alchemy 2.0.0-beta.test-export-fix-4 → 2.0.0-cli-bundle-fix.1

package/lib/GitHub/Comment.d.ts

@@ -0,0 +1,133 @@
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+export interface CommentProps {
+    /**
+     * Repository owner (user or organization).
+     */
+    owner: string;
+    /**
+     * Repository name.
+     */
+    repository: string;
+    /**
+     * Issue or Pull Request number to comment on.
+     */
+    issueNumber: number;
+    /**
+     * Comment body (supports GitHub Markdown).
+     *
+     * The body is automatically dedented, so you can use indented template
+     * literals without worrying about leading whitespace. Accepts
+     * `Output<string>` at the call site via `Output.interpolate` to embed
+     * resource attributes that are not yet resolved.
+     */
+    body: string;
+    /**
+     * Whether to allow deletion of the comment when the resource is destroyed.
+     * By default, comments are never deleted to preserve discussion history.
+     * @default false
+     */
+    allowDelete?: boolean;
+    /**
+     * GitHub API token. If not provided, falls back to
+     * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+     */
+    token?: string;
+}
+export interface Comment extends Resource<"GitHub.Comment", CommentProps, {
+    /**
+     * The numeric ID of the comment in GitHub.
+     */
+    commentId: number;
+    /**
+     * URL to view the comment in a browser.
+     */
+    htmlUrl: string;
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+}> {
+}
+/**
+ * A GitHub issue or pull request comment.
+ *
+ * `Comment` manages the lifecycle of a single comment on an issue or pull
+ * request. Comments are created on the first deploy and updated in place on
+ * subsequent deploys when the `body` changes. By default, comments are never
+ * deleted to preserve discussion history — set `allowDelete: true` to opt in.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Creating Comments
+ * @example Comment on an Issue
+ * ```typescript
+ * const comment = yield* GitHub.Comment("issue-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This is a comment created by Alchemy!",
+ * });
+ * ```
+ *
+ * @example Comment on a Pull Request
+ * ```typescript
+ * const prComment = yield* GitHub.Comment("pr-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 456,
+ *   body: "## Deployment Status\n\nSuccessfully deployed to staging!",
+ * });
+ * ```
+ *
+ * @section Updating Comments
+ * Deploy with the same logical ID and a different `body` to update the
+ * existing comment in place rather than creating a new one.
+ *
+ * @example Update Comment Content
+ * ```typescript
+ * const comment = yield* GitHub.Comment("status-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 789,
+ *   body: "Deployment completed successfully!",
+ * });
+ * ```
+ *
+ * @section Deleting Comments
+ * @example Allow Comment Deletion
+ * ```typescript
+ * const comment = yield* GitHub.Comment("temp-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This comment can be deleted",
+ *   allowDelete: true,
+ * });
+ * ```
+ *
+ * @section CI Preview Comments
+ * A common pattern is posting a preview-deployment URL on every pull request.
+ * The comment auto-updates on each push because the logical ID stays the same.
+ *
+ * @example PR Preview Comment
+ * ```typescript
+ * if (process.env.PULL_REQUEST) {
+ *   yield* GitHub.Comment("preview-comment", {
+ *     owner: "my-org",
+ *     repository: "my-repo",
+ *     issueNumber: Number(process.env.PULL_REQUEST),
+ *     body: Output.interpolate`
+ *       ## Preview Deployed
+ *
+ *       **URL:** ${website.url}
+ *     `,
+ *   });
+ * }
+ * ```
+ */
+export declare const Comment: import("../Resource.ts").ResourceClass<Comment>;
+export declare const CommentProvider: () => import("effect/Layer").Layer<Provider.Provider<Comment>, never, never>;
+//# sourceMappingURL=Comment.d.ts.map

package/lib/GitHub/Comment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Comment.d.ts","sourceRoot":"","sources":["../../src/GitHub/Comment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAQ,SAAQ,QAAQ,CACvC,gBAAgB,EAChB,YAAY,EACZ;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CACF;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,eAAO,MAAM,OAAO,iDAAsC,CAAC;AAY3D,eAAO,MAAM,eAAe,8EAiExB,CAAC"}

package/lib/GitHub/Comment.js

@@ -0,0 +1,145 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.js";
+import { Resource } from "../Resource.js";
+import { dedent } from "../Util/dedent.js";
+/**
+ * A GitHub issue or pull request comment.
+ *
+ * `Comment` manages the lifecycle of a single comment on an issue or pull
+ * request. Comments are created on the first deploy and updated in place on
+ * subsequent deploys when the `body` changes. By default, comments are never
+ * deleted to preserve discussion history — set `allowDelete: true` to opt in.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Creating Comments
+ * @example Comment on an Issue
+ * ```typescript
+ * const comment = yield* GitHub.Comment("issue-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This is a comment created by Alchemy!",
+ * });
+ * ```
+ *
+ * @example Comment on a Pull Request
+ * ```typescript
+ * const prComment = yield* GitHub.Comment("pr-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 456,
+ *   body: "## Deployment Status\n\nSuccessfully deployed to staging!",
+ * });
+ * ```
+ *
+ * @section Updating Comments
+ * Deploy with the same logical ID and a different `body` to update the
+ * existing comment in place rather than creating a new one.
+ *
+ * @example Update Comment Content
+ * ```typescript
+ * const comment = yield* GitHub.Comment("status-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 789,
+ *   body: "Deployment completed successfully!",
+ * });
+ * ```
+ *
+ * @section Deleting Comments
+ * @example Allow Comment Deletion
+ * ```typescript
+ * const comment = yield* GitHub.Comment("temp-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This comment can be deleted",
+ *   allowDelete: true,
+ * });
+ * ```
+ *
+ * @section CI Preview Comments
+ * A common pattern is posting a preview-deployment URL on every pull request.
+ * The comment auto-updates on each push because the logical ID stays the same.
+ *
+ * @example PR Preview Comment
+ * ```typescript
+ * if (process.env.PULL_REQUEST) {
+ *   yield* GitHub.Comment("preview-comment", {
+ *     owner: "my-org",
+ *     repository: "my-repo",
+ *     issueNumber: Number(process.env.PULL_REQUEST),
+ *     body: Output.interpolate`
+ *       ## Preview Deployed
+ *
+ *       **URL:** ${website.url}
+ *     `,
+ *   });
+ * }
+ * ```
+ */
+export const Comment = Resource("GitHub.Comment");
+function resolveToken(props) {
+    return (props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN);
+}
+function createClient(props) {
+    return new Octokit({ auth: resolveToken(props) });
+}
+export const CommentProvider = () => Provider.succeed(Comment, {
+    stables: ["commentId"],
+    create: Effect.fn(function* ({ news }) {
+        const octokit = createClient(news);
+        const body = dedent(news.body);
+        const { data } = yield* Effect.tryPromise(() => octokit.rest.issues.createComment({
+            owner: news.owner,
+            repo: news.repository,
+            issue_number: news.issueNumber,
+            body,
+        }));
+        return {
+            commentId: data.id,
+            htmlUrl: data.html_url,
+            updatedAt: data.updated_at,
+        };
+    }),
+    update: Effect.fn(function* ({ news, output }) {
+        const octokit = createClient(news);
+        const body = dedent(news.body);
+        const { data } = yield* Effect.tryPromise(() => octokit.rest.issues.updateComment({
+            owner: news.owner,
+            repo: news.repository,
+            comment_id: output.commentId,
+            body,
+        }));
+        return {
+            commentId: data.id,
+            htmlUrl: data.html_url,
+            updatedAt: data.updated_at,
+        };
+    }),
+    delete: Effect.fn(function* ({ olds, output }) {
+        if (!olds.allowDelete) {
+            return;
+        }
+        const octokit = createClient(olds);
+        yield* Effect.tryPromise(async () => {
+            try {
+                await octokit.rest.issues.deleteComment({
+                    owner: olds.owner,
+                    repo: olds.repository,
+                    comment_id: output.commentId,
+                });
+            }
+            catch (error) {
+                if (error.status !== 404) {
+                    throw error;
+                }
+            }
+        });
+    }),
+});
+//# sourceMappingURL=Comment.js.map

package/lib/GitHub/Comment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Comment.js","sourceRoot":"","sources":["../../src/GitHub/Comment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AA+D3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,gBAAgB,CAAC,CAAC;AAE3D,SAAS,YAAY,CAAC,KAAmB;IACvC,OAAO,CACL,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB;IACvC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE;IACxB,OAAO,EAAE,CAAC,WAAW,CAAC;IAEtB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,IAAI;SACL,CAAC,CACH,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,IAAI;SACL,CAAC,CACH,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBACtC,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,UAAU;oBACrB,UAAU,EAAE,MAAM,CAAC,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/GitHub/Secret.d.ts

@@ -0,0 +1,120 @@
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+export interface SecretProps {
+    /**
+     * Repository owner (user or organization).
+     */
+    owner: string;
+    /**
+     * Repository name.
+     */
+    repository: string;
+    /**
+     * Secret name (e.g. `AWS_ROLE_ARN`).
+     */
+    name: string;
+    /**
+     * Secret value. Wrap with `Redacted.make` to prevent the value from
+     * appearing in logs or state.
+     */
+    value: Redacted.Redacted;
+    /**
+     * Optional environment name. When set the secret is scoped to that
+     * GitHub Actions environment instead of the whole repository.
+     */
+    environment?: string;
+    /**
+     * GitHub API token. If not provided, falls back to
+     * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+     */
+    token?: string;
+}
+export interface Secret extends Resource<"GitHub.Secret", SecretProps, {
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+}> {
+}
+/**
+ * A GitHub Actions repository or environment secret.
+ *
+ * `Secret` manages the lifecycle of an encrypted secret in GitHub Actions.
+ * Secrets are encrypted using the repository's (or environment's) public
+ * key via `libsodium` before being stored. The resource is idempotent —
+ * calling it with the same name will update the secret value in place.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Repository Secrets
+ * Store secrets accessible to all GitHub Actions workflows in the
+ * repository.
+ *
+ * @example Create a Repository Secret
+ * ```typescript
+ * yield* GitHub.Secret("aws-role", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @section Environment Secrets
+ * Scope a secret to a specific GitHub Actions environment (e.g.
+ * `production`, `staging`). Environment secrets require environment
+ * protection rules to be satisfied before workflows can access them.
+ *
+ * @example Create an Environment Secret
+ * ```typescript
+ * yield* GitHub.Secret("deploy-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DEPLOY_KEY",
+ *   value: Redacted.make("my-secret-value"),
+ * });
+ * ```
+ *
+ * @section Wiring with Other Resources
+ * A common pattern is wiring the output of another resource — like an
+ * IAM role ARN or a database URL — directly into a GitHub secret so
+ * that CI workflows can use it.
+ *
+ * @example Store an IAM Role ARN for CI
+ * ```typescript
+ * const role = yield* AWS.IAM.Role("ci-role", { ... });
+ *
+ * yield* GitHub.Secret("ci-role-arn", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @example Store Multiple Secrets
+ * ```typescript
+ * yield* GitHub.Secret("db-url", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DATABASE_URL",
+ *   value: Redacted.make(database.connectionString),
+ * });
+ *
+ * yield* GitHub.Secret("api-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "API_KEY",
+ *   value: Redacted.make(apiKey),
+ * });
+ * ```
+ */
+export declare const Secret: import("../Resource.ts").ResourceClass<Secret>;
+export declare const SecretProvider: () => import("effect/Layer").Layer<Provider.Provider<Secret>, never, never>;
+//# sourceMappingURL=Secret.d.ts.map

package/lib/GitHub/Secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../src/GitHub/Secret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAEzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,MAAO,SAAQ,QAAQ,CACtC,eAAe,EACf,WAAW,EACX;IACE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CACF;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,eAAO,MAAM,MAAM,gDAAoC,CAAC;AAwBxD,eAAO,MAAM,cAAc,6EAyBvB,CAAC"}

package/lib/GitHub/Secret.js

@@ -0,0 +1,187 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../Provider.js";
+import { Resource } from "../Resource.js";
+/**
+ * A GitHub Actions repository or environment secret.
+ *
+ * `Secret` manages the lifecycle of an encrypted secret in GitHub Actions.
+ * Secrets are encrypted using the repository's (or environment's) public
+ * key via `libsodium` before being stored. The resource is idempotent —
+ * calling it with the same name will update the secret value in place.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Repository Secrets
+ * Store secrets accessible to all GitHub Actions workflows in the
+ * repository.
+ *
+ * @example Create a Repository Secret
+ * ```typescript
+ * yield* GitHub.Secret("aws-role", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @section Environment Secrets
+ * Scope a secret to a specific GitHub Actions environment (e.g.
+ * `production`, `staging`). Environment secrets require environment
+ * protection rules to be satisfied before workflows can access them.
+ *
+ * @example Create an Environment Secret
+ * ```typescript
+ * yield* GitHub.Secret("deploy-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DEPLOY_KEY",
+ *   value: Redacted.make("my-secret-value"),
+ * });
+ * ```
+ *
+ * @section Wiring with Other Resources
+ * A common pattern is wiring the output of another resource — like an
+ * IAM role ARN or a database URL — directly into a GitHub secret so
+ * that CI workflows can use it.
+ *
+ * @example Store an IAM Role ARN for CI
+ * ```typescript
+ * const role = yield* AWS.IAM.Role("ci-role", { ... });
+ *
+ * yield* GitHub.Secret("ci-role-arn", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @example Store Multiple Secrets
+ * ```typescript
+ * yield* GitHub.Secret("db-url", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DATABASE_URL",
+ *   value: Redacted.make(database.connectionString),
+ * });
+ *
+ * yield* GitHub.Secret("api-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "API_KEY",
+ *   value: Redacted.make(apiKey),
+ * });
+ * ```
+ */
+export const Secret = Resource("GitHub.Secret");
+function resolveToken(props) {
+    return (props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN);
+}
+function createClient(props) {
+    return new Octokit({ auth: resolveToken(props) });
+}
+async function encryptValue(plaintext, publicKey) {
+    const sodium = await import("libsodium-wrappers");
+    await sodium.ready;
+    const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+    const binMessage = sodium.from_string(plaintext);
+    const encrypted = sodium.crypto_box_seal(binMessage, binKey);
+    return sodium.to_base64(encrypted, sodium.base64_variants.ORIGINAL);
+}
+export const SecretProvider = () => Provider.succeed(Secret, {
+    create: Effect.fn(function* ({ news }) {
+        const octokit = createClient(news);
+        yield* upsertSecret(octokit, news);
+        return { updatedAt: new Date().toISOString() };
+    }),
+    update: Effect.fn(function* ({ news, olds }) {
+        const octokit = createClient(news);
+        const wasEnv = !!olds.environment;
+        const isEnv = !!news.environment;
+        if (wasEnv !== isEnv || olds.environment !== news.environment) {
+            yield* deleteSecret(octokit, olds);
+        }
+        yield* upsertSecret(octokit, news);
+        return { updatedAt: new Date().toISOString() };
+    }),
+    delete: Effect.fn(function* ({ olds }) {
+        const octokit = createClient(olds);
+        yield* deleteSecret(octokit, olds);
+    }),
+});
+const upsertSecret = Effect.fn(function* (octokit, props) {
+    const plaintext = Redacted.value(props.value);
+    const isEnv = !!props.environment;
+    const publicKey = yield* Effect.tryPromise(async () => {
+        if (isEnv) {
+            const { data } = await octokit.rest.actions.getEnvironmentPublicKey({
+                owner: props.owner,
+                repo: props.repository,
+                environment_name: props.environment,
+            });
+            return data;
+        }
+        const { data } = await octokit.rest.actions.getRepoPublicKey({
+            owner: props.owner,
+            repo: props.repository,
+        });
+        return data;
+    });
+    const encrypted = yield* Effect.tryPromise(() => encryptValue(plaintext, publicKey.key));
+    yield* Effect.tryPromise(async () => {
+        if (isEnv) {
+            await octokit.rest.actions.createOrUpdateEnvironmentSecret({
+                owner: props.owner,
+                repo: props.repository,
+                environment_name: props.environment,
+                secret_name: props.name,
+                encrypted_value: encrypted,
+                key_id: publicKey.key_id,
+            });
+        }
+        else {
+            await octokit.rest.actions.createOrUpdateRepoSecret({
+                owner: props.owner,
+                repo: props.repository,
+                secret_name: props.name,
+                encrypted_value: encrypted,
+                key_id: publicKey.key_id,
+            });
+        }
+    });
+});
+const deleteSecret = Effect.fn(function* (octokit, props) {
+    yield* Effect.tryPromise(async () => {
+        try {
+            if (props.environment) {
+                await octokit.rest.actions.deleteEnvironmentSecret({
+                    owner: props.owner,
+                    repo: props.repository,
+                    environment_name: props.environment,
+                    secret_name: props.name,
+                });
+            }
+            else {
+                await octokit.rest.actions.deleteRepoSecret({
+                    owner: props.owner,
+                    repo: props.repository,
+                    secret_name: props.name,
+                });
+            }
+        }
+        catch (error) {
+            if (error.status !== 404) {
+                throw error;
+            }
+        }
+    });
+});
+//# sourceMappingURL=Secret.js.map

package/lib/GitHub/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/GitHub/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAgD1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,eAAe,CAAC,CAAC;AAExD,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,CACL,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,SAAiB,EACjB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,OAAgB,EAChB,KAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;gBAClE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAY;aACrC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,UAAU;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CACvC,CAAC;IAEF,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC;gBACzD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAY;gBACpC,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,OAAgB,EAChB,KAAkB;IAElB,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;oBACjD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,gBAAgB,EAAE,KAAK,CAAC,WAAW;oBACnC,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}