alchemy 2.0.0-beta.16 → 2.0.0-beta.18

package/src/AWS/Providers.ts

@@ -49,13 +49,18 @@ export const providers = () =>
       AutoScaling.AutoScalingGroup,
       AutoScaling.LaunchTemplate,
       AutoScaling.ScalingPolicy,
+      CloudFront.CachePolicy,
       CloudFront.Distribution,
       CloudFront.Function,
       CloudFront.Invalidation,
+      CloudFront.KeyGroup,
       CloudFront.KeyValueStore,
       CloudFront.KvEntries,
       CloudFront.KvRoutesUpdate,
       CloudFront.OriginAccessControl,
+      CloudFront.OriginRequestPolicy,
+      CloudFront.PublicKey,
+      CloudFront.ResponseHeadersPolicy,
       CloudWatch.Alarm,
       CloudWatch.AlarmMuteRule,
       CloudWatch.AnomalyDetector,
@@ -124,6 +129,7 @@ export const providers = () =>
       EC2.Vpc,
       EC2.VpcEndpoint,
       ECR.Repository,
+      ECS.CapacityProvider,
       ECS.Cluster,
       ECS.DescribeTasksPolicy,
       ECS.ListTasksPolicy,
@@ -282,13 +288,18 @@ export const providers = () =>
         AutoScaling.AutoScalingGroupProvider(),
         AutoScaling.LaunchTemplateProvider(),
         AutoScaling.ScalingPolicyProvider(),
+        CloudFront.CachePolicyProvider(),
         CloudFront.DistributionProvider(),
         CloudFront.FunctionProvider(),
         CloudFront.InvalidationProvider(),
+        CloudFront.KeyGroupProvider(),
         CloudFront.KeyValueStoreProvider(),
         CloudFront.KvEntriesProvider(),
         CloudFront.KvRoutesUpdateProvider(),
         CloudFront.OriginAccessControlProvider(),
+        CloudFront.OriginRequestPolicyProvider(),
+        CloudFront.PublicKeyProvider(),
+        CloudFront.ResponseHeadersPolicyProvider(),
         CloudWatch.AlarmMuteRuleProvider(),
         CloudWatch.AlarmProvider(),
         CloudWatch.AnomalyDetectorProvider(),
@@ -357,6 +368,7 @@ export const providers = () =>
         EC2.VpcEndpointProvider(),
         EC2.VpcProvider(),
         ECR.RepositoryProvider(),
+        ECS.CapacityProviderProvider(),
         ECS.ClusterProvider(),
         ECS.DescribeTasksPolicyLive,
         ECS.ListTasksPolicyLive,

package/src/Auth/Credentials.ts

@@ -6,8 +6,11 @@ import { rootDir } from "./Profile.ts";
 
 const credentialsDirPath = path.join(rootDir, "credentials");
 
+export const profileCredentialsDirPath = (profile: string) =>
+  path.join(credentialsDirPath, profile);
+
 export const credentialsFilePath = (profile: string, provider: string) =>
-  path.join(credentialsDirPath, profile, `${provider}.json`);
+  path.join(profileCredentialsDirPath(profile), `${provider}.json`);
 
 export const readCredentials = Effect.fnUntraced(function* <T>(
   profile: string,
@@ -46,6 +49,19 @@ export const deleteCredentials = Effect.fnUntraced(function* (
     .pipe(Effect.catch(() => Effect.void));
 });
 
+/**
+ * Recursively remove the `~/.alchemy/credentials/{profile}` directory
+ * containing all per-provider secrets for `profile`. No-op if it doesn't exist.
+ */
+export const deleteProfileCredentials = Effect.fnUntraced(function* (
+  profile: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  yield* fs
+    .remove(profileCredentialsDirPath(profile), { recursive: true })
+    .pipe(Effect.catch(() => Effect.void));
+});
+
 export function displayRedacted(
   r: Redacted.Redacted<string>,
   visibleChars = 4,

package/src/Auth/Profile.ts

@@ -91,6 +91,21 @@ export const setProfile = (name: string, profile: AlchemyProfile) =>
     Effect.flatMap(writeConfig),
   );
 
+/**
+ * Remove `name` and all its provider credentials from the on-disk config.
+ * Returns `true` if the profile existed and was removed, `false` otherwise.
+ */
+export const deleteProfile = (name: string) =>
+  readConfig.pipe(
+    Effect.flatMap((config) => {
+      if (!(name in config.profiles)) {
+        return Effect.succeed(false);
+      }
+      delete config.profiles[name];
+      return writeConfig(config).pipe(Effect.as(true));
+    }),
+  );
+
 /**
  * Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
  * given `profile` (when explicitly passed via the CLI `--profile` flag),

package/src/Cloudflare/ApiToken/AccountApiToken.ts

@@ -50,6 +50,7 @@ export type AccountApiToken = Resource<
  * ```typescript
  * const token = yield* Cloudflare.AccountApiToken("ci-token", {
  *   name: "my-ci-token",
+ *   accountId,
  *   policies: [
  *     {
  *       effect: "allow",
@@ -57,7 +58,7 @@ export type AccountApiToken = Resource<
  *         "Workers Scripts Write",
  *         "Workers KV Storage Write",
  *       ],
- *       resources: { "com.cloudflare.api.account": "*" },
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
  *     },
  *   ],
  * });
@@ -120,10 +121,10 @@ export const AccountApiTokenProvider = () =>
           const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
           const newName = yield* resolveName(id, news.name);
           const oldPolicyFp = policyFingerprint(
-            resolvePolicies(olds?.policies ?? [], oldAccountId),
+            resolvePolicies(olds?.policies ?? []),
           );
           const newPolicyFp = policyFingerprint(
-            resolvePolicies(news.policies, newAccountId),
+            resolvePolicies(news.policies),
           );
           const oldCondFp = conditionFingerprint(olds?.condition);
           const newCondFp = conditionFingerprint(news.condition);
@@ -140,7 +141,7 @@ export const AccountApiTokenProvider = () =>
         create: Effect.fn(function* ({ id, news }) {
           const accountId = news.accountId ?? defaultAccountId;
           const name = yield* resolveName(id, news.name);
-          const policies = resolvePolicies(news.policies, accountId);
+          const policies = resolvePolicies(news.policies);
           const result = yield* createToken({
             accountId,
             name,
@@ -163,7 +164,7 @@ export const AccountApiTokenProvider = () =>
         update: Effect.fn(function* ({ id, news, output }) {
           const accountId = news.accountId ?? defaultAccountId;
           const name = yield* resolveName(id, news.name);
-          const policies = resolvePolicies(news.policies, accountId);
+          const policies = resolvePolicies(news.policies);
           const result = yield* updateToken({
             accountId,
             tokenId: output.tokenId,

package/src/Cloudflare/ApiToken/Common.ts

@@ -6,14 +6,13 @@ import {
 /**
  * Resource keys recognized by Cloudflare API token policies.
  *
- * The literal `"com.cloudflare.api.account"` is rewritten by the account-scoped
- * provider to `"com.cloudflare.api.account.${accountId}"` so callers don't have
- * to splice the account ID themselves.
+ * Cloudflare requires the account ID to be embedded directly in the resource
+ * key (e.g. `com.cloudflare.api.account.<accountId>`); pass the fully-qualified
+ * key — no rewriting is performed.
  *
  * @see https://developers.cloudflare.com/fundamentals/api/reference/permissions/
  */
 export type ApiTokenResourceKey =
-  | "com.cloudflare.api.account"
   | `com.cloudflare.api.account.${string}`
   | `com.cloudflare.api.account.zone.${string}`
   | `com.cloudflare.edge.r2.bucket.${string}`
@@ -86,35 +85,24 @@ export const resolvePermissionGroup = (ref: ApiTokenPermissionGroupRef) => {
   return ref.meta ? { id: ref.id, meta: ref.meta } : { id: ref.id };
 };
 
-/**
- * Rewrite the bare `"com.cloudflare.api.account"` key to the
- * account-scoped form. Pass `accountId: undefined` to leave keys unchanged
- * (e.g. for user-owned tokens whose policies don't carry an account scope).
- */
-export const resolveResources = (
+const resolveResources = (
   resources: ApiTokenPolicy["resources"],
-  accountId: string | undefined,
 ): Record<string, string> => {
   const out: Record<string, string> = {};
   for (const [key, value] of Object.entries(resources)) {
     if (value === undefined) continue;
-    if (key === "com.cloudflare.api.account" && accountId) {
-      out[`com.cloudflare.api.account.${accountId}`] = value;
-    } else {
-      out[key] = value;
-    }
+    out[key] = value;
   }
   return out;
 };
 
 export const resolvePolicies = (
   policies: ApiTokenPolicy[],
-  accountId: string | undefined,
 ): ResolvedPolicy[] =>
   policies.map((policy) => ({
     effect: policy.effect,
     permissionGroups: policy.permissionGroups.map(resolvePermissionGroup),
-    resources: resolveResources(policy.resources, accountId),
+    resources: resolveResources(policy.resources),
   }));
 
 export const policyFingerprint = (policies: ResolvedPolicy[]): string =>

package/src/Cloudflare/ApiToken/UserApiToken.ts

@@ -100,10 +100,10 @@ export const UserApiTokenProvider = () =>
           const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
           const newName = yield* resolveName(id, news.name);
           const oldPolicyFp = policyFingerprint(
-            resolvePolicies(olds?.policies ?? [], olds?.accountId),
+            resolvePolicies(olds?.policies ?? []),
           );
           const newPolicyFp = policyFingerprint(
-            resolvePolicies(news.policies, news.accountId),
+            resolvePolicies(news.policies),
           );
           const oldCondFp = conditionFingerprint(olds?.condition);
           const newCondFp = conditionFingerprint(news.condition);
@@ -119,7 +119,7 @@ export const UserApiTokenProvider = () =>
         }),
         create: Effect.fn(function* ({ id, news }) {
           const name = yield* resolveName(id, news.name);
-          const policies = resolvePolicies(news.policies, news.accountId);
+          const policies = resolvePolicies(news.policies);
           const result = yield* createToken({
             name,
             policies,
@@ -136,7 +136,7 @@ export const UserApiTokenProvider = () =>
         }),
         update: Effect.fn(function* ({ id, news, output }) {
           const name = yield* resolveName(id, news.name);
-          const policies = resolvePolicies(news.policies, news.accountId);
+          const policies = resolvePolicies(news.policies);
           const result = yield* updateToken({
             tokenId: output.tokenId,
             name,

package/src/GitHub/Comment.ts

@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
 import { dedent } from "../Util/dedent.ts";
+import * as GitHub from "./Providers.ts";
 
 export interface CommentProps {
   /**
@@ -62,7 +63,9 @@ export interface Comment extends Resource<
      * ISO-8601 timestamp of the last update.
      */
     updatedAt: string;
-  }
+  },
+  never,
+  GitHub.Providers
 > {}
 
 /**

package/src/GitHub/Providers.ts

@@ -1,6 +1,7 @@
 import * as Layer from "effect/Layer";
 import * as Provider from "../Provider.ts";
 import { GitHubAuth } from "./AuthProvider.ts";
+import { Comment, CommentProvider } from "./Comment.ts";
 import * as Credentials from "./Credentials.ts";
 import { Secret, SecretProvider } from "./Secret.ts";
 import { Variable, VariableProvider } from "./Variable.ts";
@@ -18,8 +19,13 @@ export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
  * `alchemy login` discovers.
  */
 export const providers = () =>
-  Layer.effect(Providers, Provider.collection([Secret, Variable])).pipe(
-    Layer.provide(Layer.mergeAll(SecretProvider(), VariableProvider())),
+  Layer.effect(
+    Providers,
+    Provider.collection([Comment, Secret, Variable]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(CommentProvider(), SecretProvider(), VariableProvider()),
+    ),
     Layer.provideMerge(Credentials.fromAuthProvider()),
     Layer.provideMerge(GitHubAuth),
     Layer.orDie,

package/src/GitHub/Secret.ts

@@ -4,7 +4,7 @@ import * as Redacted from "effect/Redacted";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
 import { GitHubCredentials } from "./Credentials.ts";
-import type { Providers } from "./Providers.ts";
+import type * as GitHub from "./Providers.ts";
 
 export interface SecretProps {
   /**
@@ -45,7 +45,7 @@ export interface Secret extends Resource<
     updatedAt: string;
   },
   never,
-  Providers
+  GitHub.Providers
 > {}
 
 /**

package/src/GitHub/Secrets.ts

@@ -0,0 +1,66 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+import type { Input } from "../Input.ts";
+import { Secret } from "./Secret.ts";
+
+export interface SecretsProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Optional environment name. When set every secret is scoped to that
+   * GitHub Actions environment instead of the whole repository.
+   */
+  environment?: string;
+
+  /**
+   * Map of secret name to value. Plain strings are wrapped with
+   * `Redacted.make`; already-redacted values are passed through.
+   */
+  secrets: Record<string, Input<string | Redacted.Redacted<string>>>;
+}
+
+/**
+ * Bulk-creates a set of {@link Secret}s in the same repository (and
+ * optionally the same environment).
+ *
+ * Each entry in `secrets` becomes one `GitHub.Secret` resource, using the
+ * map key as both the alchemy logical id and the secret name.
+ *
+ * @example
+ * ```ts
+ * yield* GitHub.Secrets({
+ *   owner: "alchemy-run",
+ *   repository: "alchemy-effect",
+ *   secrets: {
+ *     AXIOM_INGEST_TOKEN: tokenValue,
+ *     AXIOM_DATASET_TRACES: traces.name,
+ *   },
+ * });
+ * ```
+ */
+export const Secrets = ({
+  owner,
+  repository,
+  environment,
+  secrets,
+}: SecretsProps) =>
+  Effect.all(
+    Object.entries(secrets).map(([name, value]) =>
+      Secret(name, {
+        owner,
+        repository,
+        environment,
+        name,
+        value: Redacted.make(value),
+      }),
+    ),
+  );

package/src/GitHub/Variable.ts

@@ -2,7 +2,7 @@ import * as Effect from "effect/Effect";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
 import { GitHubCredentials } from "./Credentials.ts";
-import type { Providers } from "./Providers.ts";
+import type * as GitHub from "./Providers.ts";
 
 export interface VariableProps {
   /**
@@ -36,7 +36,7 @@ export interface Variable extends Resource<
     updatedAt: string;
   },
   never,
-  Providers
+  GitHub.Providers
 > {}
 
 /**

package/src/GitHub/index.ts

@@ -3,4 +3,5 @@ export * from "./Comment.ts";
 export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
 export * from "./Providers.ts";
 export * from "./Secret.ts";
+export * from "./Secrets.ts";
 export * from "./Variable.ts";