alchemy-effect 0.0.0 → 0.1.0

package/README.md

@@ -0,0 +1,179 @@
+> ⚠️ `alchemy-effect` is still experimental and not ready for production use (expect breaking changes). Come hang in our [Discord](https://discord.gg/jwKw8dBJdN) to participate in the early stages of development.
+
+# `alchemy-effect`
+
+`alchemy-effect` is an **Infrastructure-as-Effects (IaE)** framework that unifies business logic and infrastructure config into a single, type-safe program with the following benefits:
+1. Type-Checked IAM Policies
+2. Optimally Tree-Shaken Bundles
+3. Testable Business Logic
+4. Re-usable Components
+5. Reviewable Deployment Plans 
+
+## Install
+```bash
+bun add alchemy-effect
+```
+
+## Least-Privilege IAM Policies 🔐
+
+Type-checked Bindings ensure your IAM Policies are least-privilege - you are never missing or granting excessive permissions:
+
+<img src="./images/alchemy-effect.gif" alt="alchemy-effect type checked policies" width="600"/>
+
+You will receive a type error if you mess up your Bindings:
+<img src="./images/alchemy-effect-policy-error.png" alt="alchemy-effect type errors" width="600"/>
+
+> [!TIP]
+> This error means you are missing the `SendMessage<Messages>` binding (you provided `never` instead of `SendMessage<Messages>`).
+
+## Plan & Deploy
+An `alchemy-effect` program produces a Plan that can be reviewed prior to deployment:
+
+<img src="./images/alchemy-effect-plan.gif" alt="alchemy-effect plan video" width="600"/>
+
+## Type-Level Plan 
+All knowable information about the Plan is available at compile-time:
+
+<img src="./images/alchemy-effect-plan-type.png" alt="alchemy-effect plan type" width="600"/>
+
+> [!TIP]
+> These types can be used to implement type-level validation of infrastructure policies, e.g. disallowing publicly accessible S3 buckets.
+
+## Optimal Tree-Shaking
+
+Provide runtime clients as Layers and `export` a handler that can be optimally tree-shaken to only include necessary code.
+
+```ts
+export default Api.handler.pipe(
+  Effect.provide(SQS.clientFromEnv()),
+  Lambda.toHandler,
+);
+```
+
+## Pluggable Layers 
+Everything (including the CLI) is provided as Effect layers:
+
+<img src="./images/alchemy-effect-layers.png" alt="alchemy-effect layers" width="600"/>
+
+## Literally Typed Outputs
+The output of deploying a stack is totally known at compile-time, e.g. the `.fifo` suffix of a SQS FIFO Queue:
+
+<img src="./images/alchemy-effect-output.png" alt="alchemy-effect output" width="600"/>
+
+# Concepts 🔱 
+
+<img src="./images/alchemy-effect-triple.png" alt="alchemy-effect logo" width="600"/>
+
+Infrastructure-as-Effects has three main concepts: `Resources`, `Functions (as Effects)`, and `Bindings`:
+
+- `Resources` are the underlying infrastructure components, e.g. a SQS Queue or DynamoDB Table.
+- `Functions` contain the business logic as an Effect running in some runtime, e.g. a Lambda Function or a Cloudflare Worker.
+- `Bindings` connect `Functions` to `Resources`, e.g. `SQS.SendMessage(Messages)`
+
+## Resources
+
+Resources are declared along-side your business logic as classes, e.g. a FIFO SQS Queue:
+
+```ts
+class Messages extends SQS.Queue("Messages", {
+  fifo: true,
+  schema: S.String,
+}) {} 
+```
+
+## Functions
+
+Functions are a special kind of Resource that includes a runtime implementation function.
+
+The function always returns an `Effect<A, Err, Req>` which is then used to infer Capabilities and type-check your Bindings.
+
+```ts
+class Api extends Lambda.serve("Api", {
+  fetch: Effect.fn(function* (event) {
+    yield* SQS.sendMessage(Messages, event.body!).pipe(
+      Effect.catchAll(() => Effect.void),
+    );
+  }),
+})({
+  main: import.meta.filename,
+  bindings: $(SQS.SendMessage(Messages)),
+}) {}
+```
+
+## Bindings
+
+A Binding is a connection between a **Resource** and a **Function** that satisfies a **Capability** (aka. runtime dependency, e.g. `SQS.SendMessage(to: Messages)`).
+
+> [!TIP]
+> Bindings are inferred from your business logic and then type-checked to ensure least-privilege IAM policies.
+
+```ts
+class Api extends Lambda.serve("Api", {
+  // ...
+})({
+  main: import.meta.filename,
+  // Policy<Lambda.Function, SQS.SendMessage<Messages>>
+  bindings: $(SQS.SendMessage(Messages)),
+}) {}
+```
+
+> [!CAUTION]
+> Curring (`Lambda.serve(..)({ .. })`) is required because there's a limitation in TypeScript. We hope to simplify this in the future.
+
+# Components
+
+Infrastructure and business logic can be encapsulated as a Component using a simple function. 
+
+```ts
+const Monitor = <const ID extends string, ReqAlarm, ReqResolved>(
+  id: ID,
+  {
+    onAlarm,
+    onResolved,
+  }: {
+    onAlarm: (
+      batch: SQS.QueueEvent<Message>,
+    ) => Effect.Effect<void, never, ReqAlarm>;
+    onResolved?: (
+      batch: SQS.QueueEvent<Message>,
+    ) => Effect.Effect<void, never, ReqResolved>;
+  },
+) => {
+  class Messages extends SQS.Queue(`${id}-Messages`, {
+    fifo: true,
+    schema: Message,
+  }) {}
+
+  return <const Props extends Lambda.FunctionProps<ReqAlarm | ReqResolved>>({
+    bindings,
+    ...props
+  }: Props) =>
+    Lambda.consume(id, {
+      queue: Messages,
+      handle: Effect.fn(function* (batch) {
+        yield* SQS.sendMessage(Messages, {
+          id: 1,
+          value: "1",
+        }).pipe(Effect.catchAll(() => Effect.void));
+        if (onAlarm) {
+          yield* onAlarm(batch);
+        }
+        if (onResolved) {
+          yield* onResolved(batch);
+        }
+      }),
+    })({
+      ...props,
+      // Components are not leaky - the inner SQS.SendMessage(Messages) binding is not required to be passed in by the caler
+      bindings: bindings.and(SQS.SendMessage(Messages)),
+    });
+};
+```
+
+> [!TIP]
+> Components are very similar to React components, but for infrastructure. Instead of declaring state in your closure and returning a React element, you declare Resources and return a `Function`.
+
+# Building your own Resources, Capabilities, and Bindings
+
+> [!CAUTION]
+> WIP - docs coming soon!

package/bin/alchemy-effect.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+//#region bin/alchemy-effect.ts
+console.log("CLI main not implemented");
+/**
+* TODO: implement CLI main
+* 1. parse args
+* 2. import the user's program
+* 3. provide default layers
+* 4. implement apply and destroy functions
+* 5. support --dry-run etc.
+*/
+
+//#endregion
+export {  };
+//# sourceMappingURL=alchemy-effect.js.map

package/bin/alchemy-effect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alchemy-effect.js","names":[],"sources":["alchemy-effect.ts"],"sourcesContent":["console.log(\"CLI main not implemented\");\n\n/**\n * TODO: implement CLI main\n * 1. parse args\n * 2. import the user's program\n * 3. provide default layers\n * 4. implement apply and destroy functions\n * 5. support --dry-run etc.\n */\n"],"mappings":";;AAAA,QAAQ,IAAI,2BAA2B"}

package/bin/alchemy-effect.ts

@@ -0,0 +1,10 @@
+console.log("CLI main not implemented");
+
+/**
+ * TODO: implement CLI main
+ * 1. parse args
+ * 2. import the user's program
+ * 3. provide default layers
+ * 4. implement apply and destroy functions
+ * 5. support --dry-run etc.
+ */

package/lib/aws/account.d.ts

@@ -0,0 +1,17 @@
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import * as STS from "./sts.ts";
+declare const FailedToGetAccount_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AWS::Account::FailedToGetAccount";
+} & Readonly<A>;
+export declare class FailedToGetAccount extends FailedToGetAccount_base<{
+    message: string;
+    cause: Error;
+}> {
+}
+declare const AccountID_base: Context.TagClass<AccountID, "AWS::AccountID", string>;
+export declare class AccountID extends AccountID_base {
+}
+export declare const fromIdentity: () => Layer.Layer<AccountID, FailedToGetAccount, STS.STSClient>;
+export {};
+//# sourceMappingURL=account.d.ts.map

package/lib/aws/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/aws/account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;;;;AAEhC,qBAAa,kBAAmB,SAAQ,wBAEtC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;CACd,CAAC;CAAG;;AAEL,qBAAa,SAAU,SAAQ,cAG5B;CAAG;AAEN,eAAO,MAAM,YAAY,iEAgBtB,CAAC"}

package/lib/aws/account.js

@@ -0,0 +1,18 @@
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as STS from "./sts.js";
+export class FailedToGetAccount extends Data.TaggedError("AWS::Account::FailedToGetAccount") {
+}
+export class AccountID extends Context.Tag("AWS::AccountID")() {
+}
+export const fromIdentity = () => Layer.effect(AccountID, Effect.gen(function* () {
+    const sts = yield* STS.STSClient;
+    const identity = yield* sts.getCallerIdentity({}).pipe(Effect.catchAll((err) => new FailedToGetAccount({
+        message: "Failed to look up account ID",
+        cause: err,
+    })));
+    return identity.Account;
+}));
+//# sourceMappingURL=account.js.map

package/lib/aws/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/aws/account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CACtD,kCAAkC,CAIlC;CAAG;AAEL,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAGzD;CAAG;AAEN,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,QAAQ,CACb,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,kBAAkB,CAAC;QACrB,OAAO,EAAE,8BAA8B;QACvC,KAAK,EAAE,GAAG;KACX,CAAC,CACL,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,OAAQ,CAAC;AAC3B,CAAC,CAAC,CACH,CAAC"}

package/lib/aws/arn.d.ts

@@ -0,0 +1,6 @@
+import type * as Context from "effect/Context";
+export interface Arn<Self> {
+    arn: Self;
+}
+export type Tag<Self, A extends string> = Context.Tag<Arn<Self>, A>;
+//# sourceMappingURL=arn.d.ts.map

package/lib/aws/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../src/aws/arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE/C,MAAM,WAAW,GAAG,CAAC,IAAI;IACvB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC"}

package/lib/aws/arn.js

@@ -0,0 +1 @@
+//# sourceMappingURL=arn.js.map

package/lib/aws/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../src/aws/arn.ts"],"names":[],"mappings":""}

package/lib/aws/assets.d.ts

@@ -0,0 +1,8 @@
+import * as Context from "effect/Context";
+declare const Assets_base: Context.TagClass<Assets, "AWS::Assets", {
+    bucketName: string;
+}>;
+export declare class Assets extends Assets_base {
+}
+export {};
+//# sourceMappingURL=assets.d.ts.map

package/lib/aws/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/aws/assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;;gBAK1B,MAAM;;AAHtB,qBAAa,MAAO,SAAQ,WAKzB;CAAG"}

package/lib/aws/assets.js

@@ -0,0 +1,4 @@
+import * as Context from "effect/Context";
+export class Assets extends Context.Tag("AWS::Assets")() {
+}
+//# sourceMappingURL=assets.js.map

package/lib/aws/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/aws/assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,MAAM,OAAO,MAAO,SAAQ,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAKnD;CAAG"}

package/lib/aws/bundle.d.ts

@@ -0,0 +1,4 @@
+import * as Effect from "effect/Effect";
+import esbuild from "esbuild";
+export declare const bundle: (props: esbuild.BuildOptions) => Effect.Effect<esbuild.BuildResult<esbuild.BuildOptions>, never, never>;
+//# sourceMappingURL=bundle.d.ts.map

package/lib/aws/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/aws/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,CAAC,YAAY,2EACN,CAAC"}

package/lib/aws/bundle.js

@@ -0,0 +1,4 @@
+import * as Effect from "effect/Effect";
+import esbuild from "esbuild";
+export const bundle = (props) => Effect.promise(() => esbuild.build(props));
+//# sourceMappingURL=bundle.js.map

package/lib/aws/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/aws/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAA2B,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/lib/aws/client.d.ts

@@ -0,0 +1,8 @@
+import type * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import type { AWSClientConfig } from "itty-aws";
+import { Credentials } from "./credentials.ts";
+import { Region } from "./region.ts";
+export type TagInstance<T> = T extends new (_: never) => infer R ? R : never;
+export declare const createAWSServiceClientLayer: <Tag extends Context.Tag<any, any>, Client>(tag: Tag, clss: new (config: AWSClientConfig) => Client) => () => Layer.Layer<TagInstance<Tag>, never, Region | Credentials>;
+//# sourceMappingURL=client.d.ts.map

package/lib/aws/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/aws/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE7E,eAAO,MAAM,2BAA2B,GACrC,GAAG,SAAS,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,EACxC,KAAK,GAAG,EACR,MAAM,KAAK,MAAM,EAAE,eAAe,KAAK,MAAM,WAmBxC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC"}

package/lib/aws/client.js

@@ -0,0 +1,20 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { Credentials } from "./credentials.js";
+import { Region } from "./region.js";
+export const createAWSServiceClientLayer = (tag, clss) => () => Layer.effect(tag, Effect.gen(function* () {
+    const region = yield* Region;
+    const credentials = yield* Credentials;
+    return new clss({
+        region,
+        credentials: {
+            accessKeyId: Redacted.value(credentials.accessKeyId),
+            secretAccessKey: Redacted.value(credentials.secretAccessKey),
+            sessionToken: credentials.sessionToken
+                ? Redacted.value(credentials.sessionToken)
+                : undefined,
+        },
+    });
+}));
+//# sourceMappingURL=client.js.map

package/lib/aws/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/aws/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,MAAM,CAAC,MAAM,2BAA2B,GACtC,CACE,GAAQ,EACR,IAA6C,EAC7C,EAAE,CACJ,GAAG,EAAE,CACH,KAAK,CAAC,MAAM,CACV,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,OAAO,IAAI,IAAI,CAAC;QACd,MAAM;QACN,WAAW,EAAE;YACX,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC;YACpD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC;YAC5D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACpC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC1C,CAAC,CAAC,SAAS;SACd;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAC2D,CAAC"}

package/lib/aws/credentials.d.ts

@@ -0,0 +1,146 @@
+import { fromInstanceMetadata as _fromInstanceMetadata, fromWebToken as _fromWebToken } from "@aws-sdk/credential-providers";
+import { FileSystem, HttpClient } from "@effect/platform";
+import { type AwsCredentialIdentity } from "@smithy/types";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+declare const Credentials_base: Context.TagClass<Credentials, "AWS::Credentials", {
+    accessKeyId: Redacted.Redacted<string>;
+    secretAccessKey: Redacted.Redacted<string>;
+    sessionToken: Redacted.Redacted<string> | undefined;
+    expiration?: number;
+}>;
+export declare class Credentials extends Credentials_base {
+}
+export declare const fromAwsCredentialIdentity: (identity: AwsCredentialIdentity) => {
+    accessKeyId: Redacted.Redacted<string>;
+    secretAccessKey: Redacted.Redacted<string>;
+    sessionToken: Redacted.Redacted<string> | undefined;
+    expiration?: number;
+};
+export declare const fromCredentials: (credentials: AwsCredentialIdentity) => Layer.Layer<Credentials, never, never>;
+export declare const fromEnv: () => Layer.Layer<Credentials, never, never>;
+export declare const fromChain: () => Layer.Layer<Credentials, never, never>;
+export declare const fromIni: () => Layer.Layer<Credentials, never, never>;
+export declare const fromContainerMetadata: () => Layer.Layer<Credentials, never, never>;
+export declare const fromHttp: () => Layer.Layer<Credentials, never, never>;
+export declare const fromInstanceMetadata: (...parameters: Parameters<typeof _fromInstanceMetadata>) => Layer.Layer<Credentials, never, never>;
+export declare const fromProcess: () => Layer.Layer<Credentials, never, never>;
+export declare const fromTokenFile: () => Layer.Layer<Credentials, never, never>;
+export declare const fromWebToken: (...parameters: Parameters<typeof _fromWebToken>) => Layer.Layer<Credentials, never, never>;
+export declare const ssoRegion: (region: string) => Layer.Layer<SsoRegion, never, never>;
+declare const SsoRegion_base: Context.TagClass<SsoRegion, "AWS::SsoRegion", string>;
+export declare class SsoRegion extends SsoRegion_base {
+}
+declare const SsoStartUrl_base: Context.TagClass<SsoStartUrl, "AWS::SsoStartUrl", string>;
+export declare class SsoStartUrl extends SsoStartUrl_base {
+}
+declare const ProfileNotFound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Alchemy::AWS::ProfileNotFound";
+} & Readonly<A>;
+export declare class ProfileNotFound extends ProfileNotFound_base<{
+    message: string;
+    profile: string;
+}> {
+}
+declare const ConflictingSSORegion_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Alchemy::AWS::ConflictingSSORegion";
+} & Readonly<A>;
+export declare class ConflictingSSORegion extends ConflictingSSORegion_base<{
+    message: string;
+    ssoRegion: string;
+    profile: string;
+}> {
+}
+declare const ConflictingSSOStartUrl_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Alchemy::AWS::ConflictingSSOStartUrl";
+} & Readonly<A>;
+export declare class ConflictingSSOStartUrl extends ConflictingSSOStartUrl_base<{
+    message: string;
+    ssoStartUrl: string;
+    profile: string;
+}> {
+}
+declare const InvalidSSOProfile_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Alchemy::AWS::InvalidSSOProfile";
+} & Readonly<A>;
+export declare class InvalidSSOProfile extends InvalidSSOProfile_base<{
+    message: string;
+    profile: string;
+    missingFields: string[];
+}> {
+}
+declare const InvalidSSOToken_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Alchemy::AWS::InvalidSSOToken";
+} & Readonly<A>;
+export declare class InvalidSSOToken extends InvalidSSOToken_base<{
+    message: string;
+    sso_session: string;
+}> {
+}
+declare const ExpiredSSOToken_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Alchemy::AWS::ExpiredSSOToken";
+} & Readonly<A>;
+export declare class ExpiredSSOToken extends ExpiredSSOToken_base<{
+    message: string;
+    profile: string;
+}> {
+}
+export interface AwsProfileConfig {
+    sso_session?: string;
+    sso_account_id?: string;
+    sso_role_name?: string;
+    region?: string;
+    output?: string;
+    sso_start_url?: string;
+    sso_region?: string;
+}
+export interface SsoProfileConfig extends AwsProfileConfig {
+    sso_start_url: string;
+    sso_region: string;
+    sso_account_id: string;
+    sso_role_name: string;
+}
+export declare const fromSSO: () => Layer.Layer<Credentials, import("@effect/platform/Error").PlatformError | ProfileNotFound | ConflictingSSORegion | ConflictingSSOStartUrl | InvalidSSOProfile | InvalidSSOToken | ExpiredSSOToken | import("@effect/platform/HttpClientError").HttpClientError, FileSystem.FileSystem | HttpClient.HttpClient>;
+/**
+ * Cached SSO token retrieved from SSO login flow.
+ * @public
+ */
+export interface SSOToken {
+    /**
+     * A base64 encoded string returned by the sso-oidc service.
+     */
+    accessToken: string;
+    /**
+     * The expiration time of the accessToken as an RFC 3339 formatted timestamp.
+     */
+    expiresAt: string;
+    /**
+     * The token used to obtain an access token in the event that the accessToken is invalid or expired.
+     */
+    refreshToken?: string;
+    /**
+     * The unique identifier string for each client. The client ID generated when performing the registration
+     * portion of the OIDC authorization flow. This is used to refresh the accessToken.
+     */
+    clientId?: string;
+    /**
+     * A secret string generated when performing the registration portion of the OIDC authorization flow.
+     * This is used to refresh the accessToken.
+     */
+    clientSecret?: string;
+    /**
+     * The expiration time of the client registration (clientId and clientSecret) as an RFC 3339 formatted timestamp.
+     */
+    registrationExpiresAt?: string;
+    /**
+     * The configured sso_region for the profile that credentials are being resolved for.
+     */
+    region?: string;
+    /**
+     * The configured sso_start_url for the profile that credentials are being resolved for.
+     */
+    startUrl?: string;
+}
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/lib/aws/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/aws/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,oBAAoB,IAAI,qBAAqB,EAI7C,YAAY,IAAI,aAAa,EAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;;iBAS3B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;qBACrB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;kBAC5B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS;iBACtC,MAAM;;AANvB,qBAAa,WAAY,SAAQ,gBAQ9B;CAAG;AAEN,eAAO,MAAM,yBAAyB,GAAI,UAAU,qBAAqB;iBAPxD,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;qBACrB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;kBAC5B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS;iBACtC,MAAM;CAYnB,CAAC;AAYL,eAAO,MAAM,eAAe,GAAI,aAAa,qBAAqB,2CACE,CAAC;AAErE,eAAO,MAAM,OAAO,8CAA8B,CAAC;AAEnD,eAAO,MAAM,SAAS,8CAAoD,CAAC;AAI3E,eAAO,MAAM,OAAO,8CAA8B,CAAC;AAEnD,eAAO,MAAM,qBAAqB,8CAA4C,CAAC;AAE/E,eAAO,MAAM,QAAQ,8CAA+B,CAAC;AAErD,eAAO,MAAM,oBAAoB,GAC/B,GAAG,YAAY,UAAU,CAAC,OAAO,qBAAqB,CAAC,2CACG,CAAC;AAE7D,eAAO,MAAM,WAAW,8CAAkC,CAAC;AAE3D,eAAO,MAAM,aAAa,8CAAoC,CAAC;AAE/D,eAAO,MAAM,YAAY,GAAI,GAAG,YAAY,UAAU,CAAC,OAAO,aAAa,CAAC,2CAC3B,CAAC;AAElD,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,yCAAqC,CAAC;;AAU9E,qBAAa,SAAU,SAAQ,cAG5B;CAAG;;AACN,qBAAa,WAAY,SAAQ,gBAG9B;CAAG;;;;AAEN,qBAAa,eAAgB,SAAQ,qBAEnC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAExC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;;;;AAEL,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;;;;AAEL,qBAAa,iBAAkB,SAAQ,uBAErC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,eAAgB,SAAQ,qBAEnC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;CAAG;;;;AAEL,qBAAa,eAAgB,SAAQ,qBAEnC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;AAEL,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,OAAO,sTAkMjB,CAAC;AAEJ;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}