Release 0.12.2

Full Changelog: v0.12.1...v0.12.2

Properly surface errors

Error messages in effect-sops will now properly surface details in errors thrown downstream rather than swallowing them.

Release 0.12.0

Full Changelog: v0.11.0...v0.12.0

Release 0.11.0

What's Changed

• fix: align Effect 4 and Alchemy dependencies by cooper (@czxtm) in #16
• ci: bump version from the release tag with release-it by cooper (@czxtm) in #17

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

• ci: wait up to 20 minutes for npm to serve a new version by cooper (@czxtm) in #15

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• feat: runSopsKms — decrypt KMS-encrypted documents in-process by cooper (@czxtm) in #14

New Contributors

• cooper (@czxtm) made their first contribution in #14

Full Changelog: v0.8.1...v0.9.0

v0.8.1

Full Changelog: v0.8.0...v0.8.1

v0.8.0

What's Changed

• Update dependency effect to v4.0.0-beta.103 by renovate[bot] in #11

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Added

• The Alchemy-free alchemy-sops/Config entrypoint, exposing a SOPS document as an Effect ConfigProvider. Alchemy resolves provider credentials through Config.redacted/Config.string, so a deploy can authenticate from an encrypted document with nothing in the environment and no sops exec-env wrapper.
• provideCredentials, which supplies the provider to both a stack's providers and state layers. The state store initializes first and resolves credentials independently, so wiring only providers fails during state initialization.

Decryption is lazy and memoized, and layerAdd registers the document behind the environment, so an ambient credential still wins. A path the document lacks is reported as absent rather than as a failure, so ConfigProvider.orElse composition behaves normally.

Changed

• Backend selection moved into src/backend.ts so the Alchemy-free entrypoints share the same auto/cli/sops-age resolution as SopsFile.

Fixed

• Pinned the effect dev dependency to 4.0.0-beta.102. beta.105 removed Schema.TaggedErrorClass, which the @distilled.cloud/core bundled with alchemy@2.0.0-beta.70 still calls. The peer range is unchanged, so this does not constrain consumers.
• Restored the typecheck against @distilled.cloud/cloudflare@0.30.3, which widened a secret's status to an open union and tightened Output variance.

v0.6.0

Added

• Added the Alchemy-free alchemy-sops/Schema entrypoint for decrypting imported
  SOPS JSON and decoding it with Effect Schema.
• Added EncryptedFor<S> so TypeScript checks encrypted document keys, nesting,
  optionality, and required SOPS metadata against the schema encoded type.
• Re-exported the Schema decoder from alchemy-sops/edge.

import * as Schema from "alchemy-sops/Schema";
import * as EffectSchema from "effect/Schema";
import encrypted from "./secrets.enc.json" with { type: "json" };

const AppSecrets = EffectSchema.Struct({
  token: EffectSchema.RedactedFromValue(EffectSchema.String),
});

const secrets = yield* Schema.decodeEffect(AppSecrets)(encrypted);

Changed

• Made alchemy an optional peer so Effect applications can use the Schema and
  edge entrypoints without installing or resolving Alchemy.
• Kept effect as a required peer and removed unused Effect platform packages
  from runtime dependencies.
• Updated retry scheduling for the current Effect 4 Schedule API.