@alchemy.run/archil 0.0.0 → 2.0.0-beta.87

package/lib/internal/hosted.js

@@ -0,0 +1,291 @@
+/**
+ * Bundling and deploying the program of an `Archil.Sandbox` with `main`: a
+ * Node process run as an Archil sandbox service (`archil-sandbox services
+ * create`), which restarts when it crashes and starts whenever the sandbox
+ * boots.
+ */
+import * as archil from "@distilled.cloud/archil";
+import * as Process from "@distilled.cloud/archil/Process";
+import * as Bundle from "alchemy/Bundle/Bundle";
+import { normalizeInstallTargets, resolvePackageInstallIdentity, } from "alchemy/Bundle/InstalledPackages";
+import { findCwdForBundle, resolveMainPath } from "alchemy/Bundle/TempRoot";
+import { contextRootOf, extraFileDestination, hashExtraFiles, isContextRootDest, posixRelUnder, resolveExtraSource, } from "alchemy/Util/extraFiles";
+import { sha256, sha256Object } from "alchemy/Util/sha256";
+import { zipFiles } from "alchemy/Util/zip";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { waitForSandbox } from "./archil.js";
+/** A sandbox program failed to deploy or never started serving. */
+export class ProgramDeployFailed extends Data.TaggedError("Archil.ProgramDeployFailed") {
+}
+/** Entry for the Effect form: the package bootstrap plus the user's `main`. */
+const effectEntry = (handler) => (importPath) => `
+import { bootstrap } from "@alchemy.run/archil/Bootstrap";
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+await bootstrap(entrypoint);
+`;
+/**
+ * Entry for the async form: serve the module's `fetch(request, env)` over
+ * `node:http`, with `process.env` as `env`. Nothing from alchemy or Effect
+ * is bundled.
+ */
+const asyncEntry = (handler) => (importPath) => `
+import * as mod from ${JSON.stringify(importPath)};
+import http from "node:http";
+import { Readable } from "node:stream";
+
+const app = mod[${JSON.stringify(handler)}] ?? mod.default;
+const port = Number(process.env.PORT ?? 3000);
+
+http
+  .createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url ?? "/", \`http://\${req.headers.host ?? "localhost"}\`);
+      const headers = new Headers();
+      for (const [key, value] of Object.entries(req.headers)) {
+        for (const v of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+          headers.append(key, v);
+        }
+      }
+      const hasBody = req.method !== "GET" && req.method !== "HEAD";
+      const request = new Request(url, {
+        method: req.method,
+        headers,
+        body: hasBody ? Readable.toWeb(req) : undefined,
+        duplex: hasBody ? "half" : undefined,
+      });
+      const response = await app.fetch(request, process.env);
+      res.writeHead(response.status, Object.fromEntries(response.headers));
+      if (response.body) Readable.fromWeb(response.body).pipe(res);
+      else res.end();
+    } catch (error) {
+      console.error(error);
+      if (!res.headersSent) res.writeHead(500);
+      res.end("Internal Server Error");
+    }
+  })
+  .listen(port, "0.0.0.0");
+`;
+/**
+ * Paths left out of an upload. A tree uploaded at the program root keeps
+ * its `node_modules` (framework servers like Nuxt trace their dependencies
+ * there); other trees drop them.
+ */
+const skipped = (relative, atRoot) => relative
+    .replaceAll("\\", "/")
+    .split("/")
+    .some((segment) => segment === ".git" || (!atRoot && segment === "node_modules"));
+/** Read every extra file into program files at their destinations. */
+const collectExtraFiles = Effect.fn(function* (extraFiles) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const files = [];
+    for (const extra of extraFiles) {
+        const dest = extraFileDestination(extra.destination);
+        const source = resolveExtraSource(extra.source, path);
+        if (!(yield* fs.exists(source)))
+            continue;
+        if ((yield* fs.stat(source)).type === "File") {
+            files.push({
+                path: isContextRootDest(dest) ? path.basename(source) : dest,
+                content: yield* fs.readFile(source),
+            });
+            continue;
+        }
+        const atRoot = isContextRootDest(dest);
+        for (const name of yield* fs.readDirectory(source, { recursive: true })) {
+            if (skipped(name, atRoot))
+                continue;
+            const full = path.join(source, name);
+            if ((yield* fs.stat(full)).type !== "File")
+                continue;
+            const rel = name.replaceAll("\\", "/");
+            files.push({
+                path: isContextRootDest(dest) ? rel : `${dest}/${rel}`.replaceAll(/\/+/g, "/"),
+                content: yield* fs.readFile(full),
+            });
+        }
+    }
+    return files;
+});
+/** The `package.json` that installs `build.install`, pinned to the versions the project resolves. */
+const installManifest = Effect.fn(function* (cwd, install) {
+    const requested = yield* normalizeInstallTargets(install);
+    if (Object.keys(requested).length === 0)
+        return undefined;
+    const identity = yield* resolvePackageInstallIdentity({ cwd, requested });
+    if (Object.keys(identity.resolved).length === 0)
+        return undefined;
+    return `${JSON.stringify({ private: true, type: "module", dependencies: identity.resolved }, null, 2)}\n`;
+});
+/**
+ * Pack `main` into the files of a Node program.
+ *
+ * - The Effect form bundles `main` behind the package bootstrap.
+ * - The async form bundles `main` behind a `node:http` server for its
+ *   `fetch(request, env)`.
+ * - With `extraFiles`, `main` is already a complete Node program (a
+ *   framework's server entry): it is uploaded as built, with its tree.
+ */
+export const bundleProgram = Effect.fn(function* (props, virtualEntryPlugin) {
+    const handler = props.handler ?? "default";
+    const realMain = yield* resolveMainPath(props.main);
+    const cwd = yield* findCwdForBundle(realMain);
+    const manifest = yield* installManifest(cwd, props.build?.install);
+    const manifestFiles = manifest === undefined
+        ? []
+        : [{ path: "package.json", content: new TextEncoder().encode(manifest) }];
+    if (props.isExternal && props.extraFiles !== undefined) {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const extras = props.extraFiles.map((f) => ({ source: f.source, dest: f.destination }));
+        const root = contextRootOf(realMain, extras, path, (source) => resolveExtraSource(source, path));
+        const entryRel = posixRelUnder(root, realMain, path) ?? path.basename(realMain);
+        const entry = yield* fs.readFile(realMain);
+        const files = [
+            ...(yield* collectExtraFiles(props.extraFiles)).filter((f) => !(f.path === "package.json" && manifest !== undefined)),
+            ...manifestFiles,
+        ];
+        if (!files.some((f) => f.path === entryRel))
+            files.push({ path: entryRel, content: entry });
+        const hash = yield* sha256Object({
+            entry: yield* sha256(entry),
+            extra: yield* hashExtraFiles(extras),
+            manifest: manifest ?? "",
+            entryRel,
+        });
+        return { files, hash, entryRel, install: manifest !== undefined };
+    }
+    const entry = props.isExternal ? asyncEntry(handler) : effectEntry(handler);
+    const output = yield* Bundle.build({
+        ...props.build?.input,
+        input: realMain,
+        cwd,
+        platform: "node",
+        resolve: {
+            conditionNames: [...Bundle.NODE_CONDITION_NAMES],
+            ...props.build?.input?.resolve,
+        },
+        plugins: [props.build?.input?.plugins, virtualEntryPlugin(entry)],
+    }, {
+        ...props.build?.output,
+        format: "esm",
+        sourcemap: props.build?.output?.sourcemap ?? false,
+        minify: props.build?.output?.minify ?? false,
+        entryFileNames: "index.mjs",
+        strictExecutionOrder: true,
+        keepNames: true,
+    }, props.build);
+    const files = [
+        ...output.files.map((file) => ({
+            path: file.path,
+            content: typeof file.content === "string" ? new TextEncoder().encode(file.content) : file.content,
+        })),
+        ...manifestFiles,
+    ];
+    const hash = yield* sha256Object({ bundle: output.hash, manifest: manifest ?? "" });
+    return {
+        files,
+        hash,
+        entryRel: "index.mjs",
+        install: manifest !== undefined,
+    };
+});
+/** Single-quote a value for `sh`. */
+const shellQuote = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
+const envValue = (value) => Redacted.isRedacted(value)
+    ? String(Redacted.value(value))
+    : typeof value === "string"
+        ? value
+        : JSON.stringify(value ?? null);
+/** Boot a sandbox that is paused or stopped, and wait until it runs. */
+export const ensureRunning = Effect.fn(function* (sid) {
+    const sandbox = yield* waitForSandbox(sid);
+    if (sandbox.status === "paused") {
+        yield* archil
+            .resumeSandbox({ sid })
+            .pipe(Effect.catchTag("SandboxStartConflict", () => Effect.void));
+    }
+    else if (sandbox.status === "stopped" || sandbox.status === "exited") {
+        yield* archil
+            .startSandbox({ sid })
+            .pipe(Effect.catchTag("SandboxStartConflict", () => Effect.void));
+    }
+    const ready = yield* waitForSandbox(sid);
+    if (ready.status !== "running") {
+        return yield* new ProgramDeployFailed({
+            program: sid,
+            message: `Sandbox ${ready.name} is ${ready.status}, not running`,
+        });
+    }
+});
+/** Run a shell command in the sandbox and fail with its output on a non-zero exit. */
+const sh = Effect.fn(function* (sid, program, command) {
+    const result = yield* Process.exec(sid, command);
+    if (result.exitCode !== 0) {
+        return yield* new ProgramDeployFailed({
+            program,
+            message: `\`${command.split("\n")[0]}\` exited ${result.exitCode ?? result.status}: ${(result.stderr || result.stdout).trim()}`,
+        });
+    }
+    return result.stdout;
+});
+/** The directory a program lives in. */
+export const programDir = (name) => `/opt/alchemy/${name}`;
+/**
+ * Upload the program, (re)define its service, and wait until it answers on
+ * `port` inside the sandbox.
+ */
+export const deployProgram = Effect.fn(function* (input) {
+    const dir = programDir(input.name);
+    const staging = `${dir}.next`;
+    yield* ensureRunning(input.sid);
+    yield* sh(input.sid, input.name, `rm -rf ${shellQuote(staging)} && mkdir -p ${shellQuote(staging)}`);
+    // One archive, one upload: a framework build can have thousands of files.
+    const archive = yield* zipFiles(input.program.files);
+    yield* Effect.logInfo(`Archil.Sandbox program: uploading ${input.program.files.length} files (${Math.round(archive.byteLength / 1024)} KiB)`);
+    yield* Process.uploadFile(input.sid, `${staging}.zip`, archive);
+    yield* sh(input.sid, input.name, `python3 -m zipfile -e ${shellQuote(`${staging}.zip`)} ${shellQuote(staging)} && rm -f ${shellQuote(`${staging}.zip`)}`);
+    if (input.program.install) {
+        yield* Effect.logInfo(`Archil.Sandbox program: npm install`);
+        yield* sh(input.sid, input.name, `cd ${shellQuote(staging)} && npm install --omit=dev --no-fund --no-audit --loglevel=error`);
+    }
+    const envFlags = Object.entries({ ...input.env, PORT: String(input.port) })
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, value]) => `--env ${shellQuote(`${key}=${envValue(value)}`)}`)
+        .join(" ");
+    yield* sh(input.sid, input.name, [
+        `archil-sandbox services delete ${shellQuote(input.name)} >/dev/null 2>&1 || true`,
+        `rm -rf ${shellQuote(dir)} && mv ${shellQuote(staging)} ${shellQuote(dir)}`,
+        `archil-sandbox services create ${shellQuote(input.name)} --tcp-port ${input.port} --dir ${shellQuote(dir)} ${envFlags} -- node ${shellQuote(input.program.entryRel)} >/dev/null`,
+    ].join(" && "));
+    yield* Effect.logInfo(`Archil.Sandbox program: started, waiting for port ${input.port}`);
+    // Wait until the process answers HTTP on its port.
+    const probe = `curl -s -o /dev/null -m 2 -w '%{http_code}' http://127.0.0.1:${input.port}/ || true`;
+    const code = yield* Process.exec(input.sid, probe).pipe(Effect.map((r) => r.stdout.trim()), Effect.repeat({
+        schedule: Schedule.spaced("1 second"),
+        until: (status) => status !== "" && status !== "000",
+        times: 30,
+    }));
+    if (code === "" || code === "000") {
+        const logs = yield* Process.exec(input.sid, `archil-sandbox services logs ${shellQuote(input.name)} 2>&1 | tail -n 40`).pipe(Effect.map((r) => r.stdout), Effect.orElseSucceed(() => ""));
+        return yield* new ProgramDeployFailed({
+            program: input.name,
+            message: `The program never answered on port ${input.port}.\n${logs}`,
+        });
+    }
+});
+/** Stop the program and remove its files. Removing a missing one succeeds. */
+export const removeProgram = Effect.fn(function* (sid, name) {
+    const sandbox = yield* waitForSandbox(sid).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+    if (sandbox === undefined || sandbox.status === "deleted")
+        return;
+    yield* ensureRunning(sid);
+    yield* Process.exec(sid, `archil-sandbox services delete ${shellQuote(name)} >/dev/null 2>&1; rm -rf ${shellQuote(programDir(name))}`);
+});
+//# sourceMappingURL=hosted.js.map

package/lib/internal/hosted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted.js","sources":["../../src/internal/hosted.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,uBAAuB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAE9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,mEAAmE;AACnE,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAGpF;CAAG;AAqCL,+EAA+E;AAC/E,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,UAAkB,EAAE,EAAE,CAC9D;;WAES,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;;CAGpE,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,UAAkB,EAAE,EAAE,CAC7D;uBACqB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;;;kBAI/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BxC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,MAAe,EAAE,EAAE,CACpD,QAAQ;KACL,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;KACrB,KAAK,CAAC,GAAG,CAAC;KACV,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC;AAEtF,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,UAA2C;IACxF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC5D,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,SAAS;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;gBAC9E,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAW,EAAE,OAAmC;IAC3F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC5G,CAAC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC9C,KAAyB,EACzB,kBAAgF;IAEhF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,aAAa,GACjB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE9E,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5D,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CACjC,CAAC;QACF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAkB;YAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,QAAQ,KAAK,SAAS,CAAC,CAC9D;YACD,GAAG,aAAa;SACjB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B,KAAK,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;YACpC,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,EAA2B,CAAC;IAC7F,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAChC;QACE,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK;QACrB,KAAK,EAAE,QAAQ;QACf,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE;YACP,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,oBAAoB,CAAC;YAChD,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO;SAC/B;QACD,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;KAClE,EACD;QACE,GAAG,KAAK,CAAC,KAAK,EAAE,MAAM;QACtB,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,KAAK;QAClD,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK;QAC5C,cAAc,EAAE,WAAW;QAC3B,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;KAChB,EACD,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,MAAM,KAAK,GAAkB;QAC3B,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EACL,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;SAC3F,CAAC,CAAC;QACH,GAAG,aAAa;KACjB,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO;QACL,KAAK;QACL,IAAI;QACJ,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,QAAQ,KAAK,SAAS;KACP,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAE5E,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE,CAC1C,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAEtC,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAW;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM;aACV,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC;aACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvE,KAAK,CAAC,CAAC,MAAM;aACV,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;aACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;YACpC,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,WAAW,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,eAAe;SACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAW,EAAE,OAAe,EAAE,OAAe;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;YACpC,OAAO;YACP,OAAO,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;SAChI,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAMjD;IACC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;IAC9B,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,CAAC,CAAC,EAAE,CACP,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,IAAI,EACV,UAAU,UAAU,CAAC,OAAO,CAAC,gBAAgB,UAAU,CAAC,OAAO,CAAC,EAAE,CACnE,CAAC;IACF,0EAA0E;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,qCAAqC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CACvH,CAAC;IACF,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,KAAK,CAAC,CAAC,EAAE,CACP,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,IAAI,EACV,yBAAyB,UAAU,CAAC,GAAG,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,aAAa,UAAU,CAAC,GAAG,OAAO,MAAM,CAAC,EAAE,CACxH,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC7D,KAAK,CAAC,CAAC,EAAE,CACP,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,IAAI,EACV,MAAM,UAAU,CAAC,OAAO,CAAC,kEAAkE,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;SACxE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,UAAU,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;SACzE,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,KAAK,CAAC,CAAC,EAAE,CACP,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,IAAI,EACV;QACE,kCAAkC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B;QAClF,UAAU,UAAU,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE;QAC3E,kCAAkC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,UAAU,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,YAAY,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa;KAClL,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,qDAAqD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,mDAAmD;IACnD,MAAM,KAAK,GAAG,gEAAgE,KAAK,CAAC,IAAI,WAAW,CAAC;IACpG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAClC,MAAM,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK;QACpD,KAAK,EAAE,EAAE;KACV,CAAC,CACH,CAAC;IACF,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAC9B,KAAK,CAAC,GAAG,EACT,gCAAgC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAC3E,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAC/B,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,IAAI;YACnB,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,MAAM,IAAI,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAW,EAAE,IAAY;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpD,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IAClE,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC1B,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,GAAG,EACH,kCAAkC,UAAU,CAAC,IAAI,CAAC,4BAA4B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAC7G,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alchemy.run/archil",
-  "version": "0.0.0",
+  "version": "2.0.0-beta.87",
   "description": "Archil disks, sandboxes, images and mounts for Alchemy.",
   "keywords": [
     "alchemy",
@@ -10,12 +10,88 @@
     "infrastructure-as-code",
     "sandbox"
   ],
+  "homepage": "https://alchemy.run",
+  "bugs": {
+    "url": "https://github.com/alchemy-run/alchemy/issues"
+  },
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
-  "homepage": "https://alchemy.run",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alchemy-run/alchemy.git",
     "directory": "packages/archil"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "default": "./lib/index.js"
+    },
+    "./Bootstrap": {
+      "types": "./src/Bootstrap.ts",
+      "bun": "./src/Bootstrap.ts",
+      "default": "./src/Bootstrap.ts"
+    },
+    "./AWS": {
+      "types": "./lib/AWS/index.d.ts",
+      "bun": "./src/AWS/index.ts",
+      "worker": "./src/AWS/index.ts",
+      "default": "./lib/AWS/index.js"
+    },
+    "./internal/*": null,
+    "./*": {
+      "types": "./lib/*.d.ts",
+      "bun": "./src/*.ts",
+      "worker": "./src/*.ts",
+      "default": "./lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@alchemy.run/docker": "2.0.0-beta.87",
+    "@distilled.cloud/archil": "1.0.0-rc.20",
+    "@distilled.cloud/core": "1.0.0-rc.20",
+    "rolldown": "1.2.16"
+  },
+  "devDependencies": {
+    "@alchemy.run/aws": "2.0.0-beta.87",
+    "@effect/platform-node": "^4.1.4",
+    "@types/bun": "1.4.3",
+    "alchemy": "2.0.0-beta.87",
+    "effect": "^4.1.4",
+    "typescript": "^7.1.0-dev.20261105.1"
+  },
+  "peerDependencies": {
+    "@alchemy.run/aws": "2.0.0-beta.87",
+    "@effect/platform-node": "^4.1.4",
+    "alchemy": "2.0.0-beta.87",
+    "effect": "^4.1.4"
+  },
+  "peerDependenciesMeta": {
+    "@alchemy.run/aws": {
+      "optional": true
+    },
+    "@effect/platform-node": {
+      "optional": true
+    }
+  },
+  "alchemy": {
+    "contributes": [
+      "@alchemy.run/archil/Contributions"
+    ]
+  },
+  "scripts": {
+    "build": "pnpm -r --filter \"{.}...\" run build:package",
+    "build:package": "node scripts/build.ts"
   }
-}
+}

package/src/AWS/S3Disk.ts

@@ -0,0 +1,125 @@
+import type { PolicyStatement } from "@alchemy.run/aws/IAM/Policy";
+import type * as S3 from "@alchemy.run/aws/S3";
+import * as Output from "alchemy/Output";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { account } from "../Credentials.ts";
+import { Disk, type DiskProps } from "../Disk.ts";
+
+/**
+ * The IAM role Archil assumes to reach your bucket, per Archil region.
+ * @see https://docs.archil.com/data-sources/s3-object-storage
+ */
+export const ARCHIL_S3_PRINCIPALS: Record<string, string> = {
+  "aws-us-east-1": "arn:aws:iam::904233114299:role/archil-s3.prod.us-east-1",
+  "aws-us-east-2": "arn:aws:iam::787372716928:role/archil-s3.prod.aws.us-east-2",
+  "aws-us-west-2": "arn:aws:iam::795289710871:role/archil-s3.prod.aws.us-west-2",
+  "aws-eu-west-1": "arn:aws:iam::794252461707:role/archil-s3.prod.aws.eu-west-1",
+  "gcp-us-central1": "arn:aws:iam::025016447135:role/archil-s3.prod.gcp.us-central1",
+};
+
+/** The Archil organization isn't configured, so the bucket policy can't be scoped to it. */
+export class ArchilOrganizationRequired extends Data.TaggedError("Archil.OrganizationRequired")<{
+  readonly message: string;
+}> {}
+
+/** An Archil region with no published S3 principal. */
+export class ArchilRegionUnsupported extends Data.TaggedError("Archil.RegionUnsupported")<{
+  readonly region: string;
+  readonly message: string;
+}> {}
+
+export interface S3DiskProps extends Omit<DiskProps, "storage"> {
+  /** The bucket the disk keeps its files in. */
+  bucket: S3.Bucket | Effect.Effect<S3.Bucket, any, any>;
+  /** Prefix within the bucket, e.g. `"datasets/"`. */
+  prefix?: string;
+}
+
+/**
+ * The bucket-policy statements that let Archil's role for `region` read and
+ * write `bucketArn`, only on behalf of disks in `organization`.
+ */
+export const archilBucketStatements = (input: {
+  readonly region: string;
+  readonly organization: string;
+  readonly bucketArn: string;
+  readonly prefix?: string;
+}): PolicyStatement[] => {
+  const principal = ARCHIL_S3_PRINCIPALS[input.region]!;
+  const condition = {
+    StringEquals: { "aws:PrincipalTag/archilAccountId": input.organization },
+  };
+  const objects = `${input.bucketArn}/${input.prefix ?? ""}*`;
+  return [
+    {
+      Sid: "ArchilList",
+      Effect: "Allow",
+      Principal: { AWS: principal },
+      Action: ["s3:ListBucket"],
+      Resource: input.bucketArn,
+      Condition: condition,
+    },
+    {
+      Sid: "ArchilObjects",
+      Effect: "Allow",
+      Principal: { AWS: principal },
+      Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
+      Resource: objects,
+      Condition: condition,
+    },
+  ];
+};
+
+/**
+ * An Archil disk that keeps its files in your own S3 bucket, with no access
+ * keys anywhere: the bucket's policy trusts Archil's IAM role for your
+ * region, only on behalf of disks in your Archil organization. The disk's
+ * files are ordinary objects in the bucket, so any S3 tool can read them.
+ *
+ * Set your Archil organization id in your profile (`alchemy profile edit
+ * --add Archil`) or as `ARCHIL_ORGANIZATION`; the policy can't be scoped
+ * without it.
+ * @see https://docs.archil.com/data-sources/s3-object-storage
+ *
+ * ### Creating a Disk on Your Bucket
+ * **Example:** A dataset disk on an S3 bucket
+ * ```typescript
+ * import * as ArchilAWS from "@alchemy.run/archil/AWS";
+ *
+ * export const Store = AWS.S3.Bucket("Store", {});
+ * export const Dataset = ArchilAWS.S3Disk("Dataset", { bucket: Store, prefix: "datasets/" });
+ * ```
+ *
+ * @primitive
+ * @product S3 Disk
+ */
+export const S3Disk = (id: string, props: S3DiskProps) =>
+  Effect.gen(function* () {
+    const { bucket: bucketRef, prefix, ...diskProps } = props;
+    const bucket = Effect.isEffect(bucketRef) ? yield* bucketRef : bucketRef;
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+      const { region, organization } = yield* account;
+      if (!ARCHIL_S3_PRINCIPALS[region]) {
+        return yield* new ArchilRegionUnsupported({
+          region,
+          message: `Archil publishes no S3 principal for ${region}.`,
+        });
+      }
+      if (!organization) {
+        return yield* new ArchilOrganizationRequired({
+          message:
+            "ArchilAWS.S3Disk scopes the bucket policy to your Archil organization. Set it with `alchemy profile edit --add Archil` or ARCHIL_ORGANIZATION.",
+        });
+      }
+      yield* bucket.bind(`Archil(${id})`, {
+        policyStatements: Output.map(bucket.bucketArn, (bucketArn) =>
+          archilBucketStatements({ region, organization, bucketArn, prefix }),
+        ),
+      });
+    }
+    return yield* Disk(id, {
+      ...diskProps,
+      storage: { type: "s3", bucketName: bucket.bucketName, bucketPrefix: prefix },
+    });
+  });

package/src/AWS/index.ts

@@ -0,0 +1 @@
+export * from "./S3Disk.ts";