@distilled.cloud/doppler 1.0.0-rc.12 → 1.0.0-rc.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@distilled.cloud/doppler",
-  "version": "1.0.0-rc.12",
+  "version": "1.0.0-rc.13",
   "repository": {
     "type": "git",
     "url": "https://github.com/alchemy-run/distilled",
@@ -64,15 +64,15 @@
     }
   },
   "dependencies": {
-    "@distilled.cloud/core": "1.0.0-rc.12"
+    "@distilled.cloud/core": "1.0.0-rc.13"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",
     "@types/node": "26.2.0",
-    "@effect/platform-bun": ">=4.0.0-rc.115 || >=4.0.0"
+    "@effect/platform-bun": "^4.0.0"
   },
   "peerDependencies": {
-    "effect": ">=4.0.0-rc.115 || >=4.0.0"
+    "effect": "^4.0.0"
   },
   "scripts": {
     "build": "tsc -b",

package/src/credentials.ts

@@ -24,15 +24,17 @@ export class Credentials extends Context.Service<
   Effect.Effect<Config>
 >()("DopplerCredentials") {}
 
-/** Layer from a plain API token + optional base URL. */
+/** Layer from a plain or redacted API token and optional base URL. */
 export const fromApiKey = (config: {
-  readonly apiKey: string;
+  readonly apiKey: string | Redacted.Redacted<string>;
   readonly apiBaseUrl?: string;
 }): Layer.Layer<Credentials> =>
   Layer.succeed(
     Credentials,
     Effect.succeed({
-      apiKey: Redacted.make(config.apiKey),
+      apiKey: Redacted.isRedacted(config.apiKey)
+        ? config.apiKey
+        : Redacted.make(config.apiKey),
       apiBaseUrl: config.apiBaseUrl ?? DEFAULT_API_BASE_URL,
     }),
   );

package/src/protocol.ts

@@ -18,13 +18,13 @@
 import * as Effect from "effect/Effect";
 import type * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-import type * as HttpClient from "effect/unstable/http/HttpClient";
-import type * as HttpClientError from "effect/unstable/http/HttpClientError";
+import type * as HttpClient from "effect/http/HttpClient";
+import type * as HttpClientError from "effect/http/HttpClientError";
 import type * as API from "@distilled.cloud/core/api";
 import { makeRestProtocol } from "@distilled.cloud/core/protocol-rest";
 import type { API_ERRORS, ConfigError } from "@distilled.cloud/core/errors";
 import { Credentials, type Config } from "./credentials.ts";
-import { UnknownDopplerError } from "./errors.ts";
+import { UnknownDopplerError, DopplerParseError } from "./errors.ts";
 
 /**
  * Error channel shared by every generated Doppler operation. Generated
@@ -36,7 +36,8 @@ export type DopplerOpError =
   | InstanceType<(typeof API_ERRORS)[number]>
   | UnknownDopplerError
   | ConfigError
-  | HttpClientError.HttpClientError;
+  | HttpClientError.HttpClientError
+  | DopplerParseError;
 
 /** Context (requirements) shared by every generated Doppler operation. */
 export type DopplerOpContext = Credentials | HttpClient.HttpClient;
@@ -52,6 +53,9 @@ export const DopplerProtocol: Layer.Layer<API.Protocol> =
     baseUrl: (creds) => creds.apiBaseUrl,
     headers: (creds) => ({
       Authorization: `Bearer ${Redacted.value(creds.apiKey)}`,
+      // Download negotiates its default format from Accept; without it the
+      // API returns 415 unless the caller explicitly supplies format=json.
+      Accept: "application/json",
     }),
     // Doppler's error body is `{ messages?: string[], message?: string,
     // success?: boolean }`. The factory's default envelope covers `message`;
@@ -88,4 +92,21 @@ export const DopplerProtocol: Layer.Layer<API.Protocol> =
         message,
         body,
       }),
+    parseError: ({ body, cause }) => new DopplerParseError({ body, cause }),
+  });
+
+/** Unauthenticated browser-login operations never resolve or send credentials. */
+export type DopplerPublicOpContext = HttpClient.HttpClient;
+export const DopplerPublicProtocol: Layer.Layer<API.Protocol> =
+  makeRestProtocol({
+    credentials: Effect.succeed(undefined),
+    baseUrl: () => "https://api.doppler.com",
+    headers: () => ({ Accept: "application/json" }),
+    unknownError: ({ code, message }) =>
+      new UnknownDopplerError({
+        code: code === undefined ? undefined : String(code),
+        message,
+        body: undefined,
+      }),
+    parseError: ({ body, cause }) => new DopplerParseError({ body, cause }),
   });

package/src/response-validation.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, test } from "bun:test";
+import { runValidationModes } from "@distilled.cloud/core/testing";
+import * as Redacted from "effect/Redacted";
+import { DopplerParseError } from "./errors.ts";
+import * as Retry from "./retry.ts";
+import { generateCliAuth } from "./services/doppler.ts";
+import type { DopplerOpError } from "./protocol.ts";
+
+// generateCliAuth declares required `code`, `polling_code` (sensitive), and
+// `auth_url`. It uses the unauthenticated protocol, so no credentials.
+const run = (body: string) =>
+  runValidationModes(
+    generateCliAuth({
+      hostname: "host",
+      version: "3.0.0",
+      os: "linux",
+      arch: "x64",
+    }).pipe(Retry.none),
+    { body },
+  );
+
+describe("Doppler response validation", () => {
+  test("a matching body succeeds unchanged in both modes", async () => {
+    const body = {
+      code: "abc",
+      polling_code: "secret",
+      auth_url: "https://dashboard.doppler.com/workplace/auth/cli",
+    };
+    const { lenient, strict } = await run(JSON.stringify(body));
+    for (const result of [lenient, strict]) {
+      expect(result).toMatchObject({
+        _tag: "Success",
+        success: { code: body.code, auth_url: body.auth_url },
+      });
+      const pollingCode: Redacted.Redacted<string> = (result as any).success
+        .polling_code;
+      expect(Redacted.value(pollingCode)).toBe("secret");
+    }
+  });
+
+  test("a body missing required members: lenient returns it, strict fails", async () => {
+    const body = { code: "abc" };
+    const { lenient, strict } = await run(JSON.stringify(body));
+    expect(lenient).toMatchObject({ _tag: "Success", success: body });
+    expect(strict._tag).toBe("Failure");
+    expect((strict as any).failure).toBeInstanceOf(DopplerParseError);
+  });
+
+  test("a non-JSON body: lenient returns the text, strict fails", async () => {
+    const { lenient, strict } = await run("not json");
+    expect(lenient).toMatchObject({ _tag: "Success", success: "not json" });
+    expect((strict as any).failure).toBeInstanceOf(DopplerParseError);
+  });
+});
+
+// DopplerParseError is part of every operation's declared error type.
+export const parseErrorIsDeclared: [DopplerParseError] extends [DopplerOpError]
+  ? true
+  : false = true;

package/src/services/doppler.ts

@@ -6,6 +6,8 @@ import * as C from "@distilled.cloud/core/category";
 import * as T from "../traits.ts";
 import {
   DopplerProtocol,
+  DopplerPublicProtocol,
+  type DopplerPublicOpContext,
   type DopplerOpError,
   type DopplerOpContext,
 } from "../protocol.ts";
@@ -357,18 +359,44 @@ export const AuthOidcRequest = /*@__PURE__*/ S.suspend(() =>
 }) as any as S.Schema<AuthOidcRequest>;
 
 export interface AuthOidcResponse {
-  token?: string;
-  expires_at?: string;
+  token: string | Redacted.Redacted<string>;
+  expires_at: string;
 }
 export const AuthOidcResponse = /*@__PURE__*/ S.suspend(() =>
   S.Struct({
-    token: S.optional(S.String),
-    expires_at: S.optional(S.String),
+    token: S.String.pipe(T.SensitiveValue({})),
+    expires_at: S.String,
   }),
 ).annotate({
   identifier: "AuthOidcResponse",
 }) as any as S.Schema<AuthOidcResponse>;
 
+export interface AuthorizeCliAuthRequest {
+  code: string | Redacted.Redacted<string>;
+}
+export const AuthorizeCliAuthRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    code: S.String.pipe(T.SensitiveValue({})),
+  }).pipe(T.Http({ method: "POST", uri: "/v3/auth/cli/authorize", code: 200 })),
+).annotate({
+  identifier: "AuthorizeCliAuthRequest",
+}) as any as S.Schema<AuthorizeCliAuthRequest>;
+
+export interface AuthorizeCliAuthResponse {
+  token: string | Redacted.Redacted<string>;
+  name: string;
+  dashboard_url: string;
+}
+export const AuthorizeCliAuthResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.String.pipe(T.SensitiveValue({})),
+    name: S.String,
+    dashboard_url: S.String,
+  }),
+).annotate({
+  identifier: "AuthorizeCliAuthResponse",
+}) as any as S.Schema<AuthorizeCliAuthResponse>;
+
 export interface CloneConfigRequest {
   /** Unique identifier for the project object. */
   project: string;
@@ -1329,10 +1357,55 @@ export const CreateIntegrationRequest = /*@__PURE__*/ S.suspend(() =>
   identifier: "CreateIntegrationRequest",
 }) as any as S.Schema<CreateIntegrationRequest>;
 
+export interface CreateIntegrationResponseIntegrationFederationCase0 {
+  kind: string;
+  /** The IAM principal to grant roles to. */
+  principal: string;
+}
+export const CreateIntegrationResponseIntegrationFederationCase0 =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kind: S.String,
+      principal: S.String,
+    }),
+  ).annotate({
+    identifier: "CreateIntegrationResponseIntegrationFederationCase0",
+  }) as any as S.Schema<CreateIntegrationResponseIntegrationFederationCase0>;
+
+export interface CreateIntegrationResponseIntegrationFederationCase1 {
+  kind: string;
+  /** The issuer to enter on the app registration's federated credential. */
+  issuer: string;
+  /** The subject identifier to enter on the federated credential. */
+  subject: string;
+  /** The audience to enter on the federated credential. */
+  audience: string;
+}
+export const CreateIntegrationResponseIntegrationFederationCase1 =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kind: S.String,
+      issuer: S.String,
+      subject: S.String,
+      audience: S.String,
+    }),
+  ).annotate({
+    identifier: "CreateIntegrationResponseIntegrationFederationCase1",
+  }) as any as S.Schema<CreateIntegrationResponseIntegrationFederationCase1>;
+
+/** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+export type CreateIntegrationResponseIntegrationFederation =
+  | CreateIntegrationResponseIntegrationFederationCase0
+  | CreateIntegrationResponseIntegrationFederationCase1;
+export const CreateIntegrationResponseIntegrationFederation =
+  S.Unknown as any as S.Schema<CreateIntegrationResponseIntegrationFederation>;
+
 export interface CreateIntegrationResponseIntegration {
   slug?: string;
   name?: string;
   type?: string;
+  /** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+  federation?: CreateIntegrationResponseIntegrationFederation | null;
 }
 export const CreateIntegrationResponseIntegration = /*@__PURE__*/ S.suspend(
   () =>
@@ -1340,6 +1413,9 @@ export const CreateIntegrationResponseIntegration = /*@__PURE__*/ S.suspend(
       slug: S.optional(S.String),
       name: S.optional(S.String),
       type: S.optional(S.String),
+      federation: S.optional(
+        S.NullOr(CreateIntegrationResponseIntegrationFederation),
+      ),
     }),
 ).annotate({
   identifier: "CreateIntegrationResponseIntegration",
@@ -1952,9 +2028,9 @@ export const DownloadSecretRequestNameTransformer = S.String;
 
 export interface DownloadSecretRequest {
   /** Unique identifier for the project object. Not required if using a Service Token. */
-  project: string;
+  project?: string;
   /** Name of the config object. Not required if using a Service Token. */
-  config: string;
+  config?: string;
   format?: DownloadSecretRequestFormat | (string & {});
   /** Transform secret names to a different case */
   name_transformer?: DownloadSecretRequestNameTransformer | (string & {});
@@ -1967,8 +2043,8 @@ export interface DownloadSecretRequest {
 }
 export const DownloadSecretRequest = /*@__PURE__*/ S.suspend(() =>
   S.Struct({
-    project: S.String.pipe(T.Query()),
-    config: S.String.pipe(T.Query()),
+    project: S.optional(S.String.pipe(T.Query())),
+    config: S.optional(S.String.pipe(T.Query())),
     format: S.optional(DownloadSecretRequestFormat.pipe(T.Query())),
     name_transformer: S.optional(
       DownloadSecretRequestNameTransformer.pipe(T.Query()),
@@ -1987,19 +2063,17 @@ export const DownloadSecretRequest = /*@__PURE__*/ S.suspend(() =>
   identifier: "DownloadSecretRequest",
 }) as any as S.Schema<DownloadSecretRequest>;
 
-export interface DownloadSecretResponse {
-  STRIPE?: string;
-  ALGOLIA?: string;
-  DATABASE?: string;
-  USER?: string;
-}
+export type DownloadSecretResponseBodyMap = {
+  [key: string]: string | undefined;
+};
+export const DownloadSecretResponseBodyMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<DownloadSecretResponseBodyMap>;
+
+export type DownloadSecretResponse = DownloadSecretResponseBodyMap;
 export const DownloadSecretResponse = /*@__PURE__*/ S.suspend(() =>
-  S.Struct({
-    STRIPE: S.optional(S.String),
-    ALGOLIA: S.optional(S.String),
-    DATABASE: S.optional(S.String),
-    USER: S.optional(S.String),
-  }),
+  DownloadSecretResponseBodyMap.pipe(T.RawResponseRoot()),
 ).annotate({
   identifier: "DownloadSecretResponse",
 }) as any as S.Schema<DownloadSecretResponse>;
@@ -2114,6 +2188,39 @@ export const EnableWebhookResponse = /*@__PURE__*/ S.suspend(() =>
   identifier: "EnableWebhookResponse",
 }) as any as S.Schema<EnableWebhookResponse>;
 
+export interface GenerateCliAuthRequest {
+  hostname: string;
+  /** CLI version in vMAJOR.MINOR.PATCH format. Other formats, including prerelease suffixes, are rejected. */
+  version: string;
+  os: string;
+  arch: string;
+}
+export const GenerateCliAuthRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    hostname: S.String.pipe(T.Query()),
+    version: S.String.pipe(T.Query()),
+    os: S.String.pipe(T.Query()),
+    arch: S.String.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/v3/auth/cli/generate/2", code: 200 })),
+).annotate({
+  identifier: "GenerateCliAuthRequest",
+}) as any as S.Schema<GenerateCliAuthRequest>;
+
+export interface GenerateCliAuthResponse {
+  code: string;
+  polling_code: string | Redacted.Redacted<string>;
+  auth_url: string;
+}
+export const GenerateCliAuthResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    code: S.String,
+    polling_code: S.String.pipe(T.SensitiveValue({})),
+    auth_url: S.String,
+  }),
+).annotate({
+  identifier: "GenerateCliAuthResponse",
+}) as any as S.Schema<GenerateCliAuthResponse>;
+
 export interface GetChangeRequestPolicyRequest {
   /** Unique id of the policy */
   slug: string;
@@ -2333,17 +2440,49 @@ export const GetIntegrationRequest = /*@__PURE__*/ S.suspend(() =>
   identifier: "GetIntegrationRequest",
 }) as any as S.Schema<GetIntegrationRequest>;
 
-export type GetIntegrationResponseIntegration =
-  CreateIntegrationResponseIntegration;
-export const GetIntegrationResponseIntegration =
-  CreateIntegrationResponseIntegration;
+export type GetIntegrationResponseIntegrationFederationCase0 =
+  CreateIntegrationResponseIntegrationFederationCase0;
+export const GetIntegrationResponseIntegrationFederationCase0 =
+  CreateIntegrationResponseIntegrationFederationCase0;
+
+export type GetIntegrationResponseIntegrationFederationCase1 =
+  CreateIntegrationResponseIntegrationFederationCase1;
+export const GetIntegrationResponseIntegrationFederationCase1 =
+  CreateIntegrationResponseIntegrationFederationCase1;
+
+/** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+export type GetIntegrationResponseIntegrationFederation =
+  | CreateIntegrationResponseIntegrationFederationCase0
+  | CreateIntegrationResponseIntegrationFederationCase1;
+export const GetIntegrationResponseIntegrationFederation =
+  S.Unknown as any as S.Schema<GetIntegrationResponseIntegrationFederation>;
+
+export interface GetIntegrationResponseIntegration {
+  slug?: string;
+  name?: string;
+  type?: string;
+  /** The keyless federation identity Doppler presents to your cloud, or null if this connection does not use keyless authentication. Grant this identity access after creating the connection. */
+  federation?: GetIntegrationResponseIntegrationFederation | null;
+}
+export const GetIntegrationResponseIntegration = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    slug: S.optional(S.String),
+    name: S.optional(S.String),
+    type: S.optional(S.String),
+    federation: S.optional(
+      S.NullOr(GetIntegrationResponseIntegrationFederation),
+    ),
+  }),
+).annotate({
+  identifier: "GetIntegrationResponseIntegration",
+}) as any as S.Schema<GetIntegrationResponseIntegration>;
 
 export interface GetIntegrationResponse {
-  integration?: CreateIntegrationResponseIntegration;
+  integration?: GetIntegrationResponseIntegration;
 }
 export const GetIntegrationResponse = /*@__PURE__*/ S.suspend(() =>
   S.Struct({
-    integration: S.optional(CreateIntegrationResponseIntegration),
+    integration: S.optional(GetIntegrationResponseIntegration),
   }),
 ).annotate({
   identifier: "GetIntegrationResponse",
@@ -6222,6 +6361,24 @@ export const RevokeAuthResponse = /*@__PURE__*/ S.suspend(() =>
   identifier: "RevokeAuthResponse",
 }) as any as S.Schema<RevokeAuthResponse>;
 
+export interface RevokeCliAuthRequest {
+  token: string | Redacted.Redacted<string>;
+}
+export const RevokeCliAuthRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.String.pipe(T.SensitiveValue({})),
+  }).pipe(T.Http({ method: "POST", uri: "/v3/auth/cli/revoke", code: 200 })),
+).annotate({
+  identifier: "RevokeCliAuthRequest",
+}) as any as S.Schema<RevokeCliAuthRequest>;
+
+export type RevokeCliAuthResponse = unknown;
+export const RevokeCliAuthResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "RevokeCliAuthResponse",
+}) as any as S.Schema<RevokeCliAuthResponse>;
+
 export interface SecretsNamesRequest {
   /** Unique identifier for the project object. */
   project: string;
@@ -8279,12 +8436,27 @@ export const authOidc: API.OperationMethod<
   AuthOidcRequest,
   AuthOidcResponse,
   AuthOidcError,
-  DopplerOpContext
+  DopplerPublicOpContext
 > = /*@__PURE__*/ API.make(() => ({
   input: AuthOidcRequest,
   output: AuthOidcResponse,
   errors: [UnknownDopplerError],
-  protocol: DopplerProtocol,
+  protocol: DopplerPublicProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AuthorizeCliAuthError = Conflict | DopplerOpError;
+/** Doppler CLI browser authentication. Public endpoint; no bearer token required. Wire contract from DopplerHQ/cli pkg/http/api.go. */
+export const authorizeCliAuth: API.OperationMethod<
+  AuthorizeCliAuthRequest,
+  AuthorizeCliAuthResponse,
+  AuthorizeCliAuthError,
+  DopplerPublicOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthorizeCliAuthRequest,
+  output: AuthorizeCliAuthResponse,
+  errors: [Conflict, UnknownDopplerError],
+  protocol: DopplerPublicProtocol,
   retry: Retry.Retry,
 }));
 
@@ -8802,6 +8974,21 @@ export const enableWebhook: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
+export type GenerateCliAuthError = DopplerOpError;
+/** Doppler CLI browser authentication. Public endpoint; no bearer token required. Wire contract from DopplerHQ/cli pkg/http/api.go. */
+export const generateCliAuth: API.OperationMethod<
+  GenerateCliAuthRequest,
+  GenerateCliAuthResponse,
+  GenerateCliAuthError,
+  DopplerPublicOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GenerateCliAuthRequest,
+  output: GenerateCliAuthResponse,
+  errors: [UnknownDopplerError],
+  protocol: DopplerPublicProtocol,
+  retry: Retry.Retry,
+}));
+
 export type GetChangeRequestPolicyError = DopplerOpError;
 /** Retrieve Fetch an existing change request policy */
 export const getChangeRequestPolicy: API.OperationMethod<
@@ -9642,6 +9829,21 @@ export const revokeAuth: API.OperationMethod<
   retry: Retry.Retry,
 }));
 
+export type RevokeCliAuthError = DopplerOpError;
+/** Doppler CLI browser authentication. Public endpoint; no bearer token required. Wire contract from DopplerHQ/cli pkg/http/api.go. */
+export const revokeCliAuth: API.OperationMethod<
+  RevokeCliAuthRequest,
+  RevokeCliAuthResponse,
+  RevokeCliAuthError,
+  DopplerPublicOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RevokeCliAuthRequest,
+  output: RevokeCliAuthResponse,
+  errors: [UnknownDopplerError],
+  protocol: DopplerPublicProtocol,
+  retry: Retry.Retry,
+}));
+
 export type SecretsNamesError = DopplerOpError;
 /** List Names Secret Names */
 export const secretsNames: API.OperationMethod<