequest>;
-export type GetIntegrationResponseIntegration = CreateIntegrationResponseIntegration;
-export declare const GetIntegrationResponseIntegration: S.Schema<CreateIntegrationResponseIntegration>;
+export type GetIntegrationResponseIntegrationFederationCase0 = CreateIntegrationResponseIntegrationFederationCase0;
+export declare const GetIntegrationResponseIntegrationFederationCase0: S.Schema<CreateIntegrationResponseIntegrationFederationCase0>;
+export type GetIntegrationResponseIntegrationFederationCase1 = CreateIntegrationResponseIntegrationFederationCase1;
+export declare const GetIntegrationResponseIntegrationFederationCase1: S.Schema<CreateIntegrationResponseIntegrationFederationCase1>;
+/** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+export type GetIntegrationResponseIntegrationFederation = CreateIntegrationResponseIntegrationFederationCase0 | CreateIntegrationResponseIntegrationFederationCase1;
+export declare const GetIntegrationResponseIntegrationFederation: S.Schema<GetIntegrationResponseIntegrationFederation>;
+export interface GetIntegrationResponseIntegration {
+    slug?: string;
+    name?: string;
+    type?: string;
+    /** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+    federation?: GetIntegrationResponseIntegrationFederation | null;
+}
+export declare const GetIntegrationResponseIntegration: S.Schema<GetIntegrationResponseIntegration>;
 export interface GetIntegrationResponse {
-    integration?: CreateIntegrationResponseIntegration;
+    integration?: GetIntegrationResponseIntegration;
 }
 export declare const GetIntegrationResponse: S.Schema<GetIntegrationResponse>;
 export interface GetIntegrationsIntegrationMembersRequest {
@@ -2278,6 +2335,12 @@ export declare const RevokeAuthRequest: S.Schema<RevokeAuthRequest>;
 export interface RevokeAuthResponse {
 }
 export declare const RevokeAuthResponse: S.Schema<RevokeAuthResponse>;
+export interface RevokeCliAuthRequest {
+    token: string | Redacted.Redacted<string>;
+}
+export declare const RevokeCliAuthRequest: S.Schema<RevokeCliAuthRequest>;
+export type RevokeCliAuthResponse = unknown;
+export declare const RevokeCliAuthResponse: S.Schema<RevokeCliAuthResponse>;
 export interface SecretsNamesRequest {
     /** Unique identifier for the project object. */
     project: string;
@@ -3070,7 +3133,10 @@ export type AuthMeError = BadRequest | DopplerOpError;
 export declare const authMe: API.OperationMethod<AuthMeRequest, AuthMeResponse, AuthMeError, DopplerOpContext>;
 export type AuthOidcError = DopplerOpError;
 /** OIDC (Service Account Identity) Authenticate via a Service Account Identity with OIDC. Returns a short lived API token. */
-export declare const authOidc: API.OperationMethod<AuthOidcRequest, AuthOidcResponse, AuthOidcError, DopplerOpContext>;
+export declare const authOidc: API.OperationMethod<AuthOidcRequest, AuthOidcResponse, AuthOidcError, DopplerPublicOpContext>;
+export type AuthorizeCliAuthError = Conflict | DopplerOpError;
+/** Doppler CLI browser authentication. Public endpoint; no bearer token required. Wire contract from DopplerHQ/cli pkg/http/api.go. */
+export declare const authorizeCliAuth: API.OperationMethod<AuthorizeCliAuthRequest, AuthorizeCliAuthResponse, AuthorizeCliAuthError, DopplerPublicOpContext>;
 export type CloneConfigError = DopplerOpError;
 /** Clone Create a new branch config by cloning another. This duplicates a branch config and all its secrets. */
 export declare const cloneConfig: API.OperationMethod<CloneConfigRequest, CloneConfigResponse, CloneConfigError, DopplerOpContext>;
@@ -3171,6 +3237,9 @@ export declare const dynamicSecretsRevokeLease: API.OperationMethod<DynamicSecre
 export type EnableWebhookError = BadRequest | DopplerOpError;
 /** Enable Webhook */
 export declare const enableWebhook: API.OperationMethod<EnableWebhookRequest, EnableWebhookResponse, EnableWebhookError, DopplerOpContext>;
+export type GenerateCliAuthError = DopplerOpError;
+/** Doppler CLI browser authentication. Public endpoint; no bearer token required. Wire contract from DopplerHQ/cli pkg/http/api.go. */
+export declare const generateCliAuth: API.OperationMethod<GenerateCliAuthRequest, GenerateCliAuthResponse, GenerateCliAuthError, DopplerPublicOpContext>;
 export type GetChangeRequestPolicyError = DopplerOpError;
 /** Retrieve Fetch an existing change request policy */
 export declare const getChangeRequestPolicy: API.OperationMethod<GetChangeRequestPolicyRequest, GetChangeRequestPolicyResponse, GetChangeRequestPolicyError, DopplerOpContext>;
@@ -3322,6 +3391,9 @@ export declare const renameEnvironment: API.OperationMethod<RenameEnvironmentReq
 export type RevokeAuthError = DopplerOpError;
 /** Revoke Revoke an auth token */
 export declare const revokeAuth: API.OperationMethod<RevokeAuthRequest, RevokeAuthResponse, RevokeAuthError, DopplerOpContext>;
+export type RevokeCliAuthError = DopplerOpError;
+/** Doppler CLI browser authentication. Public endpoint; no bearer token required. Wire contract from DopplerHQ/cli pkg/http/api.go. */
+export declare const revokeCliAuth: API.OperationMethod<RevokeCliAuthRequest, RevokeCliAuthResponse, RevokeCliAuthError, DopplerPublicOpContext>;
 export type SecretsNamesError = DopplerOpError;
 /** List Names Secret Names */
 export declare const secretsNames: API.OperationMethod<SecretsNamesRequest, SecretsNamesResponse, SecretsNamesError, DopplerOpContext>;