@alchemy.run/kubernetes 2.0.0-beta.85 → 2.0.0-beta.86

package/src/internal/kubeconfig.ts

@@ -6,10 +6,13 @@
  * path: AKS/GKE/EKS CLI-managed contexts work through their exec plugins
  * (`kubelogin`, `gke-gcloud-auth-plugin`, `aws eks get-token`).
  */
+import * as Clock from "effect/Clock";
 import * as Config from "effect/Config";
 import * as Data from "effect/Data";
+import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
@@ -76,6 +79,8 @@ const decodeBase64 = (value: string) => Buffer.from(value, "base64").toString("u
 
 const expandHome = Effect.fn(function* (input: string) {
   if (!input.startsWith("~")) return input;
+  // `~` is the user's real home directory, not a configured value.
+  // oxlint-disable-next-line effecttsgo/process-env-in-effect -- home expansion reads the real process env
   const home = yield* Effect.sync(() => process.env.HOME ?? process.env.USERPROFILE);
   if (!home) {
     return yield* new KubeConfigError({
@@ -199,7 +204,7 @@ export const runExecCredential = Effect.fn(function* (options: {
 }) {
   const cacheKey = JSON.stringify([options.command, options.args ?? [], options.env ?? {}]);
   const cached = execCache.get(cacheKey);
-  const now = yield* Effect.sync(() => Date.now());
+  const now = yield* Clock.currentTimeMillis;
   if (cached && cached.expiresAt > now) {
     return cached.credentials;
   }
@@ -270,12 +275,16 @@ export const runExecCredential = Effect.fn(function* (options: {
         : undefined,
   };
 
-  const expiresAt = status.expirationTimestamp
-    ? // Re-mint 30s before the declared expiry.
-      new Date(status.expirationTimestamp).getTime() - 30_000
-    : // No declared expiry: cache briefly so bursts of requests share one
-      // plugin invocation without holding a stale credential for long.
-      now + 60_000;
+  const declaredExpiry = status.expirationTimestamp
+    ? DateTime.make(status.expirationTimestamp)
+    : Option.none();
+  const expiresAt = Option.match(declaredExpiry, {
+    // Re-mint 30s before the declared expiry.
+    onSome: (expiry) => DateTime.toEpochMillis(expiry) - 30_000,
+    // No (valid) declared expiry: cache briefly so bursts of requests share
+    // one plugin invocation without holding a stale credential for long.
+    onNone: () => now + 60_000,
+  });
   execCache.set(cacheKey, { credentials, expiresAt });
 
   return credentials;

package/src/internal/workload.ts

@@ -344,6 +344,7 @@ import * as Context from "effect/Context";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
@@ -361,6 +362,7 @@ const layer = makeEntrypointLayer(tag, entrypoint);
 const platform = Layer.mergeAll(
   BunServices.layer,
   FetchHttpClient.layer,
+  SecureRandom.layerWebCrypto,
   Logger.layer([Logger.consolePretty()]),
 );
 
@@ -434,6 +436,7 @@ import * as Context from "effect/Context";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
@@ -447,6 +450,7 @@ const layer = makeEntrypointLayer(tag, entrypoint);
 const platform = Layer.mergeAll(
   BunServices.layer,
   FetchHttpClient.layer,
+  SecureRandom.layerWebCrypto,
   Logger.layer([Logger.consolePretty()]),
 );