@alchemy.run/kubernetes 0.0.0 → 2.0.0-beta.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alchemy.run/kubernetes",
-  "version": "0.0.0",
+  "version": "2.0.0-beta.85",
   "description": "Kubernetes deployments, jobs, Helm charts, manifests and local clusters for Alchemy.",
   "keywords": [
     "alchemy",
@@ -9,12 +9,64 @@
     "infrastructure-as-code",
     "kubernetes"
   ],
+  "homepage": "https://alchemy.run",
+  "bugs": {
+    "url": "https://github.com/alchemy-run/alchemy/issues"
+  },
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
-  "homepage": "https://alchemy.run",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alchemy-run/alchemy.git",
     "directory": "packages/kubernetes"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "default": "./lib/index.js"
+    },
+    "./internal/*": null,
+    "./*": {
+      "types": "./lib/*.d.ts",
+      "bun": "./src/*.ts",
+      "default": "./lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@alchemy.run/docker": "2.0.0-beta.85",
+    "yaml": "^2.9.1"
+  },
+  "devDependencies": {
+    "@effect/platform-bun": "^4.1.0",
+    "@types/bun": "1.4.3",
+    "@types/node": "26.6.5",
+    "alchemy": "2.0.0-beta.85",
+    "effect": "^4.1.0",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "@effect/platform-bun": "^4.1.0",
+    "alchemy": "2.0.0-beta.85",
+    "effect": "^4.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@effect/platform-bun": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "pnpm -r --filter \"{.}...\" run build:package",
+    "build:package": "node scripts/build.ts"
   }
-}
+}

package/src/BuiltinAdapters.ts

@@ -0,0 +1,202 @@
+/**
+ * The built-in {@link ClusterAdapter} implementations shipped by
+ * `Kubernetes.providers()`: `kubeconfig`, `token`, `client-cert`, and
+ * `exec`. They cover any cluster `kubectl` can reach; managed-cloud
+ * adapters (EKS's `aws-eks`) are contributed by their provider layers.
+ *
+ * These adapters are auth-only — no workload identity and no managed image
+ * registry. Workloads on such clusters bind through environment variables
+ * and run pre-built `image` references (or images pushed by the user's own
+ * pipeline).
+ */
+
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import {
+  ClusterAdapter,
+  type ClusterAdapterService,
+  type ClusterTransport,
+} from "./ClusterAdapter.ts";
+import type { Connection } from "./Connection.ts";
+import {
+  mintUserCredentials,
+  resolveKubeContext,
+  runExecCredential,
+  type MintedCredentials,
+} from "./internal/kubeconfig.ts";
+
+export class BuiltinAdaptersInvalidProps extends Data.TaggedError("BuiltinAdaptersInvalidProps")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+const toAuthHeaders = (credentials: MintedCredentials): Record<string, string> =>
+  credentials.token ? { Authorization: `Bearer ${credentials.token}` } : {};
+
+const requireEndpoint = (connection: Connection) =>
+  connection.endpoint !== undefined
+    ? Effect.succeed(connection.endpoint)
+    : Effect.fail(
+        new BuiltinAdaptersInvalidProps({
+          message:
+            `A '${connection.auth.kind}' Kubernetes connection requires an ` +
+            "explicit `endpoint` (only kubeconfig-backed and managed-cloud " +
+            "connections can discover it)",
+        }),
+      );
+
+/**
+ * `kubeconfig` — resolve the cluster and credentials from a kubeconfig
+ * file, honoring static tokens, client certificates, and `exec` credential
+ * plugins.
+ */
+export const KubeConfigAdapter: Layer.Layer<
+  ClusterAdapterService,
+  never,
+  FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner
+> = Layer.effect(
+  ClusterAdapter("kubeconfig"),
+  Effect.gen(function* () {
+    // Capture the platform services at layer build so per-request minting
+    // (exec plugins can re-run on token expiry) needs no ambient context.
+    const context = yield* Effect.context<
+      FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner
+    >();
+
+    return {
+      kind: "Kubernetes.ClusterAdapter" as const,
+      connect: Effect.fn(function* (connection: Connection) {
+        if (connection.auth.kind !== "kubeconfig") {
+          return yield* Effect.die(
+            new Error(`kubeconfig adapter received auth kind '${connection.auth.kind}'`),
+          );
+        }
+        const resolved = yield* resolveKubeContext({
+          path: connection.auth.path,
+          context: connection.auth.context,
+        }).pipe(Effect.provideContext(context));
+
+        // Mint once at connect: static tokens and client certificates are
+        // stable; exec plugins re-mint per request below (their tokens
+        // expire) but any plugin-issued client certificate is captured
+        // here.
+        const initial = yield* mintUserCredentials(resolved.user).pipe(
+          Effect.provideContext(context),
+        );
+
+        const isExec = resolved.user.exec?.command !== undefined;
+        const headers: ClusterTransport["headers"] = isExec
+          ? mintUserCredentials(resolved.user).pipe(
+              Effect.map(toAuthHeaders),
+              Effect.provideContext(context),
+            )
+          : Effect.succeed(toAuthHeaders(initial));
+
+        return {
+          endpoint: connection.endpoint ?? resolved.endpoint,
+          certificateAuthorityData:
+            connection.certificateAuthorityData ?? resolved.certificateAuthorityData,
+          insecureSkipTlsVerify: connection.insecureSkipTlsVerify ?? resolved.insecureSkipTlsVerify,
+          headers,
+          clientCert: initial.clientCert,
+        } satisfies ClusterTransport;
+      }),
+    };
+  }),
+);
+
+/** `token` — a static bearer token against an explicit endpoint. */
+export const TokenAdapter: Layer.Layer<ClusterAdapterService> = Layer.succeed(
+  ClusterAdapter("token"),
+  {
+    kind: "Kubernetes.ClusterAdapter" as const,
+    connect: Effect.fn(function* (connection: Connection) {
+      if (connection.auth.kind !== "token") {
+        return yield* Effect.die(
+          new Error(`token adapter received auth kind '${connection.auth.kind}'`),
+        );
+      }
+      const token = connection.auth.token;
+      return {
+        endpoint: yield* requireEndpoint(connection),
+        certificateAuthorityData: connection.certificateAuthorityData,
+        insecureSkipTlsVerify: connection.insecureSkipTlsVerify,
+        headers: Effect.succeed({ Authorization: `Bearer ${token}` }),
+      } satisfies ClusterTransport;
+    }),
+  },
+);
+
+/** `client-cert` — mutual TLS against an explicit endpoint. */
+export const ClientCertAdapter: Layer.Layer<ClusterAdapterService> = Layer.succeed(
+  ClusterAdapter("client-cert"),
+  {
+    kind: "Kubernetes.ClusterAdapter" as const,
+    connect: Effect.fn(function* (connection: Connection) {
+      if (connection.auth.kind !== "client-cert") {
+        return yield* Effect.die(
+          new Error(`client-cert adapter received auth kind '${connection.auth.kind}'`),
+        );
+      }
+      return {
+        endpoint: yield* requireEndpoint(connection),
+        certificateAuthorityData: connection.certificateAuthorityData,
+        insecureSkipTlsVerify: connection.insecureSkipTlsVerify,
+        headers: Effect.succeed({}),
+        clientCert: {
+          certificate: connection.auth.certificate,
+          key: connection.auth.key,
+        },
+      } satisfies ClusterTransport;
+    }),
+  },
+);
+
+/**
+ * `exec` — mint credentials with a kubeconfig-style exec credential plugin
+ * against an explicit endpoint.
+ */
+export const ExecAdapter: Layer.Layer<
+  ClusterAdapterService,
+  never,
+  ChildProcessSpawner.ChildProcessSpawner
+> = Layer.effect(
+  ClusterAdapter("exec"),
+  Effect.gen(function* () {
+    const context = yield* Effect.context<ChildProcessSpawner.ChildProcessSpawner>();
+
+    return {
+      kind: "Kubernetes.ClusterAdapter" as const,
+      connect: Effect.fn(function* (connection: Connection) {
+        if (connection.auth.kind !== "exec") {
+          return yield* Effect.die(
+            new Error(`exec adapter received auth kind '${connection.auth.kind}'`),
+          );
+        }
+        const exec = connection.auth;
+        const initial = yield* runExecCredential(exec).pipe(Effect.provideContext(context));
+        return {
+          endpoint: yield* requireEndpoint(connection),
+          certificateAuthorityData: connection.certificateAuthorityData,
+          insecureSkipTlsVerify: connection.insecureSkipTlsVerify,
+          headers: runExecCredential(exec).pipe(
+            Effect.map(toAuthHeaders),
+            Effect.provideContext(context),
+          ),
+          clientCert: initial.clientCert,
+        } satisfies ClusterTransport;
+      }),
+    };
+  }),
+);
+
+/** All built-in adapters, merged for `Kubernetes.providers()`. */
+export const builtinAdapters = (): Layer.Layer<
+  ClusterAdapterService,
+  never,
+  FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner
+> => Layer.mergeAll(KubeConfigAdapter, TokenAdapter, ClientCertAdapter, ExecAdapter);