@alchemy.run/daytona 0.0.0-stage → 2.0.0-beta.86

package/src/CreateSandboxHttp.ts

@@ -0,0 +1,97 @@
+import * as sandboxes from "@distilled.cloud/daytona/sandbox";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { CreateSandbox, type CreateSandboxClient } from "./CreateSandbox.ts";
+import { makeAccess, makeOwnerLabels, withOwnerLabels } from "./DaytonaBindings.ts";
+import { definedLabels } from "./internal/Labels.ts";
+import { waitForState } from "./internal/Wait.ts";
+import { volumeIdOf } from "./MountVolume.ts";
+import { makeSandboxClient } from "./SandboxClient.ts";
+import type { Snapshot } from "./Snapshot.ts";
+
+/** {@link CreateSandbox} over Daytona's HTTP API; works on any host. */
+export const CreateSandboxHttp = Layer.effect(
+  CreateSandbox,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* (base?: Snapshot) {
+      const purpose = `${base?.LogicalId ?? ""}Sandboxes`;
+      const { authorize, organizationId } = yield* access(purpose, [
+        "write:sandboxes",
+        "delete:sandboxes",
+      ]);
+      const ownerLabels = yield* makeOwnerLabels;
+      const baseName = base ? yield* base.name : undefined;
+
+      const handle = (s: sandboxes.Sandbox2) =>
+        Effect.succeed(makeSandboxClient(s, organizationId, authorize));
+
+      const client: CreateSandboxClient = {
+        create: (input) =>
+          authorize(
+            Effect.gen(function* () {
+              const labels = withOwnerLabels(
+                input?.labels ? definedLabels(input.labels) : undefined,
+                yield* ownerLabels,
+              );
+              const snapshot = input?.snapshot ?? (baseName ? yield* baseName : undefined);
+              const { mounts, ...request } = input ?? {};
+              const volumes = mounts
+                ? yield* Effect.forEach(mounts, (m) =>
+                    Effect.map(volumeIdOf(m.volume), (volumeId) => ({
+                      volumeId,
+                      mountPath: m.path,
+                      subpath: m.subpath,
+                    })),
+                  )
+                : undefined;
+              const created = yield* sandboxes.createSandbox({
+                ...request,
+                snapshot,
+                labels,
+                volumes,
+              });
+              return yield* waitForState({
+                kind: "sandbox",
+                id: created.id,
+                observe: sandboxes.getSandbox({ sandboxIdOrName: created.id }),
+                want: ["started"],
+                fail: ["error", "build_failed", "destroyed"],
+                reason: (s) => s.errorReason,
+                budget: "5 minutes",
+              });
+            }),
+          ).pipe(Effect.flatMap(handle)),
+        get: (idOrName) =>
+          authorize(
+            sandboxes.getSandbox({ sandboxIdOrName: idOrName }).pipe(
+              Effect.map((s) =>
+                s.state === "destroyed" || s.state === "destroying" ? undefined : s,
+              ),
+              Effect.catchTag("SandboxNotFound", () => Effect.undefined),
+            ),
+          ).pipe(Effect.flatMap((s) => (s ? handle(s) : Effect.undefined))),
+        list: (input) =>
+          authorize(
+            Effect.gen(function* () {
+              const snapshots = input?.snapshots ?? (baseName ? [yield* baseName] : undefined);
+              const page = yield* sandboxes.listSandboxes({
+                ...input,
+                snapshots,
+                labels: input?.labels ? JSON.stringify(input.labels) : undefined,
+              });
+              return page.items;
+            }),
+          ),
+        delete: (idOrName) =>
+          authorize(
+            sandboxes.deleteSandbox({ sandboxIdOrName: idOrName }).pipe(
+              Effect.asVoid,
+              Effect.catchTag("SandboxNotFound", () => Effect.void),
+            ),
+          ),
+      };
+      return client;
+    });
+  }),
+);

package/src/CreateSecret.ts

@@ -0,0 +1,73 @@
+import type * as secrets from "@distilled.cloud/daytona/secret";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import type { SecretAttributes } from "./Secret.ts";
+
+export interface CreateSecretClient {
+  /**
+   * Create the secret, or write a new value (and description and hosts)
+   * to the one with this name. Returns the same attributes as
+   * `Daytona.Secret`; pass `placeholder` into a sandbox's env or the
+   * secret's `name` in `secrets`.
+   */
+  put(input: {
+    readonly name: string;
+    readonly value: string | Redacted.Redacted<string>;
+    readonly description?: string;
+    readonly hosts?: string[];
+  }): Effect.Effect<
+    SecretAttributes,
+    secrets.CreateSecretError | secrets.UpdateSecretError | secrets.ListSecretsPaginatedError,
+    RuntimeContext
+  >;
+  /** The secret with this name, or `undefined`. Values are never returned. */
+  get(
+    name: string,
+  ): Effect.Effect<SecretAttributes | undefined, secrets.ListSecretsPaginatedError, RuntimeContext>;
+  /** Every secret in the organization. */
+  list(): Effect.Effect<SecretAttributes[], secrets.ListSecretsPaginatedError, RuntimeContext>;
+  /** Delete the secret with this name. Deleting a missing one succeeds. */
+  delete(
+    name: string,
+  ): Effect.Effect<
+    void,
+    secrets.DeleteSecretError | secrets.ListSecretsPaginatedError,
+    RuntimeContext
+  >;
+}
+
+/**
+ * Store secrets in Daytona at runtime: a credential per user, injected
+ * into that user's sandboxes without the sandbox (or an agent in it)
+ * ever seeing the value. Daytona swaps the placeholder for the value only
+ * on requests to the secret's `hosts`.
+ *
+ * The host gets its own Daytona API key with `manage:secrets`. Secrets
+ * have no labels, so each one it creates carries `stack/stage/id` in its
+ * description. They are not deleted when the stack is destroyed: list them
+ * (`list()`) and match the description to clean them up.
+ *
+ * ### A Credential per User
+ * **Example:** The user's GitHub token, only sent to GitHub's API
+ * ```typescript
+ * const secrets = yield* Daytona.CreateSecret();
+ * const github = yield* secrets.put({
+ *   name: `github-${user}`,
+ *   value: token,
+ *   hosts: ["api.github.com"],
+ * });
+ * const sandbox = yield* sandboxes.create({ secrets: [{ GITHUB_TOKEN: github.name }] });
+ * ```
+ *
+ * @binding
+ * @product Secret
+ */
+export interface CreateSecret extends Binding.Service<
+  CreateSecret,
+  "Daytona.CreateSecret",
+  () => Effect.Effect<CreateSecretClient>
+> {}
+
+export const CreateSecret = Binding.Service<CreateSecret>("Daytona.CreateSecret");

package/src/CreateSecretHttp.ts

@@ -0,0 +1,58 @@
+import * as secrets from "@distilled.cloud/daytona/secret";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { CreateSecret, type CreateSecretClient } from "./CreateSecret.ts";
+import { makeAccess, makeOwnerLabels, ownerDescription } from "./DaytonaBindings.ts";
+import { ensureSecret, findSecretByName, toSecretAttributes } from "./Secret.ts";
+
+/** {@link CreateSecret} over Daytona's HTTP API; works on any host. */
+export const CreateSecretHttp = Layer.effect(
+  CreateSecret,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* () {
+      const { authorize } = yield* access("Secrets", ["manage:secrets"]);
+      // Secrets have no labels, so the owner goes in the description.
+      const marker = Effect.map(yield* makeOwnerLabels, ownerDescription);
+      const client: CreateSecretClient = {
+        put: (input) =>
+          authorize(
+            Effect.gen(function* () {
+              const mark = yield* marker;
+              return yield* ensureSecret({
+                name: input.name,
+                value: input.value,
+                description: input.description ? `${input.description} (${mark})` : mark,
+                hosts: input.hosts,
+              });
+            }),
+          ),
+        get: (name) =>
+          authorize(
+            findSecretByName(name).pipe(
+              Effect.map((s) => (s ? toSecretAttributes(s, "") : undefined)),
+            ),
+          ),
+        list: () =>
+          authorize(
+            secrets.listSecretsPaginated.items({}).pipe(
+              Stream.runCollect,
+              Effect.map((all) => Array.from(all, (s) => toSecretAttributes(s, ""))),
+            ),
+          ),
+        delete: (name) =>
+          authorize(
+            Effect.gen(function* () {
+              const found = yield* findSecretByName(name);
+              if (found === undefined) return;
+              yield* secrets
+                .deleteSecret({ secretId: found.id })
+                .pipe(Effect.catchTag("SecretNotFound", () => Effect.void));
+            }),
+          ),
+      };
+      return client;
+    });
+  }),
+);

package/src/CreateSnapshot.ts

@@ -0,0 +1,133 @@
+import type { UnsupportedDockerfile } from "@alchemy.run/docker/BuildPlan";
+import type { DockerfileSyntaxError } from "@alchemy.run/docker/DockerfileParser";
+import type * as sandboxes from "@distilled.cloud/daytona/sandbox";
+import type * as snapshots from "@distilled.cloud/daytona/snapshots";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { NameOutsidePrefix } from "./CreateVolume.ts";
+import type { ProcessError } from "./internal/Errors.ts";
+import type { StateFailed, StateTimeout } from "./internal/Wait.ts";
+import type {
+  ResolvedSnapshotSource,
+  SnapshotAttributes,
+  SnapshotContextUnsupported,
+  SnapshotImageTagInvalid,
+  SnapshotRunFailed,
+} from "./Snapshot.ts";
+
+/** `create` input: a name and one source, as `Daytona.Snapshot` takes them (Dockerfile as content). */
+export interface CreateSnapshotInput extends Omit<ResolvedSnapshotSource, "contextHashes"> {
+  readonly name: string;
+}
+
+export interface CreateSnapshotClient {
+  /**
+   * Build a snapshot and wait until it is active: pull `image`, build
+   * `dockerfile` on Daytona, or start a sandbox from `from`, `run` the
+   * commands and capture it. Returns the same attributes as
+   * `Daytona.Snapshot`.
+   */
+  create(
+    input: CreateSnapshotInput,
+  ): Effect.Effect<
+    SnapshotAttributes,
+    | snapshots.CreateSnapshotError
+    | snapshots.GetSnapshotError
+    | snapshots.ActivateSnapshotError
+    | sandboxes.CreateSandboxError
+    | sandboxes.GetSandboxError
+    | sandboxes.CreateSandboxSnapshotError
+    | ProcessError
+    | SnapshotRunFailed
+    | SnapshotImageTagInvalid
+    | SnapshotContextUnsupported
+    | UnsupportedDockerfile
+    | DockerfileSyntaxError
+    | StateTimeout
+    | StateFailed
+    | NameOutsidePrefix,
+    RuntimeContext
+  >;
+  /** The snapshot with this id or name, or `undefined`. */
+  get(
+    idOrName: string,
+  ): Effect.Effect<SnapshotAttributes | undefined, snapshots.GetSnapshotError, RuntimeContext>;
+  /** Snapshots matching Daytona's list filters. */
+  list(
+    input?: Omit<snapshots.GetAllSnapshotsRequest, "xDaytonaOrganizationID" | "page">,
+  ): Effect.Effect<SnapshotAttributes[], snapshots.GetAllSnapshotsError, RuntimeContext>;
+  /** Make a deactivated snapshot usable again and wait until it is active. */
+  activate(
+    idOrName: string,
+  ): Effect.Effect<
+    SnapshotAttributes,
+    snapshots.GetSnapshotError | snapshots.ActivateSnapshotError | StateTimeout | StateFailed,
+    RuntimeContext
+  >;
+  /** Deactivate a snapshot; sandboxes can't be created from it until it is activated. */
+  deactivate(
+    idOrName: string,
+  ): Effect.Effect<void, snapshots.DeactivateSnapshotError, RuntimeContext>;
+  /** A URL streaming the snapshot's build logs. */
+  buildLogsUrl(
+    idOrName: string,
+  ): Effect.Effect<snapshots.Url, snapshots.GetSnapshotBuildLogsUrlError, RuntimeContext>;
+  /** Delete a snapshot and wait until it is gone. Deleting a missing one succeeds. */
+  delete(
+    idOrName: string,
+  ): Effect.Effect<
+    void,
+    snapshots.RemoveSnapshotError | snapshots.GetSnapshotError | StateTimeout,
+    RuntimeContext
+  >;
+}
+
+/**
+ * Options for {@link CreateSnapshot}. Snapshots have only a name, no labels
+ * or description, so a `prefix` is how you find the ones a binding
+ * created: the binding refuses names that don't start with it.
+ */
+export interface CreateSnapshotOptions {
+  /** Every name the binding creates must start with this. */
+  readonly prefix?: string;
+}
+
+/**
+ * Build Daytona snapshots at runtime: a warm base per repository, built
+ * when it's first needed, that later sandboxes start from. To capture a
+ * sandbox you already have, use `sandbox.createSandboxSnapshot` on its
+ * handle.
+ *
+ * The host gets its own Daytona API key with `write:snapshots`,
+ * `delete:snapshots` and, for `from` builds, `write:sandboxes` and
+ * `delete:sandboxes`. Snapshots have only a name, so the `prefix` you give
+ * is how you find the ones it created. They are not deleted when the stack
+ * is destroyed: `list()` and delete the names with your prefix to clean
+ * them up.
+ *
+ * ### A Warm Base per Repository
+ * **Example:** Build it on first use, then start sandboxes from it
+ * ```typescript
+ * const images = yield* Daytona.CreateSnapshot({ prefix: "repo-" });
+ * const name = `repo-${owner}-${repo}`;
+ * const base =
+ *   (yield* images.get(name)) ??
+ *   (yield* images.create({
+ *     name,
+ *     from: "daytonaio/sandbox:0.4.3",
+ *     run: [`git clone https://github.com/${owner}/${repo} /home/daytona/repo`, "cd /home/daytona/repo && npm ci"],
+ *   }));
+ * const sandbox = yield* sandboxes.create({ snapshot: base.name });
+ * ```
+ *
+ * @binding
+ * @product Snapshot
+ */
+export interface CreateSnapshot extends Binding.Service<
+  CreateSnapshot,
+  "Daytona.CreateSnapshot",
+  (options?: CreateSnapshotOptions) => Effect.Effect<CreateSnapshotClient>
+> {}
+
+export const CreateSnapshot = Binding.Service<CreateSnapshot>("Daytona.CreateSnapshot");

package/src/CreateSnapshotHttp.ts

@@ -0,0 +1,77 @@
+import * as snapshots from "@distilled.cloud/daytona/snapshots";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import {
+  CreateSnapshot,
+  type CreateSnapshotClient,
+  type CreateSnapshotOptions,
+} from "./CreateSnapshot.ts";
+import { NameOutsidePrefix } from "./CreateVolume.ts";
+import { makeAccess, makeOwnerLabels } from "./DaytonaBindings.ts";
+import {
+  buildSnapshot,
+  checkRuntimeDockerfile,
+  deleteSnapshot,
+  getSnapshot,
+  toSnapshotAttributes,
+  waitForSnapshot,
+} from "./Snapshot.ts";
+
+/** {@link CreateSnapshot} over Daytona's HTTP API; works on any host. */
+export const CreateSnapshotHttp = Layer.effect(
+  CreateSnapshot,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* (options?: CreateSnapshotOptions) {
+      const { authorize } = yield* access("Snapshots", [
+        "write:snapshots",
+        "delete:snapshots",
+        "write:sandboxes",
+        "delete:sandboxes",
+      ]);
+      // A snapshot has only a name: `prefix` scopes it. The owner labels go
+      // on the sandbox a warm base is captured from.
+      const labels = yield* makeOwnerLabels;
+      const prefix = options?.prefix;
+      const client: CreateSnapshotClient = {
+        create: ({ name, ...source }) =>
+          prefix !== undefined && !name.startsWith(prefix)
+            ? Effect.fail(new NameOutsidePrefix({ objectName: name, prefix }))
+            : authorize(
+                Effect.gen(function* () {
+                  if (source.dockerfile !== undefined)
+                    yield* checkRuntimeDockerfile(source.dockerfile);
+                  const built = yield* buildSnapshot({
+                    name,
+                    source,
+                    labels: yield* labels,
+                    note: () => Effect.void,
+                  });
+                  return toSnapshotAttributes(built, "");
+                }),
+              ),
+        get: (idOrName) =>
+          authorize(
+            getSnapshot(idOrName).pipe(
+              Effect.map((s) => (s ? toSnapshotAttributes(s, "") : undefined)),
+            ),
+          ),
+        list: (input) =>
+          authorize(
+            snapshots.getAllSnapshots.items({ ...input }).pipe(
+              Stream.runCollect,
+              Effect.map((all) => Array.from(all, (s) => toSnapshotAttributes(s, ""))),
+            ),
+          ),
+        activate: (idOrName) =>
+          authorize(waitForSnapshot(idOrName).pipe(Effect.map((s) => toSnapshotAttributes(s, "")))),
+        deactivate: (idOrName) =>
+          authorize(snapshots.deactivateSnapshot({ id: idOrName }).pipe(Effect.asVoid)),
+        buildLogsUrl: (idOrName) => authorize(snapshots.getSnapshotBuildLogsUrl({ id: idOrName })),
+        delete: (idOrName) => authorize(deleteSnapshot(idOrName)),
+      };
+      return client;
+    });
+  }),
+);

package/src/CreateVolume.ts

@@ -0,0 +1,104 @@
+import type * as volumes from "@distilled.cloud/daytona/volumes";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Data from "effect/Data";
+import type * as Effect from "effect/Effect";
+import type { StateFailed, StateTimeout } from "./internal/Wait.ts";
+import type { VolumeAttributes } from "./Volume.ts";
+
+/** A name outside the binding's `prefix`. */
+export class NameOutsidePrefix extends Data.TaggedError("Daytona.NameOutsidePrefix")<{
+  readonly objectName: string;
+  readonly prefix: string;
+}> {
+  override get message() {
+    return `${this.objectName} must start with ${this.prefix}: the binding only manages names with that prefix`;
+  }
+}
+
+export interface CreateVolumeClient {
+  /**
+   * The volume named `name`, created (and waited on until ready) if it
+   * doesn't exist. Returns the same attributes as `Daytona.Volume`.
+   */
+  getOrCreate(input: {
+    readonly name: string;
+  }): Effect.Effect<
+    VolumeAttributes,
+    | volumes.CreateVolumeError
+    | volumes.GetVolumeByNameError
+    | volumes.GetVolumeError
+    | StateTimeout
+    | StateFailed
+    | NameOutsidePrefix,
+    RuntimeContext
+  >;
+  /** The volume with this name, or `undefined`. */
+  get(
+    name: string,
+  ): Effect.Effect<VolumeAttributes | undefined, volumes.GetVolumeByNameError, RuntimeContext>;
+  /** Every volume in the organization. */
+  list(): Effect.Effect<VolumeAttributes[], volumes.ListVolumesError, RuntimeContext>;
+  /**
+   * Delete a volume. Returns once Daytona has accepted the delete; it
+   * removes the volume in the background. Fails with `VolumeInUse` while a
+   * sandbox mounts it: Daytona releases a volume about a minute after the
+   * sandbox that wrote to it is deleted, so retry later. Deleting a missing
+   * one succeeds.
+   */
+  delete(
+    volumeId: string,
+  ): Effect.Effect<
+    void,
+    volumes.DeleteVolumeError | volumes.GetVolumeError | StateTimeout,
+    RuntimeContext
+  >;
+}
+
+/**
+ * Options for {@link CreateVolume}. Volumes have only a name, no labels or
+ * description, so a `prefix` is how you find the ones a binding created:
+ * the binding refuses names that don't start with it.
+ */
+export interface CreateVolumeOptions {
+  /** Every name the binding creates or gets must start with this. */
+  readonly prefix?: string;
+}
+
+/**
+ * Create, find and delete Daytona volumes at runtime: a volume per user,
+ * per project or per session, mounted into the sandboxes you create.
+ *
+ * The host gets its own Daytona API key with `read:volumes`,
+ * `write:volumes` and `delete:volumes`. Volumes have only a name, so the
+ * `prefix` you give is how you find the ones it created. They are not
+ * deleted when the stack is destroyed: `list()` and delete the names with
+ * your prefix to clean them up.
+ *
+ * ### Volume per User
+ * **Example:** Mount the user's volume as their home directory
+ * ```typescript
+ * const volumes = yield* Daytona.CreateVolume({ prefix: "user-" });
+ * const sandboxes = yield* Daytona.CreateSandbox(Base);
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const home = yield* volumes.getOrCreate({ name: `user-${user}` });
+ *     const sandbox = yield* sandboxes.create({
+ *       mounts: [{ volume: home, path: "/home/daytona/work" }],
+ *     });
+ *     const ls = yield* sandbox.exec("ls /home/daytona/work");
+ *     return yield* HttpServerResponse.json(ls);
+ *   }),
+ * };
+ * ```
+ *
+ * @binding
+ * @product Volume
+ */
+export interface CreateVolume extends Binding.Service<
+  CreateVolume,
+  "Daytona.CreateVolume",
+  (options?: CreateVolumeOptions) => Effect.Effect<CreateVolumeClient>
+> {}
+
+export const CreateVolume = Binding.Service<CreateVolume>("Daytona.CreateVolume");

package/src/CreateVolumeHttp.ts

@@ -0,0 +1,50 @@
+import * as volumes from "@distilled.cloud/daytona/volumes";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import {
+  CreateVolume,
+  NameOutsidePrefix,
+  type CreateVolumeClient,
+  type CreateVolumeOptions,
+} from "./CreateVolume.ts";
+import { makeAccess } from "./DaytonaBindings.ts";
+import { deleteVolumeById, ensureVolume, getVolumeByName, toVolumeAttributes } from "./Volume.ts";
+
+/** {@link CreateVolume} over Daytona's HTTP API; works on any host. */
+export const CreateVolumeHttp = Layer.effect(
+  CreateVolume,
+  Effect.gen(function* () {
+    const access = yield* makeAccess;
+    return Effect.fn(function* (options?: CreateVolumeOptions) {
+      const { authorize } = yield* access("Volumes", [
+        "read:volumes",
+        "write:volumes",
+        "delete:volumes",
+      ]);
+      // A volume has only a name: `prefix` scopes it.
+      const prefix = options?.prefix;
+      const client: CreateVolumeClient = {
+        getOrCreate: ({ name }) =>
+          prefix !== undefined && !name.startsWith(prefix)
+            ? Effect.fail(new NameOutsidePrefix({ objectName: name, prefix }))
+            : authorize(ensureVolume(name).pipe(Effect.map(toVolumeAttributes))),
+        get: (name) =>
+          authorize(
+            getVolumeByName(name).pipe(Effect.map((v) => (v ? toVolumeAttributes(v) : undefined))),
+          ),
+        list: () =>
+          authorize(
+            volumes
+              .listVolumes({})
+              .pipe(
+                Effect.map((all) =>
+                  all.filter((v) => v.state !== "deleted").map(toVolumeAttributes),
+                ),
+              ),
+          ),
+        delete: (volumeId) => authorize(deleteVolumeById(volumeId, { wait: false })),
+      };
+      return client;
+    });
+  }),
+);

package/src/Credentials.ts

@@ -0,0 +1,37 @@
+import { ConfigError } from "@distilled.cloud/core/errors";
+import {
+  Credentials,
+  DEFAULT_ANALYTICS_BASE_URL,
+  DEFAULT_TOOLBOX_BASE_URL,
+} from "@distilled.cloud/daytona/Credentials";
+import { lazyCredentials } from "alchemy/Auth/Resolve";
+import * as Layer from "effect/Layer";
+import { DAYTONA_AUTH_PROVIDER_NAME, type DaytonaResolvedCredentials } from "./AuthProvider.ts";
+
+export {
+  Credentials,
+  CredentialsFromEnv,
+  DEFAULT_ANALYTICS_BASE_URL,
+  DEFAULT_API_BASE_URL,
+  DEFAULT_TOOLBOX_BASE_URL,
+} from "@distilled.cloud/daytona/Credentials";
+
+/**
+ * A `Credentials` layer that resolves Daytona credentials through the
+ * Alchemy AuthProvider for the current profile.
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    Credentials,
+    lazyCredentials<DaytonaResolvedCredentials, ConfigError>()(
+      DAYTONA_AUTH_PROVIDER_NAME,
+      (creds) => ({
+        apiKey: creds.token,
+        apiBaseUrl: creds.apiBaseUrl,
+        analyticsBaseUrl: DEFAULT_ANALYTICS_BASE_URL,
+        toolboxBaseUrl: DEFAULT_TOOLBOX_BASE_URL,
+        organizationId: creds.organizationId,
+      }),
+      { expiresAt: (creds) => creds.expires },
+    ),
+  );