alchemy 2.0.0-beta.17 → 2.0.0-beta.18

package/lib/GitHub/Secrets.js

@@ -0,0 +1,30 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { Secret } from "./Secret.js";
+/**
+ * Bulk-creates a set of {@link Secret}s in the same repository (and
+ * optionally the same environment).
+ *
+ * Each entry in `secrets` becomes one `GitHub.Secret` resource, using the
+ * map key as both the alchemy logical id and the secret name.
+ *
+ * @example
+ * ```ts
+ * yield* GitHub.Secrets({
+ *   owner: "alchemy-run",
+ *   repository: "alchemy-effect",
+ *   secrets: {
+ *     AXIOM_INGEST_TOKEN: tokenValue,
+ *     AXIOM_DATASET_TRACES: traces.name,
+ *   },
+ * });
+ * ```
+ */
+export const Secrets = ({ owner, repository, environment, secrets, }) => Effect.all(Object.entries(secrets).map(([name, value]) => Secret(name, {
+    owner,
+    repository,
+    environment,
+    name,
+    value: Redacted.make(value),
+})));
+//# sourceMappingURL=Secrets.js.map

package/lib/GitHub/Secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secrets.js","sourceRoot":"","sources":["../../src/GitHub/Secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0BrC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EACtB,KAAK,EACL,UAAU,EACV,WAAW,EACX,OAAO,GACM,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAC5C,MAAM,CAAC,IAAI,EAAE;IACX,KAAK;IACL,UAAU;IACV,WAAW;IACX,IAAI;IACJ,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;CAC5B,CAAC,CACH,CACF,CAAC"}

package/lib/GitHub/index.d.ts

@@ -3,5 +3,6 @@ export * from "./Comment.ts";
 export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
 export * from "./Providers.ts";
 export * from "./Secret.ts";
+export * from "./Secrets.ts";
 export * from "./Variable.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/GitHub/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/lib/GitHub/index.js

@@ -3,5 +3,6 @@ export * from "./Comment.js";
 export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.js";
 export * from "./Providers.js";
 export * from "./Secret.js";
+export * from "./Secrets.js";
 export * from "./Variable.js";
 //# sourceMappingURL=index.js.map

package/lib/GitHub/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/GitHub/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.17",
+  "version": "2.0.0-beta.18",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",

package/src/AWS/CloudFront/CachePolicy.ts

@@ -0,0 +1,271 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface CachePolicyProps {
+  /**
+   * Name of the cache policy. If omitted, a deterministic name is generated.
+   *
+   * Names must be unique per AWS account. Changing the name triggers
+   * a replacement.
+   */
+  name?: string;
+  /**
+   * Optional comment describing the policy.
+   */
+  comment?: string;
+  /**
+   * Minimum amount of time, in seconds, that objects stay in the cache.
+   */
+  minTTL: number;
+  /**
+   * Default amount of time, in seconds, that objects stay in the cache when
+   * the origin does not send `Cache-Control` or `Expires` headers.
+   */
+  defaultTTL?: number;
+  /**
+   * Maximum amount of time, in seconds, that objects stay in the cache.
+   */
+  maxTTL?: number;
+  /**
+   * Controls which request values become part of the cache key and which
+   * additional headers/cookies/query strings CloudFront forwards to the origin.
+   */
+  parametersInCacheKeyAndForwardedToOrigin?: cloudfront.ParametersInCacheKeyAndForwardedToOrigin;
+}
+
+export interface CachePolicy extends Resource<
+  "AWS.CloudFront.CachePolicy",
+  CachePolicyProps,
+  {
+    /**
+     * CloudFront-assigned cache policy identifier.
+     */
+    cachePolicyId: string;
+    /**
+     * Name of the cache policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current minimum TTL.
+     */
+    minTTL: number;
+    /**
+     * Current default TTL.
+     */
+    defaultTTL: number | undefined;
+    /**
+     * Current maximum TTL.
+     */
+    maxTTL: number | undefined;
+    /**
+     * Current cache-key/forwarded-value configuration.
+     */
+    parametersInCacheKeyAndForwardedToOrigin:
+      | cloudfront.ParametersInCacheKeyAndForwardedToOrigin
+      | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront cache policy.
+ *
+ * Cache policies determine the values CloudFront includes in the cache key,
+ * the headers, cookies and query strings it forwards to the origin, and the
+ * TTL bounds for cached responses. Policies are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * For AWS-managed policies (CachingOptimized, CachingDisabled,
+ * AllViewerExceptHostHeader) reference them by ID via the constants in
+ * {@link ManagedPolicies} instead of creating a custom policy.
+ *
+ * @section Creating Cache Policies
+ * @example Cache by query string and Authorization header
+ * ```typescript
+ * const cachePolicy = yield* CachePolicy("ApiCachePolicy", {
+ *   comment: "Cache GETs by query string + Authorization",
+ *   minTTL: 0,
+ *   defaultTTL: 60,
+ *   maxTTL: 3600,
+ *   parametersInCacheKeyAndForwardedToOrigin: {
+ *     EnableAcceptEncodingGzip: true,
+ *     EnableAcceptEncodingBrotli: true,
+ *     HeadersConfig: {
+ *       HeaderBehavior: "whitelist",
+ *       Headers: { Quantity: 1, Items: ["Authorization"] },
+ *     },
+ *     CookiesConfig: { CookieBehavior: "none" },
+ *     QueryStringsConfig: { QueryStringBehavior: "all" },
+ *   },
+ * });
+ * ```
+ */
+export const CachePolicy = Resource<CachePolicy>("AWS.CloudFront.CachePolicy");
+
+export const CachePolicyProvider = () =>
+  Provider.effect(
+    CachePolicy,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getCachePolicyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchCachePolicy", () => Effect.succeed(undefined)),
+          );
+        if (!config?.CachePolicyConfig) return undefined;
+        return { config: config.CachePolicyConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listCachePolicies({ Type: "custom" });
+        const summary = listed.CachePolicyList?.Items?.find(
+          (item) => item.CachePolicy?.CachePolicyConfig?.Name === name,
+        );
+        if (!summary?.CachePolicy?.Id) return undefined;
+        return yield* getById(summary.CachePolicy.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.CachePolicy.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        props: CachePolicyProps,
+      ): cloudfront.CachePolicyConfig => ({
+        Name: name,
+        Comment: props.comment,
+        MinTTL: props.minTTL,
+        DefaultTTL: props.defaultTTL,
+        MaxTTL: props.maxTTL,
+        ParametersInCacheKeyAndForwardedToOrigin:
+          props.parametersInCacheKeyAndForwardedToOrigin,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.CachePolicyConfig,
+        etag: string | undefined,
+      ) => ({
+        cachePolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        minTTL: config.MinTTL,
+        defaultTTL: config.DefaultTTL,
+        maxTTL: config.MaxTTL,
+        parametersInCacheKeyAndForwardedToOrigin:
+          config.ParametersInCacheKeyAndForwardedToOrigin,
+      });
+
+      return {
+        stables: ["cachePolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.cachePolicyId) {
+            const found = yield* getById(output.cachePolicyId);
+            if (found) return toAttrs(output.cachePolicyId, found.config, found.etag);
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* createName(id, news);
+          const created = yield* cloudfront
+            .createCachePolicy({ CachePolicyConfig: buildConfig(name, news) })
+            .pipe(
+              Effect.catchTag("CachePolicyAlreadyExists", () =>
+                getByName(name).pipe(
+                  Effect.flatMap((existing) =>
+                    existing
+                      ? Effect.succeed({
+                          CachePolicy: {
+                            Id: existing.id,
+                            LastModifiedTime: new Date(),
+                            CachePolicyConfig: existing.config,
+                          },
+                          ETag: existing.etag,
+                          Location: undefined,
+                        })
+                      : Effect.fail(
+                          new Error(
+                            `Cache policy '${name}' already exists but could not be recovered`,
+                          ),
+                        ),
+                  ),
+                ),
+              ),
+            );
+          if (!created.CachePolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("createCachePolicy returned no identifier"),
+            );
+          }
+          yield* session.note(created.CachePolicy.Id);
+          return toAttrs(
+            created.CachePolicy.Id,
+            created.CachePolicy.CachePolicyConfig,
+            created.ETag,
+          );
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+          const current = yield* getById(output.cachePolicyId);
+          const updated = yield* cloudfront.updateCachePolicy({
+            Id: output.cachePolicyId,
+            IfMatch: current?.etag ?? output.etag,
+            CachePolicyConfig: buildConfig(output.name, news),
+          });
+          if (!updated.CachePolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("updateCachePolicy returned no identifier"),
+            );
+          }
+          yield* session.note(output.cachePolicyId);
+          return toAttrs(
+            updated.CachePolicy.Id,
+            updated.CachePolicy.CachePolicyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.cachePolicyId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteCachePolicy({
+              Id: output.cachePolicyId,
+              IfMatch: current.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchCachePolicy", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: CachePolicyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });

package/src/AWS/CloudFront/KeyGroup.ts

@@ -0,0 +1,233 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface KeyGroupProps {
+  /**
+   * Name of the key group. If omitted, a deterministic name is generated.
+   *
+   * Names must be unique per AWS account. Changing the name triggers
+   * a replacement.
+   */
+  name?: string;
+  /**
+   * Public key IDs that belong to the group. Order is preserved.
+   */
+  items: Input<string>[];
+  /**
+   * Optional comment describing the group.
+   */
+  comment?: string;
+}
+
+export interface KeyGroup extends Resource<
+  "AWS.CloudFront.KeyGroup",
+  KeyGroupProps,
+  {
+    /**
+     * CloudFront-assigned key group identifier. Used by Distributions in
+     * `TrustedKeyGroups` to authorize signed URLs/cookies.
+     */
+    keyGroupId: string;
+    /**
+     * Name of the key group.
+     */
+    name: string;
+    /**
+     * Public key IDs that belong to the group.
+     */
+    items: string[];
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the group.
+     */
+    comment: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront key group.
+ *
+ * Key groups bundle one or more {@link PublicKey} resources for use as
+ * `TrustedKeyGroups` on a Distribution's cache behavior. CloudFront uses
+ * the keys in the group to verify the signatures on signed URLs and
+ * signed cookies for that behavior.
+ *
+ * @section Creating Key Groups
+ * @example Group two public keys for signed URL verification
+ * ```typescript
+ * const primary = yield* PublicKey("PrimarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./primary.pem"),
+ * });
+ * const secondary = yield* PublicKey("SecondarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./secondary.pem"),
+ * });
+ *
+ * const keyGroup = yield* KeyGroup("SignedUrlKeys", {
+ *   comment: "Trusted signers for /private",
+ *   items: [primary.publicKeyId, secondary.publicKeyId],
+ * });
+ * ```
+ */
+export const KeyGroup = Resource<KeyGroup>("AWS.CloudFront.KeyGroup");
+
+export const KeyGroupProvider = () =>
+  Provider.effect(
+    KeyGroup,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getKeyGroupConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchResource", () => Effect.succeed(undefined)),
+          );
+        if (!config?.KeyGroupConfig) return undefined;
+        return { config: config.KeyGroupConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listKeyGroups({});
+        const summary = listed.KeyGroupList?.Items?.find(
+          (item) => item.KeyGroup?.KeyGroupConfig?.Name === name,
+        );
+        if (!summary?.KeyGroup?.Id) return undefined;
+        return yield* getById(summary.KeyGroup.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.KeyGroup.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        items: string[],
+        comment: string | undefined,
+      ): cloudfront.KeyGroupConfig => ({
+        Name: name,
+        Items: items,
+        Comment: comment,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.KeyGroupConfig,
+        etag: string | undefined,
+      ) => ({
+        keyGroupId: id,
+        name: config.Name,
+        items: config.Items,
+        etag,
+        comment: config.Comment,
+      });
+
+      return {
+        stables: ["keyGroupId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.keyGroupId) {
+            const found = yield* getById(output.keyGroupId);
+            if (found) return toAttrs(output.keyGroupId, found.config, found.etag);
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* createName(id, news);
+          const items = news.items as string[];
+          const created = yield* cloudfront
+            .createKeyGroup({
+              KeyGroupConfig: buildConfig(name, items, news.comment),
+            })
+            .pipe(
+              Effect.catchTag("KeyGroupAlreadyExists", () =>
+                getByName(name).pipe(
+                  Effect.flatMap((existing) =>
+                    existing
+                      ? Effect.succeed({
+                          KeyGroup: {
+                            Id: existing.id,
+                            LastModifiedTime: new Date(),
+                            KeyGroupConfig: existing.config,
+                          },
+                          ETag: existing.etag,
+                          Location: undefined,
+                        })
+                      : Effect.fail(
+                          new Error(
+                            `Key group '${name}' already exists but could not be recovered`,
+                          ),
+                        ),
+                  ),
+                ),
+              ),
+            );
+          if (!created.KeyGroup?.Id) {
+            return yield* Effect.fail(
+              new Error("createKeyGroup returned no identifier"),
+            );
+          }
+          yield* session.note(created.KeyGroup.Id);
+          return toAttrs(
+            created.KeyGroup.Id,
+            created.KeyGroup.KeyGroupConfig,
+            created.ETag,
+          );
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+          const current = yield* getById(output.keyGroupId);
+          const items = news.items as string[];
+          const updated = yield* cloudfront.updateKeyGroup({
+            Id: output.keyGroupId,
+            IfMatch: current?.etag ?? output.etag,
+            KeyGroupConfig: buildConfig(output.name, items, news.comment),
+          });
+          if (!updated.KeyGroup?.Id) {
+            return yield* Effect.fail(
+              new Error("updateKeyGroup returned no identifier"),
+            );
+          }
+          yield* session.note(output.keyGroupId);
+          return toAttrs(
+            updated.KeyGroup.Id,
+            updated.KeyGroup.KeyGroupConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.keyGroupId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteKeyGroup({
+              Id: output.keyGroupId,
+              IfMatch: current.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchResource", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: { name?: string }) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });