alchemy 2.0.0-beta.15 → 2.0.0-beta.17

package/src/GitHub/AuthProvider.ts

@@ -0,0 +1,309 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import {
+  deleteCredentials,
+  displayRedacted,
+  readCredentials,
+  writeCredentials,
+} from "../Auth/Credentials.ts";
+import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+const options: Array<{
+  value: GitHubAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "gh-cli",
+    label: "GitHub CLI",
+    hint: "delegate to `gh auth token` (run `gh auth login` first)",
+  },
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "GITHUB_ACCESS_TOKEN or GITHUB_TOKEN",
+  },
+  {
+    value: "stored",
+    label: "Personal Access Token",
+    hint: "enter PAT interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+export type GitHubAuthConfig =
+  | { method: "env" }
+  | { method: "stored" }
+  | { method: "gh-cli" };
+
+export interface GitHubStoredCredentials {
+  type: "pat";
+  token: string;
+}
+
+export interface GitHubResolvedCredentials {
+  type: "token";
+  token: Redacted.Redacted<string>;
+  source: { type: GitHubAuthConfig["method"]; details?: string };
+}
+
+export const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
+
+/**
+ * Layer that registers the GitHub {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the GitHub
+ * `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `gh-cli`: shells out to `gh auth token` (recommended).
+ * - `env`: reads `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN`.
+ * - `stored`: prompts for a PAT and writes it to `~/.alchemy/credentials`.
+ *
+ * Browser/device OAuth is intentionally not implemented: GitHub's
+ * OAuth App flow requires a `client_secret` we cannot ship, and
+ * device flow is exactly what `gh auth login` already does.
+ */
+export const GitHubAuth = AuthProviderLayer<
+  GitHubAuthConfig,
+  GitHubResolvedCredentials
+>()(GITHUB_AUTH_PROVIDER_NAME, {
+  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
+  logout: (profileName, config) => logout(profileName, config),
+  login: (profileName, config) => login(profileName, config),
+  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
+  read: (profileName, config) => resolveCredentials(profileName, config),
+});
+
+const resolveCredentials = (
+  profileName: string,
+  config: GitHubAuthConfig,
+): Effect.Effect<
+  GitHubResolvedCredentials,
+  AuthError,
+  FileSystem.FileSystem | ChildProcessSpawner
+> =>
+  Match.value(config).pipe(
+    Match.when(
+      { method: "env" },
+      Effect.fnUntraced(function* () {
+        const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
+        if (access) {
+          return {
+            type: "token" as const,
+            token: access,
+            source: {
+              type: "env" as const,
+              details: "GITHUB_ACCESS_TOKEN",
+            },
+          };
+        }
+        const token = yield* getEnvRedacted("GITHUB_TOKEN");
+        if (token) {
+          return {
+            type: "token" as const,
+            token,
+            source: { type: "env" as const, details: "GITHUB_TOKEN" },
+          };
+        }
+        return yield* new AuthError({
+          message:
+            "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+      }),
+    ),
+    Match.when({ method: "stored" }, () =>
+      readCredentials<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
+        Effect.flatMap((creds) =>
+          creds == null
+            ? Effect.fail(
+                new AuthError({
+                  message:
+                    "GitHub stored credentials not found. Run: alchemy login --configure",
+                }),
+              )
+            : Effect.succeed({
+                type: "token" as const,
+                token: Redacted.make(creds.token),
+                source: { type: "stored" as const },
+              }),
+        ),
+      ),
+    ),
+    Match.when({ method: "gh-cli" }, () =>
+      ghCliToken().pipe(
+        Effect.map((token) => ({
+          type: "token" as const,
+          token: Redacted.make(token),
+          source: { type: "gh-cli" as const },
+        })),
+      ),
+    ),
+    Match.exhaustive,
+  );
+
+const logout = (profileName: string, config: GitHubAuthConfig) =>
+  Match.value(config).pipe(
+    Match.when({ method: "env" }, () => Effect.void),
+    Match.when({ method: "gh-cli" }, () => Effect.void),
+    Match.when({ method: "stored" }, () =>
+      deleteCredentials(profileName, "gh-stored").pipe(
+        Effect.andThen(Clank.success("GitHub: stored credentials removed")),
+      ),
+    ),
+    Match.exhaustive,
+  );
+
+const login = (profileName: string, config: GitHubAuthConfig) =>
+  Match.value(config)
+    .pipe(
+      Match.when({ method: "env" }, () => Effect.void),
+      Match.when({ method: "gh-cli" }, () =>
+        ghCliToken().pipe(
+          Effect.tap(() =>
+            Clank.success("GitHub: gh CLI authentication available."),
+          ),
+          Effect.asVoid,
+        ),
+      ),
+      Match.when({ method: "stored" }, () =>
+        readCredentials<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
+          Effect.flatMap((creds) =>
+            creds == null ? loginStored(profileName) : Effect.void,
+          ),
+        ),
+      ),
+      Match.exhaustive,
+    )
+    .pipe(
+      Effect.mapError(
+        (e) => new AuthError({ message: "login failed", cause: e }),
+      ),
+    );
+
+const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+  Effect.gen(function* () {
+    if (ctx.ci) {
+      return { method: "env" as const };
+    }
+    return yield* configureInteractive(profileName);
+  }).pipe(
+    Effect.mapError(
+      (e) =>
+        new AuthError({
+          message: "failed to configure credentials",
+          cause: e,
+        }),
+    ),
+  );
+
+const configureInteractive = (profileName: string) =>
+  Clank.select({
+    message: "GitHub authentication method",
+    options,
+  }).pipe(
+    Effect.flatMap((method) =>
+      Match.value(method).pipe(
+        Match.when("env", () => Effect.succeed({ method: "env" as const })),
+        Match.when("gh-cli", () =>
+          ghCliToken().pipe(
+            Effect.as({ method: "gh-cli" as const }),
+            Effect.mapError(
+              (e) =>
+                new AuthError({
+                  message: `gh CLI not available: ${e.message}`,
+                  cause: e,
+                }),
+            ),
+          ),
+        ),
+        Match.when("stored", () => loginStored(profileName)),
+        Match.exhaustive,
+      ),
+    ),
+  );
+
+const loginStored = Effect.fnUntraced(function* (profileName: string) {
+  const token = yield* Clank.password({
+    message:
+      "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
+    validate: (v) => (v.length === 0 ? "Required" : undefined),
+  }).pipe(retryOnce);
+
+  yield* writeCredentials<GitHubStoredCredentials>(profileName, "gh-stored", {
+    type: "pat",
+    token,
+  });
+  yield* Clank.success("GitHub: credentials saved.");
+  return { method: "stored" as const };
+});
+
+class GhCliError extends Error {
+  readonly _tag = "GhCliError";
+}
+
+const ghCliToken = () =>
+  Effect.gen(function* () {
+    const handle = yield* ChildProcess.make("gh", ["auth", "token"], {
+      shell: false,
+    });
+    const [exitCode, stdout, stderr] = yield* Effect.all(
+      [
+        handle.exitCode,
+        Stream.mkString(Stream.decodeText(handle.stdout)),
+        Stream.mkString(Stream.decodeText(handle.stderr)),
+      ],
+      { concurrency: 3 },
+    );
+    if (exitCode !== 0) {
+      return yield* Effect.fail(
+        new GhCliError(
+          `gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`,
+        ),
+      );
+    }
+    const token = stdout.trim();
+    if (!token) {
+      return yield* Effect.fail(
+        new GhCliError("gh auth token returned empty output"),
+      );
+    }
+    return token;
+  }).pipe(
+    Effect.scoped,
+    Effect.mapError((e) =>
+      e instanceof GhCliError
+        ? new AuthError({ message: e.message, cause: e })
+        : new AuthError({
+            message:
+              "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
+            cause: e,
+          }),
+    ),
+  );
+
+const prettyPrint = (profileName: string, config: GitHubAuthConfig) =>
+  resolveCredentials(profileName, config).pipe(
+    Effect.tap((creds) => {
+      const sourceStr = creds.source.details
+        ? `${creds.source.type} - ${creds.source.details}`
+        : creds.source.type;
+      return Effect.all([
+        Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+        Console.log(`  source: ${sourceStr}`),
+      ]);
+    }),
+    Effect.catch((e) =>
+      Console.error(`  Failed to retrieve credentials: ${e}`),
+    ),
+  );

package/src/GitHub/Comment.ts

@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
 import { dedent } from "../Util/dedent.ts";
+import * as GitHub from "./Providers.ts";
 
 export interface CommentProps {
   /**
@@ -62,7 +63,9 @@ export interface Comment extends Resource<
      * ISO-8601 timestamp of the last update.
      */
     updatedAt: string;
-  }
+  },
+  never,
+  GitHub.Providers
 > {}
 
 /**

package/src/GitHub/Credentials.ts

@@ -0,0 +1,99 @@
+import { Octokit } from "@octokit/rest";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { AuthError, getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import {
+  GITHUB_AUTH_PROVIDER_NAME,
+  type GitHubAuthConfig,
+  type GitHubResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export interface GitHubCredentialsService {
+  readonly token: Redacted.Redacted<string>;
+  readonly octokit: () => Octokit;
+}
+
+export class GitHubCredentials extends Context.Service<
+  GitHubCredentials,
+  GitHubCredentialsService
+>()("GitHub::Credentials") {}
+
+const make = (token: Redacted.Redacted<string>): GitHubCredentialsService => ({
+  token,
+  octokit: () => new Octokit({ auth: Redacted.value(token) }),
+});
+
+/**
+ * Build a `GitHubCredentials` layer from a literal token. Useful for
+ * tests or when callers already have a PAT in hand.
+ */
+export const fromToken = (token: string | Redacted.Redacted<string>) =>
+  Layer.succeed(
+    GitHubCredentials,
+    make(typeof token === "string" ? Redacted.make(token) : token),
+  );
+
+/**
+ * Build a `GitHubCredentials` layer that reads the token from
+ * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` at layer build time.
+ */
+export const fromEnv = () =>
+  Layer.effect(
+    GitHubCredentials,
+    Effect.gen(function* () {
+      const access = yield* Config.redacted("GITHUB_ACCESS_TOKEN").pipe(
+        Config.option,
+      );
+      const token = yield* Config.redacted("GITHUB_TOKEN").pipe(Config.option);
+      const value =
+        access._tag === "Some"
+          ? access.value
+          : token._tag === "Some"
+            ? token.value
+            : undefined;
+      if (value == null) {
+        return yield* new AuthError({
+          message:
+            "GitHub credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+      }
+      return make(value);
+    }).pipe(Effect.orDie),
+  );
+
+/**
+ * Build a `GitHubCredentials` layer that resolves a token via the
+ * Alchemy AuthProvider for the configured profile (defaults to
+ * `default`, overridable with `ALCHEMY_PROFILE`).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    GitHubCredentials,
+    Effect.gen(function* () {
+      const auth = yield* getAuthProvider<
+        GitHubAuthConfig,
+        GitHubResolvedCredentials
+      >(GITHUB_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const ctx = yield* Effect.context<never>();
+
+      return yield* loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as GitHubAuthConfig),
+        ),
+        Effect.map((creds) => make(creds.token)),
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: `Failed to resolve GitHub credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+        Effect.provide(ctx),
+      );
+    }).pipe(Effect.orDie),
+  );

package/src/GitHub/Providers.ts

@@ -1,6 +1,32 @@
 import * as Layer from "effect/Layer";
-import { SecretProvider } from "./Secret.ts";
-import { VariableProvider } from "./Variable.ts";
+import * as Provider from "../Provider.ts";
+import { GitHubAuth } from "./AuthProvider.ts";
+import { Comment, CommentProvider } from "./Comment.ts";
+import * as Credentials from "./Credentials.ts";
+import { Secret, SecretProvider } from "./Secret.ts";
+import { Variable, VariableProvider } from "./Variable.ts";
 
+export { GitHubCredentials } from "./Credentials.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "GitHub",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * GitHub providers (Secret, Variable) plus the GitHub AuthProvider that
+ * `alchemy login` discovers.
+ */
 export const providers = () =>
-  Layer.mergeAll(SecretProvider(), VariableProvider());
+  Layer.effect(
+    Providers,
+    Provider.collection([Comment, Secret, Variable]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(CommentProvider(), SecretProvider(), VariableProvider()),
+    ),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(GitHubAuth),
+    Layer.orDie,
+  );

package/src/GitHub/Secret.ts

@@ -1,8 +1,10 @@
-import { Octokit } from "@octokit/rest";
+import type { Octokit } from "@octokit/rest";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
+import { GitHubCredentials } from "./Credentials.ts";
+import type * as GitHub from "./Providers.ts";
 
 export interface SecretProps {
   /**
@@ -31,12 +33,6 @@ export interface SecretProps {
    * GitHub Actions environment instead of the whole repository.
    */
   environment?: string;
-
-  /**
-   * GitHub API token. If not provided, falls back to
-   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
-   */
-  token?: string;
 }
 
 export interface Secret extends Resource<
@@ -47,7 +43,9 @@ export interface Secret extends Resource<
      * ISO-8601 timestamp of the last update.
      */
     updatedAt: string;
-  }
+  },
+  never,
+  GitHub.Providers
 > {}
 
 /**
@@ -58,9 +56,10 @@ export interface Secret extends Resource<
  * key via `libsodium` before being stored. The resource is idempotent —
  * calling it with the same name will update the secret value in place.
  *
- * Authentication is resolved in order: explicit `token` prop,
- * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
- * `repo` scope for private repositories or `public_repo` for public ones.
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
  *
  * @section Repository Secrets
  * Store secrets accessible to all GitHub Actions workflows in the
@@ -130,21 +129,20 @@ export interface Secret extends Resource<
  */
 export const Secret = Resource<Secret>("GitHub.Secret");
 
-function resolveToken(props: SecretProps): string | undefined {
-  return (
-    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
-  );
-}
-
-function createClient(props: SecretProps): Octokit {
-  return new Octokit({ auth: resolveToken(props) });
-}
+const getOctokit = Effect.gen(function* () {
+  const creds = yield* GitHubCredentials;
+  return creds.octokit();
+});
 
 async function encryptValue(
   plaintext: string,
   publicKey: string,
 ): Promise<string> {
-  const sodium = await import("libsodium-wrappers");
+  const mod = await import("libsodium-wrappers");
+  // Bun/ESM interop: the actual sodium API lives on `.default` when the
+  // CJS module is wrapped, but is the module itself under other loaders.
+  const sodium: typeof import("libsodium-wrappers") =
+    (mod as any).default ?? mod;
   await sodium.ready;
   const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
   const binMessage = sodium.from_string(plaintext);
@@ -155,13 +153,13 @@ async function encryptValue(
 export const SecretProvider = () =>
   Provider.succeed(Secret, {
     create: Effect.fn(function* ({ news }) {
-      const octokit = createClient(news);
+      const octokit = yield* getOctokit;
       yield* upsertSecret(octokit, news);
       return { updatedAt: new Date().toISOString() };
     }),
 
     update: Effect.fn(function* ({ news, olds }) {
-      const octokit = createClient(news);
+      const octokit = yield* getOctokit;
 
       const wasEnv = !!olds.environment;
       const isEnv = !!news.environment;
@@ -174,7 +172,7 @@ export const SecretProvider = () =>
     }),
 
     delete: Effect.fn(function* ({ olds }) {
-      const octokit = createClient(olds);
+      const octokit = yield* getOctokit;
       yield* deleteSecret(octokit, olds);
     }),
   });

package/src/GitHub/Variable.ts

@@ -1,7 +1,8 @@
-import { Octokit } from "@octokit/rest";
 import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
+import { GitHubCredentials } from "./Credentials.ts";
+import type * as GitHub from "./Providers.ts";
 
 export interface VariableProps {
   /**
@@ -23,12 +24,6 @@ export interface VariableProps {
    * Variable value.
    */
   value: string;
-
-  /**
-   * GitHub API token. If not provided, falls back to
-   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
-   */
-  token?: string;
 }
 
 export interface Variable extends Resource<
@@ -39,7 +34,9 @@ export interface Variable extends Resource<
      * ISO-8601 timestamp of the last update.
      */
     updatedAt: string;
-  }
+  },
+  never,
+  GitHub.Providers
 > {}
 
 /**
@@ -51,9 +48,10 @@ export interface Variable extends Resource<
  * labels, or feature flags. For sensitive values, use `GitHub.Secret`
  * instead.
  *
- * Authentication is resolved in order: explicit `token` prop,
- * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
- * `repo` scope for private repositories or `public_repo` for public ones.
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
  *
  * @section Repository Variables
  * Store variables accessible to all GitHub Actions workflows in the
@@ -104,20 +102,15 @@ export interface Variable extends Resource<
  */
 export const Variable = Resource<Variable>("GitHub.Variable");
 
-function resolveToken(props: VariableProps): string | undefined {
-  return (
-    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
-  );
-}
-
-function createClient(props: VariableProps): Octokit {
-  return new Octokit({ auth: resolveToken(props) });
-}
+const getOctokit = Effect.gen(function* () {
+  const creds = yield* GitHubCredentials;
+  return creds.octokit();
+});
 
 export const VariableProvider = () =>
   Provider.succeed(Variable, {
     create: Effect.fn(function* ({ news }) {
-      const octokit = createClient(news);
+      const octokit = yield* getOctokit;
 
       yield* Effect.tryPromise(() =>
         octokit.rest.actions.createRepoVariable({
@@ -132,7 +125,7 @@ export const VariableProvider = () =>
     }),
 
     update: Effect.fn(function* ({ news }) {
-      const octokit = createClient(news);
+      const octokit = yield* getOctokit;
 
       yield* Effect.tryPromise(() =>
         octokit.rest.actions.updateRepoVariable({
@@ -147,7 +140,7 @@ export const VariableProvider = () =>
     }),
 
     delete: Effect.fn(function* ({ olds }) {
-      const octokit = createClient(olds);
+      const octokit = yield* getOctokit;
 
       yield* Effect.tryPromise(async () => {
         try {

package/src/GitHub/index.ts

@@ -1,4 +1,6 @@
+export * as Auth from "./AuthProvider.ts";
 export * from "./Comment.ts";
+export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
 export * from "./Providers.ts";
 export * from "./Secret.ts";
 export * from "./Variable.ts";