alchemy 2.0.0-beta.15 → 2.0.0-beta.16

package/src/Cloudflare/Artifacts/ArtifactsBinding.ts

@@ -0,0 +1,188 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type Artifacts as ArtifactsLike } from "./Artifacts.ts";
+
+export class ArtifactsError extends Data.TaggedError("ArtifactsError")<{
+  message: string;
+  cause: Error;
+}> {}
+
+export type Scope = "read" | "write";
+
+export type ArtifactsCreateOptions = {
+  readOnly?: boolean;
+  description?: string;
+  setDefaultBranch?: string;
+};
+
+export type ArtifactsImportOptions = {
+  source: { url: string; branch?: string; depth?: number };
+  target: {
+    name: string;
+    opts?: { description?: string; readOnly?: boolean };
+  };
+};
+
+export type ArtifactsListOptions = {
+  limit?: number;
+  cursor?: string;
+};
+
+export type ArtifactsForkOptions = {
+  description?: string;
+  readOnly?: boolean;
+  defaultBranchOnly?: boolean;
+};
+
+/**
+ * Effect-native handle to a single Artifacts repo. Wraps the runtime
+ * {@link ArtifactsRepo} so each method returns an Effect.
+ */
+export interface ArtifactsRepoClient {
+  /** Underlying Cloudflare runtime handle. */
+  raw: ArtifactsRepo;
+  createToken(
+    scope?: Scope,
+    ttl?: number,
+  ): Effect.Effect<ArtifactsCreateTokenResult, ArtifactsError>;
+  listTokens(): Effect.Effect<ArtifactsTokenListResult, ArtifactsError>;
+  revokeToken(tokenOrId: string): Effect.Effect<boolean, ArtifactsError>;
+  fork(
+    name: string,
+    opts?: ArtifactsForkOptions,
+  ): Effect.Effect<ArtifactsCreateRepoResult, ArtifactsError>;
+}
+
+/**
+ * Effect-native client for a Cloudflare Artifacts namespace binding.
+ *
+ * Wraps the runtime {@link Artifacts} binding so each method returns an
+ * Effect tagged with {@link ArtifactsError}. Use
+ * `Cloudflare.ArtifactsBinding.bind(Repos)` inside a Worker's init phase.
+ */
+export interface ArtifactsClient {
+  /** Effect resolving to the raw Cloudflare runtime binding. */
+  raw: Effect.Effect<Artifacts, never, WorkerEnvironment>;
+  create(
+    name: string,
+    opts?: ArtifactsCreateOptions,
+  ): Effect.Effect<
+    ArtifactsCreateRepoResult,
+    ArtifactsError,
+    WorkerEnvironment
+  >;
+  /** Look up an existing repo by name. Fails with `ArtifactsError` if missing. */
+  get(
+    name: string,
+  ): Effect.Effect<ArtifactsRepoClient, ArtifactsError, WorkerEnvironment>;
+  list(
+    opts?: ArtifactsListOptions,
+  ): Effect.Effect<ArtifactsRepoListResult, ArtifactsError, WorkerEnvironment>;
+  delete(
+    name: string,
+  ): Effect.Effect<boolean, ArtifactsError, WorkerEnvironment>;
+  import(
+    opts: ArtifactsImportOptions,
+  ): Effect.Effect<
+    ArtifactsCreateRepoResult,
+    ArtifactsError,
+    WorkerEnvironment
+  >;
+}
+
+export class ArtifactsBinding extends Binding.Service<
+  ArtifactsBinding,
+  (artifacts: ArtifactsLike) => Effect.Effect<ArtifactsClient>
+>()("Cloudflare.Artifacts.Binding") {}
+
+export const ArtifactsBindingLive = Layer.effect(
+  ArtifactsBinding,
+  Effect.gen(function* () {
+    const Policy = yield* ArtifactsBindingPolicy;
+
+    return Effect.fn(function* (artifacts: ArtifactsLike) {
+      yield* Policy(artifacts);
+      const env = WorkerEnvironment.asEffect();
+      const raw = env.pipe(
+        Effect.map(
+          (env) => (env as Record<string, Artifacts>)[artifacts.name]!,
+        ),
+      );
+
+      const use = <T>(
+        fn: (raw: Artifacts) => Promise<T>,
+      ): Effect.Effect<T, ArtifactsError, WorkerEnvironment> =>
+        raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
+
+      return {
+        raw,
+        create: (name, opts) => use((raw) => raw.create(name, opts)),
+        get: (name) =>
+          use((raw) => raw.get(name)).pipe(
+            Effect.flatMap((repo) =>
+              repo == null
+                ? Effect.fail(
+                    new ArtifactsError({
+                      message: `Artifacts repo '${name}' not found`,
+                      cause: new Error("not_found"),
+                    }),
+                  )
+                : Effect.succeed(wrapRepo(repo as ArtifactsRepo)),
+            ),
+          ),
+        list: (opts) => use((raw) => raw.list(opts)),
+        delete: (name) => use((raw) => raw.delete(name)),
+        import: (opts) => use((raw) => raw.import(opts)),
+      } satisfies ArtifactsClient;
+    });
+  }),
+);
+
+export class ArtifactsBindingPolicy extends Binding.Policy<
+  ArtifactsBindingPolicy,
+  (artifacts: ArtifactsLike) => Effect.Effect<void>
+>()("Cloudflare.Artifacts.Binding") {}
+
+export const ArtifactsBindingPolicyLive = ArtifactsBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, artifacts: ArtifactsLike) {
+    if (isWorker(host)) {
+      yield* host.bind(artifacts.name, {
+        bindings: [
+          {
+            type: "artifacts",
+            name: artifacts.name,
+            namespace: artifacts.namespace,
+          } as any,
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`ArtifactsBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
+
+const tryPromise = <T>(
+  fn: () => Promise<T>,
+): Effect.Effect<T, ArtifactsError> =>
+  Effect.tryPromise({
+    try: fn,
+    catch: (error: any) =>
+      new ArtifactsError({
+        message: error?.message ?? "Unknown error",
+        cause: error,
+      }),
+  });
+
+const wrapRepo = (raw: ArtifactsRepo): ArtifactsRepoClient => ({
+  raw,
+  createToken: (scope, ttl) => tryPromise(() => raw.createToken(scope, ttl)),
+  listTokens: () => tryPromise(() => raw.listTokens()),
+  revokeToken: (tokenOrId) => tryPromise(() => raw.revokeToken(tokenOrId)),
+  fork: (name, opts) => tryPromise(() => raw.fork(name, opts)),
+});

package/src/Cloudflare/Artifacts/index.ts

@@ -0,0 +1,2 @@
+export * from "./Artifacts.ts";
+export * from "./ArtifactsBinding.ts";

package/src/Cloudflare/Providers.ts

@@ -4,6 +4,7 @@ import * as Build from "../Build/index.ts";
 import * as Provider from "../Provider.ts";
 import { Random, RandomProvider } from "../Random.ts";
 import * as ApiToken from "./ApiToken/index.ts";
+import * as Artifacts from "./Artifacts/index.ts";
 import { CloudflareAuth } from "./Auth/AuthProvider.ts";
 import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
 import * as Containers from "./Container/index.ts";
@@ -33,6 +34,7 @@ export const providers = () =>
     Provider.collection([
       ApiToken.AccountApiToken,
       ApiToken.UserApiToken,
+      Artifacts.ArtifactsBindingPolicy,
       Command,
       Containers.Container,
       D1.D1ConnectionPolicy,
@@ -58,6 +60,7 @@ export const providers = () =>
       Layer.mergeAll(
         ApiToken.AccountApiTokenProvider(),
         ApiToken.UserApiTokenProvider(),
+        Artifacts.ArtifactsBindingPolicyLive,
         Containers.ContainerProvider(),
         D1.D1ConnectionPolicyLive,
         D1.DatabaseProvider(),

package/src/Cloudflare/Workers/InferEnv.ts

@@ -1,5 +1,4 @@
 /// <reference types="@cloudflare/workers-types" />
-// import type * as cf from "@cloudflare/workers-types";
 
 import type * as Effect from "effect/Effect";
 import type { UnwrapEffect } from "../../Util/effect.ts";
@@ -24,6 +23,8 @@ type GetBindingType<T> = T extends Cloudflare.Assets
         ? KVNamespace
         : T extends Cloudflare.Queue
           ? Queue<unknown>
-          : T extends Cloudflare.DurableObjectNamespaceLike
-            ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
-            : never;
+          : T extends Cloudflare.Artifacts
+            ? Artifacts
+            : T extends Cloudflare.DurableObjectNamespaceLike
+              ? DurableObjectNamespace<Exclude<T["Shape"], undefined>>
+              : never;

package/src/Cloudflare/Workers/Worker.ts

@@ -24,6 +24,10 @@ import Sonda from "sonda/rolldown";
 import type * as vite from "vite";
 import * as Artifacts from "../../Artifacts.ts";
 import * as Binding from "../../Binding.ts";
+import {
+  isArtifacts as isArtifactsBinding,
+  type Artifacts as ArtifactsBinding,
+} from "../Artifacts/Artifacts.ts";
 import { hashDirectory, type MemoOptions } from "../../Build/Memo.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
@@ -183,6 +187,7 @@ export type WorkerBindingResource =
   | D1Database
   | KVNamespace
   | CloudflareQueue
+  | ArtifactsBinding
   | DurableObjectNamespaceLike<any>;
 
 export type WorkerBindings = {
@@ -667,7 +672,13 @@ export const Worker: Platform<
               type: "assets",
               name: bindingName,
             }
-          : isDurableObjectNamespaceLike(binding)
+          : isArtifactsBinding(binding)
+            ? ({
+                type: "artifacts",
+                name: bindingName,
+                namespace: binding.namespace,
+              } as any)
+            : isDurableObjectNamespaceLike(binding)
             ? {
                 type: "durable_object_namespace",
                 name: bindingName,

package/src/Cloudflare/index.ts

@@ -1,4 +1,5 @@
 export * from "./ApiToken/index.ts";
+export * from "./Artifacts/index.ts";
 export * from "./CloudflareEnvironment.ts";
 export * from "./Container/index.ts";
 export * from "./D1/index.ts";

package/src/GitHub/AuthProvider.ts

@@ -0,0 +1,309 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import {
+  deleteCredentials,
+  displayRedacted,
+  readCredentials,
+  writeCredentials,
+} from "../Auth/Credentials.ts";
+import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+const options: Array<{
+  value: GitHubAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "gh-cli",
+    label: "GitHub CLI",
+    hint: "delegate to `gh auth token` (run `gh auth login` first)",
+  },
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "GITHUB_ACCESS_TOKEN or GITHUB_TOKEN",
+  },
+  {
+    value: "stored",
+    label: "Personal Access Token",
+    hint: "enter PAT interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+export type GitHubAuthConfig =
+  | { method: "env" }
+  | { method: "stored" }
+  | { method: "gh-cli" };
+
+export interface GitHubStoredCredentials {
+  type: "pat";
+  token: string;
+}
+
+export interface GitHubResolvedCredentials {
+  type: "token";
+  token: Redacted.Redacted<string>;
+  source: { type: GitHubAuthConfig["method"]; details?: string };
+}
+
+export const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
+
+/**
+ * Layer that registers the GitHub {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the GitHub
+ * `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `gh-cli`: shells out to `gh auth token` (recommended).
+ * - `env`: reads `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN`.
+ * - `stored`: prompts for a PAT and writes it to `~/.alchemy/credentials`.
+ *
+ * Browser/device OAuth is intentionally not implemented: GitHub's
+ * OAuth App flow requires a `client_secret` we cannot ship, and
+ * device flow is exactly what `gh auth login` already does.
+ */
+export const GitHubAuth = AuthProviderLayer<
+  GitHubAuthConfig,
+  GitHubResolvedCredentials
+>()(GITHUB_AUTH_PROVIDER_NAME, {
+  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
+  logout: (profileName, config) => logout(profileName, config),
+  login: (profileName, config) => login(profileName, config),
+  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
+  read: (profileName, config) => resolveCredentials(profileName, config),
+});
+
+const resolveCredentials = (
+  profileName: string,
+  config: GitHubAuthConfig,
+): Effect.Effect<
+  GitHubResolvedCredentials,
+  AuthError,
+  FileSystem.FileSystem | ChildProcessSpawner
+> =>
+  Match.value(config).pipe(
+    Match.when(
+      { method: "env" },
+      Effect.fnUntraced(function* () {
+        const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
+        if (access) {
+          return {
+            type: "token" as const,
+            token: access,
+            source: {
+              type: "env" as const,
+              details: "GITHUB_ACCESS_TOKEN",
+            },
+          };
+        }
+        const token = yield* getEnvRedacted("GITHUB_TOKEN");
+        if (token) {
+          return {
+            type: "token" as const,
+            token,
+            source: { type: "env" as const, details: "GITHUB_TOKEN" },
+          };
+        }
+        return yield* new AuthError({
+          message:
+            "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+      }),
+    ),
+    Match.when({ method: "stored" }, () =>
+      readCredentials<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
+        Effect.flatMap((creds) =>
+          creds == null
+            ? Effect.fail(
+                new AuthError({
+                  message:
+                    "GitHub stored credentials not found. Run: alchemy login --configure",
+                }),
+              )
+            : Effect.succeed({
+                type: "token" as const,
+                token: Redacted.make(creds.token),
+                source: { type: "stored" as const },
+              }),
+        ),
+      ),
+    ),
+    Match.when({ method: "gh-cli" }, () =>
+      ghCliToken().pipe(
+        Effect.map((token) => ({
+          type: "token" as const,
+          token: Redacted.make(token),
+          source: { type: "gh-cli" as const },
+        })),
+      ),
+    ),
+    Match.exhaustive,
+  );
+
+const logout = (profileName: string, config: GitHubAuthConfig) =>
+  Match.value(config).pipe(
+    Match.when({ method: "env" }, () => Effect.void),
+    Match.when({ method: "gh-cli" }, () => Effect.void),
+    Match.when({ method: "stored" }, () =>
+      deleteCredentials(profileName, "gh-stored").pipe(
+        Effect.andThen(Clank.success("GitHub: stored credentials removed")),
+      ),
+    ),
+    Match.exhaustive,
+  );
+
+const login = (profileName: string, config: GitHubAuthConfig) =>
+  Match.value(config)
+    .pipe(
+      Match.when({ method: "env" }, () => Effect.void),
+      Match.when({ method: "gh-cli" }, () =>
+        ghCliToken().pipe(
+          Effect.tap(() =>
+            Clank.success("GitHub: gh CLI authentication available."),
+          ),
+          Effect.asVoid,
+        ),
+      ),
+      Match.when({ method: "stored" }, () =>
+        readCredentials<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
+          Effect.flatMap((creds) =>
+            creds == null ? loginStored(profileName) : Effect.void,
+          ),
+        ),
+      ),
+      Match.exhaustive,
+    )
+    .pipe(
+      Effect.mapError(
+        (e) => new AuthError({ message: "login failed", cause: e }),
+      ),
+    );
+
+const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+  Effect.gen(function* () {
+    if (ctx.ci) {
+      return { method: "env" as const };
+    }
+    return yield* configureInteractive(profileName);
+  }).pipe(
+    Effect.mapError(
+      (e) =>
+        new AuthError({
+          message: "failed to configure credentials",
+          cause: e,
+        }),
+    ),
+  );
+
+const configureInteractive = (profileName: string) =>
+  Clank.select({
+    message: "GitHub authentication method",
+    options,
+  }).pipe(
+    Effect.flatMap((method) =>
+      Match.value(method).pipe(
+        Match.when("env", () => Effect.succeed({ method: "env" as const })),
+        Match.when("gh-cli", () =>
+          ghCliToken().pipe(
+            Effect.as({ method: "gh-cli" as const }),
+            Effect.mapError(
+              (e) =>
+                new AuthError({
+                  message: `gh CLI not available: ${e.message}`,
+                  cause: e,
+                }),
+            ),
+          ),
+        ),
+        Match.when("stored", () => loginStored(profileName)),
+        Match.exhaustive,
+      ),
+    ),
+  );
+
+const loginStored = Effect.fnUntraced(function* (profileName: string) {
+  const token = yield* Clank.password({
+    message:
+      "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
+    validate: (v) => (v.length === 0 ? "Required" : undefined),
+  }).pipe(retryOnce);
+
+  yield* writeCredentials<GitHubStoredCredentials>(profileName, "gh-stored", {
+    type: "pat",
+    token,
+  });
+  yield* Clank.success("GitHub: credentials saved.");
+  return { method: "stored" as const };
+});
+
+class GhCliError extends Error {
+  readonly _tag = "GhCliError";
+}
+
+const ghCliToken = () =>
+  Effect.gen(function* () {
+    const handle = yield* ChildProcess.make("gh", ["auth", "token"], {
+      shell: false,
+    });
+    const [exitCode, stdout, stderr] = yield* Effect.all(
+      [
+        handle.exitCode,
+        Stream.mkString(Stream.decodeText(handle.stdout)),
+        Stream.mkString(Stream.decodeText(handle.stderr)),
+      ],
+      { concurrency: 3 },
+    );
+    if (exitCode !== 0) {
+      return yield* Effect.fail(
+        new GhCliError(
+          `gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`,
+        ),
+      );
+    }
+    const token = stdout.trim();
+    if (!token) {
+      return yield* Effect.fail(
+        new GhCliError("gh auth token returned empty output"),
+      );
+    }
+    return token;
+  }).pipe(
+    Effect.scoped,
+    Effect.mapError((e) =>
+      e instanceof GhCliError
+        ? new AuthError({ message: e.message, cause: e })
+        : new AuthError({
+            message:
+              "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
+            cause: e,
+          }),
+    ),
+  );
+
+const prettyPrint = (profileName: string, config: GitHubAuthConfig) =>
+  resolveCredentials(profileName, config).pipe(
+    Effect.tap((creds) => {
+      const sourceStr = creds.source.details
+        ? `${creds.source.type} - ${creds.source.details}`
+        : creds.source.type;
+      return Effect.all([
+        Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+        Console.log(`  source: ${sourceStr}`),
+      ]);
+    }),
+    Effect.catch((e) =>
+      Console.error(`  Failed to retrieve credentials: ${e}`),
+    ),
+  );

package/src/GitHub/Credentials.ts

@@ -0,0 +1,99 @@
+import { Octokit } from "@octokit/rest";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { AuthError, getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import {
+  GITHUB_AUTH_PROVIDER_NAME,
+  type GitHubAuthConfig,
+  type GitHubResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export interface GitHubCredentialsService {
+  readonly token: Redacted.Redacted<string>;
+  readonly octokit: () => Octokit;
+}
+
+export class GitHubCredentials extends Context.Service<
+  GitHubCredentials,
+  GitHubCredentialsService
+>()("GitHub::Credentials") {}
+
+const make = (token: Redacted.Redacted<string>): GitHubCredentialsService => ({
+  token,
+  octokit: () => new Octokit({ auth: Redacted.value(token) }),
+});
+
+/**
+ * Build a `GitHubCredentials` layer from a literal token. Useful for
+ * tests or when callers already have a PAT in hand.
+ */
+export const fromToken = (token: string | Redacted.Redacted<string>) =>
+  Layer.succeed(
+    GitHubCredentials,
+    make(typeof token === "string" ? Redacted.make(token) : token),
+  );
+
+/**
+ * Build a `GitHubCredentials` layer that reads the token from
+ * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` at layer build time.
+ */
+export const fromEnv = () =>
+  Layer.effect(
+    GitHubCredentials,
+    Effect.gen(function* () {
+      const access = yield* Config.redacted("GITHUB_ACCESS_TOKEN").pipe(
+        Config.option,
+      );
+      const token = yield* Config.redacted("GITHUB_TOKEN").pipe(Config.option);
+      const value =
+        access._tag === "Some"
+          ? access.value
+          : token._tag === "Some"
+            ? token.value
+            : undefined;
+      if (value == null) {
+        return yield* new AuthError({
+          message:
+            "GitHub credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+      }
+      return make(value);
+    }).pipe(Effect.orDie),
+  );
+
+/**
+ * Build a `GitHubCredentials` layer that resolves a token via the
+ * Alchemy AuthProvider for the configured profile (defaults to
+ * `default`, overridable with `ALCHEMY_PROFILE`).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    GitHubCredentials,
+    Effect.gen(function* () {
+      const auth = yield* getAuthProvider<
+        GitHubAuthConfig,
+        GitHubResolvedCredentials
+      >(GITHUB_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const ctx = yield* Effect.context<never>();
+
+      return yield* loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as GitHubAuthConfig),
+        ),
+        Effect.map((creds) => make(creds.token)),
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: `Failed to resolve GitHub credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+        Effect.provide(ctx),
+      );
+    }).pipe(Effect.orDie),
+  );