alchemy 0.1.13 → 0.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "type": "module",
   "module": "./lib/index.js",
   "scripts": {
@@ -12,10 +12,12 @@
     ".": "./lib/index.js",
     "./agent": "./lib/agent/index.js",
     "./aws": "./lib/aws/index.js",
+    "./aws/oidc": "./lib/aws/oidc/index.js",
     "./cloudflare": "./lib/cloudflare/index.js",
     "./esbuild": "./lib/esbuild.js",
     "./markdown": "./lib/markdown/index.js",
     "./fs": "./lib/fs.js",
+    "./github": "./lib/github/index.js",
     "./stripe": "./lib/stripe/index.js",
     "./typescript": "./lib/typescript/index.js"
   },
@@ -28,12 +30,15 @@
     "@aws-sdk/client-sagemaker": "^3.0.0",
     "@aws-sdk/client-ses": "^3.0.0",
     "@aws-sdk/client-sesv2": "^3.0.0",
-    "@aws-sdk/client-sqs": "^3.0.1",
+    "@aws-sdk/client-sqs": "^3.0.0",
+    "@aws-sdk/client-sts": "^3.0.0",
+    "@octokit/rest": "^21.1.1",
     "ai": "^4.1.16",
     "diff": "^7.0.0",
     "esbuild": "^0.24.2",
     "glob": "^10.3.10",
     "hono": "^4.7.4",
+    "libsodium-wrappers": "^0.7.15",
     "jszip": "^3.0.0",
     "stripe": "^17.7.0",
     "turndown": "^7.2.0",
@@ -44,12 +49,15 @@
     "@ai-sdk/openai": "^1.1.9",
     "@biomejs/biome": "^1.9.4",
     "@cloudflare/workers-types": "^4.20250303.0",
+    "@octokit/rest": "^21.1.1",
     "@types/bun": "latest",
     "@types/diff": "^5.0.0",
+    "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "latest",
     "@types/turndown": "^5.0.5",
     "ai": "^4.1.16",
     "change-case": "^5.4.4",
+    "libsodium-wrappers": "^0.7.15",
     "openpgp": "^6.1.0",
     "turndown": "^7.2.0",
     "typescript": "latest",

package/src/aws/account-id.ts

@@ -0,0 +1,11 @@
+import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+
+const sts = new STSClient({});
+
+/**
+ * Helper to get the current AWS account ID
+ */
+export async function getAccountId(): Promise<string> {
+  const identity = await sts.send(new GetCallerIdentityCommand({}));
+  return identity.Account!;
+}

package/src/aws/index.ts

@@ -1,3 +1,4 @@
+export * from "./account-id";
 export * from "./bucket";
 export * from "./function";
 export * from "./policy";

package/src/aws/oidc/github-oidc-provider.ts

@@ -0,0 +1,34 @@
+import type { Input } from "../../input";
+import { isOutput } from "../../output";
+import { OIDCProvider, type OIDCProviderProps } from "./oidc-provider";
+
+/**
+ * Default thumbprint for GitHub's OIDC provider
+ * This is the certificate thumbprint that GitHub uses to sign OIDC tokens
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws
+ */
+const DEFAULT_GITHUB_THUMBPRINT = "6938fd4d98bab03faadb97b34396831e3780aea1";
+
+export interface GitHubOIDCProviderProps
+  extends Omit<OIDCProviderProps, "thumbprint"> {
+  owner: string;
+  repository: string;
+  thumbprint?: string;
+}
+
+export class GitHubOIDCProvider extends OIDCProvider {
+  constructor(id: string, props: Input<GitHubOIDCProviderProps>) {
+    super(
+      id,
+      isOutput<GitHubOIDCProviderProps>(props)
+        ? props.apply((props) => ({
+            ...props,
+            thumbprint: props.thumbprint ?? DEFAULT_GITHUB_THUMBPRINT,
+          }))
+        : ({
+            ...props,
+            thumbprint: props.thumbprint ?? DEFAULT_GITHUB_THUMBPRINT,
+          } as Input<OIDCProviderProps>),
+    );
+  }
+}

package/src/aws/oidc/index.ts

@@ -0,0 +1,2 @@
+export * from "./github-oidc-provider";
+export * from "./oidc-provider";

package/src/aws/oidc/oidc-provider.ts

@@ -0,0 +1,253 @@
+import {
+  CreateOpenIDConnectProviderCommand,
+  DeleteOpenIDConnectProviderCommand,
+  GetOpenIDConnectProviderCommand,
+  GetRoleCommand,
+  IAMClient,
+  type Tag,
+  UpdateAssumeRolePolicyCommand,
+} from "@aws-sdk/client-iam";
+import { type Context, Resource } from "../../resource";
+import { getAccountId } from "../account-id";
+
+/**
+ * Properties for configuring an AWS OIDC provider for GitHub Actions
+ */
+export interface OIDCProviderProps {
+  /**
+   * The GitHub organization or user that owns the repository
+   */
+  owner: string;
+
+  /**
+   * The name of the GitHub repository
+   */
+  repository: string;
+
+  /**
+   * Optional list of branches to restrict access to
+   * If not provided, all branches will be allowed
+   */
+  branches?: string[];
+
+  /**
+   * Optional list of environments to restrict access to
+   * If not provided, all environments will be allowed
+   */
+  environments?: string[];
+
+  /**
+   * The ARN of the IAM role to be assumed
+   */
+  roleArn: string;
+
+  /**
+   * Optional maximum session duration in seconds (default: 3600)
+   */
+  maxSessionDuration?: number;
+
+  /**
+   * Thumbprint for the OIDC provider
+   */
+  thumbprint: string;
+
+  /**
+   * Optional AWS region (defaults to AWS_REGION environment variable)
+   */
+  region?: string;
+}
+
+/**
+ * Output returned after OIDC provider configuration
+ */
+export interface OIDCProviderOutput extends OIDCProviderProps {
+  /**
+   * The ARN of the OIDC provider
+   */
+  providerArn: string;
+
+  /**
+   * Time at which the provider was created
+   */
+  createdAt: number;
+}
+
+/**
+ * Unique identifier for our trust policy statement
+ * Used to track and remove our specific statement without affecting others
+ */
+const TRUST_POLICY_SID = "GitHubOIDCTrust";
+
+/**
+ * Resource for configuring AWS OIDC provider for GitHub Actions
+ */
+export class OIDCProvider extends Resource(
+  "aws::OIDCProvider",
+  async (ctx: Context<OIDCProviderOutput>, props: OIDCProviderProps) => {
+    // Initialize AWS SDK client
+    const client = new IAMClient({
+      region: props.region,
+    });
+
+    if (ctx.event === "delete") {
+      if (ctx.output?.providerArn) {
+        try {
+          // First, remove our trust policy statement from the role
+          const getRole = await client.send(
+            new GetRoleCommand({
+              RoleName: props.roleArn.split("/").pop(),
+            }),
+          );
+
+          if (getRole.Role?.AssumeRolePolicyDocument) {
+            const policy = JSON.parse(
+              decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+            );
+
+            // Remove our specific statement while preserving others
+            policy.Statement = policy.Statement.filter(
+              (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+            );
+
+            await client.send(
+              new UpdateAssumeRolePolicyCommand({
+                RoleName: props.roleArn.split("/").pop(),
+                PolicyDocument: JSON.stringify(policy),
+              }),
+            );
+          }
+
+          // Then delete the OIDC provider if we're the last user
+          const provider = await client.send(
+            new GetOpenIDConnectProviderCommand({
+              OpenIDConnectProviderArn: ctx.output.providerArn,
+            }),
+          );
+
+          // Only delete the provider if it exists and has no other tags
+          if (provider && (!provider.Tags || provider.Tags.length === 0)) {
+            await client.send(
+              new DeleteOpenIDConnectProviderCommand({
+                OpenIDConnectProviderArn: ctx.output.providerArn,
+              }),
+            );
+          }
+        } catch (error) {
+          // Log but don't throw on cleanup errors
+          console.error("Error during cleanup:", error);
+        }
+      }
+      return;
+    }
+
+    try {
+      const url = "https://token.actions.githubusercontent.com";
+      const thumbprint = props.thumbprint;
+
+      // Create or get existing OIDC provider
+      let providerArn: string;
+      try {
+        const createProvider = await client.send(
+          new CreateOpenIDConnectProviderCommand({
+            Url: url,
+            ClientIDList: ["sts.amazonaws.com"],
+            ThumbprintList: [thumbprint],
+            Tags: [
+              {
+                Key: "ManagedBy",
+                Value: "alchemy",
+              },
+            ] as Tag[],
+          }),
+        );
+        providerArn = createProvider.OpenIDConnectProviderArn!;
+      } catch (error: any) {
+        if (error.name === "EntityAlreadyExistsException") {
+          // Provider exists, use its ARN
+          providerArn = `arn:aws:iam::${await getAccountId()}:oidc-provider/${url}`;
+        } else {
+          throw error;
+        }
+      }
+
+      // Get current role policy
+      const getRole = await client.send(
+        new GetRoleCommand({
+          RoleName: props.roleArn.split("/").pop(),
+        }),
+      );
+
+      let policy: any;
+      if (getRole.Role?.AssumeRolePolicyDocument) {
+        policy = JSON.parse(
+          decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+        );
+      } else {
+        policy = {
+          Version: "2012-10-17",
+          Statement: [],
+        };
+      }
+
+      // Construct the trust policy conditions
+      const conditions: Record<string, any> = {
+        StringEquals: {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          "token.actions.githubusercontent.com:sub": `repo:${props.owner}/${props.repository}:`,
+        },
+      };
+
+      if (props.branches?.length) {
+        conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
+          props.branches.map(
+            (branch) =>
+              `repo:${props.owner}/${props.repository}:ref:refs/heads/${branch}`,
+          );
+      }
+
+      if (props.environments?.length) {
+        conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
+          props.environments.map(
+            (env) =>
+              `repo:${props.owner}/${props.repository}:environment:${env}`,
+          );
+      }
+
+      // Create our policy statement
+      const ourStatement = {
+        Sid: TRUST_POLICY_SID,
+        Effect: "Allow",
+        Principal: {
+          Federated: providerArn,
+        },
+        Action: "sts:AssumeRoleWithWebIdentity",
+        Condition: conditions,
+      };
+
+      // Remove any existing statement with our SID and add the new one
+      policy.Statement = [
+        ...policy.Statement.filter(
+          (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+        ),
+        ourStatement,
+      ];
+
+      // Update the role's trust policy
+      await client.send(
+        new UpdateAssumeRolePolicyCommand({
+          RoleName: props.roleArn.split("/").pop(),
+          PolicyDocument: JSON.stringify(policy),
+        }),
+      );
+
+      return {
+        ...props,
+        providerArn,
+        createdAt: Date.now(),
+      };
+    } catch (error) {
+      console.error("Error configuring OIDC provider:", error);
+      throw error;
+    }
+  },
+) {}

package/src/aws/queue.ts

@@ -8,14 +8,30 @@ import {
 import { Resource } from "../resource";
 
 export interface QueueProps {
+  /**
+   * Name of the queue
+   * For FIFO queues, the name must end with the .fifo suffix
+   */
   queueName: string;
+
+  /**
+   * Whether this is a FIFO queue.
+   * If true, the queueName must end with .fifo suffix
+   */
   fifo?: boolean;
+
   visibilityTimeout?: number;
   messageRetentionPeriod?: number;
   maximumMessageSize?: number;
   delaySeconds?: number;
   receiveMessageWaitTimeSeconds?: number;
+
+  /**
+   * Enables content-based deduplication for FIFO queues.
+   * Only applicable when fifo is true.
+   */
   contentBasedDeduplication?: boolean;
+
   deduplicationScope?: "messageGroup" | "queue";
   fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
   tags?: Record<string, string>;
@@ -31,7 +47,13 @@ export class Queue extends Resource(
   "sqs::Queue",
   async (ctx, props: QueueProps) => {
     const client = new SQSClient({});
-    const queueName = props.fifo ? `${props.queueName}.fifo` : props.queueName;
+    // Don't automatically add .fifo suffix - user must include it in queueName
+    const queueName = props.queueName;
+
+    // Validate that FIFO queues have .fifo suffix
+    if (props.fifo && !queueName.endsWith(".fifo")) {
+      throw new Error("FIFO queue names must end with .fifo suffix");
+    }
 
     if (ctx.event === "delete") {
       try {

package/src/aws/role.ts

@@ -1,10 +1,13 @@
 import {
+  AttachRolePolicyCommand,
   CreateRoleCommand,
   DeleteRoleCommand,
   DeleteRolePolicyCommand,
+  DetachRolePolicyCommand,
   EntityAlreadyExistsException,
   GetRoleCommand,
   IAMClient,
+  ListAttachedRolePoliciesCommand,
   NoSuchEntityException,
   PutRolePolicyCommand,
   type Tag,
@@ -59,6 +62,32 @@ export class Role extends Resource(
         }
       }
 
+      // We need to detach managed policies before deleting the role
+      // First, get all attached policies
+      try {
+        const attachedPoliciesResponse = await client.send(
+          new ListAttachedRolePoliciesCommand({
+            RoleName: props.roleName,
+          }),
+        );
+
+        // Detach all managed policies
+        const attachedPolicies =
+          attachedPoliciesResponse.AttachedPolicies || [];
+        for (const policy of attachedPolicies) {
+          await client.send(
+            new DetachRolePolicyCommand({
+              RoleName: props.roleName,
+              PolicyArn: policy.PolicyArn!,
+            }),
+          );
+        }
+      } catch (error: any) {
+        if (error.name !== NoSuchEntityException.name) {
+          throw error;
+        }
+      }
+
       await ignore(NoSuchEntityException.name, () =>
         client.send(
           new DeleteRoleCommand({
@@ -229,6 +258,46 @@ export class Role extends Resource(
       }
     }
 
+    // Handle managed policy attachments
+    // Get currently attached policies
+    const attachedPoliciesResponse = await client.send(
+      new ListAttachedRolePoliciesCommand({
+        RoleName: props.roleName,
+      }),
+    );
+
+    const currentAttachedPolicies =
+      attachedPoliciesResponse.AttachedPolicies || [];
+    const currentPolicyArns = currentAttachedPolicies.map((p) => p.PolicyArn!);
+
+    // If we're updating, use an empty array as default when managedPolicyArns is undefined
+    // to ensure we detach all managed policies
+    const desiredPolicyArns = props.managedPolicyArns || [];
+
+    // Detach policies that are no longer needed
+    for (const policyArn of currentPolicyArns) {
+      if (!desiredPolicyArns.includes(policyArn)) {
+        await client.send(
+          new DetachRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyArn: policyArn,
+          }),
+        );
+      }
+    }
+
+    // Attach new policies that weren't attached before
+    for (const policyArn of desiredPolicyArns) {
+      if (!currentPolicyArns.includes(policyArn)) {
+        await client.send(
+          new AttachRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyArn: policyArn,
+          }),
+        );
+      }
+    }
+
     if (!role?.Role) {
       throw new Error(`Failed to create or update role ${props.roleName}`);
     }

package/src/aws/ses.ts

@@ -1,5 +1,4 @@
 import {
-  AlreadyExistsException,
   CreateConfigurationSetCommand,
   CreateEmailIdentityCommand,
   DeleteConfigurationSetCommand,
@@ -8,6 +7,11 @@ import {
   GetConfigurationSetCommand,
   GetEmailIdentityCommand,
   NotFoundException,
+  PutConfigurationSetDeliveryOptionsCommand,
+  PutConfigurationSetReputationOptionsCommand,
+  PutConfigurationSetSendingOptionsCommand,
+  PutConfigurationSetSuppressionOptionsCommand,
+  PutConfigurationSetTrackingOptionsCommand,
   PutEmailIdentityDkimAttributesCommand,
   type ReputationOptions,
   SESv2Client,
@@ -103,7 +107,7 @@ export interface SESOutput extends SESProps {
  */
 export class SES extends Resource(
   "aws::SES",
-  async (ctx: Context<SESOutput>, props: SESProps): Promise<SESOutput> => {
+  async (ctx: Context<SESOutput>, props: SESProps) => {
     // Create SES client
     const client = new SESv2Client({});
 
@@ -138,10 +142,7 @@ export class SES extends Resource(
       }
 
       // Return empty output for delete
-      return {
-        ...props,
-        id,
-      };
+      return;
     }
 
     // Created resources
@@ -154,66 +155,68 @@ export class SES extends Resource(
     if (props.configurationSetName) {
       try {
         // Check if configuration set exists
-        let getConfigResult;
+        let configSetExists = false;
         try {
-          getConfigResult = await client.send(
+          await client.send(
             new GetConfigurationSetCommand({
               ConfigurationSetName: props.configurationSetName,
             }),
           );
+          configSetExists = true;
         } catch (error) {
           if (error instanceof NotFoundException) {
-            getConfigResult = null;
+            configSetExists = false;
           } else {
             throw error;
           }
         }
 
-        if (getConfigResult) {
-          // For updating configuration set, we need to use individual commands
-          // since there's no unified UpdateConfigurationSetCommand
-
+        if (configSetExists) {
+          // Update existing configuration set using appropriate update commands
           if (props.sendingOptions) {
             await client.send(
-              new CreateConfigurationSetCommand({
+              new PutConfigurationSetSendingOptionsCommand({
                 ConfigurationSetName: props.configurationSetName,
-                SendingOptions: props.sendingOptions,
+                SendingEnabled: props.sendingOptions.SendingEnabled,
               }),
             );
           }
 
           if (props.reputationOptions) {
             await client.send(
-              new CreateConfigurationSetCommand({
+              new PutConfigurationSetReputationOptionsCommand({
                 ConfigurationSetName: props.configurationSetName,
-                ReputationOptions: props.reputationOptions,
+                ReputationMetricsEnabled:
+                  props.reputationOptions.ReputationMetricsEnabled,
               }),
             );
           }
 
           if (props.trackingOptions) {
             await client.send(
-              new CreateConfigurationSetCommand({
+              new PutConfigurationSetTrackingOptionsCommand({
                 ConfigurationSetName: props.configurationSetName,
-                TrackingOptions: props.trackingOptions,
+                CustomRedirectDomain:
+                  props.trackingOptions.CustomRedirectDomain,
               }),
             );
           }
 
           if (props.suppressionOptions) {
             await client.send(
-              new CreateConfigurationSetCommand({
+              new PutConfigurationSetSuppressionOptionsCommand({
                 ConfigurationSetName: props.configurationSetName,
-                SuppressionOptions: props.suppressionOptions,
+                SuppressedReasons: props.suppressionOptions.SuppressedReasons,
               }),
             );
           }
 
           if (props.deliveryOptions) {
             await client.send(
-              new CreateConfigurationSetCommand({
+              new PutConfigurationSetDeliveryOptionsCommand({
                 ConfigurationSetName: props.configurationSetName,
-                DeliveryOptions: props.deliveryOptions,
+                TlsPolicy: props.deliveryOptions.TlsPolicy,
+                SendingPoolName: props.deliveryOptions.SendingPoolName,
               }),
             );
           }
@@ -241,14 +244,7 @@ export class SES extends Resource(
           configurationSetArn = `arn:aws:ses:${process.env.AWS_REGION}:${process.env.AWS_ACCOUNT_ID}:configuration-set/${props.configurationSetName}`;
         }
       } catch (error: any) {
-        if (error instanceof AlreadyExistsException) {
-          // If it already exists but we couldn't get it (permissions issue), continue
-          console.warn(
-            `Configuration set ${props.configurationSetName} already exists but cannot be retrieved`,
-          );
-        } else {
-          throw error;
-        }
+        throw error;
       }
     }