alchemy 2.0.0-beta.5 → 2.0.0-beta.50

package/lib/GitHub/AuthProvider.d.ts

@@ -0,0 +1,39 @@
+import * as Redacted from "effect/Redacted";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { CredentialsStore } from "../Auth/Credentials.ts";
+export type GitHubAuthConfig = {
+    method: "env";
+} | {
+    method: "stored";
+} | {
+    method: "gh-cli";
+};
+export interface GitHubStoredCredentials {
+    type: "pat";
+    token: string;
+}
+export interface GitHubResolvedCredentials {
+    type: "token";
+    token: Redacted.Redacted<string>;
+    source: {
+        type: GitHubAuthConfig["method"];
+        details?: string;
+    };
+}
+export declare const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
+/**
+ * Layer that registers the GitHub {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the GitHub
+ * `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `gh-cli`: shells out to `gh auth token` (recommended).
+ * - `env`: reads `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN`.
+ * - `stored`: prompts for a PAT and writes it to `~/.alchemy/credentials`.
+ *
+ * Browser/device OAuth is intentionally not implemented: GitHub's
+ * OAuth App flow requires a `client_secret` we cannot ship, and
+ * device flow is exactly what `gh auth login` already does.
+ */
+export declare const GitHubAuth: import("effect/Layer").Layer<never, never, ChildProcessSpawner | import("../index.ts").AuthProviders | CredentialsStore>;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/GitHub/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/GitHub/AuthProvider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAMlF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AA0B3E,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzB,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAMlD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,0HA8OtB,CAAC"}

package/lib/GitHub/AuthProvider.js

@@ -0,0 +1,160 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { AuthError, AuthProviderLayer, } from "../Auth/AuthProvider.js";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.js";
+import { getEnvRedacted, retryOnce } from "../Auth/Env.js";
+import * as Clank from "../Util/Clank.js";
+const options = [
+    {
+        value: "gh-cli",
+        label: "GitHub CLI",
+        hint: "delegate to `gh auth token` (run `gh auth login` first)",
+    },
+    {
+        value: "env",
+        label: "Environment Variables",
+        hint: "GITHUB_ACCESS_TOKEN or GITHUB_TOKEN",
+    },
+    {
+        value: "stored",
+        label: "Personal Access Token",
+        hint: "enter PAT interactively, stored in ~/.alchemy/credentials",
+    },
+];
+export const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
+class GhCliError extends Error {
+    _tag = "GhCliError";
+}
+/**
+ * Layer that registers the GitHub {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the GitHub
+ * `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `gh-cli`: shells out to `gh auth token` (recommended).
+ * - `env`: reads `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN`.
+ * - `stored`: prompts for a PAT and writes it to `~/.alchemy/credentials`.
+ *
+ * Browser/device OAuth is intentionally not implemented: GitHub's
+ * OAuth App flow requires a `client_secret` we cannot ship, and
+ * device flow is exactly what `gh auth login` already does.
+ */
+export const GitHubAuth = AuthProviderLayer()(GITHUB_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+    const cp = yield* ChildProcessSpawner;
+    const ghCliToken = () => Effect.gen(function* () {
+        const handle = yield* cp.spawn(ChildProcess.make("gh", ["auth", "token"], { shell: false }));
+        const [exitCode, stdout, stderr] = yield* Effect.all([
+            handle.exitCode,
+            Stream.mkString(Stream.decodeText(handle.stdout)),
+            Stream.mkString(Stream.decodeText(handle.stderr)),
+        ], { concurrency: 3 });
+        if (exitCode !== 0) {
+            return yield* Effect.fail(new GhCliError(`gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`));
+        }
+        const token = stdout.trim();
+        if (!token) {
+            return yield* Effect.fail(new GhCliError("gh auth token returned empty output"));
+        }
+        return token;
+    }).pipe(Effect.scoped, Effect.mapError((e) => e instanceof GhCliError
+        ? new AuthError({ message: e.message, cause: e })
+        : new AuthError({
+            message: "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
+            cause: e,
+        })));
+    const loginStored = Effect.fnUntraced(function* (profileName) {
+        const token = yield* Clank.password({
+            message: "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
+            validate: (v) => (v.length === 0 ? "Required" : undefined),
+        }).pipe(retryOnce);
+        yield* store.write(profileName, "gh-stored", {
+            type: "pat",
+            token,
+        });
+        yield* Clank.success("GitHub: credentials saved.");
+        return { method: "stored" };
+    });
+    const configureInteractive = (profileName) => Clank.select({
+        message: "GitHub authentication method",
+        options,
+    }).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("gh-cli", () => ghCliToken().pipe(Effect.as({ method: "gh-cli" }), Effect.mapError((e) => new AuthError({
+        message: `gh CLI not available: ${e.message}`,
+        cause: e,
+    })))), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+    const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+        if (ctx.ci) {
+            return { method: "env" };
+        }
+        return yield* configureInteractive(profileName);
+    }).pipe(Effect.mapError((e) => new AuthError({
+        message: "failed to configure credentials",
+        cause: e,
+    })));
+    const resolveCredentials = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, Effect.fnUntraced(function* () {
+        const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
+        if (access) {
+            return {
+                type: "token",
+                token: access,
+                source: {
+                    type: "env",
+                    details: "GITHUB_ACCESS_TOKEN",
+                },
+            };
+        }
+        const token = yield* getEnvRedacted("GITHUB_TOKEN");
+        if (token) {
+            return {
+                type: "token",
+                token,
+                source: { type: "env", details: "GITHUB_TOKEN" },
+            };
+        }
+        return yield* new AuthError({
+            message: "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+    })), Match.when({ method: "stored" }, () => store.read(profileName, "gh-stored").pipe(Effect.flatMap((creds) => creds == null
+        ? Effect.fail(new AuthError({
+            message: "GitHub stored credentials not found. Run: alchemy login --configure",
+        }))
+        : Effect.succeed({
+            type: "token",
+            token: Redacted.make(creds.token),
+            source: { type: "stored" },
+        })))), Match.when({ method: "gh-cli" }, () => ghCliToken().pipe(Effect.map((token) => ({
+        type: "token",
+        token: Redacted.make(token),
+        source: { type: "gh-cli" },
+    })))), Match.exhaustive);
+    const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "gh-cli" }, () => Effect.void), Match.when({ method: "stored" }, () => store
+        .delete(profileName, "gh-stored")
+        .pipe(Effect.andThen(Clank.success("GitHub: stored credentials removed")))), Match.exhaustive);
+    const login = (profileName, config) => Match.value(config)
+        .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "gh-cli" }, () => ghCliToken().pipe(Effect.tap(() => Clank.success("GitHub: gh CLI authentication available.")), Effect.asVoid)), Match.when({ method: "stored" }, () => store
+        .read(profileName, "gh-stored")
+        .pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive)
+        .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
+    const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => {
+        const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+        return Effect.all([
+            Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+            Console.log(`  source: ${sourceStr}`),
+        ]);
+    }), Effect.catch((e) => Console.error(`  Failed to retrieve credentials: ${e}`)));
+    return {
+        configure: configureCredentials,
+        logout,
+        login,
+        prettyPrint,
+        read: resolveCredentials,
+    };
+}));
+//# sourceMappingURL=AuthProvider.js.map

package/lib/GitHub/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/GitHub/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EACL,SAAS,EACT,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAE1C,MAAM,OAAO,GAIR;IACH;QACE,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,yDAAyD;KAChE;IACD;QACE,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,qCAAqC;KAC5C;IACD;QACE,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,2DAA2D;KAClE;CACF,CAAC;AAkBF,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD,MAAM,UAAW,SAAQ,KAAK;IACnB,IAAI,GAAG,YAAY,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,EAGxC,CACD,yBAAyB,EACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;IAEtC,MAAM,UAAU,GAAG,GAAqC,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAClD;YACE,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAClD,EACD,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CACZ,6BAA6B,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAC3E,CACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC,qCAAqC,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,CAAC,YAAY,UAAU;QACrB,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC,CAAC,IAAI,SAAS,CAAC;YACZ,OAAO,EACL,iGAAiG;YACnG,KAAK,EAAE,CAAC;SACT,CAAC,CACP,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAmB;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClC,OAAO,EACL,2EAA2E;YAC7E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3D,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAA0B,WAAW,EAAE,WAAW,EAAE;YACpE,IAAI,EAAE,KAAK;YACX,KAAK;SACN,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,CAAC,WAAmB,EAAE,EAAE,CACnD,KAAK,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,8BAA8B;QACvC,OAAO;KACR,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC,CAAC,EACnE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CACxB,UAAU,EAAE,CAAC,IAAI,CACf,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC,EACxC,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,yBAAyB,CAAC,CAAC,OAAO,EAAE;QAC7C,KAAK,EAAE,CAAC;KACT,CAAC,CACL,CACF,CACF,EACD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EACpD,KAAK,CAAC,UAAU,CACjB,CACF,CACF,CAAC;IAEJ,MAAM,oBAAoB,GAAG,CAAC,WAAmB,EAAE,GAAqB,EAAE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,KAAK,EAAE,CAAC;KACT,CAAC,CACL,CACF,CAAC;IAEJ,MAAM,kBAAkB,GAAG,CACzB,WAAmB,EACnB,MAAwB,EAC6B,EAAE,CACvD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,OAAgB;gBACtB,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE;oBACN,IAAI,EAAE,KAAc;oBACpB,OAAO,EAAE,qBAAqB;iBAC/B;aACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,IAAI,EAAE,OAAgB;gBACtB,KAAK;gBACL,MAAM,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,cAAc,EAAE;aAC1D,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YAC1B,OAAO,EACL,4EAA4E;SAC/E,CAAC,CAAC;IACL,CAAC,CAAC,CACH,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,KAAK,CAAC,IAAI,CAA0B,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,IAAI,IAAI;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;YACZ,OAAO,EACL,qEAAqE;SACxE,CAAC,CACH;QACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACb,IAAI,EAAE,OAAgB;YACtB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;SACpC,CAAC,CACP,CACF,CACF,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,UAAU,EAAE,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE,OAAgB;QACtB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;KACpC,CAAC,CAAC,CACJ,CACF,EACD,KAAK,CAAC,UAAU,CACjB,CAAC;IAEJ,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,MAAwB,EAAE,EAAE,CAC/D,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAChD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACnD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,KAAK;SACF,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC;SAChC,IAAI,CACH,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,OAAO,CAAC,oCAAoC,CAAC,CACpD,CACF,CACJ,EACD,KAAK,CAAC,UAAU,CACjB,CAAC;IAEJ,MAAM,KAAK,GAAG,CAAC,WAAmB,EAAE,MAAwB,EAAE,EAAE,CAC9D,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;SAChB,IAAI,CACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAChD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,UAAU,EAAE,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,KAAK,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAC1D,EACD,MAAM,CAAC,MAAM,CACd,CACF,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,KAAK;SACF,IAAI,CAA0B,WAAW,EAAE,WAAW,CAAC;SACvD,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CACvD,CACF,CACJ,EACD,KAAK,CAAC,UAAU,CACjB;SACA,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC5D,CACF,CAAC;IAEN,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAE,MAAwB,EAAE,EAAE,CACpE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO;YACpC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;YAClD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACtB,OAAO,MAAM,CAAC,GAAG,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,YAAY,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,EACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CACxD,CACF,CAAC;IAEJ,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,MAAM;QACN,KAAK;QACL,WAAW;QACX,IAAI,EAAE,kBAAkB;KACzB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/GitHub/Comment.d.ts

@@ -0,0 +1,134 @@
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import * as GitHub from "./Providers.ts";
+export interface CommentProps {
+    /**
+     * Repository owner (user or organization).
+     */
+    owner: string;
+    /**
+     * Repository name.
+     */
+    repository: string;
+    /**
+     * Issue or Pull Request number to comment on.
+     */
+    issueNumber: number;
+    /**
+     * Comment body (supports GitHub Markdown).
+     *
+     * The body is automatically dedented, so you can use indented template
+     * literals without worrying about leading whitespace. Accepts
+     * `Output<string>` at the call site via `Output.interpolate` to embed
+     * resource attributes that are not yet resolved.
+     */
+    body: string;
+    /**
+     * Whether to allow deletion of the comment when the resource is destroyed.
+     * By default, comments are never deleted to preserve discussion history.
+     * @default false
+     */
+    allowDelete?: boolean;
+    /**
+     * GitHub API token. If not provided, falls back to
+     * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+     */
+    token?: string;
+}
+export interface Comment extends Resource<"GitHub.Comment", CommentProps, {
+    /**
+     * The numeric ID of the comment in GitHub.
+     */
+    commentId: number;
+    /**
+     * URL to view the comment in a browser.
+     */
+    htmlUrl: string;
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+}, never, GitHub.Providers> {
+}
+/**
+ * A GitHub issue or pull request comment.
+ *
+ * `Comment` manages the lifecycle of a single comment on an issue or pull
+ * request. Comments are created on the first deploy and updated in place on
+ * subsequent deploys when the `body` changes. By default, comments are never
+ * deleted to preserve discussion history — set `allowDelete: true` to opt in.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Creating Comments
+ * @example Comment on an Issue
+ * ```typescript
+ * const comment = yield* GitHub.Comment("issue-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This is a comment created by Alchemy!",
+ * });
+ * ```
+ *
+ * @example Comment on a Pull Request
+ * ```typescript
+ * const prComment = yield* GitHub.Comment("pr-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 456,
+ *   body: "## Deployment Status\n\nSuccessfully deployed to staging!",
+ * });
+ * ```
+ *
+ * @section Updating Comments
+ * Deploy with the same logical ID and a different `body` to update the
+ * existing comment in place rather than creating a new one.
+ *
+ * @example Update Comment Content
+ * ```typescript
+ * const comment = yield* GitHub.Comment("status-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 789,
+ *   body: "Deployment completed successfully!",
+ * });
+ * ```
+ *
+ * @section Deleting Comments
+ * @example Allow Comment Deletion
+ * ```typescript
+ * const comment = yield* GitHub.Comment("temp-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This comment can be deleted",
+ *   allowDelete: true,
+ * });
+ * ```
+ *
+ * @section CI Preview Comments
+ * A common pattern is posting a preview-deployment URL on every pull request.
+ * The comment auto-updates on each push because the logical ID stays the same.
+ *
+ * @example PR Preview Comment
+ * ```typescript
+ * if (process.env.PULL_REQUEST) {
+ *   yield* GitHub.Comment("preview-comment", {
+ *     owner: "my-org",
+ *     repository: "my-repo",
+ *     issueNumber: Number(process.env.PULL_REQUEST),
+ *     body: Output.interpolate`
+ *       ## Preview Deployed
+ *
+ *       **URL:** ${website.url}
+ *     `,
+ *   });
+ * }
+ * ```
+ */
+export declare const Comment: import("../Resource.ts").ResourceClass<Comment>;
+export declare const CommentProvider: () => import("effect/Layer").Layer<Provider.Provider<Comment>, never, never>;
+//# sourceMappingURL=Comment.d.ts.map

package/lib/GitHub/Comment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Comment.d.ts","sourceRoot":"","sources":["../../src/GitHub/Comment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAQ,SAAQ,QAAQ,CACvC,gBAAgB,EAChB,YAAY,EACZ;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EACL,MAAM,CAAC,SAAS,CACjB;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,eAAO,MAAM,OAAO,iDAAsC,CAAC;AAY3D,eAAO,MAAM,eAAe,8EAuFxB,CAAC"}

package/lib/GitHub/Comment.js

@@ -0,0 +1,172 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.js";
+import { Resource } from "../Resource.js";
+import { dedent } from "../Util/dedent.js";
+import * as GitHub from "./Providers.js";
+/**
+ * A GitHub issue or pull request comment.
+ *
+ * `Comment` manages the lifecycle of a single comment on an issue or pull
+ * request. Comments are created on the first deploy and updated in place on
+ * subsequent deploys when the `body` changes. By default, comments are never
+ * deleted to preserve discussion history — set `allowDelete: true` to opt in.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Creating Comments
+ * @example Comment on an Issue
+ * ```typescript
+ * const comment = yield* GitHub.Comment("issue-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This is a comment created by Alchemy!",
+ * });
+ * ```
+ *
+ * @example Comment on a Pull Request
+ * ```typescript
+ * const prComment = yield* GitHub.Comment("pr-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 456,
+ *   body: "## Deployment Status\n\nSuccessfully deployed to staging!",
+ * });
+ * ```
+ *
+ * @section Updating Comments
+ * Deploy with the same logical ID and a different `body` to update the
+ * existing comment in place rather than creating a new one.
+ *
+ * @example Update Comment Content
+ * ```typescript
+ * const comment = yield* GitHub.Comment("status-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 789,
+ *   body: "Deployment completed successfully!",
+ * });
+ * ```
+ *
+ * @section Deleting Comments
+ * @example Allow Comment Deletion
+ * ```typescript
+ * const comment = yield* GitHub.Comment("temp-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This comment can be deleted",
+ *   allowDelete: true,
+ * });
+ * ```
+ *
+ * @section CI Preview Comments
+ * A common pattern is posting a preview-deployment URL on every pull request.
+ * The comment auto-updates on each push because the logical ID stays the same.
+ *
+ * @example PR Preview Comment
+ * ```typescript
+ * if (process.env.PULL_REQUEST) {
+ *   yield* GitHub.Comment("preview-comment", {
+ *     owner: "my-org",
+ *     repository: "my-repo",
+ *     issueNumber: Number(process.env.PULL_REQUEST),
+ *     body: Output.interpolate`
+ *       ## Preview Deployed
+ *
+ *       **URL:** ${website.url}
+ *     `,
+ *   });
+ * }
+ * ```
+ */
+export const Comment = Resource("GitHub.Comment");
+function resolveToken(props) {
+    return (props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN);
+}
+function createClient(props) {
+    return new Octokit({ auth: resolveToken(props) });
+}
+export const CommentProvider = () => Provider.succeed(Comment, {
+    stables: ["commentId"],
+    reconcile: Effect.fn(function* ({ news, output }) {
+        const octokit = createClient(news);
+        const body = dedent(news.body);
+        // Observe — GitHub assigns `comment_id` server-side. Probe for live
+        // state via the cached id; a 404 (deleted out-of-band, or never
+        // created) collapses to "no observed comment" so we converge by
+        // posting a fresh one.
+        const observedId = output?.commentId
+            ? yield* Effect.tryPromise({
+                try: async () => {
+                    try {
+                        const { data } = await octokit.rest.issues.getComment({
+                            owner: news.owner,
+                            repo: news.repository,
+                            comment_id: output.commentId,
+                        });
+                        return data.id;
+                    }
+                    catch (error) {
+                        if (error.status === 404)
+                            return undefined;
+                        throw error;
+                    }
+                },
+                catch: (e) => e,
+            })
+            : undefined;
+        // Ensure — when no live comment exists, POST creates one.
+        if (observedId === undefined) {
+            const { data } = yield* Effect.tryPromise(() => octokit.rest.issues.createComment({
+                owner: news.owner,
+                repo: news.repository,
+                issue_number: news.issueNumber,
+                body,
+            }));
+            return {
+                commentId: data.id,
+                htmlUrl: data.html_url,
+                updatedAt: data.updated_at,
+            };
+        }
+        // Sync — PATCH the existing comment with the desired body. GitHub's
+        // updateComment is idempotent for identical bodies (returns same
+        // updatedAt), so we always issue the call rather than diffing.
+        const { data } = yield* Effect.tryPromise(() => octokit.rest.issues.updateComment({
+            owner: news.owner,
+            repo: news.repository,
+            comment_id: observedId,
+            body,
+        }));
+        return {
+            commentId: data.id,
+            htmlUrl: data.html_url,
+            updatedAt: data.updated_at,
+        };
+    }),
+    delete: Effect.fn(function* ({ olds, output }) {
+        if (!olds.allowDelete) {
+            return;
+        }
+        const octokit = createClient(olds);
+        yield* Effect.tryPromise(async () => {
+            try {
+                await octokit.rest.issues.deleteComment({
+                    owner: olds.owner,
+                    repo: olds.repository,
+                    comment_id: output.commentId,
+                });
+            }
+            catch (error) {
+                if (error.status !== 404) {
+                    throw error;
+                }
+            }
+        });
+    }),
+});
+//# sourceMappingURL=Comment.js.map

package/lib/GitHub/Comment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Comment.js","sourceRoot":"","sources":["../../src/GitHub/Comment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAiEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,gBAAgB,CAAC,CAAC;AAE3D,SAAS,YAAY,CAAC,KAAmB;IACvC,OAAO,CACL,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB;IACvC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE;IACxB,OAAO,EAAE,CAAC,WAAW,CAAC;IAEtB,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,oEAAoE;QACpE,gEAAgE;QAChE,gEAAgE;QAChE,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,EAAE,SAAS;YAClC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvB,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;4BACpD,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,IAAI,EAAE,IAAI,CAAC,UAAU;4BACrB,UAAU,EAAE,MAAM,CAAC,SAAS;yBAC7B,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC,EAAE,CAAC;oBACjB,CAAC;oBAAC,OAAO,KAAU,EAAE,CAAC;wBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;4BAAE,OAAO,SAAS,CAAC;wBAC3C,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAU;aACzB,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEd,0DAA0D;QAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;gBAChC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,UAAU;gBACrB,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,IAAI;aACL,CAAC,CACH,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,EAAE;gBAClB,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,SAAS,EAAE,IAAI,CAAC,UAAU;aAC3B,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,iEAAiE;QACjE,+DAA+D;QAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,UAAU,EAAE,UAAU;YACtB,IAAI;SACL,CAAC,CACH,CAAC;QACF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBACtC,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,UAAU;oBACrB,UAAU,EAAE,MAAM,CAAC,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/GitHub/Credentials.d.ts

@@ -0,0 +1,30 @@
+import { Octokit } from "@octokit/rest";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { Profile } from "../Auth/Profile.ts";
+export interface GitHubCredentialsService {
+    readonly token: Redacted.Redacted<string>;
+    readonly octokit: () => Octokit;
+}
+declare const GitHubCredentials_base: Context.ServiceClass<GitHubCredentials, "GitHub::Credentials", GitHubCredentialsService>;
+export declare class GitHubCredentials extends GitHubCredentials_base {
+}
+/**
+ * Build a `GitHubCredentials` layer from a literal token. Useful for
+ * tests or when callers already have a PAT in hand.
+ */
+export declare const fromToken: (token: string | Redacted.Redacted<string>) => Layer.Layer<GitHubCredentials, never, never>;
+/**
+ * Build a `GitHubCredentials` layer that reads the token from
+ * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` at layer build time.
+ */
+export declare const fromEnv: () => Layer.Layer<GitHubCredentials, never, never>;
+/**
+ * Build a `GitHubCredentials` layer that resolves a token via the
+ * Alchemy AuthProvider for the configured profile (defaults to
+ * `default`, overridable with `ALCHEMY_PROFILE`).
+ */
+export declare const fromAuthProvider: () => Layer.Layer<GitHubCredentials, never, Profile | import("../index.ts").AuthProviders>;
+export {};
+//# sourceMappingURL=Credentials.d.ts.map

package/lib/GitHub/Credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/GitHub/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAmB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAO9D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;CACjC;;AAED,qBAAa,iBAAkB,SAAQ,sBAGb;CAAG;AAO7B;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,iDAIhE,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,OAAO,oDAsBjB,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,4FAyB1B,CAAC"}

package/lib/GitHub/Credentials.js

@@ -0,0 +1,54 @@
+import { Octokit } from "@octokit/rest";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { AuthError, getAuthProvider } from "../Auth/AuthProvider.js";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.js";
+import { GITHUB_AUTH_PROVIDER_NAME, } from "./AuthProvider.js";
+export class GitHubCredentials extends Context.Service()("GitHub::Credentials") {
+}
+const make = (token) => ({
+    token,
+    octokit: () => new Octokit({ auth: Redacted.value(token) }),
+});
+/**
+ * Build a `GitHubCredentials` layer from a literal token. Useful for
+ * tests or when callers already have a PAT in hand.
+ */
+export const fromToken = (token) => Layer.succeed(GitHubCredentials, make(typeof token === "string" ? Redacted.make(token) : token));
+/**
+ * Build a `GitHubCredentials` layer that reads the token from
+ * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` at layer build time.
+ */
+export const fromEnv = () => Layer.effect(GitHubCredentials, Effect.gen(function* () {
+    const access = yield* Config.redacted("GITHUB_ACCESS_TOKEN").pipe(Config.option);
+    const token = yield* Config.redacted("GITHUB_TOKEN").pipe(Config.option);
+    const value = access._tag === "Some"
+        ? access.value
+        : token._tag === "Some"
+            ? token.value
+            : undefined;
+    if (value == null) {
+        return yield* new AuthError({
+            message: "GitHub credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+    }
+    return make(value);
+}).pipe(Effect.orDie));
+/**
+ * Build a `GitHubCredentials` layer that resolves a token via the
+ * Alchemy AuthProvider for the configured profile (defaults to
+ * `default`, overridable with `ALCHEMY_PROFILE`).
+ */
+export const fromAuthProvider = () => Layer.effect(GitHubCredentials, Effect.gen(function* () {
+    const profile = yield* Profile;
+    const auth = yield* getAuthProvider(GITHUB_AUTH_PROVIDER_NAME);
+    const profileName = yield* ALCHEMY_PROFILE;
+    const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(Effect.flatMap((config) => auth.read(profileName, config)), Effect.map((creds) => make(creds.token)), Effect.mapError((e) => new AuthError({
+        message: `Failed to resolve GitHub credentials for profile '${profileName}': ${e.message ?? String(e)}`,
+    })));
+}).pipe(Effect.orDie));
+//# sourceMappingURL=Credentials.js.map

package/lib/GitHub/Credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/GitHub/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,yBAAyB,GAG1B,MAAM,mBAAmB,CAAC;AAO3B,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,qBAAqB,CAAC;CAAG;AAE7B,MAAM,IAAI,GAAG,CAAC,KAAgC,EAA4B,EAAE,CAAC,CAAC;IAC5E,KAAK;IACL,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;CAC5D,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAyC,EAAE,EAAE,CACrE,KAAK,CAAC,OAAO,CACX,iBAAiB,EACjB,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAC/D,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAC1B,KAAK,CAAC,MAAM,CACV,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,MAAM,CACd,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,MAAM;QACpB,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YACrB,CAAC,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YAC1B,OAAO,EACL,wEAAwE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CACtB,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAGjC,yBAAyB,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAEvE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAA0B,CAAC,CACnD,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EACxC,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,qDAAqD,WAAW,MAAO,CAA0B,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE;KAClI,CAAC,CACL,CACF,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CACtB,CAAC"}

package/lib/GitHub/Providers.d.ts

@@ -0,0 +1,14 @@
+import * as Layer from "effect/Layer";
+import * as Provider from "../Provider.ts";
+import * as Credentials from "./Credentials.ts";
+export { GitHubCredentials } from "./Credentials.ts";
+declare const Providers_base: Provider.ProviderCollection<Providers, "GitHub">;
+export declare class Providers extends Providers_base {
+}
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+/**
+ * GitHub providers (Secret, Variable) plus the GitHub AuthProvider that
+ * `alchemy login` discovers.
+ */
+export declare const providers: () => Layer.Layer<import("../Auth/Profile.ts").Profile | import("../Auth/Credentials.ts").CredentialsStore | Credentials.GitHubCredentials | Providers, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("../index.ts").AuthProviders>;
+//# sourceMappingURL=Providers.d.ts.map

package/lib/GitHub/Providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../../src/GitHub/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAIhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;;AAErD,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,SAAS,0TAanB,CAAC"}