alchemy 2.0.0-beta.2 → 2.0.0-beta.test-export-fix-3

package/src/Construct.ts

@@ -12,8 +12,8 @@ import * as Namespace from "./Namespace.ts";
  * @section Creating Constructs
  * @example Simple Reusable Construct
  * ```typescript
- * import * as Construct from "alchemy-effect/Construct";
- * import { Bucket } from "alchemy-effect/AWS/S3";
+ * import * as Construct from "alchemy/Construct";
+ * import { Bucket } from "alchemy/AWS/S3";
  *
  * export const Logs = Construct.fn(function* (
  *   id: string,

package/src/GitHub/Comment.ts

@@ -0,0 +1,224 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { dedent } from "../Util/dedent.ts";
+
+export interface CommentProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Issue or Pull Request number to comment on.
+   */
+  issueNumber: number;
+
+  /**
+   * Comment body (supports GitHub Markdown).
+   *
+   * The body is automatically dedented, so you can use indented template
+   * literals without worrying about leading whitespace. Accepts
+   * `Output<string>` at the call site via `Output.interpolate` to embed
+   * resource attributes that are not yet resolved.
+   */
+  body: string;
+
+  /**
+   * Whether to allow deletion of the comment when the resource is destroyed.
+   * By default, comments are never deleted to preserve discussion history.
+   * @default false
+   */
+  allowDelete?: boolean;
+
+  /**
+   * GitHub API token. If not provided, falls back to
+   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+   */
+  token?: string;
+}
+
+export interface Comment extends Resource<
+  "GitHub.Comment",
+  CommentProps,
+  {
+    /**
+     * The numeric ID of the comment in GitHub.
+     */
+    commentId: number;
+
+    /**
+     * URL to view the comment in a browser.
+     */
+    htmlUrl: string;
+
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+  }
+> {}
+
+/**
+ * A GitHub issue or pull request comment.
+ *
+ * `Comment` manages the lifecycle of a single comment on an issue or pull
+ * request. Comments are created on the first deploy and updated in place on
+ * subsequent deploys when the `body` changes. By default, comments are never
+ * deleted to preserve discussion history — set `allowDelete: true` to opt in.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Creating Comments
+ * @example Comment on an Issue
+ * ```typescript
+ * const comment = yield* GitHub.Comment("issue-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This is a comment created by Alchemy!",
+ * });
+ * ```
+ *
+ * @example Comment on a Pull Request
+ * ```typescript
+ * const prComment = yield* GitHub.Comment("pr-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 456,
+ *   body: "## Deployment Status\n\nSuccessfully deployed to staging!",
+ * });
+ * ```
+ *
+ * @section Updating Comments
+ * Deploy with the same logical ID and a different `body` to update the
+ * existing comment in place rather than creating a new one.
+ *
+ * @example Update Comment Content
+ * ```typescript
+ * const comment = yield* GitHub.Comment("status-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 789,
+ *   body: "Deployment completed successfully!",
+ * });
+ * ```
+ *
+ * @section Deleting Comments
+ * @example Allow Comment Deletion
+ * ```typescript
+ * const comment = yield* GitHub.Comment("temp-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This comment can be deleted",
+ *   allowDelete: true,
+ * });
+ * ```
+ *
+ * @section CI Preview Comments
+ * A common pattern is posting a preview-deployment URL on every pull request.
+ * The comment auto-updates on each push because the logical ID stays the same.
+ *
+ * @example PR Preview Comment
+ * ```typescript
+ * if (process.env.PULL_REQUEST) {
+ *   yield* GitHub.Comment("preview-comment", {
+ *     owner: "my-org",
+ *     repository: "my-repo",
+ *     issueNumber: Number(process.env.PULL_REQUEST),
+ *     body: Output.interpolate`
+ *       ## Preview Deployed
+ *
+ *       **URL:** ${website.url}
+ *     `,
+ *   });
+ * }
+ * ```
+ */
+export const Comment = Resource<Comment>("GitHub.Comment");
+
+function resolveToken(props: CommentProps): string | undefined {
+  return (
+    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
+  );
+}
+
+function createClient(props: CommentProps): Octokit {
+  return new Octokit({ auth: resolveToken(props) });
+}
+
+export const CommentProvider = () =>
+  Provider.succeed(Comment, {
+    stables: ["commentId"],
+
+    create: Effect.fn(function* ({ news }) {
+      const octokit = createClient(news);
+      const body = dedent(news.body);
+
+      const { data } = yield* Effect.tryPromise(() =>
+        octokit.rest.issues.createComment({
+          owner: news.owner,
+          repo: news.repository,
+          issue_number: news.issueNumber,
+          body,
+        }),
+      );
+
+      return {
+        commentId: data.id,
+        htmlUrl: data.html_url,
+        updatedAt: data.updated_at,
+      };
+    }),
+
+    update: Effect.fn(function* ({ news, output }) {
+      const octokit = createClient(news);
+      const body = dedent(news.body);
+
+      const { data } = yield* Effect.tryPromise(() =>
+        octokit.rest.issues.updateComment({
+          owner: news.owner,
+          repo: news.repository,
+          comment_id: output.commentId,
+          body,
+        }),
+      );
+
+      return {
+        commentId: data.id,
+        htmlUrl: data.html_url,
+        updatedAt: data.updated_at,
+      };
+    }),
+
+    delete: Effect.fn(function* ({ olds, output }) {
+      if (!olds.allowDelete) {
+        return;
+      }
+
+      const octokit = createClient(olds);
+
+      yield* Effect.tryPromise(async () => {
+        try {
+          await octokit.rest.issues.deleteComment({
+            owner: olds.owner,
+            repo: olds.repository,
+            comment_id: output.commentId,
+          });
+        } catch (error: any) {
+          if (error.status !== 404) {
+            throw error;
+          }
+        }
+      });
+    }),
+  });

package/src/GitHub/Secret.ts

@@ -0,0 +1,257 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+
+export interface SecretProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Secret name (e.g. `AWS_ROLE_ARN`).
+   */
+  name: string;
+
+  /**
+   * Secret value. Wrap with `Redacted.make` to prevent the value from
+   * appearing in logs or state.
+   */
+  value: Redacted.Redacted;
+
+  /**
+   * Optional environment name. When set the secret is scoped to that
+   * GitHub Actions environment instead of the whole repository.
+   */
+  environment?: string;
+
+  /**
+   * GitHub API token. If not provided, falls back to
+   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+   */
+  token?: string;
+}
+
+export interface Secret extends Resource<
+  "GitHub.Secret",
+  SecretProps,
+  {
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+  }
+> {}
+
+/**
+ * A GitHub Actions repository or environment secret.
+ *
+ * `Secret` manages the lifecycle of an encrypted secret in GitHub Actions.
+ * Secrets are encrypted using the repository's (or environment's) public
+ * key via `libsodium` before being stored. The resource is idempotent —
+ * calling it with the same name will update the secret value in place.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Repository Secrets
+ * Store secrets accessible to all GitHub Actions workflows in the
+ * repository.
+ *
+ * @example Create a Repository Secret
+ * ```typescript
+ * yield* GitHub.Secret("aws-role", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @section Environment Secrets
+ * Scope a secret to a specific GitHub Actions environment (e.g.
+ * `production`, `staging`). Environment secrets require environment
+ * protection rules to be satisfied before workflows can access them.
+ *
+ * @example Create an Environment Secret
+ * ```typescript
+ * yield* GitHub.Secret("deploy-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DEPLOY_KEY",
+ *   value: Redacted.make("my-secret-value"),
+ * });
+ * ```
+ *
+ * @section Wiring with Other Resources
+ * A common pattern is wiring the output of another resource — like an
+ * IAM role ARN or a database URL — directly into a GitHub secret so
+ * that CI workflows can use it.
+ *
+ * @example Store an IAM Role ARN for CI
+ * ```typescript
+ * const role = yield* AWS.IAM.Role("ci-role", { ... });
+ *
+ * yield* GitHub.Secret("ci-role-arn", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @example Store Multiple Secrets
+ * ```typescript
+ * yield* GitHub.Secret("db-url", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DATABASE_URL",
+ *   value: Redacted.make(database.connectionString),
+ * });
+ *
+ * yield* GitHub.Secret("api-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "API_KEY",
+ *   value: Redacted.make(apiKey),
+ * });
+ * ```
+ */
+export const Secret = Resource<Secret>("GitHub.Secret");
+
+function resolveToken(props: SecretProps): string | undefined {
+  return (
+    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
+  );
+}
+
+function createClient(props: SecretProps): Octokit {
+  return new Octokit({ auth: resolveToken(props) });
+}
+
+async function encryptValue(
+  plaintext: string,
+  publicKey: string,
+): Promise<string> {
+  const sodium = await import("libsodium-wrappers");
+  await sodium.ready;
+  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+  const binMessage = sodium.from_string(plaintext);
+  const encrypted = sodium.crypto_box_seal(binMessage, binKey);
+  return sodium.to_base64(encrypted, sodium.base64_variants.ORIGINAL);
+}
+
+export const SecretProvider = () =>
+  Provider.succeed(Secret, {
+    create: Effect.fn(function* ({ news }) {
+      const octokit = createClient(news);
+      yield* upsertSecret(octokit, news);
+      return { updatedAt: new Date().toISOString() };
+    }),
+
+    update: Effect.fn(function* ({ news, olds }) {
+      const octokit = createClient(news);
+
+      const wasEnv = !!olds.environment;
+      const isEnv = !!news.environment;
+      if (wasEnv !== isEnv || olds.environment !== news.environment) {
+        yield* deleteSecret(octokit, olds);
+      }
+
+      yield* upsertSecret(octokit, news);
+      return { updatedAt: new Date().toISOString() };
+    }),
+
+    delete: Effect.fn(function* ({ olds }) {
+      const octokit = createClient(olds);
+      yield* deleteSecret(octokit, olds);
+    }),
+  });
+
+const upsertSecret = Effect.fn(function* (
+  octokit: Octokit,
+  props: SecretProps,
+) {
+  const plaintext = Redacted.value(props.value);
+  const isEnv = !!props.environment;
+
+  const publicKey = yield* Effect.tryPromise(async () => {
+    if (isEnv) {
+      const { data } = await octokit.rest.actions.getEnvironmentPublicKey({
+        owner: props.owner,
+        repo: props.repository,
+        environment_name: props.environment!,
+      });
+      return data;
+    }
+    const { data } = await octokit.rest.actions.getRepoPublicKey({
+      owner: props.owner,
+      repo: props.repository,
+    });
+    return data;
+  });
+
+  const encrypted = yield* Effect.tryPromise(() =>
+    encryptValue(plaintext, publicKey.key),
+  );
+
+  yield* Effect.tryPromise(async () => {
+    if (isEnv) {
+      await octokit.rest.actions.createOrUpdateEnvironmentSecret({
+        owner: props.owner,
+        repo: props.repository,
+        environment_name: props.environment!,
+        secret_name: props.name,
+        encrypted_value: encrypted,
+        key_id: publicKey.key_id,
+      });
+    } else {
+      await octokit.rest.actions.createOrUpdateRepoSecret({
+        owner: props.owner,
+        repo: props.repository,
+        secret_name: props.name,
+        encrypted_value: encrypted,
+        key_id: publicKey.key_id,
+      });
+    }
+  });
+});
+
+const deleteSecret = Effect.fn(function* (
+  octokit: Octokit,
+  props: SecretProps,
+) {
+  yield* Effect.tryPromise(async () => {
+    try {
+      if (props.environment) {
+        await octokit.rest.actions.deleteEnvironmentSecret({
+          owner: props.owner,
+          repo: props.repository,
+          environment_name: props.environment,
+          secret_name: props.name,
+        });
+      } else {
+        await octokit.rest.actions.deleteRepoSecret({
+          owner: props.owner,
+          repo: props.repository,
+          secret_name: props.name,
+        });
+      }
+    } catch (error: any) {
+      if (error.status !== 404) {
+        throw error;
+      }
+    }
+  });
+});

package/src/GitHub/Variable.ts

@@ -0,0 +1,166 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+
+export interface VariableProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Variable name (e.g. `AWS_ROLE_ARN`).
+   */
+  name: string;
+
+  /**
+   * Variable value.
+   */
+  value: string;
+
+  /**
+   * GitHub API token. If not provided, falls back to
+   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+   */
+  token?: string;
+}
+
+export interface Variable extends Resource<
+  "GitHub.Variable",
+  VariableProps,
+  {
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+  }
+> {}
+
+/**
+ * A GitHub Actions repository variable.
+ *
+ * `Variable` manages the lifecycle of a plain-text configuration variable
+ * in GitHub Actions. Variables are visible in workflow logs and are
+ * suitable for non-sensitive configuration like region names, environment
+ * labels, or feature flags. For sensitive values, use `GitHub.Secret`
+ * instead.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Repository Variables
+ * Store variables accessible to all GitHub Actions workflows in the
+ * repository.
+ *
+ * @example Create a Repository Variable
+ * ```typescript
+ * yield* GitHub.Variable("aws-region", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_REGION",
+ *   value: "us-east-1",
+ * });
+ * ```
+ *
+ * @section Wiring with Other Resources
+ * Pass output attributes from other resources into GitHub variables so
+ * that CI workflows can reference them.
+ *
+ * @example Store a Worker URL for CI
+ * ```typescript
+ * const worker = yield* Cloudflare.Worker("Api", { ... });
+ *
+ * yield* GitHub.Variable("api-url", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "API_URL",
+ *   value: worker.url!,
+ * });
+ * ```
+ *
+ * @example Multiple Variables
+ * ```typescript
+ * yield* GitHub.Variable("region", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_REGION",
+ *   value: "us-east-1",
+ * });
+ *
+ * yield* GitHub.Variable("stage", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "DEPLOY_STAGE",
+ *   value: "production",
+ * });
+ * ```
+ */
+export const Variable = Resource<Variable>("GitHub.Variable");
+
+function resolveToken(props: VariableProps): string | undefined {
+  return (
+    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
+  );
+}
+
+function createClient(props: VariableProps): Octokit {
+  return new Octokit({ auth: resolveToken(props) });
+}
+
+export const VariableProvider = () =>
+  Provider.succeed(Variable, {
+    create: Effect.fn(function* ({ news }) {
+      const octokit = createClient(news);
+
+      yield* Effect.tryPromise(() =>
+        octokit.rest.actions.createRepoVariable({
+          owner: news.owner,
+          repo: news.repository,
+          name: news.name,
+          value: news.value,
+        }),
+      );
+
+      return { updatedAt: new Date().toISOString() };
+    }),
+
+    update: Effect.fn(function* ({ news }) {
+      const octokit = createClient(news);
+
+      yield* Effect.tryPromise(() =>
+        octokit.rest.actions.updateRepoVariable({
+          owner: news.owner,
+          repo: news.repository,
+          name: news.name,
+          value: news.value,
+        }),
+      );
+
+      return { updatedAt: new Date().toISOString() };
+    }),
+
+    delete: Effect.fn(function* ({ olds }) {
+      const octokit = createClient(olds);
+
+      yield* Effect.tryPromise(async () => {
+        try {
+          await octokit.rest.actions.deleteRepoVariable({
+            owner: olds.owner,
+            repo: olds.repository,
+            name: olds.name,
+          });
+        } catch (error: any) {
+          if (error.status !== 404) {
+            throw error;
+          }
+        }
+      });
+    }),
+  });

package/src/GitHub/index.ts

@@ -0,0 +1,3 @@
+export * from "./Comment.ts";
+export * from "./Secret.ts";
+export * from "./Variable.ts";

package/src/Kubernetes/client.ts

@@ -1,6 +1,6 @@
-import { AwsClient } from "aws4fetch";
 import { Credentials } from "@distilled.cloud/aws/Credentials";
 import { Region } from "@distilled.cloud/aws/Region";
+import { AwsClient } from "aws4fetch";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
@@ -28,7 +28,7 @@ export interface KubernetesClusterConnection {
   certificateAuthorityData: string;
 }
 
-const fieldManager = "alchemy-effect";
+const fieldManager = "alchemy";
 
 const createBearerToken = Effect.fn(function* (clusterName: string) {
   const credentials = yield* yield* Credentials;

package/src/Output.ts

@@ -90,7 +90,7 @@ export abstract class BaseExpr<A = any, Req = any> implements Output<A, Req> {
   declare readonly A: A;
   declare readonly src: ResourceLike;
   declare readonly req: Req;
-  // we use a kind tag instead of instanceof to protect ourselves from duplicate alchemy-effect module imports
+  // we use a kind tag instead of instanceof to protect ourselves from duplicate alchemy module imports
   constructor() {}
   as<T>(): Output<T, Req> {
     return this as any;

package/src/Platform.ts

@@ -33,7 +33,7 @@ export type Main<Services = never> = void | {
 };
 
 export type Rpc<Shape> = {
-  "~alchemy-effect/rpc": Shape;
+  "~alchemy/rpc": Shape;
 };
 
 // services provided to the Resource

package/src/Provider.ts

@@ -369,7 +369,7 @@ export const tryFindProviderByType: {
   const Tag = Provider<R>(resourceType) as Context.Service<Provider<R>, any>;
   const direct = yield* Effect.serviceOption(Tag);
   if (Option.isSome(direct)) {
-    return direct.value;
+    return direct;
   }
 
   const context = yield* Effect.context<never>();