alchemy 2.0.0-beta.34 → 2.0.0-beta.35

package/src/AWS/Environment.ts

@@ -11,12 +11,17 @@ import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
 
 export const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(
   Config.withDefault("default"),
 );
 
 export const AWS_REGION = Config.string("AWS_REGION");
+export const AWS_ACCOUNT_ID = Config.string("AWS_ACCOUNT_ID");
+export const AWS_ACCESS_KEY_ID = Config.string("AWS_ACCESS_KEY_ID");
+export const AWS_SECRET_ACCESS_KEY = Config.redacted("AWS_SECRET_ACCESS_KEY");
+export const AWS_SESSION_TOKEN = Config.redacted("AWS_SESSION_TOKEN");
 
 export type AccountID = string;
 export type RegionID = string;
@@ -52,9 +57,18 @@ export class AWSEnvironment extends Context.Service<
 >()("AWS::Environment") {}
 
 /**
- * Build an `AWSEnvironment` from an SSO profile (`AWS_PROFILE` env var,
- * defaults to `"default"`). Uses the profile's `sso_account_id` and `region`,
- * and resolves credentials lazily via `aws sso login`.
+ * Build an `AWSEnvironment` from one of two sources, in priority order:
+ *
+ *   1. **Environment variables** — used when `AWS_ACCESS_KEY_ID` is set, as
+ *      it is on GitHub Actions runners after `aws-actions/configure-aws-credentials`
+ *      runs (OIDC), or whenever the user has exported static creds. Requires
+ *      `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`, and `AWS_ACCOUNT_ID`. The role
+ *      ARN's account ID is exported by `configure-aws-credentials` as
+ *      `AWS_ACCOUNT_ID` when invoked with `output-credentials: true`.
+ *   2. **SSO profile** (`AWS_PROFILE`, default `"default"`) — used locally
+ *      when no static creds are exported. Reads the profile's
+ *      `sso_account_id` / `region` from `~/.aws/config` and refreshes
+ *      credentials lazily via `aws sso login`.
  */
 export const Default = Layer.effect(
   AWSEnvironment,
@@ -62,6 +76,46 @@ export const Default = Layer.effect(
 ).pipe(Layer.orDie);
 
 export const loadDefault = () =>
+  Effect.gen(function* () {
+    // Env-credentials path only kicks in under CI (where
+    // `aws-actions/configure-aws-credentials` exports AWS_ACCESS_KEY_ID
+    // and friends). Locally we always go through SSO so a stray
+    // AWS_ACCESS_KEY_ID in the shell doesn't silently override the
+    // user's `~/.aws/config` profile.
+    const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    if (ci) {
+      const accessKeyId = yield* AWS_ACCESS_KEY_ID.pipe(
+        Config.option,
+        Config.map(Option.getOrUndefined),
+      );
+      if (accessKeyId) {
+        return yield* loadFromEnv(accessKeyId);
+      }
+    }
+    return yield* loadFromSso();
+  });
+
+const loadFromEnv = (accessKeyId: string) =>
+  Effect.gen(function* () {
+    const secretAccessKey = yield* AWS_SECRET_ACCESS_KEY;
+    const sessionToken = yield* AWS_SESSION_TOKEN.pipe(
+      Config.option,
+      Config.map(Option.getOrUndefined),
+    );
+    const region = yield* AWS_REGION;
+    const accountId = yield* AWS_ACCOUNT_ID;
+    return {
+      accountId,
+      region,
+      credentials: Effect.succeed({
+        accessKeyId: Redacted.make(accessKeyId),
+        secretAccessKey,
+        sessionToken,
+      } satisfies ResolvedCredentials),
+    } satisfies AWSEnvironmentShape;
+  });
+
+const loadFromSso = () =>
   Effect.gen(function* () {
     const profileName = yield* AWS_PROFILE;
     const auth = yield* Auth.Default;

package/src/AWS/IAM/OpenIDConnectProvider.ts

@@ -3,9 +3,9 @@ import * as Effect from "effect/Effect";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import { diffTags } from "../../Tags.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import { toTagRecord } from "./common.ts";
 
 export interface OpenIDConnectProviderProps {
@@ -14,13 +14,17 @@ export interface OpenIDConnectProviderProps {
    */
   url: string;
   /**
-   * Client IDs allowed for the provider.
+   * Client IDs allowed for the provider. AWS rejects requests with an
+   * empty list, so the prop is typed as a non-empty tuple.
    */
-  clientIDList?: string[];
+  clientIDList?: [string, ...string[]];
   /**
-   * Certificate thumbprints for the provider.
+   * Certificate thumbprints for the provider. AWS auto-manages thumbprints
+   * for well-known IdPs (e.g. GitHub Actions), so this is optional — but
+   * `iam.updateOpenIDConnectProviderThumbprint` rejects an empty list, so
+   * the prop is typed as a non-empty tuple when supplied.
    */
-  thumbprintList?: string[];
+  thumbprintList?: [string, ...string[]];
   /**
    * User-defined tags to apply to the provider.
    */
@@ -34,7 +38,11 @@ export interface OpenIDConnectProvider extends Resource<
     openIDConnectProviderArn: string;
     url: string;
     clientIDList: string[];
-    thumbprintList: string[];
+    /**
+     * Reflects the desired state — `undefined` when the user opted out of
+     * managing thumbprints (AWS auto-manages them for well-known IdPs).
+     */
+    thumbprintList: string[] | undefined;
     tags: Record<string, string>;
   },
   never,
@@ -181,10 +189,13 @@ export const OpenIDConnectProviderProvider = () =>
 
           // Sync thumbprints — `updateOpenIDConnectProviderThumbprint`
           // replaces the entire list, so call it whenever the set differs.
-          const desiredThumbprints = news.thumbprintList ?? [];
+          // When the user didn't request a list we leave the cloud-managed
+          // thumbprints alone (AWS auto-manages for well-known IdPs).
+          const desiredThumbprints = news.thumbprintList;
           if (
+            desiredThumbprints &&
             JSON.stringify([...observedThumbprints].sort()) !==
-            JSON.stringify([...desiredThumbprints].sort())
+              JSON.stringify([...desiredThumbprints].sort())
           ) {
             yield* iam.updateOpenIDConnectProviderThumbprint({
               OpenIDConnectProviderArn: providerArn,

package/src/AWS/IAM/Policy.ts

@@ -4,7 +4,6 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import {
   createInternalTags,
   createTagsList,
@@ -13,6 +12,7 @@ import {
 } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import {
   oldestNondefaultPolicyVersion,
   parsePolicyDocument,

package/src/AWS/Providers.ts

@@ -21,6 +21,7 @@ import { Random, RandomProvider } from "../Random.ts";
 import * as ACM from "./ACM/index.ts";
 import * as ApiGateway from "./ApiGateway/index.ts";
 import * as Assets from "./Assets.ts";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
 import { AwsAuth } from "./AuthProvider.ts";
 import * as AutoScaling from "./AutoScaling/index.ts";
 import * as CloudFront from "./CloudFront/index.ts";
@@ -578,6 +579,7 @@ export const providers = () =>
     Layer.provideMerge(Endpoint.fromEnvironment),
     Layer.provideMerge(DefaultEnvironment),
     Layer.provideMerge(AwsAuth),
+    Layer.provideMerge(CredentialsStoreLive),
     // Apply a blanket retry policy to every AWS SDK call. Like distilled's
     // `makeDefault` it retries throttling, 5xx, and Smithy `@retryable`
     // errors with exponential backoff + jitter + `RetryAfter` header

package/src/Auth/Credentials.ts

@@ -1,5 +1,8 @@
+import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import type { PlatformError } from "effect/PlatformError";
 import * as Redacted from "effect/Redacted";
 import path from "pathe";
 import { rootDir } from "./Profile.ts";
@@ -12,55 +15,88 @@ export const profileCredentialsDirPath = (profile: string) =>
 export const credentialsFilePath = (profile: string, provider: string) =>
   path.join(profileCredentialsDirPath(profile), `${provider}.json`);
 
-export const readCredentials = Effect.fnUntraced(function* <T>(
-  profile: string,
-  provider: string,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  const data = yield* fs
-    .readFileString(credentialsFilePath(profile, provider))
-    .pipe(Effect.catch(() => Effect.succeed(undefined)));
-  if (data === undefined) return undefined as T | undefined;
-  try {
-    return JSON.parse(data) as T;
-  } catch {
-    return undefined as T | undefined;
-  }
-});
+/**
+ * Service exposing per-profile credential file helpers. All methods have
+ * `R = never` — the {@link FileSystem.FileSystem} requirement is captured
+ * by {@link CredentialsStoreLive} when the layer is built.
+ */
+export interface CredentialsStoreService {
+  readonly read: <T>(
+    profile: string,
+    provider: string,
+  ) => Effect.Effect<T | undefined>;
+  readonly write: <T>(
+    profile: string,
+    provider: string,
+    credentials: T,
+  ) => Effect.Effect<void, PlatformError>;
+  readonly delete: (profile: string, provider: string) => Effect.Effect<void>;
+  /**
+   * Recursively remove the `~/.alchemy/credentials/{profile}` directory
+   * containing all per-provider secrets for `profile`. No-op if it doesn't exist.
+   */
+  readonly deleteProfile: (profile: string) => Effect.Effect<void>;
+}
 
-export const writeCredentials = Effect.fnUntraced(function* <T>(
-  profile: string,
-  provider: string,
-  credentials: T,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  const filePath = credentialsFilePath(profile, provider);
-  yield* fs.makeDirectory(path.dirname(filePath), { recursive: true });
-  yield* fs.writeFileString(filePath, JSON.stringify(credentials, null, 2));
-});
+export class CredentialsStore extends Context.Service<
+  CredentialsStore,
+  CredentialsStoreService
+>()("Alchemy::CredentialsStore") {}
 
-export const deleteCredentials = Effect.fnUntraced(function* (
-  profile: string,
-  provider: string,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  yield* fs
-    .remove(credentialsFilePath(profile, provider))
-    .pipe(Effect.catch(() => Effect.void));
-});
+export const CredentialsStoreLive = Layer.effect(
+  CredentialsStore,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
 
-/**
- * Recursively remove the `~/.alchemy/credentials/{profile}` directory
- * containing all per-provider secrets for `profile`. No-op if it doesn't exist.
- */
-export const deleteProfileCredentials = Effect.fnUntraced(function* (
-  profile: string,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  yield* fs
-    .remove(profileCredentialsDirPath(profile), { recursive: true })
-    .pipe(Effect.catch(() => Effect.void));
-});
+    const read = <T>(
+      profile: string,
+      provider: string,
+    ): Effect.Effect<T | undefined> =>
+      fs.readFileString(credentialsFilePath(profile, provider)).pipe(
+        Effect.catch(() => Effect.succeed(undefined as string | undefined)),
+        Effect.map((data) => {
+          if (data === undefined) return undefined as T | undefined;
+          try {
+            return JSON.parse(data) as T;
+          } catch {
+            return undefined as T | undefined;
+          }
+        }),
+      );
+
+    const write = <T>(
+      profile: string,
+      provider: string,
+      credentials: T,
+    ): Effect.Effect<void, PlatformError> => {
+      const filePath = credentialsFilePath(profile, provider);
+      return fs
+        .makeDirectory(path.dirname(filePath), { recursive: true })
+        .pipe(
+          Effect.flatMap(() =>
+            fs.writeFileString(filePath, JSON.stringify(credentials, null, 2)),
+          ),
+        );
+    };
+
+    const remove_ = (profile: string, provider: string): Effect.Effect<void> =>
+      fs
+        .remove(credentialsFilePath(profile, provider))
+        .pipe(Effect.catch(() => Effect.void));
+
+    const deleteProfile = (profile: string): Effect.Effect<void> =>
+      fs
+        .remove(profileCredentialsDirPath(profile), { recursive: true })
+        .pipe(Effect.catch(() => Effect.void));
+
+    return {
+      read,
+      write,
+      delete: remove_,
+      deleteProfile,
+    } satisfies CredentialsStoreService;
+  }),
+);
 
 export function displayRedacted(
   r: Redacted.Redacted<string>,

package/src/Auth/Profile.ts

@@ -3,9 +3,15 @@ import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import type { PlatformError } from "effect/PlatformError";
 import os from "node:os";
 import path from "pathe";
-import type { AuthProvider, ConfigureContext } from "./AuthProvider.ts";
+import type {
+  AuthError,
+  AuthProvider,
+  ConfigureContext,
+} from "./AuthProvider.ts";
 
 export const rootDir = path.join(os.homedir(), ".alchemy");
 export const configFilePath = path.join(rootDir, "profiles.json");
@@ -52,59 +58,126 @@ const emptyConfig = (): AlchemyConfig["Service"] => ({
   profiles: {},
 });
 
-export const readConfig = FileSystem.FileSystem.asEffect().pipe(
-  Effect.flatMap((fs) => fs.readFileString(configFilePath)),
-  Effect.flatMap((data) =>
-    Effect.try({
-      try: () => {
-        const parsed = JSON.parse(data);
-        if (parsed?.version !== CONFIG_VERSION) {
-          // TODO(sam): this is destructive, should we maintain a chain of migrations from 0 to current?
-          return emptyConfig();
-        }
-        return parsed as AlchemyConfig["Service"];
-      },
-      catch: emptyConfig,
-    }),
-  ),
-  Effect.orElseSucceed(emptyConfig),
-);
-
-export const writeConfig = (config: AlchemyConfig["Service"]) =>
-  FileSystem.FileSystem.asEffect().pipe(
-    Effect.tap((fs) =>
-      fs.makeDirectory(path.dirname(configFilePath), { recursive: true }),
-    ),
-    Effect.flatMap((fs) =>
-      fs.writeFileString(configFilePath, JSON.stringify(config, null, 2)),
-    ),
-  );
-
-export const getProfile = (name: string) =>
-  readConfig.pipe(Effect.map((config) => config.profiles[name]));
+/**
+ * Service exposing on-disk profile helpers. All methods have `R = never` —
+ * the {@link FileSystem.FileSystem} requirement is captured by
+ * {@link ProfileLive} when the layer is built, freeing call sites from
+ * having to thread `FileSystem` through their own Effects.
+ *
+ * Use {@link Profile} directly when you need profile helpers — yield it
+ * from your `Effect.gen` and call its methods (each has `R = never`).
+ */
+export interface ProfileService {
+  readonly readConfig: Effect.Effect<AlchemyConfig["Service"]>;
+  readonly writeConfig: (
+    config: AlchemyConfig["Service"],
+  ) => Effect.Effect<void, PlatformError>;
+  readonly getProfile: (
+    name: string,
+  ) => Effect.Effect<AlchemyProfile | undefined>;
+  readonly setProfile: (
+    name: string,
+    profile: AlchemyProfile,
+  ) => Effect.Effect<void, PlatformError>;
+  readonly deleteProfile: (
+    name: string,
+  ) => Effect.Effect<boolean, PlatformError>;
+  readonly loadOrConfigure: <Config extends { method: string }>(
+    auth: AuthProvider<Config>,
+    profileName: string,
+    ctx: ConfigureContext,
+  ) => Effect.Effect<Config, AuthError | PlatformError>;
+}
 
-export const setProfile = (name: string, profile: AlchemyProfile) =>
-  readConfig.pipe(
-    Effect.tap((config) =>
-      Effect.sync(() => (config.profiles[name] = profile)),
-    ),
-    Effect.flatMap(writeConfig),
-  );
+export class Profile extends Context.Service<Profile, ProfileService>()(
+  "Alchemy::Profile",
+) {}
 
 /**
- * Remove `name` and all its provider credentials from the on-disk config.
- * Returns `true` if the profile existed and was removed, `false` otherwise.
+ * Layer that builds the {@link Profile} service. Captures the
+ * {@link FileSystem.FileSystem} dependency at layer-build time, so any
+ * Effect that yields {@link Profile} ends up with `R = Profile` (no
+ * `FileSystem` leak). Provide this once at the top of your runtime
+ * (alongside `PlatformServices` / `NodeContext`).
  */
-export const deleteProfile = (name: string) =>
-  readConfig.pipe(
-    Effect.flatMap((config) => {
-      if (!(name in config.profiles)) {
-        return Effect.succeed(false);
-      }
-      delete config.profiles[name];
-      return writeConfig(config).pipe(Effect.as(true));
-    }),
-  );
+export const ProfileLive = Layer.effect(
+  Profile,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+
+    const readConfig: Effect.Effect<AlchemyConfig["Service"]> = fs
+      .readFileString(configFilePath)
+      .pipe(
+        Effect.flatMap((data) =>
+          Effect.try({
+            try: () => {
+              const parsed = JSON.parse(data);
+              if (parsed?.version !== CONFIG_VERSION) {
+                // TODO(sam): this is destructive, should we maintain a chain of migrations from 0 to current?
+                return emptyConfig();
+              }
+              return parsed as AlchemyConfig["Service"];
+            },
+            catch: emptyConfig,
+          }),
+        ),
+        Effect.orElseSucceed(emptyConfig),
+      );
+
+    const writeConfig = (config: AlchemyConfig["Service"]) =>
+      fs
+        .makeDirectory(path.dirname(configFilePath), { recursive: true })
+        .pipe(
+          Effect.flatMap(() =>
+            fs.writeFileString(configFilePath, JSON.stringify(config, null, 2)),
+          ),
+        );
+
+    const getProfile = (name: string) =>
+      readConfig.pipe(Effect.map((config) => config.profiles[name]));
+
+    const setProfile = (name: string, profile: AlchemyProfile) =>
+      readConfig.pipe(
+        Effect.tap((config) =>
+          Effect.sync(() => (config.profiles[name] = profile)),
+        ),
+        Effect.flatMap(writeConfig),
+      );
+
+    const deleteProfile = (name: string) =>
+      readConfig.pipe(
+        Effect.flatMap((config) => {
+          if (!(name in config.profiles)) {
+            return Effect.succeed(false);
+          }
+          delete config.profiles[name];
+          return writeConfig(config).pipe(Effect.as(true));
+        }),
+      );
+
+    const loadOrConfigure = <Config extends { method: string }>(
+      auth: AuthProvider<Config>,
+      profileName: string,
+      ctx: ConfigureContext,
+    ) =>
+      Effect.flatMap(getProfile(profileName), (existing) =>
+        existing?.[auth.name]
+          ? Effect.succeed(existing[auth.name] as Config)
+          : Effect.tap(auth.configure(profileName, ctx), (config) =>
+              setProfile(profileName, { ...existing, [auth.name]: config }),
+            ),
+      );
+
+    return {
+      readConfig,
+      writeConfig,
+      getProfile,
+      setProfile,
+      deleteProfile,
+      loadOrConfigure,
+    } satisfies ProfileService;
+  }),
+);
 
 /**
  * Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
@@ -129,22 +202,3 @@ export const withProfileOverride = (
   );
   return ConfigProvider.orElse(base)(overrideProvider);
 };
-
-/**
- * Load the stored config for the given AuthProvider in `profileName`.
- * If absent, run the provider's `configure` step (passing through `ctx` so
- * providers can pick a CI-friendly default) and persist the resulting config
- * under the provider's name.
- */
-export const loadOrConfigure = <Config extends { method: string }>(
-  auth: AuthProvider<Config>,
-  profileName: string,
-  ctx: ConfigureContext,
-) =>
-  Effect.flatMap(getProfile(profileName), (existing) =>
-    existing?.[auth.name]
-      ? Effect.succeed(existing?.[auth.name])
-      : Effect.tap(auth.configure(profileName, ctx), (config) =>
-          setProfile(profileName, { ...existing, [auth.name]: config }),
-        ),
-  );