alchemy 2.0.0-beta.15 → 2.0.0-beta.16

package/lib/GitHub/Secret.d.ts

@@ -1,6 +1,8 @@
 import * as Redacted from "effect/Redacted";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
+import { GitHubCredentials } from "./Credentials.ts";
+import type { Providers } from "./Providers.ts";
 export interface SecretProps {
     /**
      * Repository owner (user or organization).
@@ -24,18 +26,13 @@ export interface SecretProps {
      * GitHub Actions environment instead of the whole repository.
      */
     environment?: string;
-    /**
-     * GitHub API token. If not provided, falls back to
-     * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
-     */
-    token?: string;
 }
 export interface Secret extends Resource<"GitHub.Secret", SecretProps, {
     /**
      * ISO-8601 timestamp of the last update.
      */
     updatedAt: string;
-}> {
+}, never, Providers> {
 }
 /**
  * A GitHub Actions repository or environment secret.
@@ -45,9 +42,10 @@ export interface Secret extends Resource<"GitHub.Secret", SecretProps, {
  * key via `libsodium` before being stored. The resource is idempotent —
  * calling it with the same name will update the secret value in place.
  *
- * Authentication is resolved in order: explicit `token` prop,
- * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
- * `repo` scope for private repositories or `public_repo` for public ones.
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
  *
  * @section Repository Secrets
  * Store secrets accessible to all GitHub Actions workflows in the
@@ -116,5 +114,5 @@ export interface Secret extends Resource<"GitHub.Secret", SecretProps, {
  * ```
  */
 export declare const Secret: import("../Resource.ts").ResourceClass<Secret>;
-export declare const SecretProvider: () => import("effect/Layer").Layer<Provider.Provider<Secret>, never, never>;
+export declare const SecretProvider: () => import("effect/Layer").Layer<Provider.Provider<Secret>, never, GitHubCredentials>;
 //# sourceMappingURL=Secret.d.ts.map

package/lib/GitHub/Secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../src/GitHub/Secret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAEzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,MAAO,SAAQ,QAAQ,CACtC,eAAe,EACf,WAAW,EACX;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CACF;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,eAAO,MAAM,MAAM,gDAAoC,CAAC;AAwBxD,eAAO,MAAM,cAAc,6EAyBvB,CAAC"}
+{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../src/GitHub/Secret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAEzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,MAAO,SAAQ,QAAQ,CACtC,eAAe,EACf,WAAW,EACX;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,eAAO,MAAM,MAAM,gDAAoC,CAAC;AAuBxD,eAAO,MAAM,cAAc,yFAyBvB,CAAC"}

package/lib/GitHub/Secret.js

@@ -1,8 +1,8 @@
-import { Octokit } from "@octokit/rest";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as Provider from "../Provider.js";
 import { Resource } from "../Resource.js";
+import { GitHubCredentials } from "./Credentials.js";
 /**
  * A GitHub Actions repository or environment secret.
  *
@@ -11,9 +11,10 @@ import { Resource } from "../Resource.js";
  * key via `libsodium` before being stored. The resource is idempotent —
  * calling it with the same name will update the secret value in place.
  *
- * Authentication is resolved in order: explicit `token` prop,
- * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
- * `repo` scope for private repositories or `public_repo` for public ones.
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
  *
  * @section Repository Secrets
  * Store secrets accessible to all GitHub Actions workflows in the
@@ -82,14 +83,15 @@ import { Resource } from "../Resource.js";
  * ```
  */
 export const Secret = Resource("GitHub.Secret");
-function resolveToken(props) {
-    return (props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN);
-}
-function createClient(props) {
-    return new Octokit({ auth: resolveToken(props) });
-}
+const getOctokit = Effect.gen(function* () {
+    const creds = yield* GitHubCredentials;
+    return creds.octokit();
+});
 async function encryptValue(plaintext, publicKey) {
-    const sodium = await import("libsodium-wrappers");
+    const mod = await import("libsodium-wrappers");
+    // Bun/ESM interop: the actual sodium API lives on `.default` when the
+    // CJS module is wrapped, but is the module itself under other loaders.
+    const sodium = mod.default ?? mod;
     await sodium.ready;
     const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
     const binMessage = sodium.from_string(plaintext);
@@ -98,12 +100,12 @@ async function encryptValue(plaintext, publicKey) {
 }
 export const SecretProvider = () => Provider.succeed(Secret, {
     create: Effect.fn(function* ({ news }) {
-        const octokit = createClient(news);
+        const octokit = yield* getOctokit;
         yield* upsertSecret(octokit, news);
         return { updatedAt: new Date().toISOString() };
     }),
     update: Effect.fn(function* ({ news, olds }) {
-        const octokit = createClient(news);
+        const octokit = yield* getOctokit;
         const wasEnv = !!olds.environment;
         const isEnv = !!news.environment;
         if (wasEnv !== isEnv || olds.environment !== news.environment) {
@@ -113,7 +115,7 @@ export const SecretProvider = () => Provider.succeed(Secret, {
         return { updatedAt: new Date().toISOString() };
     }),
     delete: Effect.fn(function* ({ olds }) {
-        const octokit = createClient(olds);
+        const octokit = yield* getOctokit;
         yield* deleteSecret(octokit, olds);
     }),
 });

package/lib/GitHub/Secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/GitHub/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAgD1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,eAAe,CAAC,CAAC;AAExD,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,CACL,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,SAAiB,EACjB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,OAAgB,EAChB,KAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;gBAClE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAY;aACrC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,UAAU;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CACvC,CAAC;IAEF,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC;gBACzD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAY;gBACpC,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,OAAgB,EAChB,KAAkB;IAElB,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;oBACjD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAW;oBACnC,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/GitHub/Secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA6CrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,eAAe,CAAC,CAAC;AAExD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY,CACzB,SAAiB,EACjB,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/C,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,MAAM,GACT,GAAW,CAAC,OAAO,IAAI,GAAG,CAAC;IAC9B,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAElC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,OAAgB,EAChB,KAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;gBAClE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAY;aACrC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,UAAU;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CACvC,CAAC;IAEF,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC;gBACzD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAY;gBACpC,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,OAAgB,EAChB,KAAkB;IAElB,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;oBACjD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAW;oBACnC,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/lib/GitHub/Variable.d.ts

@@ -1,5 +1,7 @@
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
+import { GitHubCredentials } from "./Credentials.ts";
+import type { Providers } from "./Providers.ts";
 export interface VariableProps {
     /**
      * Repository owner (user or organization).
@@ -17,18 +19,13 @@ export interface VariableProps {
      * Variable value.
      */
     value: string;
-    /**
-     * GitHub API token. If not provided, falls back to
-     * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
-     */
-    token?: string;
 }
 export interface Variable extends Resource<"GitHub.Variable", VariableProps, {
     /**
      * ISO-8601 timestamp of the last update.
      */
     updatedAt: string;
-}> {
+}, never, Providers> {
 }
 /**
  * A GitHub Actions repository variable.
@@ -39,9 +36,10 @@ export interface Variable extends Resource<"GitHub.Variable", VariableProps, {
  * labels, or feature flags. For sensitive values, use `GitHub.Secret`
  * instead.
  *
- * Authentication is resolved in order: explicit `token` prop,
- * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
- * `repo` scope for private repositories or `public_repo` for public ones.
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
  *
  * @section Repository Variables
  * Store variables accessible to all GitHub Actions workflows in the
@@ -91,5 +89,5 @@ export interface Variable extends Resource<"GitHub.Variable", VariableProps, {
  * ```
  */
 export declare const Variable: import("../Resource.ts").ResourceClass<Variable>;
-export declare const VariableProvider: () => import("effect/Layer").Layer<Provider.Provider<Variable>, never, never>;
+export declare const VariableProvider: () => import("effect/Layer").Layer<Provider.Provider<Variable>, never, GitHubCredentials>;
 //# sourceMappingURL=Variable.d.ts.map

package/lib/GitHub/Variable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Variable.d.ts","sourceRoot":"","sources":["../../src/GitHub/Variable.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,iBAAiB,EACjB,aAAa,EACb;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CACF;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,eAAO,MAAM,QAAQ,kDAAwC,CAAC;AAY9D,eAAO,MAAM,gBAAgB,+EAiDzB,CAAC"}
+{"version":3,"file":"Variable.d.ts","sourceRoot":"","sources":["../../src/GitHub/Variable.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,iBAAiB,EACjB,aAAa,EACb;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,eAAO,MAAM,QAAQ,kDAAwC,CAAC;AAO9D,eAAO,MAAM,gBAAgB,2FAiDzB,CAAC"}

package/lib/GitHub/Variable.js

@@ -1,7 +1,7 @@
-import { Octokit } from "@octokit/rest";
 import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.js";
 import { Resource } from "../Resource.js";
+import { GitHubCredentials } from "./Credentials.js";
 /**
  * A GitHub Actions repository variable.
  *
@@ -11,9 +11,10 @@ import { Resource } from "../Resource.js";
  * labels, or feature flags. For sensitive values, use `GitHub.Secret`
  * instead.
  *
- * Authentication is resolved in order: explicit `token` prop,
- * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
- * `repo` scope for private repositories or `public_repo` for public ones.
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
  *
  * @section Repository Variables
  * Store variables accessible to all GitHub Actions workflows in the
@@ -63,15 +64,13 @@ import { Resource } from "../Resource.js";
  * ```
  */
 export const Variable = Resource("GitHub.Variable");
-function resolveToken(props) {
-    return (props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN);
-}
-function createClient(props) {
-    return new Octokit({ auth: resolveToken(props) });
-}
+const getOctokit = Effect.gen(function* () {
+    const creds = yield* GitHubCredentials;
+    return creds.octokit();
+});
 export const VariableProvider = () => Provider.succeed(Variable, {
     create: Effect.fn(function* ({ news }) {
-        const octokit = createClient(news);
+        const octokit = yield* getOctokit;
         yield* Effect.tryPromise(() => octokit.rest.actions.createRepoVariable({
             owner: news.owner,
             repo: news.repository,
@@ -81,7 +80,7 @@ export const VariableProvider = () => Provider.succeed(Variable, {
         return { updatedAt: new Date().toISOString() };
     }),
     update: Effect.fn(function* ({ news }) {
-        const octokit = createClient(news);
+        const octokit = yield* getOctokit;
         yield* Effect.tryPromise(() => octokit.rest.actions.updateRepoVariable({
             owner: news.owner,
             repo: news.repository,
@@ -91,7 +90,7 @@ export const VariableProvider = () => Provider.succeed(Variable, {
         return { updatedAt: new Date().toISOString() };
     }),
     delete: Effect.fn(function* ({ olds }) {
-        const octokit = createClient(olds);
+        const octokit = yield* getOctokit;
         yield* Effect.tryPromise(async () => {
             try {
                 await octokit.rest.actions.deleteRepoVariable({

package/lib/GitHub/Variable.js.map

@@ -1 +1 @@
-{"version":3,"file":"Variable.js","sourceRoot":"","sources":["../../src/GitHub/Variable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAyC1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,iBAAiB,CAAC,CAAC;AAE9D,SAAS,YAAY,CAAC,KAAoB;IACxC,OAAO,CACL,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;oBAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,UAAU;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"Variable.js","sourceRoot":"","sources":["../../src/GitHub/Variable.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAsCrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,iBAAiB,CAAC,CAAC;AAE9D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAElC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAElC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAElC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;oBAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,UAAU;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/GitHub/index.d.ts

@@ -1,4 +1,6 @@
+export * as Auth from "./AuthProvider.ts";
 export * from "./Comment.ts";
+export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
 export * from "./Providers.ts";
 export * from "./Secret.ts";
 export * from "./Variable.ts";

package/lib/GitHub/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/lib/GitHub/index.js

@@ -1,4 +1,6 @@
+export * as Auth from "./AuthProvider.js";
 export * from "./Comment.js";
+export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.js";
 export * from "./Providers.js";
 export * from "./Secret.js";
 export * from "./Variable.js";

package/lib/GitHub/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.15",
+  "version": "2.0.0-beta.16",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -231,11 +231,11 @@
     "@ai-sdk/provider": "^3.0.8",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.12.4",
-    "@distilled.cloud/cloudflare": "^0.12.4",
+    "@distilled.cloud/aws": "^0.12.5",
+    "@distilled.cloud/cloudflare": "^0.12.5",
     "@distilled.cloud/cloudflare-rolldown-plugin": "0.3.0",
     "@distilled.cloud/cloudflare-vite-plugin": "0.2.0",
-    "@distilled.cloud/core": "^0.12.4",
+    "@distilled.cloud/core": "^0.12.5",
     "@effect/vitest": "4.0.0-beta.48",
     "@libsql/client": "^0.17.0",
     "@octokit/rest": "^22.0.1",

package/src/Cloudflare/ApiToken/AccountApiToken.ts

@@ -12,14 +12,12 @@ import {
   conditionFingerprint,
   policyFingerprint,
   resolvePolicies,
-  type BaseApiTokenProps,
+  type ApiTokenProps,
 } from "./Common.ts";
 
-export type AccountApiTokenProps = BaseApiTokenProps;
-
 export type AccountApiToken = Resource<
   "Cloudflare.AccountApiToken",
-  AccountApiTokenProps,
+  ApiTokenProps,
   {
     tokenId: string;
     name: string;
@@ -87,7 +85,7 @@ export const AccountApiTokenProvider = () =>
   Provider.effect(
     AccountApiToken,
     Effect.gen(function* () {
-      const { accountId } = yield* CloudflareEnvironment;
+      const { accountId: defaultAccountId } = yield* CloudflareEnvironment;
       const createToken = yield* accounts.createToken;
       const updateToken = yield* accounts.updateToken;
       const deleteToken = yield* accounts.deleteToken;
@@ -100,6 +98,7 @@ export const AccountApiTokenProvider = () =>
           status?: "active" | "disabled" | "expired" | null;
         },
         value: Redacted.Redacted<string>,
+        accountId: string,
       ): AccountApiTokenAttributes => ({
         tokenId: tokenData.id ?? "",
         name: tokenData.name ?? "",
@@ -112,16 +111,19 @@ export const AccountApiTokenProvider = () =>
         stables: ["tokenId", "accountId"],
         diff: Effect.fn(function* ({ id, olds, news, output }) {
           if (!isResolved(news)) return undefined;
-          if ((output?.accountId ?? accountId) !== accountId) {
+          const newAccountId = news.accountId ?? defaultAccountId;
+          const oldAccountId =
+            output?.accountId ?? olds?.accountId ?? defaultAccountId;
+          if (oldAccountId !== newAccountId) {
             return { action: "replace" } as const;
           }
           const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
           const newName = yield* resolveName(id, news.name);
           const oldPolicyFp = policyFingerprint(
-            resolvePolicies(olds?.policies ?? [], accountId),
+            resolvePolicies(olds?.policies ?? [], oldAccountId),
           );
           const newPolicyFp = policyFingerprint(
-            resolvePolicies(news.policies, accountId),
+            resolvePolicies(news.policies, newAccountId),
           );
           const oldCondFp = conditionFingerprint(olds?.condition);
           const newCondFp = conditionFingerprint(news.condition);
@@ -136,6 +138,7 @@ export const AccountApiTokenProvider = () =>
           }
         }),
         create: Effect.fn(function* ({ id, news }) {
+          const accountId = news.accountId ?? defaultAccountId;
           const name = yield* resolveName(id, news.name);
           const policies = resolvePolicies(news.policies, accountId);
           const result = yield* createToken({
@@ -151,9 +154,14 @@ export const AccountApiTokenProvider = () =>
               `Cloudflare did not return a value for token "${name}".`,
             );
           }
-          return buildAttributes(result, Redacted.make(result.value));
+          return buildAttributes(
+            result,
+            Redacted.make(result.value),
+            accountId,
+          );
         }),
         update: Effect.fn(function* ({ id, news, output }) {
+          const accountId = news.accountId ?? defaultAccountId;
           const name = yield* resolveName(id, news.name);
           const policies = resolvePolicies(news.policies, accountId);
           const result = yield* updateToken({
@@ -167,7 +175,7 @@ export const AccountApiTokenProvider = () =>
           });
           // Cloudflare doesn't return the value on update; preserve the
           // value captured at creation.
-          return buildAttributes(result, output.value);
+          return buildAttributes(result, output.value, accountId);
         }),
         delete: Effect.fn(function* ({ output }) {
           yield* deleteToken({
@@ -187,7 +195,9 @@ export const AccountApiTokenProvider = () =>
             accountId: output.accountId,
             tokenId: output.tokenId,
           }).pipe(
-            Effect.map((token) => buildAttributes(token, output.value)),
+            Effect.map((token) =>
+              buildAttributes(token, output.value, output.accountId),
+            ),
             Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
             Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
           );

package/src/Cloudflare/ApiToken/Common.ts

@@ -41,12 +41,17 @@ export interface ApiTokenCondition {
   };
 }
 
-export type BaseApiTokenProps = {
+export type ApiTokenProps = {
   /**
    * Token name. Defaults to a generated physical name based on the
    * resource's logical id, app name, and stage.
    */
   name?: string;
+  /**
+   * The Cloudflare account ID that owns this token. Defaults to the
+   * account ID resolved from the ambient {@link CloudflareEnvironment}.
+   */
+  accountId?: string;
   /**
    * Access policies attached to the token. At least one policy is required
    * by Cloudflare.

package/src/Cloudflare/ApiToken/UserApiToken.ts

@@ -11,14 +11,12 @@ import {
   conditionFingerprint,
   policyFingerprint,
   resolvePolicies,
-  type BaseApiTokenProps,
+  type ApiTokenProps,
 } from "./Common.ts";
 
-export type UserApiTokenProps = BaseApiTokenProps;
-
 export type UserApiToken = Resource<
   "Cloudflare.UserApiToken",
-  UserApiTokenProps,
+  ApiTokenProps,
   {
     tokenId: string;
     name: string;
@@ -102,10 +100,10 @@ export const UserApiTokenProvider = () =>
           const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
           const newName = yield* resolveName(id, news.name);
           const oldPolicyFp = policyFingerprint(
-            resolvePolicies(olds?.policies ?? [], undefined),
+            resolvePolicies(olds?.policies ?? [], olds?.accountId),
           );
           const newPolicyFp = policyFingerprint(
-            resolvePolicies(news.policies, undefined),
+            resolvePolicies(news.policies, news.accountId),
           );
           const oldCondFp = conditionFingerprint(olds?.condition);
           const newCondFp = conditionFingerprint(news.condition);
@@ -121,7 +119,7 @@ export const UserApiTokenProvider = () =>
         }),
         create: Effect.fn(function* ({ id, news }) {
           const name = yield* resolveName(id, news.name);
-          const policies = resolvePolicies(news.policies, undefined);
+          const policies = resolvePolicies(news.policies, news.accountId);
           const result = yield* createToken({
             name,
             policies,
@@ -138,7 +136,7 @@ export const UserApiTokenProvider = () =>
         }),
         update: Effect.fn(function* ({ id, news, output }) {
           const name = yield* resolveName(id, news.name);
-          const policies = resolvePolicies(news.policies, undefined);
+          const policies = resolvePolicies(news.policies, news.accountId);
           const result = yield* updateToken({
             tokenId: output.tokenId,
             name,

package/src/Cloudflare/Artifacts/Artifacts.ts

@@ -0,0 +1,139 @@
+import * as Effect from "effect/Effect";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import { ArtifactsBinding } from "./ArtifactsBinding.ts";
+
+type ArtifactsTypeId = typeof ArtifactsTypeId;
+const ArtifactsTypeId = "Cloudflare.Artifacts" as const;
+
+/**
+ * Cloudflare validation: 3–63 chars, lowercase alphanumeric and hyphens, must
+ * start and end with a lowercase alphanumeric character.
+ */
+const ARTIFACTS_NAMESPACE_REGEX = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/;
+
+export class InvalidArtifactsNamespaceError extends Error {
+  readonly _tag = "InvalidArtifactsNamespaceError" as const;
+  constructor(public readonly namespace: string) {
+    super(
+      `Invalid artifacts namespace name '${namespace}'. Must be 3-63 characters, start and end with a lowercase alphanumeric character, and contain only lowercase alphanumeric characters and hyphens.`,
+    );
+  }
+}
+
+export type ArtifactsProps = {
+  /**
+   * Cloudflare namespace name. Namespaces are implicit on Cloudflare — the
+   * first repo created against this name conjures the namespace.
+   *
+   * Must be 3–63 lowercase alphanumeric characters or hyphens, and must start
+   * and end with a lowercase alphanumeric character. If omitted, a unique
+   * physical name is generated from the resource's logical id, app, and stage.
+   */
+  namespace?: string;
+};
+
+/**
+ * Marker for a Cloudflare Artifacts namespace binding.
+ *
+ * Artifacts namespaces are implicit (created on first repo write) and require
+ * no deploy-time provisioning, so this is a pure binding marker rather than
+ * a full Resource. The Worker provider sees this object in `bindings: { ... }`
+ * and emits the corresponding `{ type: "artifacts", name, namespace }` binding
+ * to the script.
+ */
+export type Artifacts = {
+  kind: ArtifactsTypeId;
+  name: string;
+  namespace: string;
+};
+
+export const isArtifacts = (value: unknown): value is Artifacts =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as Artifacts).kind === ArtifactsTypeId;
+
+/**
+ * A Cloudflare Artifacts namespace — the top-level container for Git-compatible
+ * versioned repositories. See the
+ * {@link https://blog.cloudflare.com/artifacts-git-for-agents-beta/ | Artifacts launch post}
+ * and {@link https://developers.cloudflare.com/artifacts/concepts/namespaces/ | Namespaces docs}.
+ *
+ * Namespaces on Cloudflare are **implicit**: there is no `POST /namespaces`
+ * endpoint. The namespace is conjured the first time a repo is created against
+ * it (either via the REST API or the Worker binding). Because of that, the
+ * Alchemy "resource" is a thin binding marker — there is nothing to provision
+ * at deploy time. Repos themselves are typically created at runtime through
+ * the bound `Artifacts` API.
+ *
+ * @section Declaring a Namespace
+ * @example Default namespace (a unique physical name is generated)
+ * ```typescript
+ * const Repos = Cloudflare.Artifacts("Repos");
+ * ```
+ *
+ * @example Override the namespace name (must be lowercase, 3–63 chars)
+ * ```typescript
+ * const Repos = Cloudflare.Artifacts("Repos", { namespace: "starter-repos" });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Wiring it into a Worker
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { Repos },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { Repos: Artifacts }
+ * ```
+ *
+ * @example Async-style worker
+ * ```typescript
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     const repo = await env.Repos.create("starter-repo");
+ *     return Response.json({ remote: repo.remote, token: repo.token });
+ *   },
+ * };
+ * ```
+ *
+ * @example Effect-style worker
+ * ```typescript
+ * const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
+ * const repo = yield* artifacts.create("starter-repo", {
+ *   setDefaultBranch: "main",
+ * });
+ * ```
+ */
+export const Artifacts: {
+  (
+    name: string,
+    props?: ArtifactsProps,
+  ): Effect.Effect<Artifacts, never, Stack | Stage>;
+  /**
+   * Bind a Cloudflare Artifacts namespace to the surrounding Worker, returning
+   * an Effect-native client. See {@link ArtifactsBinding}.
+   */
+  bind: typeof ArtifactsBinding.bind;
+} = Object.assign(
+  Effect.fn(function* (name: string, props?: ArtifactsProps) {
+    const namespace = props?.namespace
+      ? props.namespace
+      : name.toLocaleLowerCase();
+    if (!ARTIFACTS_NAMESPACE_REGEX.test(namespace)) {
+      return yield* Effect.die(new InvalidArtifactsNamespaceError(namespace));
+    }
+    return {
+      kind: ArtifactsTypeId,
+      name,
+      namespace,
+    } satisfies Artifacts;
+  }),
+  {
+    bind: (...args: Parameters<typeof ArtifactsBinding.bind>) =>
+      ArtifactsBinding.bind(...args),
+  },
+);