@alchemy.run/archil 0.0.0 → 2.0.0-beta.87

package/lib/CreateDisk.js

@@ -0,0 +1,47 @@
+import * as archil from "@distilled.cloud/archil";
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { ApiAccess, runtimeName, runtimePrefix } from "./ArchilBindings.js";
+import { makeDiskHandle } from "./Clients.js";
+import { deleteDisk, ensureDisk } from "./Disk.js";
+import { findDiskByName, listAllDisks } from "./internal/archil.js";
+export const CreateDisk = Binding.Service("Archil.CreateDisk");
+/** {@link CreateDisk} over Archil's HTTP API, usable from any host. */
+export const CreateDiskHttp = Layer.effect(CreateDisk, Effect.gen(function* () {
+    const access = yield* ApiAccess;
+    return Effect.fn(function* (options) {
+        const authorize = yield* access();
+        const { prefix: owner } = yield* runtimePrefix("Disks");
+        const prefix = Effect.succeed(owner);
+        const fullName = (name) => Effect.succeed(runtimeName(owner, name));
+        const handle = (disk) => makeDiskHandle({ diskId: disk.id, name: disk.name }, authorize);
+        return {
+            prefix: owner,
+            create: (name, createOptions) => authorize(Effect.gen(function* () {
+                const disk = yield* ensureDisk(yield* fullName(name), createOptions?.storage ?? options?.storage);
+                return handle(disk);
+            })),
+            get: (name) => authorize(Effect.gen(function* () {
+                const diskName = yield* fullName(name);
+                const disk = yield* findDiskByName(diskName);
+                return disk && disk.status !== "deleted" ? handle(disk) : undefined;
+            })),
+            list: () => authorize(Effect.gen(function* () {
+                const p = yield* prefix;
+                const disks = yield* Stream.runCollect(listAllDisks());
+                return disks
+                    .filter((d) => d.name.startsWith(`${p}-`) && d.status !== "deleted")
+                    .map(handle);
+            })),
+            delete: (name) => authorize(Effect.gen(function* () {
+                const diskName = yield* fullName(name);
+                const disk = yield* findDiskByName(diskName);
+                if (disk)
+                    yield* deleteDisk(disk.id);
+            })),
+        };
+    });
+}));
+//# sourceMappingURL=CreateDisk.js.map

package/lib/CreateDisk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateDisk.js","sources":["../src/CreateDisk.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAmGpE,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAa,mBAAmB,CAAC,CAAC;AAE3E,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACxC,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAChC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAA2B;QACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,CAAC,IAAkC,EAAE,EAAE,CACpD,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAC9B,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAC5B,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrB,aAAa,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,CAC3C,CAAC;gBACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC,CACH;YACH,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CACZ,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC7C,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,CAAC,CAAC,CACH;YACH,IAAI,EAAE,GAAG,EAAE,CACT,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvD,OAAO,KAAK;qBACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;qBACnE,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,CAAC,CAAC,CACH;YACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,IAAI;oBAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC,CAAC,CACH;SACuB,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/lib/CreateImage.d.ts

@@ -0,0 +1,42 @@
+import type { ImageRegistry } from "@alchemy.run/docker/Registry";
+import * as archil from "@distilled.cloud/archil";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { type ImageAttributes } from "./Image.ts";
+import type { ArchilFailed, ArchilNotReady } from "./internal/archil.ts";
+export interface CreateImageClient {
+    /**
+     * Pull an OCI reference into an Archil image and wait until it is ready.
+     * Takes the same `image` and `registry` props as {@link Image}.
+     */
+    build(props: {
+        readonly image: string;
+        readonly registry?: ImageRegistry;
+    }): Effect.Effect<ImageAttributes, archil.CreateImageError | archil.GetImageError | ArchilFailed | ArchilNotReady, RuntimeContext>;
+    /** An image by id, or `undefined` when it doesn't exist. */
+    get(imageId: string): Effect.Effect<ImageAttributes | undefined, archil.GetImageError, RuntimeContext>;
+}
+/**
+ * Build sandbox images at run time, e.g. one per customer repository, with
+ * the same props as the deploy-time {@link Image}. Pass the result's
+ * `imageId` to `CreateSandbox`.
+ *
+ * ### Building Images
+ * **Example:** An image per tenant
+ * ```typescript
+ * const images = yield* Archil.CreateImage();
+ * const image = yield* images.build({ image: `ghcr.io/acme/${tenant}:latest` });
+ * const sandbox = yield* sandboxes.create({ name: tenant, image: image.imageId });
+ * ```
+ *
+ * @binding
+ * @product Image
+ */
+export interface CreateImage extends Binding.Service<CreateImage, "Archil.CreateImage", () => Effect.Effect<CreateImageClient>> {
+}
+export declare const CreateImage: CreateImage;
+/** {@link CreateImage} over Archil's HTTP API, usable from any host. */
+export declare const CreateImageHttp: Layer.Layer<CreateImage, never, never>;
+//# sourceMappingURL=CreateImage.d.ts.map

package/lib/CreateImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateImage.d.ts","sources":["../src/CreateImage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAgC,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;KACnC,GAAG,MAAM,CAAC,MAAM,CACf,eAAe,EACf,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,aAAa,GAAG,YAAY,GAAG,cAAc,EAC9E,cAAc,CACf,CAAC;IACF,4DAA4D;IAC5D,GAAG,CACD,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,CAAC,eAAe,GAAG,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;CACrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,OAAO,CAClD,WAAW,EACX,oBAAoB,EACpB,MAAM,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CACvC;CAAG;AAEJ,eAAO,MAAM,WAAW,aAAqD,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,eAAe,wCAkB3B,CAAC"}

package/lib/CreateImage.js

@@ -0,0 +1,19 @@
+import * as archil from "@distilled.cloud/archil";
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { ApiAccess } from "./ArchilBindings.js";
+import { pullImage, toImageAttributes } from "./Image.js";
+export const CreateImage = Binding.Service("Archil.CreateImage");
+/** {@link CreateImage} over Archil's HTTP API, usable from any host. */
+export const CreateImageHttp = Layer.effect(CreateImage, Effect.gen(function* () {
+    const access = yield* ApiAccess;
+    return Effect.fn(function* () {
+        const authorize = yield* access();
+        return {
+            build: (props) => authorize(pullImage(props.image, props.registry, props.image)),
+            get: (imageId) => authorize(archil.getImage({ image_id: imageId }).pipe(Effect.map(({ data }) => toImageAttributes(data, data.source)), Effect.catchTag("NotFound", () => Effect.undefined))),
+        };
+    });
+}));
+//# sourceMappingURL=CreateImage.js.map

package/lib/CreateImage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateImage.js","sources":["../src/CreateImage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAC;AA4ChF,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,oBAAoB,CAAC,CAAC;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CACzC,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAChC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAChF,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CACf,SAAS,CACP,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAC9D,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpD,CACF;SACwB,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/lib/CreateSandbox.d.ts

@@ -0,0 +1,104 @@
+import * as archil from "@distilled.cloud/archil";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { type SandboxHandle } from "./Clients.ts";
+import type { Image } from "./Image.ts";
+import type { ArchilFailed, ArchilNotReady } from "./internal/archil.ts";
+import { deleteSandbox, type Sandbox, type SandboxProps } from "./Sandbox.ts";
+import { MountDiskUnresolved, type MountOptionUnsupported } from "./SandboxOptions.ts";
+/**
+ * A run-time create: a box {@link Sandbox}'s props (no program), with a
+ * required name. A mount's disk is a `DiskHandle` (e.g. from
+ * `CreateDisk`), or a `MountDisk` reference this host bound at deploy.
+ */
+export interface CreateSandboxRequest extends Omit<SandboxProps, "name" | "main" | "handler" | "port" | "build" | "extraFiles" | "isExternal"> {
+    /** Name, stamped with this binding's prefix. Lowercase letters, digits and `-`. */
+    readonly name: string;
+}
+export type CreateSandboxError = archil.CreateSandboxError | archil.ForkSandboxError | archil.GetSandboxError | archil.ListSandboxesError | ArchilFailed | ArchilNotReady | MountOptionUnsupported | MountDiskUnresolved;
+export interface CreateSandboxClient {
+    /**
+     * The name prefix this client puts on everything it creates,
+     * `alc-<id>-<hash of stack/stage/id>`.
+     */
+    readonly prefix: string;
+    /**
+     * Create a sandbox (or return the one that already has this name) and
+     * wait until it is running. Takes a {@link Sandbox}'s props; the bound
+     * image is the default.
+     */
+    create(request: CreateSandboxRequest): Effect.Effect<SandboxHandle, CreateSandboxError, RuntimeContext>;
+    /** A sandbox this client created, or `undefined`. */
+    get(name: string): Effect.Effect<SandboxHandle | undefined, archil.ListSandboxesError, RuntimeContext>;
+    /** Every sandbox this client created. */
+    list(): Effect.Effect<SandboxHandle[], archil.ListSandboxesError, RuntimeContext>;
+    /** Delete a sandbox this client created. Deleting a missing sandbox succeeds. */
+    delete(name: string): Effect.Effect<void, archil.ListSandboxesError | Effect.Error<ReturnType<typeof deleteSandbox>>, RuntimeContext>;
+}
+/**
+ * Create sandboxes at run time, one per user, session, or task: Firecracker
+ * microVMs with disks mounted, public ports, and an outbound network policy
+ * that can inject credentials at the boundary. Bind an {@link Image} to make
+ * it the default image; a run-time `create` takes the same props as a
+ * deploy-time {@link Sandbox}. Bind a {@link Sandbox} instead and `create`
+ * forks it: each sandbox starts from its memory and disk, with whatever its
+ * `run` commands set up, and changes only its own copy.
+ *
+ * Objects created at run time are tagged with the stack, stage and binding
+ * (`alchemy::stack`, `alchemy::stage`, `alchemy::id`) and are not deleted
+ * when the stack is destroyed. List them by those tags to clean them up.
+ * Archil has no tags, labels or descriptions, so the tags are a name
+ * prefix, `alc-<id>-<hash of stack/stage/id>`: every sandbox (and fork)
+ * this client creates is `<prefix>-<name>`, and `prefix` on the client is the value.
+ *
+ * ### Sandboxes per Task
+ * **Example:** Run a task in a sandbox with the user's disk mounted
+ * ```typescript
+ * export default class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const disks = yield* Archil.CreateDisk();
+ *     const sandboxes = yield* Archil.CreateSandbox(Agent);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const home = yield* disks.create("user-1");
+ *         const sandbox = yield* sandboxes.create({
+ *           name: "task-1",
+ *           mounts: [{ disk: home, path: "/home/user" }],
+ *           network: { egress: { default: "deny", allow: ["registry.npmjs.org"] } },
+ *           idleTtlSeconds: 300,
+ *         });
+ *         const result = yield* sandbox.exec("npm test", { cwd: "/home/user/app" });
+ *         yield* sandbox.pause();
+ *         return HttpServerResponse.text(result.stdout);
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Layer.mergeAll(Archil.CreateDiskHttp, Archil.CreateSandboxHttp))),
+ * ) {}
+ * ```
+ *
+ * ### Forking a Sandbox Built at Deploy
+ * **Example:** A fork per user from a sandbox set up at deploy
+ * ```typescript
+ * export const Golden = Archil.Sandbox("Golden", {
+ *   run: ["git clone --depth 1 https://github.com/sindresorhus/is ~/is"],
+ * });
+ *
+ * // in a Worker or program:
+ * const sandboxes = yield* Archil.CreateSandbox(Golden);
+ * const sandbox = (yield* sandboxes.get(`user-${user}`)) ?? (yield* sandboxes.create({ name: `user-${user}` }));
+ * const result = yield* sandbox.exec("git log -1", { cwd: "~/is" });
+ * ```
+ *
+ * @binding
+ * @product Sandbox
+ */
+export interface CreateSandbox extends Binding.Service<CreateSandbox, "Archil.CreateSandbox", (base?: Image | Sandbox) => Effect.Effect<CreateSandboxClient>> {
+}
+export declare const CreateSandbox: CreateSandbox;
+/** {@link CreateSandbox} over Archil's HTTP API, usable from any host. */
+export declare const CreateSandboxHttp: Layer.Layer<CreateSandbox, never, never>;
+//# sourceMappingURL=CreateSandbox.d.ts.map

package/lib/CreateSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSandbox.d.ts","sources":["../src/CreateSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EACL,aAAa,EAEb,KAAK,OAAO,EACZ,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EAKnB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAChD,YAAY,EACZ,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,CAC7E;IACC,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,kBAAkB,GAC1B,MAAM,CAAC,kBAAkB,GACzB,MAAM,CAAC,gBAAgB,GACvB,MAAM,CAAC,eAAe,GACtB,MAAM,CAAC,kBAAkB,GACzB,YAAY,GACZ,cAAc,GACd,sBAAsB,GACtB,mBAAmB,CAAC;AAoBxB,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,MAAM,CACJ,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACpE,qDAAqD;IACrD,GAAG,CACD,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACvF,yCAAyC;IACzC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAClF,iFAAiF;IACjF,MAAM,CACJ,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAC1E,cAAc,CACf,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,WAAW,aAAc,SAAQ,OAAO,CAAC,OAAO,CACpD,aAAa,EACb,sBAAsB,EACtB,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAC/D;CAAG;AAEJ,eAAO,MAAM,aAAa,eAAyD,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,0CA4F7B,CAAC"}

package/lib/CreateSandbox.js

@@ -0,0 +1,98 @@
+import * as archil from "@distilled.cloud/archil";
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Random from "effect/Random";
+import { ApiAccess, runtimeName, runtimePrefix } from "./ArchilBindings.js";
+import { makeSandboxHandle } from "./Clients.js";
+import { findSandboxByName, listSandboxes, waitForSandbox } from "./internal/archil.js";
+import { deleteSandbox, toCreateSandboxRequest, } from "./Sandbox.js";
+import { MountDiskUnresolved, mountDiskId, toSandboxMount, } from "./SandboxOptions.js";
+/**
+ * A mount's disk id at run time: a handle carries it; a declared disk
+ * reads the id `MountDisk` bound into this host at deploy.
+ */
+const runtimeDiskId = Effect.fn(function* (disk, path) {
+    if (isDiskRef(disk))
+        return disk.diskId;
+    if (Effect.isEffect(disk)) {
+        return yield* new MountDiskUnresolved({
+            path,
+            message: `The disk mounted at ${path} is a declaration: bind it with Archil.MountDisk(disk) and pass that reference, or pass a DiskHandle.`,
+        });
+    }
+    const diskId = yield* disk.diskId;
+    return yield* diskId;
+});
+const isDiskRef = (disk) => mountDiskId(disk) !== undefined;
+export const CreateSandbox = Binding.Service("Archil.CreateSandbox");
+/** {@link CreateSandbox} over Archil's HTTP API, usable from any host. */
+export const CreateSandboxHttp = Layer.effect(CreateSandbox, Effect.gen(function* () {
+    const access = yield* ApiAccess;
+    return Effect.fn(function* (base) {
+        const authorize = yield* access();
+        const { prefix: owner } = yield* runtimePrefix("Sandboxes");
+        const prefix = Effect.succeed(owner);
+        // Resources are proxies (every property reads as an Output), so tell a
+        // bound sandbox from a bound image by its type, not by `in`.
+        const isSandbox = (b) => b.Type === "Archil.Sandbox";
+        const source = base !== undefined && isSandbox(base) ? yield* base.sandboxId : undefined;
+        const imageId = base !== undefined && !isSandbox(base) ? yield* base.imageId : undefined;
+        const fullName = (name) => Effect.succeed(runtimeName(owner, name));
+        // Forks carry the same prefix as the sandboxes they come from; an
+        // unnamed fork gets a random name.
+        const forkName = Effect.fn(function* (name) {
+            const id = (yield* Random.nextIntBetween(0, 2 ** 31)).toString(36);
+            return yield* fullName(name ?? `fork-${id}`);
+        });
+        const handle = (s) => makeSandboxHandle({ sandboxId: s.sandbox_id, name: s.name }, authorize, forkName);
+        return {
+            prefix: owner,
+            create: (request) => authorize(Effect.gen(function* () {
+                const name = yield* fullName(request.name);
+                const existing = yield* findSandboxByName(name);
+                if (existing)
+                    return handle(existing);
+                if (source !== undefined) {
+                    // A bound sandbox is the base: fork its memory and disk.
+                    const { data } = yield* archil.forkSandbox({
+                        sid: yield* source,
+                        wait: true,
+                        name,
+                    });
+                    return handle(yield* waitForSandbox(data.sandbox_id));
+                }
+                const defaultImage = request.image === undefined && request.baseImage === undefined && imageId
+                    ? yield* imageId
+                    : request.image;
+                const mounts = [];
+                for (const mount of request.mounts ?? []) {
+                    const diskId = yield* runtimeDiskId(mount.disk, mount.path);
+                    mounts.push(yield* toSandboxMount(diskId, mount));
+                }
+                const { data } = yield* archil
+                    .createSandbox(toCreateSandboxRequest(name, { ...request, image: defaultImage }, mounts))
+                    .pipe(Effect.catchTag("SandboxNameConflict", (conflict) => findSandboxByName(name).pipe(Effect.flatMap((found) => found ? Effect.succeed({ data: found }) : Effect.fail(conflict)))));
+                return handle(yield* waitForSandbox(data.sandbox_id));
+            })),
+            get: (name) => authorize(Effect.gen(function* () {
+                const sandboxName = yield* fullName(name);
+                const found = yield* findSandboxByName(sandboxName);
+                return found ? handle(found) : undefined;
+            })),
+            list: () => authorize(Effect.gen(function* () {
+                const p = yield* prefix;
+                return (yield* listSandboxes())
+                    .filter((s) => s.name.startsWith(`${p}-`) && s.status !== "deleted")
+                    .map(handle);
+            })),
+            delete: (name) => authorize(Effect.gen(function* () {
+                const sandboxName = yield* fullName(name);
+                const found = yield* findSandboxByName(sandboxName);
+                if (found)
+                    yield* deleteSandbox(found.sandbox_id);
+            })),
+        };
+    });
+}));
+//# sourceMappingURL=CreateSandbox.js.map

package/lib/CreateSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSandbox.js","sources":["../src/CreateSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAC;AAClD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAsB,MAAM,cAAc,CAAC;AAGrE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EACL,aAAa,EACb,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,cAAc,GAIf,MAAM,qBAAqB,CAAC;AAyB7B;;;GAGG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAmB,EAAE,IAAY;IAC1E,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;YACpC,IAAI;YACJ,OAAO,EAAE,uBAAuB,IAAI,uGAAuG;SAC5I,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,IAAmB,EAAmB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAiG5F,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAgB,sBAAsB,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAC3C,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAChC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAsB;QAChD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,SAAS,GAAG,CAAC,CAAkB,EAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,kEAAkE;QAClE,mCAAmC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAwB;YAC5D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAuC,EAAE,EAAE,CACzD,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpF,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAChD,IAAI,QAAQ;oBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,yDAAyD;oBACzD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;wBACzC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM;wBAClB,IAAI,EAAE,IAAI;wBACV,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,YAAY,GAChB,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO;oBACvE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;oBAChB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,MAAM,MAAM,GAA0B,EAAE,CAAC;gBACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;oBACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM;qBAC3B,aAAa,CACZ,sBAAsB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CAC1E;qBACA,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClD,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChE,CACF,CACF,CACF,CAAC;gBACJ,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,CAAC,CAAC,CACH;YACH,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CACZ,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACpD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3C,CAAC,CAAC,CACH;YACH,IAAI,EAAE,GAAG,EAAE,CACT,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;qBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;qBACnE,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,CAAC,CAAC,CACH;YACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACpD,IAAI,KAAK;oBAAE,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACpD,CAAC,CAAC,CACH;SAC0B,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/lib/Credentials.d.ts

@@ -0,0 +1,44 @@
+import { Credentials } from "@distilled.cloud/archil/Credentials";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+export { Credentials, CredentialsFromEnv, DEFAULT_REGION, REGIONS, } from "@distilled.cloud/archil/Credentials";
+/** Where the current Archil credentials act. */
+export interface ArchilAccount {
+    /** Archil region id, e.g. `aws-us-east-1`. */
+    readonly region: string;
+    /** Archil organization id, when configured. */
+    readonly organization: string | undefined;
+}
+declare const Account_base: Context.ServiceClass<Account, "Archil.Account", Effect.Effect<ArchilAccount, never, never>>;
+/**
+ * The region (and organization) the current Archil credentials act in.
+ * Holds an effect so it resolves on first use, never at layer build.
+ */
+export declare class Account extends Account_base {
+}
+/** The region and organization of the current Archil credentials. */
+export declare const account: Effect.Effect<ArchilAccount, never, Account>;
+/**
+ * Build Archil `Credentials` + `Account` from an explicit API key. Useful
+ * for tests, or for a runtime that reads its key from a binding.
+ *
+ * @example
+ * ```ts
+ * Effect.provide(Archil.fromApiKey({ apiKey: "key-...", region: "aws-us-east-1" }))
+ * ```
+ */
+export declare const fromApiKey: (input: {
+    apiKey: string | Redacted.Redacted<string>;
+    region?: string;
+    organization?: string;
+}) => Layer.Layer<Account | Credentials, never, never>;
+/**
+ * Build Archil `Credentials` + `Account` that resolve through the Alchemy
+ * AuthProvider: environment credentials (`ARCHIL_API_KEY`) when present,
+ * otherwise the selected profile. Resolution is deferred until the first
+ * API call, so building the provider layers never needs a profile.
+ */
+export declare const fromAuthProvider: () => Layer.Layer<Account | Credentials, never, import("alchemy").AuthProviders | import("alchemy/Auth/Profile").ProfileStore>;
+//# sourceMappingURL=Credentials.d.ts.map

package/lib/Credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.d.ts","sources":["../src/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EAGZ,MAAM,qCAAqC,CAAC;AAG7C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,OAAO,GACR,MAAM,qCAAqC,CAAC;AAE7C,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;;AAED;;;GAGG;AACH,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ,qEAAqE;AACrE,eAAO,MAAM,OAAO,8CAElB,CAAC;AA0BH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAAW;IAChC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,qDAOmC,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gIAM1B,CAAC"}

package/lib/Credentials.js

@@ -0,0 +1,57 @@
+import { controlPlaneUrl, Credentials, DEFAULT_REGION, REGIONS, } from "@distilled.cloud/archil/Credentials";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import { lazyCredentials } from "alchemy/Auth/Resolve";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { ARCHIL_AUTH_PROVIDER_NAME } from "./AuthProvider.js";
+export { Credentials, CredentialsFromEnv, DEFAULT_REGION, REGIONS, } from "@distilled.cloud/archil/Credentials";
+/**
+ * The region (and organization) the current Archil credentials act in.
+ * Holds an effect so it resolves on first use, never at layer build.
+ */
+export class Account extends Context.Service()("Archil.Account") {
+}
+/** The region and organization of the current Archil credentials. */
+export const account = Effect.gen(function* () {
+    return yield* yield* Account;
+});
+const make = (resolve) => Effect.gen(function* () {
+    const credentials = Effect.flatMap(resolve, (creds) => {
+        const apiBaseUrl = controlPlaneUrl(creds.region);
+        return apiBaseUrl
+            ? Effect.succeed({ apiKey: creds.apiKey, apiBaseUrl, region: creds.region })
+            : Effect.fail(new ConfigError({
+                message: `Unknown Archil region "${creds.region}". Valid regions: ${Object.keys(REGIONS).join(", ")}`,
+            }));
+    });
+    // `Account` is typed as never failing, so a credentials failure dies
+    // here; the engine still reports it as `CredentialsRequired`.
+    const accountInfo = yield* resolve.pipe(Effect.map((creds) => ({ region: creds.region, organization: creds.organization })), Effect.orDie, Effect.cached);
+    return Context.make(Credentials, credentials).pipe(Context.add(Account, accountInfo));
+});
+/**
+ * Build Archil `Credentials` + `Account` from an explicit API key. Useful
+ * for tests, or for a runtime that reads its key from a binding.
+ *
+ * @example
+ * ```ts
+ * Effect.provide(Archil.fromApiKey({ apiKey: "key-...", region: "aws-us-east-1" }))
+ * ```
+ */
+export const fromApiKey = (input) => Effect.succeed({
+    type: "apiKey",
+    apiKey: typeof input.apiKey === "string" ? Redacted.make(input.apiKey) : input.apiKey,
+    region: input.region ?? DEFAULT_REGION,
+    organization: input.organization,
+    source: { type: "stored" },
+}).pipe(make, Layer.effectContext);
+/**
+ * Build Archil `Credentials` + `Account` that resolve through the Alchemy
+ * AuthProvider: environment credentials (`ARCHIL_API_KEY`) when present,
+ * otherwise the selected profile. Resolution is deferred until the first
+ * API call, so building the provider layers never needs a profile.
+ */
+export const fromAuthProvider = () => Layer.effectContext(lazyCredentials()(ARCHIL_AUTH_PROVIDER_NAME, (creds) => creds).pipe(Effect.flatMap(make)));
+//# sourceMappingURL=Credentials.js.map

package/lib/Credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.js","sources":["../src/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,OAAO,GACR,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAkC,MAAM,mBAAmB,CAAC;AAE9F,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,OAAO,GACR,MAAM,qCAAqC,CAAC;AAU7C;;;GAGG;AACH,MAAM,OAAO,OAAQ,SAAQ,OAAO,CAAC,OAAO,EAAyC,CACnF,gBAAgB,CACjB;CAAG;AAEJ,qEAAqE;AACrE,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACzC,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CACX,OAA8D,EACP,EAAE,CACzD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,UAAU;YACf,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5E,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,WAAW,CAAC;gBACd,OAAO,EAAE,0BAA0B,KAAK,CAAC,MAAM,qBAAqB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACtG,CAAC,CACH,CAAC;IACR,CAAC,CAAC,CAAC;IACH,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,EACnF,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,MAAM,CACd,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAI1B,EAAE,EAAE,CACH,MAAM,CAAC,OAAO,CAA4B;IACxC,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;IACrF,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;IACtC,YAAY,EAAE,KAAK,CAAC,YAAY;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,aAAa,CACjB,eAAe,EAA0C,CACvD,yBAAyB,EACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CACjB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC7B,CAAC"}