@alchemy.run/daytona 0.0.0-stage → 2.0.0-beta.86

package/src/DaytonaBindings.ts

@@ -0,0 +1,111 @@
+import {
+  Credentials,
+  DEFAULT_ANALYTICS_BASE_URL,
+  DEFAULT_TOOLBOX_BASE_URL,
+} from "@distilled.cloud/daytona/Credentials";
+import * as Binding from "alchemy/Binding";
+import * as Output from "alchemy/Output";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import { createInternalTags } from "alchemy/Tags";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import { ApiKey, type Permission } from "./ApiKey.ts";
+import { toLabels } from "./internal/Labels.ts";
+
+/**
+ * How a Daytona binding reaches the API from any host.
+ *
+ * Daytona authorizes with API keys whose permissions are checked per kind
+ * of object, so each binding mints its own {@link ApiKey} for its host at
+ * deploy, with only the permissions it needs, and the host reads the key
+ * back at runtime through `RuntimeContext`. The deployer's key never
+ * leaves the deploying machine, and the host works on any runtime
+ * (Cloudflare Workers, Lambda, containers) because the key travels as a
+ * plain secret, not a cloud identity.
+ */
+export interface DaytonaAccess {
+  /**
+   * Run Daytona operations with the host's minted key. Provides
+   * `Credentials` and an `HttpClient`; the result requires only
+   * `RuntimeContext`.
+   */
+  readonly authorize: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E, Exclude<R, Credentials | HttpClient.HttpClient> | RuntimeContext>;
+  /** The organization the key acts on. */
+  readonly organizationId: Effect.Effect<string, never, RuntimeContext>;
+}
+
+/**
+ * Resolve once, when a binding's layer is built: returns a function that
+ * mints (at deploy) and reads back (at runtime) an API key for the current
+ * host, named after the host and `purpose`, with `permissions`.
+ */
+export const makeAccess = Effect.gen(function* () {
+  const Key = yield* ApiKey;
+  return Effect.fn(function* (purpose: string, permissions: Permission[]) {
+    const host = yield* Binding.Host;
+    const key = yield* Key(`${host?.LogicalId ?? ""}${purpose}ApiKey`, { permissions });
+    const value = yield* key.value;
+    const apiBaseUrl = yield* key.apiBaseUrl;
+    const organizationId = yield* key.organizationId;
+    const authorize = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      Effect.gen(function* () {
+        const config = {
+          apiKey: yield* value,
+          apiBaseUrl: yield* apiBaseUrl,
+          analyticsBaseUrl: DEFAULT_ANALYTICS_BASE_URL,
+          toolboxBaseUrl: DEFAULT_TOOLBOX_BASE_URL,
+          organizationId: yield* organizationId,
+        };
+        return yield* effect.pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              Layer.succeed(Credentials, Effect.succeed(config)),
+              FetchHttpClient.layer,
+            ),
+          ),
+        );
+      });
+    return {
+      authorize,
+      organizationId,
+    } satisfies DaytonaAccess;
+  });
+});
+
+/**
+ * The labels a runtime binding puts on what it creates: the host's
+ * `alchemy::stack`, `alchemy::stage` and `alchemy::id`, as Daytona label
+ * keys (`alchemy.stack`, `alchemy.stage`, `alchemy.id`; Daytona doesn't
+ * accept `::` in a key). Computed at deploy from the host's identity and
+ * bound into the host, so the runtime reads them back rather than
+ * computing them.
+ */
+export const makeOwnerLabels = Effect.gen(function* () {
+  const host = yield* Binding.Host;
+  const id = host?.LogicalId ?? "";
+  const owner = Output.fromEffect(createInternalTags(id)) as unknown as {
+    bind(key: string): Effect.Effect<unknown>;
+  };
+  const tags = yield* owner.bind(`${id}DaytonaOwner`);
+  return Effect.map(
+    tags as Effect.Effect<Record<string, string> | undefined, never, RuntimeContext>,
+    (owner) => toLabels(owner),
+  );
+});
+
+/** The owner labels as a description, for objects that only have one. */
+export const ownerDescription = (labels: Record<string, string>) =>
+  `${labels["alchemy.stack"]}/${labels["alchemy.stage"]}/${labels["alchemy.id"]}`;
+
+/** User labels with the owner labels on top: a user label never overwrites `alchemy.*`. */
+export const withOwnerLabels = (
+  user: Record<string, string> | undefined,
+  owner: Record<string, string>,
+) => ({
+  ...Object.fromEntries(Object.entries(user ?? {}).filter(([k]) => !k.startsWith("alchemy."))),
+  ...owner,
+});

package/src/IdentityProvider.ts

@@ -0,0 +1,181 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import { declarable } from "./internal/Declared.ts";
+import { isOwnedName, resolveName } from "./internal/Names.ts";
+import {
+  currentOrganizationId,
+  movesOrganization,
+  organizationIdFor,
+  type OrganizationRef,
+} from "./internal/Organization.ts";
+import { resolved, type Ref } from "./internal/Ref.ts";
+import type { RoleRef } from "./OrganizationInvitation.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface IdentityProviderProps {
+  /**
+   * Organization to act on, e.g. a `Daytona.Organization`. Defaults to the
+   * credentials' organization. Changing it replaces the resource.
+   */
+  organization?: Ref<OrganizationRef>;
+  /** Display name. If omitted, generated from the stack, stage and logical ID. */
+  name?: string;
+  /** OIDC issuer URL. */
+  issuerUrl: string;
+  /** OIDC client ID. */
+  clientId: string;
+  /** OIDC client secret. Updated in place. */
+  clientSecret: string | Redacted.Redacted<string>;
+  /** Scopes to request. @default "openid email profile" */
+  scope?: string;
+  /** Email domains that sign in through this provider. */
+  emailDomains: string[];
+  /** Accept any email domain. @default false */
+  allowAnyDomain?: boolean;
+  /** Trust the provider's `email_verified` claim. @default false */
+  trustEmailVerified?: boolean;
+  /** Custom roles new members get. */
+  defaultRoles?: Ref<RoleRef>[];
+  /** Whether sign-in through it is enabled. @default true */
+  enabled?: boolean;
+}
+
+export interface IdentityProviderAttributes {
+  /** Identity provider ID. */
+  identityProviderId: string;
+  /** Organization ID. */
+  organizationId: string;
+  /** Display name. */
+  name: string;
+  /** Email domains. */
+  emailDomains: string[];
+  /** Whether it is enabled. */
+  enabled: boolean;
+}
+
+export type IdentityProvider = Resource<
+  "Daytona.IdentityProvider",
+  IdentityProviderProps,
+  IdentityProviderAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * An OIDC identity provider for single sign-on into the Daytona
+ * organization. Needs an organization with SSO enabled (an enterprise
+ * plan); other organizations reject it.
+ *
+ * ### Single Sign-On
+ * **Example:** Sign in with your company's OIDC provider
+ * ```typescript
+ * export const Sso = Daytona.IdentityProvider("Sso", {
+ *   issuerUrl: "https://login.example.com",
+ *   clientId: "daytona",
+ *   clientSecret: Config.Redacted("OIDC_CLIENT_SECRET"),
+ *   emailDomains: ["example.com"],
+ *   defaultRoles: [Developer],
+ * });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const IdentityProvider = declarable<IdentityProvider>()(
+  Resource<IdentityProvider>("Daytona.IdentityProvider"),
+);
+
+const toAttributes = (
+  organizationId: string,
+  p: { id: string; name: string; emailDomains: string[]; enabled: boolean },
+): IdentityProviderAttributes => ({
+  identityProviderId: p.id,
+  organizationId,
+  name: p.name,
+  emailDomains: p.emailDomains,
+  enabled: p.enabled,
+});
+
+const roleIds = (roles: IdentityProviderProps["defaultRoles"]) =>
+  Effect.succeed((roles ?? []).map((r) => resolved(r).roleId));
+
+export const IdentityProviderProvider = () =>
+  Provider.effect(
+    IdentityProvider,
+    Effect.succeed({
+      stables: ["identityProviderId", "organizationId"],
+      list: Effect.fn(function* () {
+        const organizationId = yield* currentOrganizationId;
+        const all = yield* organizations.listOrganizationIdentityProviders({ organizationId });
+        return all.map((p) => toAttributes(organizationId, p));
+      }),
+      diff: Effect.fn(function* ({ news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        if (yield* movesOrganization(news.organization, output))
+          return { action: "replace" } as const;
+      }),
+      read: Effect.fn(function* ({ id, olds, output }) {
+        const organizationId = output?.organizationId ?? (yield* currentOrganizationId);
+        const name = yield* resolveName(id, olds?.name, output?.name);
+        const all = yield* organizations.listOrganizationIdentityProviders({ organizationId });
+        const found =
+          all.find((p) => p.id === output?.identityProviderId) ?? all.find((p) => p.name === name);
+        if (found === undefined) return undefined;
+        const attrs = toAttributes(organizationId, found);
+        return (yield* isOwnedName(id, found.name, output !== undefined)) ? attrs : Unowned(attrs);
+      }),
+      reconcile: Effect.fn(function* ({ id, news, output }) {
+        const organizationId = yield* organizationIdFor(news.organization);
+        const name = yield* resolveName(id, news.name, output?.name);
+        const desired = {
+          name,
+          emailDomains: news.emailDomains,
+          allowAnyDomain: news.allowAnyDomain ?? false,
+          trustEmailVerified: news.trustEmailVerified ?? false,
+          defaultAssignedRoleIds: yield* roleIds(news.defaultRoles),
+          enabled: news.enabled ?? true,
+        };
+        const oidcConfig = {
+          issuerUrl: news.issuerUrl,
+          clientId: news.clientId,
+          clientSecret: news.clientSecret,
+          scope: news.scope,
+        };
+        // Observe
+        const all = yield* organizations.listOrganizationIdentityProviders({ organizationId });
+        const current =
+          all.find((p) => p.id === output?.identityProviderId) ?? all.find((p) => p.name === name);
+        // Ensure
+        if (current === undefined) {
+          const created = yield* organizations.createOrganizationIdentityProvider({
+            organizationId,
+            oidcConfig,
+            ...desired,
+          });
+          return toAttributes(organizationId, created);
+        }
+        // Sync — the client secret can't be read back, so the full
+        // configuration is written on every deploy.
+        const updated = yield* organizations.updateOrganizationIdentityProvider({
+          organizationId,
+          id: current.id,
+          oidcConfig,
+          ...desired,
+        });
+        return toAttributes(organizationId, updated);
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        yield* organizations
+          .deleteOrganizationIdentityProvider({
+            organizationId: output.organizationId,
+            id: output.identityProviderId,
+          })
+          .pipe(Effect.catchTag("IdentityProviderNotFound", () => Effect.void));
+      }),
+    }),
+  );

package/src/MountVolume.ts

@@ -0,0 +1,122 @@
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { Sandbox } from "./Sandbox.ts";
+import type { Volume } from "./Volume.ts";
+
+/**
+ * A volume a mount names: a `Daytona.Volume` (or the reference
+ * `MountVolume` returns), or a runtime handle from `CreateVolume`.
+ */
+export interface MountableVolume {
+  readonly volumeId: string | Effect.Effect<string, never, RuntimeContext>;
+}
+
+/** A volume mounted at a path: an entry of `mounts`. */
+export interface VolumeMount {
+  /** The volume. */
+  readonly volume: MountableVolume;
+  /** Absolute path in the sandbox. */
+  readonly path: string;
+  /** Mount only this directory of the volume. */
+  readonly subpath?: string;
+}
+
+export interface MountVolumeOptions {
+  /** Absolute path in the sandbox. */
+  readonly path: string;
+  /** Mount only this directory of the volume. */
+  readonly subpath?: string;
+}
+
+/** The volume ID behind a mount entry. */
+export const volumeIdOf = (volume: MountableVolume) =>
+  typeof volume.volumeId === "string" ? Effect.succeed(volume.volumeId) : volume.volumeId;
+
+const isSandboxHost = (value: unknown): value is Sandbox =>
+  typeof value === "object" &&
+  value !== null &&
+  (value as { Type?: string }).Type === "Daytona.Sandbox";
+
+/**
+ * Mount a {@link Volume} at a path.
+ *
+ * Inside a sandbox's program, the volume is mounted into that sandbox:
+ * it joins the sandbox's `mounts`. A mount change replaces the sandbox,
+ * since Daytona only mounts volumes when it creates one. Inside any other
+ * host (a Worker, a Lambda), the binding resolves the volume and returns a
+ * mount reference to pass to `CreateSandbox`'s `create({ mounts })`.
+ *
+ * The reference has the same fields as a `mounts` entry: `volume`,
+ * `path` and `subpath`. Daytona has no per-volume access control, so the
+ * binding mints no credentials.
+ *
+ * ### Mounting a Volume in a Program
+ * **Example:** Serve the files of a volume
+ * ```typescript
+ * export default class Agent extends Daytona.Sandbox<Agent>()(
+ *   "Agent",
+ *   { main: import.meta.url, public: true },
+ *   Effect.gen(function* () {
+ *     const data = yield* Daytona.MountVolume(Data, { path: "/data" });
+ *     const fs = yield* FileSystem.FileSystem;
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         return yield* HttpServerResponse.json(yield* fs.readDirectory(data.path));
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Daytona.MountVolumeLive)),
+ * ) {}
+ * ```
+ *
+ * ### Mounting a Volume in Sandboxes You Create
+ * **Example:** A shared cache plus each user's home
+ * ```typescript
+ * const cache = yield* Daytona.MountVolume(Cache, { path: "/cache" });
+ * const sandboxes = yield* Daytona.CreateSandbox(Base);
+ * const volumes = yield* Daytona.CreateVolume({ prefix: "user-" });
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const home = yield* volumes.getOrCreate({ name: `user-${user}` });
+ *     const sandbox = yield* sandboxes.create({
+ *       mounts: [cache, { volume: home, path: "/home/daytona/work" }],
+ *     });
+ *     return yield* HttpServerResponse.json(yield* sandbox.exec("ls /cache"));
+ *   }),
+ * };
+ * ```
+ *
+ * @binding
+ * @product Volume
+ */
+export interface MountVolume extends Binding.Service<
+  MountVolume,
+  "Daytona.MountVolume",
+  (volume: Volume, options: MountVolumeOptions) => Effect.Effect<VolumeMount>
+> {}
+
+export const MountVolume = Binding.Service<MountVolume>("Daytona.MountVolume");
+
+/** {@link MountVolume}; works on any host. */
+export const MountVolumeLive = Layer.effect(
+  MountVolume,
+  Effect.succeed(
+    Effect.fn(function* (volume: Volume, options: MountVolumeOptions) {
+      const volumeId = yield* volume.volumeId;
+      if (!globalThis.__ALCHEMY_RUNTIME__) {
+        const host = yield* Binding.Host;
+        if (isSandboxHost(host)) {
+          yield* host.bind`Daytona.MountVolume(${volume})`({
+            mounts: [{ volumeId: volume.volumeId, path: options.path, subpath: options.subpath }],
+          });
+        }
+      }
+      return {
+        volume: { volumeId },
+        path: options.path,
+        subpath: options.subpath,
+      } satisfies VolumeMount;
+    }),
+  ),
+);

package/src/OAuthClient.ts

@@ -0,0 +1,27 @@
+import { makeOAuthClient } from "alchemy/Auth/OAuthFlow";
+
+export { OAuthCredentials, OAuthError, type DeviceAuthorization } from "alchemy/Auth/OAuthFlow";
+
+/**
+ * The Daytona CLI's public WorkOS client (no secret), published by Daytona's
+ * `GET /api/config` under `oidc.cli`. `daytona login` uses the same device
+ * flow. A user session can call what an organization API key can't: the
+ * organization, role, invitation and API key endpoints.
+ */
+export const OAUTH_CLIENT_ID = "client_01M392QZWMYD01SA05BPEYQ84V";
+
+export const OAUTH_ENDPOINTS = {
+  deviceAuthorization: "https://api.auth.daytona.io/user_management/authorize/device",
+  token: "https://api.auth.daytona.io/user_management/authenticate",
+};
+
+const client = makeOAuthClient({
+  clientId: OAUTH_CLIENT_ID,
+  endpoints: OAUTH_ENDPOINTS,
+  auth: { kind: "pkce" },
+  // WorkOS answers on api.auth.daytona.io but serves the device page on
+  // auth.daytona.io.
+  verificationHosts: ["auth.daytona.io"],
+});
+
+export const { deviceAuthorize, deviceToken, refresh, usesCurrentClient } = client;

package/src/Organization.ts

@@ -0,0 +1,121 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import { resolveName } from "./internal/Names.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface OrganizationProps {
+  /** Organization name. If omitted, generated from the stack, stage and logical ID. */
+  name?: string;
+  /**
+   * Region new sandboxes go to by default. Daytona sets it once, so changing
+   * it replaces the organization.
+   */
+  defaultRegionId: string;
+}
+
+export interface OrganizationAttributes {
+  /** Organization ID. */
+  organizationId: string;
+  /** Name. */
+  name: string;
+  /** Default region. */
+  defaultRegionId: string | undefined;
+}
+
+export type Organization = Resource<
+  "Daytona.Organization",
+  OrganizationProps,
+  OrganizationAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A new Daytona organization, owned by the signed-in user. Creating
+ * organizations needs a user login, not an organization API key: an API
+ * key already belongs to exactly one organization. To configure the
+ * organization your key belongs to, use {@link OrganizationSettings}.
+ *
+ * ### Creating an Organization
+ * **Example:** A separate organization for a team
+ * ```typescript
+ * export const Team = Daytona.Organization("Team", { defaultRegionId: "us" });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const Organization = Resource<Organization>("Daytona.Organization");
+
+const toAttributes = (o: organizations.Organization): OrganizationAttributes => ({
+  organizationId: o.id,
+  name: o.name,
+  defaultRegionId: o.defaultRegionId,
+});
+
+export const OrganizationProvider = () =>
+  Provider.effect(
+    Organization,
+    Effect.succeed({
+      stables: ["organizationId"],
+      nuke: { skip: true },
+      list: () => Effect.succeed([]),
+      diff: Effect.fn(function* ({ id, news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        const name = yield* resolveName(
+          id,
+          news.name,
+          news.name === undefined ? output.name : undefined,
+        );
+        // Reconcile finds an organization by name, so the old one must go
+        // first or the replacement would adopt it.
+        if (
+          name !== output.name ||
+          (output.defaultRegionId !== undefined && news.defaultRegionId !== output.defaultRegionId)
+        ) {
+          return { action: "replace", deleteFirst: true } as const;
+        }
+      }),
+      read: Effect.fn(function* ({ output }) {
+        if (output === undefined) return undefined;
+        return yield* organizations.getOrganization({ organizationId: output.organizationId }).pipe(
+          Effect.map(toAttributes),
+          Effect.catchTag("OrganizationNotFound", () => Effect.undefined),
+        );
+      }),
+      reconcile: Effect.fn(function* ({ id, news, output }) {
+        const name = yield* resolveName(id, news.name, output?.name);
+        // Observe
+        let current = output
+          ? yield* organizations
+              .getOrganization({ organizationId: output.organizationId })
+              .pipe(Effect.catchTag("OrganizationNotFound", () => Effect.undefined))
+          : (yield* organizations.listOrganizations({})).find((o) => o.name === name);
+        // Ensure
+        if (current === undefined) {
+          current = yield* organizations.createOrganization({
+            name,
+            defaultRegionId: news.defaultRegionId,
+          });
+        }
+        // Sync: Daytona only accepts a default region while none is set
+        // (an adopted organization); changing one replaces (see diff).
+        if (current.defaultRegionId === undefined) {
+          yield* organizations.setOrganizationDefaultRegion({
+            organizationId: current.id,
+            defaultRegionId: news.defaultRegionId,
+          });
+          current = yield* organizations.getOrganization({ organizationId: current.id });
+        }
+        return toAttributes(current);
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        yield* organizations
+          .deleteOrganization({ organizationId: output.organizationId })
+          .pipe(Effect.catchTag("OrganizationNotFound", () => Effect.void));
+      }),
+    }),
+  );