@alchemy.run/archil 0.0.0 → 2.0.0-beta.87

package/lib/ApiToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiToken.js","sources":["../src/ApiToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAmChE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAW,iBAAiB,CAAC,CAAC;AAE9D,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAyC;IAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACrF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CACjC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;AAEJ,mDAAmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY,EAAE,WAAoB;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,IAAI;QACJ,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;QAC9E,MAAM;KACsB,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,QAAQ,CAAC,MAAM,CACb,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC9D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;iBACvB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;iBAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACf,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE;gBACvB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM;aACP,CAAC,CAAC,CAAC;QACR,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAChE,IACE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC/C,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,WAAW,EACtC,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;iBAClD,CAAC;YACb,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;YACvD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC;YAChF,oEAAoE;YACpE,4DAA4D;YAC5D,OAAO,OAAO,CAAC;gBACb,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE;gBAC1B,IAAI;gBACJ,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,UAAU;YACV,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IACE,QAAQ;gBACR,MAAM;gBACN,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;gBACnC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,EAC9B,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,iEAAiE;YACjE,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACjB,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,KAAK,CAAC,CAAC;gBACvD,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/ArchilBindings.d.ts

@@ -0,0 +1,65 @@
+/**
+ * How Archil bindings reach Archil from any host.
+ *
+ * Archil only mints API keys from a console session and can't scope them,
+ * so a host's control-plane clients use the key the stack deploys with,
+ * recorded per host and read back at run time. Hosts that only touch one
+ * disk never hold an API key: the object bindings get a per-host S3
+ * `Archil.DiskUser` (read-only for `ReadDisk`), and `MountDisk` a per-host
+ * token user.
+ */
+import { Credentials } from "@distilled.cloud/archil/Credentials";
+import * as Objects from "@distilled.cloud/archil/Objects";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as Stream from "effect/Stream";
+import type { Disk } from "./Disk.ts";
+/** Runs disk object effects and streams with one set of object credentials. */
+export interface ObjectsRunner {
+    <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, Exclude<R, Objects.ObjectCredentials | HttpClient.HttpClient> | RuntimeContext>;
+    stream<A, E, R>(stream: Stream.Stream<A, E, R>): Stream.Stream<A, E, Exclude<R, Objects.ObjectCredentials | HttpClient.HttpClient> | RuntimeContext>;
+}
+/** Runs Archil SDK effects and streams with the host's own API key. */
+export interface Authorize {
+    <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, Exclude<R, Credentials | HttpClient.HttpClient> | RuntimeContext>;
+    stream<A, E, R>(stream: Stream.Stream<A, E, R>): Stream.Stream<A, E, Exclude<R, Credentials | HttpClient.HttpClient> | RuntimeContext>;
+    /** Disk object calls with the same API key. */
+    readonly objects: ObjectsRunner;
+}
+/**
+ * Record (at deploy) and read back (at run time) the API key a host's
+ * Archil clients call the control plane with. Every Archil binding on one
+ * host shares one record (the engine de-duplicates the declaration).
+ */
+export declare const ApiAccess: Effect.Effect<() => Effect.Effect<Authorize, never, never>, never, never>;
+/**
+ * Create (at deploy) and read back (at run time) a per-host S3 user on one
+ * disk, and run object calls signed with its keys. The keys reach only
+ * that disk, and only `GET`/`HEAD` when `readOnly`. Every object binding
+ * of one kind on one host shares one user (the engine de-duplicates the
+ * declaration).
+ */
+export declare const DiskKeyAccess: Effect.Effect<(disk: Disk, access: "read" | "write") => Effect.Effect<ObjectsRunner, never, never>, never, never>;
+/** What every name a run-time client creates starts with. */
+export declare const RUNTIME_NAME_MARKER = "alc-";
+/**
+ * The owner a binding's run-time client stamps on what it creates. Archil
+ * disks and sandboxes have no tags, labels or descriptions, only a name,
+ * so the owner (`alchemy::stack`, `alchemy::stage`, `alchemy::id`) is a
+ * name prefix: `alc-<id>-<hash of stack/stage/id>`. Hosts know their stack
+ * and stage at run time (`ALCHEMY_STACK_NAME`, `ALCHEMY_STAGE`), so the
+ * prefix is the same at deploy and at run time without a resource.
+ * Destroying the stack doesn't delete what carries it.
+ */
+export declare const runtimePrefix: (label: string) => Effect.Effect<{
+    prefix: string;
+    tags: {
+        "alchemy::stack": string;
+        "alchemy::stage": string;
+        "alchemy::id": string;
+    };
+}, never, never>;
+/** `<prefix>-<name>`. */
+export declare const runtimeName: (prefix: string, name: string) => string;
+//# sourceMappingURL=ArchilBindings.d.ts.map

package/lib/ArchilBindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArchilBindings.d.ts","sources":["../src/ArchilBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAmB,WAAW,EAAkB,MAAM,qCAAqC,CAAC;AACnG,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAG3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAG1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAItC,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAC7B,MAAM,CAAC,MAAM,CACd,CAAC,EACD,CAAC,EACD,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,CAC/E,CAAC;IACF,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAC7B,MAAM,CAAC,MAAM,CACd,CAAC,EACD,CAAC,EACD,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,CAC/E,CAAC;CACH;AAED,uEAAuE;AACvE,MAAM,WAAW,SAAS;IACxB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,CAAC;IACzF,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,CAAC;IACzF,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AASD;;;;GAIG;AACH,eAAO,MAAM,SAAS,2EAqBpB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,mHAgCxB,CAAC;AAEH,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAmB1C;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;;gBAcxB,CAAC;AAEH,yBAAyB;AACzB,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAwB,CAAC"}

package/lib/ArchilBindings.js

@@ -0,0 +1,128 @@
+/**
+ * How Archil bindings reach Archil from any host.
+ *
+ * Archil only mints API keys from a console session and can't scope them,
+ * so a host's control-plane clients use the key the stack deploys with,
+ * recorded per host and read back at run time. Hosts that only touch one
+ * disk never hold an API key: the object bindings get a per-host S3
+ * `Archil.DiskUser` (read-only for `ReadDisk`), and `MountDisk` a per-host
+ * token user.
+ */
+import { controlPlaneUrl, Credentials, DEFAULT_REGION } from "@distilled.cloud/archil/Credentials";
+import * as Objects from "@distilled.cloud/archil/Objects";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import * as Binding from "alchemy/Binding";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { DiskUser } from "./DiskUser.js";
+import { DeployerKey } from "./internal/DeployerKey.js";
+// TypeScript can't infer a generic call signature whose requirement is
+// `Exclude<R, …>` from `Effect.provide`, so runners assert their shape.
+const runnerOf = (layer) => ({
+    run: (effect) => effect.pipe(Effect.provide(layer)),
+    stream: (stream) => stream.pipe(Stream.provide(layer)),
+});
+/**
+ * Record (at deploy) and read back (at run time) the API key a host's
+ * Archil clients call the control plane with. Every Archil binding on one
+ * host shares one record (the engine de-duplicates the declaration).
+ */
+export const ApiAccess = Effect.gen(function* () {
+    const Key = yield* DeployerKey;
+    return Effect.fn(function* () {
+        const host = yield* Binding.Host;
+        const token = yield* Key(`${host?.LogicalId ?? "Script"}ArchilApiKey`, {});
+        const apiKey = yield* token.apiKey;
+        const region = yield* token.region;
+        const credentials = Effect.all([apiKey, region]).pipe(Effect.map(([key, r]) => ({
+            apiKey: key,
+            apiBaseUrl: controlPlaneUrl(r) ?? controlPlaneUrl(DEFAULT_REGION),
+            region: r,
+        })));
+        const layer = Layer.mergeAll(Objects.ObjectCredentialsFromApiKey, FetchHttpClient.layer).pipe(Layer.provideMerge(Layer.succeed(Credentials, credentials)));
+        const { run, stream } = runnerOf(layer);
+        const objects = Object.assign(run, { stream });
+        return Object.assign(run, { stream, objects });
+    });
+});
+/**
+ * Create (at deploy) and read back (at run time) a per-host S3 user on one
+ * disk, and run object calls signed with its keys. The keys reach only
+ * that disk, and only `GET`/`HEAD` when `readOnly`. Every object binding
+ * of one kind on one host shares one user (the engine de-duplicates the
+ * declaration).
+ */
+export const DiskKeyAccess = Effect.gen(function* () {
+    const Users = yield* DiskUser;
+    return Effect.fn(function* (disk, access) {
+        const host = yield* Binding.Host;
+        const user = yield* Users(`${host?.LogicalId ?? "Script"}${disk.LogicalId}${access === "read" ? "Reader" : "Writer"}`, { disk: disk.diskId, type: "s3", readOnly: access === "read" });
+        const accessKeyId = yield* user.accessKeyId;
+        const secretAccessKey = yield* user.secretAccessKey;
+        const region = yield* disk.region;
+        const auth = Effect.gen(function* () {
+            const keyId = yield* accessKeyId;
+            const secret = yield* secretAccessKey;
+            if (keyId === undefined || secret === undefined) {
+                return yield* new ConfigError({
+                    message: `The S3 user for ${disk.LogicalId} has no keys; redeploy to create them again.`,
+                });
+            }
+            return yield* Objects.diskKeysAuth({
+                region: yield* region,
+                accessKeyId: keyId,
+                secretAccessKey: secret,
+            });
+        });
+        const layer = Layer.mergeAll(Layer.succeed(Objects.ObjectCredentials, auth), FetchHttpClient.layer);
+        const { run, stream } = runnerOf(layer);
+        return Object.assign(run, { stream });
+    });
+});
+/** What every name a run-time client creates starts with. */
+export const RUNTIME_NAME_MARKER = "alc-";
+const toNameLabel = (value) => value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "");
+/** FNV-1a, 32-bit, as 8 hex digits: the same on every host, no crypto API needed. */
+const fnv1a = (value) => {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i++) {
+        hash ^= value.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16).padStart(8, "0");
+};
+/**
+ * The owner a binding's run-time client stamps on what it creates. Archil
+ * disks and sandboxes have no tags, labels or descriptions, only a name,
+ * so the owner (`alchemy::stack`, `alchemy::stage`, `alchemy::id`) is a
+ * name prefix: `alc-<id>-<hash of stack/stage/id>`. Hosts know their stack
+ * and stage at run time (`ALCHEMY_STACK_NAME`, `ALCHEMY_STAGE`), so the
+ * prefix is the same at deploy and at run time without a resource.
+ * Destroying the stack doesn't delete what carries it.
+ */
+export const runtimePrefix = Effect.fn(function* (label) {
+    const host = yield* Binding.Host;
+    const stack = yield* Effect.serviceOption(Stack);
+    const tags = {
+        "alchemy::stack": Option.isSome(stack) ? stack.value.name : "",
+        "alchemy::stage": Option.isSome(stack) ? stack.value.stage : "",
+        "alchemy::id": `${host?.LogicalId ?? "Script"}${label}`,
+    };
+    const owner = `${tags["alchemy::stack"]}/${tags["alchemy::stage"]}/${tags["alchemy::id"]}`;
+    const readable = toNameLabel(tags["alchemy::id"]).slice(0, 14).replace(/-+$/, "") || "x";
+    return {
+        prefix: `${RUNTIME_NAME_MARKER}${readable}-${fnv1a(owner)}`,
+        tags,
+    };
+});
+/** `<prefix>-<name>`. */
+export const runtimeName = (prefix, name) => `${prefix}-${name}`;
+//# sourceMappingURL=ArchilBindings.js.map

package/lib/ArchilBindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArchilBindings.js","sources":["../src/ArchilBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACnG,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAgCxD,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,QAAQ,GAAG,CAAK,KAAsB,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,EAAE,CAAU,MAA8B,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,EAAE,CAAU,MAA8B,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;CACxF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IAC/B,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,SAAS,IAAI,QAAQ,cAAc,EAAE,EAAE,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAE;YAClE,MAAM,EAAE,CAAC;SACV,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,2BAA2B,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,CAC3F,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAC5D,CAAC;QACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAA6B,CAAC;QAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAyB,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IAC9B,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAU,EAAE,MAAwB;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CACvB,GAAG,IAAI,EAAE,SAAS,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,EAC3F,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAC/D,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC5C,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;YACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;oBAC5B,OAAO,EAAE,mBAAmB,IAAI,CAAC,SAAS,8CAA8C;iBACzF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;gBACjC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM;gBACrB,WAAW,EAAE,KAAK;gBAClB,eAAe,EAAE,MAAM;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAC1B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAC9C,eAAe,CAAC,KAAK,CACtB,CAAC;QACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAA6B,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CACpC,KAAK;KACF,WAAW,EAAE;KACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;KAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;KACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3B,qFAAqF;AACrF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE;IAC9B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG;QACX,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC9D,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC/D,aAAa,EAAE,GAAG,IAAI,EAAE,SAAS,IAAI,QAAQ,GAAG,KAAK,EAAE;KACxD,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3F,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACzF,OAAO;QACL,MAAM,EAAE,GAAG,mBAAmB,GAAG,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE;QAC3D,IAAI;KACL,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,yBAAyB;AACzB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC"}

package/lib/AuthProvider.d.ts

@@ -0,0 +1,40 @@
+import { type StoredAuthConfig } from "alchemy/Auth/StoredAuthProvider";
+import * as Redacted from "effect/Redacted";
+/**
+ * Canonical name registered in the AuthProviders registry. Use this key to
+ * look up the Archil AuthProvider from inside provider Layers.
+ */
+export declare const ARCHIL_AUTH_PROVIDER_NAME = "Archil";
+export type ArchilAuthConfig = StoredAuthConfig;
+/**
+ * Resolved Archil credentials.
+ *
+ * Archil's control plane authenticates with account API keys (created in
+ * the console). Every disk, sandbox and image
+ * lives in one region, which picks the control plane and S3 endpoints.
+ */
+export interface ArchilResolvedCredentials {
+    type: "apiKey";
+    apiKey: Redacted.Redacted<string>;
+    /** Archil region id, e.g. `aws-us-east-1`. */
+    region: string;
+    /**
+     * Archil organization id. Only needed to scope bucket policies on
+     * bring-your-own-bucket disks to your organization.
+     */
+    organization: string | undefined;
+    source: {
+        type: ArchilAuthConfig["method"] | "env";
+        details?: string;
+    };
+}
+/**
+ * Layer that registers the Archil AuthProvider into the AuthProviders
+ * registry when built. Included in `Archil.providers()` so the alchemy CLI
+ * (`alchemy profile edit`) can configure it.
+ */
+export declare const ArchilAuth: import("effect/Layer").Layer<never, never, import("alchemy").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/crypto/SecureRandom").SecureRandom>;
+/** Schema of Archil's inline API-key values. */
+export declare const ArchilStoredCredentials: import("effect/Schema").Codec<import("alchemy/Auth/StoredAuthProvider").StoredValues, import("alchemy/Auth/StoredAuthProvider").StoredValues, never, never>;
+export type ArchilStoredCredentials = typeof ArchilStoredCredentials.Type;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sources":["../src/AuthProvider.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AA0ED;;;;GAIG;AACH,eAAO,MAAM,UAAU,uMAAmB,CAAC;AAE3C,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,6JAA0B,CAAC;AAC/D,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC"}

package/lib/AuthProvider.js

@@ -0,0 +1,87 @@
+import { DEFAULT_REGION, REGIONS } from "@distilled.cloud/archil/Credentials";
+import { AuthError } from "alchemy/Auth/AuthProvider";
+import { getEnv, getEnvRedacted } from "alchemy/Auth/Env";
+import { makeStoredAuthProvider, storedSecret, storedValueText, } from "alchemy/Auth/StoredAuthProvider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+/**
+ * Canonical name registered in the AuthProviders registry. Use this key to
+ * look up the Archil AuthProvider from inside provider Layers.
+ */
+export const ARCHIL_AUTH_PROVIDER_NAME = "Archil";
+const validateRegion = (value) => value in REGIONS ? undefined : `One of ${Object.keys(REGIONS).join(", ")}`;
+const readEnvironment = Effect.gen(function* () {
+    const apiKey = yield* getEnvRedacted("ARCHIL_API_KEY");
+    if (apiKey === undefined || Redacted.value(apiKey).trim().length === 0) {
+        return yield* AuthError.make({
+            message: "Archil CI credentials not found. Set ARCHIL_API_KEY.",
+        });
+    }
+    return {
+        type: "apiKey",
+        apiKey: Redacted.make(Redacted.value(apiKey).trim()),
+        region: (yield* getEnv("ARCHIL_REGION")) ?? DEFAULT_REGION,
+        organization: yield* getEnv("ARCHIL_ORGANIZATION"),
+        source: { type: "env", details: "ARCHIL_API_KEY" },
+    };
+});
+const archilAuth = makeStoredAuthProvider({
+    provider: ARCHIL_AUTH_PROVIDER_NAME,
+    fields: [
+        {
+            name: "apiKey",
+            label: "Archil API Key",
+            description: "Create one at https://console.archil.com (API Keys). It starts with `key-`.",
+            secret: true,
+            validate: (value) => (value.trim().length === 0 ? "Required" : undefined),
+        },
+        {
+            name: "region",
+            label: "Archil Region",
+            description: `Region your disks and sandboxes live in. Defaults to ${DEFAULT_REGION}.`,
+            optional: true,
+            validate: (value) => (value.trim().length === 0 ? undefined : validateRegion(value.trim())),
+        },
+        {
+            name: "organization",
+            label: "Archil Organization ID",
+            description: "Only needed for disks on your own S3 bucket: scopes the bucket policy to your organization.",
+            optional: true,
+        },
+    ],
+    toResolved: (values, source) => ({
+        type: "apiKey",
+        apiKey: storedSecret(values.apiKey) ?? Redacted.make(""),
+        region: storedValueText(values.region) || DEFAULT_REGION,
+        organization: storedValueText(values.organization) || undefined,
+        source: { type: source },
+    }),
+    readEnvironment,
+    environment: [
+        {
+            name: "ARCHIL_API_KEY",
+            required: true,
+            secret: true,
+            description: "Archil API key.",
+        },
+        {
+            name: "ARCHIL_REGION",
+            required: false,
+            description: `Archil region id. Defaults to ${DEFAULT_REGION}.`,
+        },
+        {
+            name: "ARCHIL_ORGANIZATION",
+            required: false,
+            description: "Archil organization id, for bring-your-own-bucket disk policies.",
+        },
+    ],
+});
+/**
+ * Layer that registers the Archil AuthProvider into the AuthProviders
+ * registry when built. Included in `Archil.providers()` so the alchemy CLI
+ * (`alchemy profile edit`) can configure it.
+ */
+export const ArchilAuth = archilAuth.layer;
+/** Schema of Archil's inline API-key values. */
+export const ArchilStoredCredentials = archilAuth.storedSchema;
+//# sourceMappingURL=AuthProvider.js.map

package/lib/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sources":["../src/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,eAAe,GAEhB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAwBlD,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CACvC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAE7E,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,cAAc;QAC1D,YAAY,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAClD,MAAM,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE;KACxB,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,sBAAsB,CAA4B;IACnE,QAAQ,EAAE,yBAAyB;IACnC,MAAM,EAAE;QACN;YACE,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,6EAA6E;YAC1F,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1E;QACD;YACE,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,wDAAwD,cAAc,GAAG;YACtF,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;SAC5F;QACD;YACE,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EACT,6FAA6F;YAC/F,QAAQ,EAAE,IAAI;SACf;KACF;IACD,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,cAAc;QACxD,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,SAAS;QAC/D,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACzB,CAAC;IACF,eAAe;IACf,WAAW,EAAE;QACX;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,iBAAiB;SAC/B;QACD;YACE,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iCAAiC,cAAc,GAAG;SAChE;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC,YAAY,CAAC"}

package/lib/Bootstrap.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve the bundled program (the runners registered via `host.run` /
+ * serve) and run it with a Node HTTP server bound to `PORT`, so the
+ * returned `{ fetch }` handler is actually served and `host.run` loops
+ * stay alive.
+ */
+export declare const bootstrap: (entrypoint: unknown) => Promise<void>;
+//# sourceMappingURL=Bootstrap.d.ts.map

package/lib/Bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bootstrap.d.ts","sources":["../src/Bootstrap.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,eAAO,MAAM,SAAS,eAAgB,OAAO,KAAG,OAAO,CAAC,IAAI,CA0B3D,CAAC"}

package/lib/Bootstrap.js

@@ -0,0 +1,27 @@
+/**
+ * Process bootstrap for an `Archil.Sandbox` program (a Node process serving the
+ * bundled program). The generated entry imports this module and the user's
+ * `main`, nothing else — see `alchemy/Runtime/Bootstrap` for why.
+ */
+import { NodeServices } from "@effect/platform-node";
+import { NodeHttpServer } from "alchemy/Http";
+import { reifyBoundConfigProvider } from "alchemy/Runtime";
+import { entrypointLayer, resolveProgram, runProcess, stackFromEnv, } from "alchemy/Runtime/Bootstrap";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as SecureRandom from "effect/crypto/SecureRandom";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+/**
+ * Resolve the bundled program (the runners registered via `host.run` /
+ * serve) and run it with a Node HTTP server bound to `PORT`, so the
+ * returned `{ fetch }` handler is actually served and `host.run` loops
+ * stay alive.
+ */
+export const bootstrap = (entrypoint) => {
+    const platform = Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer, SecureRandom.layerWebCrypto, Logger.layer([Logger.consolePretty()]));
+    const program = resolveProgram("program").pipe(Effect.provide(entrypointLayer(entrypoint).pipe(Layer.provideMerge(stackFromEnv), Layer.provideMerge(NodeHttpServer({ hostname: "0.0.0.0" })), Layer.provideMerge(platform), Layer.provideMerge(Layer.succeed(ConfigProvider.ConfigProvider, reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env))))), Effect.scoped);
+    return runProcess("Archil service", program);
+};
+//# sourceMappingURL=Bootstrap.js.map

package/lib/Bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bootstrap.js","sources":["../src/Bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAmB,EAAiB,EAAE;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,YAAY,CAAC,KAAK,EAClB,eAAe,CAAC,KAAK,EACrB,YAAY,CAAC,cAAc,EAC3B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CACvC,CAAC;IAEF,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CACZ,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC9B,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,EAChC,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,EAC3D,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAC5B,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,OAAO,CACX,cAAc,CAAC,cAAc,EAC7B,wBAAwB,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAChE,CACF,CACF,CACF,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IAEF,OAAO,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC,CAAC"}

package/lib/Branch.d.ts

@@ -0,0 +1,101 @@
+import * as archil from "@distilled.cloud/archil";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import type { Providers } from "./Providers.ts";
+export interface BranchProps {
+    /** Id of the disk to branch (e.g. `disk.diskId`). Changing it replaces the branch. */
+    disk: string;
+    /**
+     * Branch name, unique within the disk. If omitted, a unique name is
+     * generated from the stack, stage, and logical ID. Changing it replaces
+     * the branch.
+     */
+    name?: string;
+    /**
+     * Name of the committed checkpoint the branch starts from (e.g.
+     * `checkpoint.name`). Changing it replaces the branch.
+     */
+    fromCheckpoint: string;
+    /**
+     * Branch the checkpoint was taken on. Omit for a checkpoint on the root
+     * disk. Changing it replaces the branch.
+     */
+    fromBranch?: string;
+}
+export interface BranchAttributes {
+    /** Id of the disk the branch belongs to. */
+    diskId: string;
+    /** Branch name. Mount it with `archil mount <disk> <path> --branch <name>`. */
+    name: string;
+    /** Id of the branch's own writable filesystem. */
+    filesystemId: string;
+    /** Checkpoint the branch started from. */
+    fromCheckpoint: string;
+    /** Filesystem the checkpoint was taken on. */
+    fromFilesystemId: string;
+    /** When the branch was created. */
+    createdAt: string;
+}
+export type Branch = Resource<"Archil.Branch", BranchProps, BranchAttributes, never, Providers, BranchLookup>;
+/**
+ * Props for {@link Branch.lookup}: find a branch this stack
+ * doesn't manage by its disk and name.
+ */
+export interface BranchLookup {
+    /** Id of the disk the branch belongs to. */
+    disk: string;
+    /** Branch name. */
+    name: string;
+}
+/**
+ * An independent, writable fork of a disk, started from a committed
+ * checkpoint in about 35 ms whatever the disk's size. Writes on the branch
+ * never reach its source or its siblings. Branches share the disk's
+ * credentials, so a disk user can mount any branch of its disk.
+ *
+ * Archil has no API to delete a branch yet, so destroying the resource
+ * only removes it from Alchemy's state. Branches made per session at run
+ * time come from {@link BranchDisk}.
+ * @see https://docs.archil.com/concepts/branches-and-checkpoints
+ *
+ * ### Creating a Branch
+ * **Example:** A staging copy of a seeded disk
+ * ```typescript
+ * export const Staging = Effect.gen(function* () {
+ *   const seed = yield* Seed;
+ *   const base = yield* Base;
+ *   return yield* Archil.Branch("Staging", {
+ *     disk: seed.diskId,
+ *     fromCheckpoint: base.name,
+ *   });
+ * });
+ * ```
+ *
+ * ### Looking up an existing branch
+ * `Branch.lookup` references a branch Alchemy doesn't manage (created in
+ * the Archil console or by another stack). It is read during plan/deploy,
+ * never created, updated or deleted.
+ *
+ * **Example:** Reference an existing branch
+ * ```typescript
+ * const main = Archil.Branch.lookup({ disk: "dsk_123", name: "main" });
+ * ```
+ *
+ * @resource
+ * @product Disk
+ */
+export declare const Branch: import("alchemy").ResourceClass<Branch>;
+/** Map a branch response to attributes. */
+export declare const toBranchAttributes: (branch: archil.BranchResponse) => BranchAttributes;
+/** Get a branch; `undefined` when it (or its disk) doesn't exist. */
+export declare const getBranch: (diskId: string, name: string) => Effect.Effect<BranchAttributes | undefined, archil.ArchilParseError | archil.BadGateway | import("@distilled.cloud/core/errors").BadRequest | archil.BadRequest | archil.ConfigError | import("@distilled.cloud/core/errors").Conflict | import("@distilled.cloud/core/errors").Forbidden | archil.GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | archil.InternalServerError | import("@distilled.cloud/core/protocol-http").InvalidInput | archil.Locked | import("@distilled.cloud/core/sdk-error").SdkError | archil.ServiceUnavailable | archil.TooManyRequests | archil.Unauthorized | archil.UnknownArchilError | archil.UnprocessableEntity, archil.ArchilOpContext>;
+/** Create a branch, or return the existing one with that name. */
+export declare const ensureBranch: (input: {
+    disk: string;
+    name: string;
+    fromCheckpoint: string;
+    fromBranch?: string;
+}) => Effect.Effect<BranchAttributes, archil.ArchilParseError | archil.BadGateway | import("@distilled.cloud/core/errors").BadRequest | archil.BadRequest | archil.ConfigError | import("@distilled.cloud/core/errors").Conflict | archil.Conflict | import("@distilled.cloud/core/errors").Forbidden | archil.GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | archil.InternalServerError | import("@distilled.cloud/core/protocol-http").InvalidInput | archil.Locked | import("@distilled.cloud/core/errors").NotFound | archil.NotFound | import("@distilled.cloud/core/sdk-error").SdkError | archil.ServiceUnavailable | archil.TooManyRequests | archil.Unauthorized | archil.UnknownArchilError | archil.UnprocessableEntity, archil.ArchilOpContext>;
+export declare const BranchProvider: () => import("effect/Layer").Layer<Provider.Provider<Branch>, never, import("alchemy").Stack | import("alchemy").Stage | archil.ArchilOpContext>;
+//# sourceMappingURL=Branch.d.ts.map

package/lib/Branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Branch.d.ts","sources":["../src/Branch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAGlD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,QAAQ,CAC3B,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,KAAK,EACL,SAAS,EACT,YAAY,CACb,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,MAAM,yCAAoC,CAAC;AAExD,2CAA2C;AAC3C,eAAO,MAAM,kBAAkB,WAAY,MAAM,CAAC,cAAc,KAAG,gBAOjE,CAAC;AAEH,qEAAqE;AACrE,eAAO,MAAM,SAAS,WAAY,MAAM,QAAQ,MAAM,0qBAInD,CAAC;AAEJ,kEAAkE;AAClE,eAAO,MAAM,YAAY;UACjB,MAAM;UACN,MAAM;oBACI,MAAM;iBACT,MAAM;qvBAoBnB,CAAC;AAKH,eAAO,MAAM,cAAc,kJAgDxB,CAAC"}

package/lib/Branch.js

@@ -0,0 +1,117 @@
+import * as archil from "@distilled.cloud/archil";
+import { isResolved } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+/**
+ * An independent, writable fork of a disk, started from a committed
+ * checkpoint in about 35 ms whatever the disk's size. Writes on the branch
+ * never reach its source or its siblings. Branches share the disk's
+ * credentials, so a disk user can mount any branch of its disk.
+ *
+ * Archil has no API to delete a branch yet, so destroying the resource
+ * only removes it from Alchemy's state. Branches made per session at run
+ * time come from {@link BranchDisk}.
+ * @see https://docs.archil.com/concepts/branches-and-checkpoints
+ *
+ * ### Creating a Branch
+ * **Example:** A staging copy of a seeded disk
+ * ```typescript
+ * export const Staging = Effect.gen(function* () {
+ *   const seed = yield* Seed;
+ *   const base = yield* Base;
+ *   return yield* Archil.Branch("Staging", {
+ *     disk: seed.diskId,
+ *     fromCheckpoint: base.name,
+ *   });
+ * });
+ * ```
+ *
+ * ### Looking up an existing branch
+ * `Branch.lookup` references a branch Alchemy doesn't manage (created in
+ * the Archil console or by another stack). It is read during plan/deploy,
+ * never created, updated or deleted.
+ *
+ * **Example:** Reference an existing branch
+ * ```typescript
+ * const main = Archil.Branch.lookup({ disk: "dsk_123", name: "main" });
+ * ```
+ *
+ * @resource
+ * @product Disk
+ */
+export const Branch = Resource("Archil.Branch");
+/** Map a branch response to attributes. */
+export const toBranchAttributes = (branch) => ({
+    diskId: branch.root_filesystem_id,
+    name: branch.branch_name,
+    filesystemId: branch.filesystem_id,
+    fromCheckpoint: branch.from_checkpoint_name,
+    fromFilesystemId: branch.from_checkpoint_filesystem_id,
+    createdAt: branch.created_at,
+});
+/** Get a branch; `undefined` when it (or its disk) doesn't exist. */
+export const getBranch = (diskId, name) => archil.getBranch({ id: diskId, name }).pipe(Effect.map(({ data }) => toBranchAttributes(data)), Effect.catchTag("NotFound", () => Effect.undefined));
+/** Create a branch, or return the existing one with that name. */
+export const ensureBranch = Effect.fn(function* (input) {
+    const existing = yield* getBranch(input.disk, input.name);
+    if (existing)
+        return existing;
+    return yield* archil
+        .createBranch({
+        id: input.disk,
+        branch_name: input.name,
+        from_checkpoint_name: input.fromCheckpoint,
+        from_branch: input.fromBranch,
+    })
+        .pipe(Effect.map(({ data }) => toBranchAttributes(data)), 
+    // A concurrent create of the same name won the race.
+    Effect.catchTag("Conflict", (conflict) => getBranch(input.disk, input.name).pipe(Effect.flatMap((found) => (found ? Effect.succeed(found) : Effect.fail(conflict))))));
+});
+const branchName = (id, name) => name ? Effect.succeed(name) : createPhysicalName({ id, maxLength: 63, delimiter: "-" });
+export const BranchProvider = () => Provider.effect(Branch, Effect.gen(function* () {
+    return {
+        stables: [
+            "diskId",
+            "name",
+            "filesystemId",
+            "fromCheckpoint",
+            "fromFilesystemId",
+            "createdAt",
+        ],
+        // No delete API: nuke can't remove branches (they go with their disk).
+        nuke: { skip: true },
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+            if (!isResolved(news) || olds === undefined)
+                return undefined;
+            const name = output?.name ?? (yield* branchName(id, olds.name));
+            if (news.disk !== olds.disk ||
+                (news.name !== undefined && news.name !== name) ||
+                news.fromCheckpoint !== olds.fromCheckpoint ||
+                news.fromBranch !== olds.fromBranch) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        lookup: ({ disk, name }) => getBranch(disk, name),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (!output && !olds)
+                return undefined;
+            const diskId = output?.diskId ?? olds.disk;
+            const name = output?.name ?? (yield* branchName(id, olds?.name));
+            return yield* getBranch(diskId, name);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+            return yield* ensureBranch({
+                disk: news.disk,
+                name: output?.name ?? (yield* branchName(id, news.name)),
+                fromCheckpoint: news.fromCheckpoint,
+                fromBranch: news.fromBranch,
+            });
+        }),
+        // Archil has no branch delete API; the branch goes with its disk.
+        delete: () => Effect.void,
+    };
+}));
+//# sourceMappingURL=Branch.js.map

package/lib/Branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Branch.js","sources":["../src/Branch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA2DxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,eAAe,CAAC,CAAC;AAExD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA6B,EAAoB,EAAE,CAAC,CAAC;IACtF,MAAM,EAAE,MAAM,CAAC,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC,WAAW;IACxB,YAAY,EAAE,MAAM,CAAC,aAAa;IAClC,cAAc,EAAE,MAAM,CAAC,oBAAoB;IAC3C,gBAAgB,EAAE,MAAM,CAAC,6BAA6B;IACtD,SAAS,EAAE,MAAM,CAAC,UAAU;CAC7B,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CACxD,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpD,CAAC;AAEJ,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAKhD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,KAAK,CAAC,CAAC,MAAM;SACjB,YAAY,CAAC;QACZ,EAAE,EAAE,KAAK,CAAC,IAAI;QACd,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,oBAAoB,EAAE,KAAK,CAAC,cAAc;QAC1C,WAAW,EAAE,KAAK,CAAC,UAAU;KAC9B,CAAC;SACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClD,qDAAqD;IACrD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnF,CACF,CACF,CAAC;AACN,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC1D,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAE1F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE;YACP,QAAQ;YACR,MAAM;YACN,cAAc;YACd,gBAAgB;YAChB,kBAAkB;YAClB,WAAW;SACZ;QACD,uEAAuE;QACvE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACpB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,IACE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBACvB,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC/C,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;gBAC3C,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EACnC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;QAEjD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAK,CAAC,IAAI,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAClD,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxD,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC;QACF,kEAAkE;QAClE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}