alchemy 0.9.1 → 0.10.0

package/lib/aws/function.d.ts

@@ -177,6 +177,10 @@ export interface Function extends Resource<"lambda::Function">, FunctionProps {
      * ARN of the signing job
      */
     signingJobArn?: string;
+    /**
+     * Function URL if configured
+     */
+    functionUrl?: string;
 }
 /**
  * AWS Lambda Function Resource

package/lib/aws/function.js

@@ -1,4 +1,4 @@
-import { Architecture, CreateFunctionCommand, DeleteFunctionCommand, GetFunctionCommand, GetFunctionConfigurationCommand, LambdaClient, ResourceNotFoundException, Runtime, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, Architecture, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteFunctionCommand, DeleteFunctionUrlConfigCommand, GetFunctionCommand, GetFunctionConfigurationCommand, GetFunctionUrlConfigCommand, LambdaClient, ResourceNotFoundException, Runtime, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, } from "@aws-sdk/client-lambda";
 import fs from "node:fs";
 import path from "node:path";
 import { Resource } from "../resource";
@@ -62,12 +62,26 @@ export const Function = Resource("lambda::Function", async function (id, props)
     const region = await resolveRegion(client);
     const code = await zipCode(props.zipPath);
     if (this.phase === "delete") {
+        // Delete function URL if it exists
+        if (this.output?.url) {
+            try {
+                await client.send(new DeleteFunctionUrlConfigCommand({
+                    FunctionName: props.functionName,
+                }));
+            }
+            catch (error) {
+                if (error.name !== "ResourceNotFoundException") {
+                    console.warn("Failed to delete function URL:", error);
+                }
+            }
+        }
         await ignore(ResourceNotFoundException.name, () => client.send(new DeleteFunctionCommand({
             FunctionName: props.functionName,
         })));
         return this.destroy();
     }
     else {
+        let functionUrl;
         try {
             // Check if function exists
             await client.send(new GetFunctionCommand({
@@ -98,6 +112,139 @@ export const Function = Resource("lambda::Function", async function (id, props)
                 }));
                 // Wait for configuration update to stabilize
                 await waitForFunctionStabilization(client, props.functionName);
+                // Handle URL configuration
+                if (props.url) {
+                    try {
+                        // Check if URL config exists already
+                        const urlConfig = await client.send(new GetFunctionUrlConfigCommand({
+                            FunctionName: props.functionName,
+                        }));
+                        // Update URL configuration if it exists
+                        if (urlConfig) {
+                            const updateResult = await client.send(new UpdateFunctionUrlConfigCommand({
+                                FunctionName: props.functionName,
+                                AuthType: props.url.authType || "NONE",
+                                Cors: props.url.cors
+                                    ? {
+                                        AllowCredentials: props.url.cors.allowCredentials,
+                                        AllowHeaders: props.url.cors.allowHeaders,
+                                        AllowMethods: props.url.cors.allowMethods,
+                                        AllowOrigins: props.url.cors.allowOrigins,
+                                        ExposeHeaders: props.url.cors.exposeHeaders,
+                                        MaxAge: props.url.cors.maxAge,
+                                    }
+                                    : undefined,
+                            }));
+                            functionUrl = updateResult.FunctionUrl;
+                            // Add public access permission for function URL
+                            if (props.url.authType === "NONE") {
+                                try {
+                                    await client.send(new AddPermissionCommand({
+                                        FunctionName: props.functionName,
+                                        StatementId: "FunctionURLAllowPublicAccess",
+                                        Action: "lambda:InvokeFunctionUrl",
+                                        Principal: "*",
+                                        FunctionUrlAuthType: "NONE",
+                                    }));
+                                }
+                                catch (permError) {
+                                    if (!permError.message?.includes("already exists")) {
+                                        console.warn("Error adding URL permission:", permError);
+                                    }
+                                }
+                            }
+                        }
+                        else {
+                            // Create URL configuration if it doesn't exist
+                            const createResult = await client.send(new CreateFunctionUrlConfigCommand({
+                                FunctionName: props.functionName,
+                                AuthType: props.url.authType || "NONE",
+                                Cors: props.url.cors
+                                    ? {
+                                        AllowCredentials: props.url.cors.allowCredentials,
+                                        AllowHeaders: props.url.cors.allowHeaders,
+                                        AllowMethods: props.url.cors.allowMethods,
+                                        AllowOrigins: props.url.cors.allowOrigins,
+                                        ExposeHeaders: props.url.cors.exposeHeaders,
+                                        MaxAge: props.url.cors.maxAge,
+                                    }
+                                    : undefined,
+                            }));
+                            functionUrl = createResult.FunctionUrl;
+                            // Add public access permission for function URL
+                            if (props.url.authType === "NONE") {
+                                try {
+                                    await client.send(new AddPermissionCommand({
+                                        FunctionName: props.functionName,
+                                        StatementId: "FunctionURLAllowPublicAccess",
+                                        Action: "lambda:InvokeFunctionUrl",
+                                        Principal: "*",
+                                        FunctionUrlAuthType: "NONE",
+                                    }));
+                                }
+                                catch (permError) {
+                                    if (!permError.message?.includes("already exists")) {
+                                        console.warn("Error adding URL permission:", permError);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    catch (error) {
+                        if (error.name === "ResourceNotFoundException") {
+                            // Create URL configuration if it doesn't exist
+                            const createResult = await client.send(new CreateFunctionUrlConfigCommand({
+                                FunctionName: props.functionName,
+                                AuthType: props.url.authType || "NONE",
+                                Cors: props.url.cors
+                                    ? {
+                                        AllowCredentials: props.url.cors.allowCredentials,
+                                        AllowHeaders: props.url.cors.allowHeaders,
+                                        AllowMethods: props.url.cors.allowMethods,
+                                        AllowOrigins: props.url.cors.allowOrigins,
+                                        ExposeHeaders: props.url.cors.exposeHeaders,
+                                        MaxAge: props.url.cors.maxAge,
+                                    }
+                                    : undefined,
+                            }));
+                            functionUrl = createResult.FunctionUrl;
+                            // Add public access permission for function URL
+                            if (props.url.authType === "NONE") {
+                                try {
+                                    await client.send(new AddPermissionCommand({
+                                        FunctionName: props.functionName,
+                                        StatementId: "FunctionURLAllowPublicAccess",
+                                        Action: "lambda:InvokeFunctionUrl",
+                                        Principal: "*",
+                                        FunctionUrlAuthType: "NONE",
+                                    }));
+                                }
+                                catch (permError) {
+                                    if (!permError.message?.includes("already exists")) {
+                                        console.warn("Error adding URL permission:", permError);
+                                    }
+                                }
+                            }
+                        }
+                        else {
+                            throw error;
+                        }
+                    }
+                }
+                else if (this.output?.url) {
+                    // Remove URL config if it was previously set but not in current props
+                    try {
+                        await client.send(new DeleteFunctionUrlConfigCommand({
+                            FunctionName: props.functionName,
+                        }));
+                        functionUrl = undefined;
+                    }
+                    catch (error) {
+                        if (error.name !== "ResourceNotFoundException") {
+                            console.warn("Failed to delete function URL:", error);
+                        }
+                    }
+                }
             }
         }
         catch (error) {
@@ -149,6 +296,46 @@ export const Function = Resource("lambda::Function", async function (id, props)
                         await new Promise((resolve) => setTimeout(resolve, 1000));
                     }
                 }
+                // Create URL configuration if needed
+                if (props.url) {
+                    try {
+                        const createResult = await client.send(new CreateFunctionUrlConfigCommand({
+                            FunctionName: props.functionName,
+                            AuthType: props.url.authType || "NONE",
+                            Cors: props.url.cors
+                                ? {
+                                    AllowCredentials: props.url.cors.allowCredentials,
+                                    AllowHeaders: props.url.cors.allowHeaders,
+                                    AllowMethods: props.url.cors.allowMethods,
+                                    AllowOrigins: props.url.cors.allowOrigins,
+                                    ExposeHeaders: props.url.cors.exposeHeaders,
+                                    MaxAge: props.url.cors.maxAge,
+                                }
+                                : undefined,
+                        }));
+                        functionUrl = createResult.FunctionUrl;
+                        // Add public access permission for function URL
+                        if (props.url.authType === "NONE") {
+                            try {
+                                await client.send(new AddPermissionCommand({
+                                    FunctionName: props.functionName,
+                                    StatementId: "FunctionURLAllowPublicAccess",
+                                    Action: "lambda:InvokeFunctionUrl",
+                                    Principal: "*",
+                                    FunctionUrlAuthType: "NONE",
+                                }));
+                            }
+                            catch (permError) {
+                                if (!permError.message?.includes("already exists")) {
+                                    console.warn("Error adding URL permission:", permError);
+                                }
+                            }
+                        }
+                    }
+                    catch (error) {
+                        console.warn("Failed to create function URL:", error);
+                    }
+                }
             }
             else {
                 throw error;
@@ -163,6 +350,20 @@ export const Function = Resource("lambda::Function", async function (id, props)
                 FunctionName: props.functionName,
             })),
         ]);
+        // Try to get function URL if it wasn't already retrieved and URL is configured
+        if (!functionUrl && (props.url || this.output?.url)) {
+            try {
+                const urlConfig = await client.send(new GetFunctionUrlConfigCommand({
+                    FunctionName: props.functionName,
+                }));
+                functionUrl = urlConfig.FunctionUrl;
+            }
+            catch (error) {
+                if (error.name !== "ResourceNotFoundException") {
+                    console.warn("Failed to get function URL:", error);
+                }
+            }
+        }
         return this({
             ...props,
             arn: config.FunctionArn,
@@ -185,6 +386,7 @@ export const Function = Resource("lambda::Function", async function (id, props)
             packageType: config.PackageType,
             signingProfileVersionArn: config.SigningProfileVersionArn,
             signingJobArn: config.SigningJobArn,
+            functionUrl: functionUrl,
         });
     }
 });

package/lib/cloudflare/api-error.js

@@ -38,7 +38,14 @@ export class CloudflareApiError extends Error {
  * @returns Never returns - always throws an error
  */
 export async function handleApiError(response, action, resourceType, resourceName) {
-    const json = await response.json();
+    const text = await response.text();
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch (error) {
+        json = { errors: [{ message: text }] };
+    }
     const errors = json?.errors || [
         { message: response.statusText },
     ];

package/lib/github/index.d.ts

@@ -1 +1,2 @@
+export * from "./repository-environment";
 export * from "./secret";

package/lib/github/index.js

@@ -1 +1,2 @@
+export * from "./repository-environment";
 export * from "./secret";

package/lib/github/repository-environment.d.ts

@@ -0,0 +1,153 @@
+import type { Context } from "../context";
+import { Resource } from "../resource";
+/**
+ * Properties for creating or updating a GitHub Repository Environment
+ */
+export interface RepositoryEnvironmentProps {
+    /**
+     * Repository owner (user or organization)
+     */
+    owner: string;
+    /**
+     * Repository name
+     */
+    repository: string;
+    /**
+     * Environment name
+     */
+    name: string;
+    /**
+     * Wait timer before allowing deployments to proceed (in minutes)
+     * Must be between 0 and 43200 (30 days)
+     * @default 0
+     */
+    waitTimer?: number;
+    /**
+     * Determine whether to prevent self-reviews on pull requests
+     * Note: Requires at least one reviewer when enabled
+     * @default false
+     */
+    preventSelfReview?: boolean;
+    /**
+     * Determine whether administrators can bypass deployment protection rules
+     * @default true
+     */
+    adminBypass?: boolean;
+    /**
+     * Required reviewers for deployments to this environment
+     */
+    reviewers?: {
+        /**
+         * GitHub usernames or user IDs that can approve deployments
+         * Can be numeric IDs or string usernames (which will be resolved to IDs)
+         */
+        users?: Array<number | string>;
+        /**
+         * GitHub team names or team IDs that can approve deployments
+         * Can be numeric IDs or string team names (which will be resolved to IDs)
+         * Note: For team names, should be in the format "org/team-name"
+         */
+        teams?: Array<number | string>;
+    };
+    /**
+     * Deployment branch policy for the environment
+     */
+    deploymentBranchPolicy?: {
+        /**
+         * Whether to restrict deployments to protected branches
+         * @default false
+         */
+        protectedBranches?: boolean;
+        /**
+         * Whether to allow custom branch policies
+         * When true, specific branch patterns can be specified using createDeploymentBranchPolicy
+         * @default false
+         */
+        customBranchPolicies?: boolean;
+    };
+    /**
+     * Branch patterns for deployment when customBranchPolicies is true
+     * For example: ["main", "releases/*"]
+     * @default []
+     */
+    branchPatterns?: string[];
+    /**
+     * Optional GitHub API token (overrides environment variable)
+     * If not provided, will use GITHUB_TOKEN environment variable
+     * @default process.env.GITHUB_TOKEN
+     */
+    token?: string;
+}
+/**
+ * Output returned after Repository Environment creation/update
+ */
+export interface RepositoryEnvironment extends Resource<"github::RepositoryEnvironment">, RepositoryEnvironmentProps {
+    /**
+     * The ID of the resource
+     */
+    id: string;
+    /**
+     * The numeric ID of the environment in GitHub
+     */
+    environmentId: number;
+    /**
+     * Time at which the object was created/updated
+     */
+    updatedAt: string;
+}
+/**
+ * Resource for managing GitHub repository environments
+ *
+ * Note: If preventSelfReview is true, at least one reviewer must be specified.
+ *
+ * Branch policies are efficiently managed with proper diffing:
+ * - Only manages branch patterns configured through this resource
+ * - Preserves any manually added branch patterns outside this resource
+ * - When updating, only modifies patterns that have changed from previous state
+ * - Compares against previous resource state, not current environment state
+ * - Safely handles policy type changes
+ *
+ * @example
+ * // Create a basic environment with no protection rules
+ * const devEnv = await RepositoryEnvironment("dev-environment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "development"
+ * });
+ *
+ * @example
+ * // Create a production environment with approval requirements
+ * const prodEnv = await RepositoryEnvironment("prod-environment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "production",
+ *   waitTimer: 10, // 10 minute delay
+ *   preventSelfReview: true,
+ *   reviewers: {
+ *     teams: ["platform-team"], // team name
+ *     users: ["security-admin"] // username
+ *   },
+ *   deploymentBranchPolicy: {
+ *     protectedBranches: true,
+ *     customBranchPolicies: false
+ *   }
+ * });
+ *
+ * @example
+ * // Create an environment with reviewer IDs
+ * const stagingEnv = await RepositoryEnvironment("staging-environment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "staging",
+ *   reviewers: {
+ *     teams: [1234567], // team ID
+ *     users: [7654321]  // user ID
+ *   },
+ *   deploymentBranchPolicy: {
+ *     protectedBranches: false,
+ *     customBranchPolicies: true
+ *   },
+ *   branchPatterns: ["main", "release/*"]
+ * });
+ */
+export declare const RepositoryEnvironment: (((this: any, id: string, props?: {}) => never) & (new (_: never) => never)) | ((this: Context<RepositoryEnvironment>, id: string, props: RepositoryEnvironmentProps) => Promise<RepositoryEnvironment>);