@alchemy.run/daytona 0.0.0 → 2.0.0-beta.86

package/lib/Secret.js

@@ -0,0 +1,130 @@
+import { createHash } from "node:crypto";
+import * as secrets from "@distilled.cloud/daytona/secret";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { isOwnedName, resolveName } from "./internal/Names.js";
+/**
+ * A secret stored in Daytona. A sandbox gets a placeholder in place of
+ * the value, and Daytona's egress proxy substitutes the real value only on
+ * requests to the secret's `hosts`, so code in the sandbox (or an agent
+ * running there) can use a credential without being able to read it.
+ *
+ * Declare a secret here for credentials the whole app shares. For a secret
+ * per user, create it at runtime with {@link CreateSecret}.
+ * @see https://www.daytona.io/docs/en/secrets/
+ *
+ * ### Creating a Secret
+ * **Example:** An npm token only sent to the registry
+ * ```typescript
+ * export const NpmToken = Daytona.Secret("NpmToken", {
+ *   value: Config.Redacted("NPM_TOKEN"),
+ *   hosts: ["registry.npmjs.org"],
+ * });
+ * ```
+ *
+ * ### Using a Secret in a Sandbox
+ * **Example:** Expose it to a sandbox as an environment variable
+ * ```typescript
+ * export const DevBox = Daytona.Sandbox("DevBox", {
+ *   snapshot: Base,
+ *   secrets: { NPM_TOKEN: NpmToken },
+ * });
+ * ```
+ *
+ * @resource
+ * @product Secret
+ */
+export const Secret = Resource("Daytona.Secret");
+export const hashSecretValue = (value) => Effect.sync(() => createHash("sha256")
+    .update(Redacted.isRedacted(value) ? Redacted.value(value) : value)
+    .digest("hex"));
+export const toSecretAttributes = (s, valueHash) => ({
+    secretId: s.id,
+    name: s.name,
+    placeholder: s.placeholder,
+    hosts: s.hosts,
+    description: s.description,
+    valueHash,
+});
+export const getSecretById = (secretId) => secrets.getSecret({ secretId }).pipe(Effect.catchTag("SecretNotFound", () => Effect.undefined));
+/** Exact-name lookup over the paginated list (its `name` filter is a substring match). */
+export const findSecretByName = (name) => secrets.listSecretsPaginated.items({ name }).pipe(Stream.filter((s) => s.name === name), Stream.runHead, Effect.map((found) => (found._tag === "Some" ? found.value : undefined)));
+export const ensureSecret = Effect.fn(function* (input) {
+    const valueHash = yield* hashSecretValue(input.value);
+    const existing = input.existing ?? (yield* findSecretByName(input.name));
+    if (existing === undefined) {
+        const created = yield* secrets
+            .createSecret({
+            name: input.name,
+            value: input.value,
+            description: input.description,
+            hosts: input.hosts,
+        })
+            .pipe(Effect.catchTag("SecretAlreadyExists", () => Effect.undefined));
+        if (created !== undefined)
+            return toSecretAttributes(created, valueHash);
+    }
+    const current = existing ?? (yield* findSecretByName(input.name));
+    if (current === undefined)
+        return yield* Effect.die(`Daytona secret ${input.name} vanished during create`);
+    // Sync — the value can't be observed, so it is rewritten unless the
+    // hash we last wrote matches. Description and hosts diff against cloud.
+    const hostsChanged = input.hosts !== undefined && !deepEqual([...input.hosts].sort(), [...current.hosts].sort());
+    const descriptionChanged = input.description !== undefined && input.description !== current.description;
+    const valueChanged = input.knownHash !== valueHash;
+    if (!hostsChanged && !descriptionChanged && !valueChanged)
+        return toSecretAttributes(current, valueHash);
+    const updated = yield* secrets.updateSecret({
+        secretId: current.id,
+        value: valueChanged ? input.value : undefined,
+        description: descriptionChanged ? input.description : undefined,
+        hosts: hostsChanged ? input.hosts : undefined,
+    });
+    return toSecretAttributes(updated, valueHash);
+});
+export const SecretProvider = () => Provider.effect(Secret, Effect.succeed({
+    stables: ["secretId", "placeholder"],
+    list: Effect.fn(function* () {
+        const all = yield* secrets.listSecretsPaginated.items({}).pipe(Stream.runCollect);
+        return Array.from(all).map((s) => toSecretAttributes(s, ""));
+    }),
+    diff: Effect.fn(function* ({ id, news, output }) {
+        if (!isResolved(news) || output === undefined)
+            return undefined;
+        const name = yield* resolveName(id, news.name, news.name === undefined ? output.name : undefined);
+        if (name !== output.name)
+            return { action: "replace", deleteFirst: true };
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+        const name = yield* resolveName(id, olds?.name, output?.name);
+        const found = (output ? yield* getSecretById(output.secretId) : undefined) ??
+            (yield* findSecretByName(name));
+        if (found === undefined)
+            return undefined;
+        const attrs = toSecretAttributes(found, output?.valueHash ?? "");
+        return (yield* isOwnedName(id, found.name, output !== undefined)) ? attrs : Unowned(attrs);
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const name = yield* resolveName(id, news.name, output?.name);
+        const byId = output ? yield* getSecretById(output.secretId) : undefined;
+        return yield* ensureSecret({
+            name,
+            value: news.value,
+            description: news.description,
+            hosts: news.hosts,
+            existing: byId?.name === name ? byId : undefined,
+            knownHash: byId?.name === name ? output?.valueHash : undefined,
+        });
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* secrets
+            .deleteSecret({ secretId: output.secretId })
+            .pipe(Effect.catchTag("SecretNotFound", () => Effect.void));
+    }),
+}));
+//# sourceMappingURL=Secret.js.map

package/lib/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sources":["../src/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AA8C/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,gBAAgB,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAyC,EAAE,EAAE,CAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACf,UAAU,CAAC,QAAQ,CAAC;KACjB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;KAClE,MAAM,CAAC,KAAK,CAAC,CACjB,CAAC;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAkB,EAAE,SAAiB,EAAoB,EAAE,CAAC,CAAC;IAC9F,QAAQ,EAAE,CAAC,CAAC,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE,CAChD,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAElG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/C,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CACzE,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAOhD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO;aAC3B,YAAY,CAAC;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,yBAAyB,CAAC,CAAC;IAClF,oEAAoE;IACpE,wEAAwE;IACxE,MAAM,YAAY,GAChB,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GACtB,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC;IAC/E,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;IACnD,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB,IAAI,CAAC,YAAY;QACvD,OAAO,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC7C,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC/D,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,OAAO,CAAC;IACb,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAC7B,EAAE,EACF,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAClD,CAAC;QACF,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAW,CAAC;IACrF,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,KAAK,GACT,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7F,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;YACzB,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAChD,SAAS,EAAE,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,OAAO;aACX,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;aAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;CACH,CAAC,CACH,CAAC"}

package/lib/Snapshot.d.ts

@@ -0,0 +1,327 @@
+import * as BuildPlan from "@alchemy.run/docker/BuildPlan";
+import type { InlineDockerfile } from "@alchemy.run/docker/Dockerfile";
+import * as DockerfileParser from "@alchemy.run/docker/DockerfileParser";
+import * as dockerRegistry from "@distilled.cloud/daytona/docker_registry";
+import * as sandboxes from "@distilled.cloud/daytona/sandbox";
+import * as snapshots from "@distilled.cloud/daytona/snapshots";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import { type Ref } from "./internal/Ref.ts";
+import type { Providers } from "./Providers.ts";
+/** A snapshot, by name. Accepts a `Daytona.Snapshot` or `{ name }`. */
+export type SnapshotRef = {
+    readonly name: string;
+};
+/** A private registry. Accepts a `Daytona.Registry` or `{ registryId }`. */
+export type SnapshotRegistry = {
+    readonly registryId: string;
+};
+export type GpuType = snapshots.GpuType;
+export interface SnapshotBuild {
+    /** Build arguments, read by the Dockerfile's `ARG` instructions. */
+    args?: Record<string, string>;
+    /**
+     * BuildKit secrets, keyed by id; mount one in a `RUN` step with
+     * `--mount=type=secret,id=<id>`. They never enter the image or its hash.
+     * Daytona's builders can't receive secrets, so setting any builds locally.
+     */
+    secrets?: Record<string, Redacted.Redacted<string>>;
+    /**
+     * Build on Daytona's builders (`true`), or with your local Docker
+     * (`false`), pushing the image to Daytona's registry. Build locally to use
+     * build secrets, base images only your machine can pull, or your local
+     * layer cache.
+     * @default true, unless `secrets` are set
+     */
+    remote?: boolean;
+}
+export interface SnapshotProps {
+    /**
+     * Snapshot name, unique in the organization. Sandboxes are created from
+     * it by name. If omitted, a unique name is generated from the stack,
+     * stage and logical ID. Changing it replaces the snapshot.
+     */
+    name?: string;
+    /**
+     * An image to pull, with an explicit tag or digest (Daytona rejects
+     * `latest`, `lts` and `stable`). Pass a {@link Registry} as `registry`
+     * for private images. Exclusive with `dockerfile` and `from`.
+     */
+    image?: string;
+    /**
+     * A Dockerfile to build: a path (relative to the cwd), or inline content
+     * (`Dockerfile.inline`). Daytona builds it on its own builders, uploading
+     * the files it `COPY`s from {@link context}; no local Docker is needed.
+     * Set `build.remote: false` to build it with your local Docker instead.
+     * Changing the Dockerfile or any file it copies replaces the snapshot.
+     * Exclusive with `image` and `from`.
+     * @default `${context}/Dockerfile` when `context` is set
+     */
+    dockerfile?: string | InlineDockerfile;
+    /**
+     * Build context directory for a Dockerfile path. Only the files its
+     * `COPY`/`ADD` instructions reach are uploaded (after `.dockerignore`).
+     * Inline Dockerfiles have no context and can't `COPY` local files.
+     */
+    context?: string;
+    /** How the Dockerfile is built. */
+    build?: SnapshotBuild;
+    /**
+     * Build a warm base from another snapshot: start a sandbox from `from`,
+     * run `run` in it, and capture its filesystem as this snapshot. Use it to
+     * bake a cloned repository and installed dependencies into the snapshot
+     * sandboxes fork from. Exclusive with `image` and `dockerfile`.
+     */
+    from?: Ref<SnapshotRef>;
+    /**
+     * Shell commands run in order in the `from` sandbox before it is
+     * captured. A non-zero exit fails the deploy.
+     */
+    run?: string[];
+    /** Private registry to pull `image` (or a Dockerfile's base) from. */
+    registry?: Ref<SnapshotRegistry>;
+    /** The command a sandbox from this snapshot runs. */
+    entrypoint?: string[];
+    /** vCPUs for sandboxes from this snapshot. */
+    cpu?: number;
+    /** Memory in GiB. */
+    memory?: number;
+    /** Disk in GiB. */
+    disk?: number;
+    /** GPUs per sandbox. Billed per hour while a sandbox runs. */
+    gpu?: number;
+    /** Acceptable GPU types, in order of preference. */
+    gpuType?: GpuType[];
+    /** Region to build the snapshot in. */
+    regionId?: string;
+    /** Sandbox class (`container`, `linux-vm`, …). Dockerfile builds need `container`. */
+    sandboxClass?: snapshots.SandboxClass;
+}
+export interface SnapshotAttributes {
+    /** Snapshot ID. */
+    snapshotId: string;
+    /** Snapshot name; what sandboxes are created from. */
+    name: string;
+    /** State (`active` once usable). */
+    state: snapshots.SnapshotState;
+    /** The pulled or built image. */
+    imageName: string | undefined;
+    /** Internal image reference. */
+    ref: string | undefined;
+    /** vCPUs. */
+    cpu: number;
+    /** Memory in GiB. */
+    memory: number;
+    /** Disk in GiB. */
+    disk: number;
+    /** GPUs. */
+    gpu: number;
+    /** The sandbox this snapshot was captured from, for `from` snapshots. */
+    sourceSandboxId: string | undefined;
+    /** Hash of everything the snapshot was built from. */
+    buildHash: string;
+}
+export type Snapshot = Resource<"Daytona.Snapshot", SnapshotProps, SnapshotAttributes, never, Providers, SnapshotLookup>;
+/**
+ * Props for {@link Snapshot.lookup}: find a snapshot this stack
+ * doesn't manage by its name or id.
+ */
+export interface SnapshotLookup {
+    /** Snapshot name or id. */
+    name: string;
+}
+/**
+ * A Daytona snapshot: the image sandboxes boot from, with its default
+ * size. Pull one from a registry, build one from a Dockerfile on
+ * Daytona's builders, or capture one from a sandbox after running setup
+ * commands in it (a warm base to fork from).
+ *
+ * Snapshots are immutable: changing what one is built from replaces it.
+ * Daytona deactivates a snapshot after two weeks without use; deploy
+ * reactivates it.
+ * @see https://www.daytona.io/docs/en/snapshots/
+ *
+ * ### Pulling an Image
+ * **Example:** A public image with a size
+ * ```typescript
+ * export const Node = Daytona.Snapshot("Node", {
+ *   image: "node:22-bookworm",
+ *   cpu: 2,
+ *   memory: 4,
+ *   disk: 10,
+ * });
+ * ```
+ *
+ * ### Building from a Dockerfile
+ * **Example:** An inline Dockerfile built by Daytona
+ * ```typescript
+ * export const Base = Daytona.Snapshot("Base", {
+ *   dockerfile: Dockerfile.inline`
+ *     FROM node:22-bookworm
+ *     RUN apt-get update && apt-get install -y git ripgrep
+ *   `,
+ *   cpu: 2,
+ *   memory: 4,
+ * });
+ * ```
+ *
+ * ### Building a Directory
+ * **Example:** A Dockerfile and the files it copies
+ * ```typescript
+ * export const App = Daytona.Snapshot("App", {
+ *   context: "./sandbox",
+ *   build: { args: { NODE_ENV: "production" } },
+ * });
+ * ```
+ *
+ * ### Building with Local Docker
+ * **Example:** A build that reads a private npm token
+ * ```typescript
+ * export const App = Daytona.Snapshot("App", {
+ *   context: "./sandbox",
+ *   build: {
+ *     remote: false,
+ *     secrets: { npmrc: Redacted.make(process.env.NPM_TOKEN!) },
+ *   },
+ * });
+ * ```
+ *
+ * ### A Warm Base to Fork From
+ * **Example:** Clone and install once, then start every sandbox from it
+ * ```typescript
+ * export const Warm = Daytona.Snapshot("Warm", {
+ *   from: Base,
+ *   run: [
+ *     "git clone https://github.com/alchemy-run/alchemy /home/daytona/alchemy",
+ *     "cd /home/daytona/alchemy && pnpm install",
+ *   ],
+ * });
+ * ```
+ *
+ * ### Looking up an existing snapshot
+ * `Snapshot.lookup` references a snapshot Alchemy doesn't manage (created in
+ * the Daytona dashboard or by another stack). It is read during plan/deploy,
+ * never created, updated or deleted.
+ * `buildHash` is empty: the image wasn't built by this stack.
+ *
+ * **Example:** Start a sandbox from an existing snapshot
+ * ```typescript
+ * const base = Daytona.Snapshot.lookup({ name: "python-ml" });
+ * ```
+ *
+ * @resource
+ * @product Snapshot
+ */
+export declare const Snapshot: import("alchemy/Resource").ResourceConstructor<Snapshot, Providers> & Effect.Effect<import("alchemy/Resource").ResourceConstructor<Snapshot, never>, never, never> & {
+    Self: import("alchemy/Self").Self<Snapshot>;
+    Provider: Provider.Provider<Snapshot>;
+    Aliases: readonly string[] | undefined;
+    ref(id: string, options?: {
+        stage?: string;
+        stack?: string;
+    }): Effect.Effect<Snapshot, never, never>;
+} & {
+    lookup(props: {
+        name: import("alchemy/Input").Input<string>;
+    }): Snapshot;
+} & ((id: string, props: import("./internal/Declared.ts").DeclaredProps<SnapshotProps>) => Effect.Effect<Snapshot, never, Providers>);
+/**
+ * What Daytona's builders can build: any Dockerfile, for amd64. Daytona's
+ * build request has no field for build arguments, so the plan bakes them
+ * into `ARG` defaults, nor for BuildKit secrets, so the plan rejects them.
+ */
+export declare const capabilities: BuildPlan.Capabilities;
+declare const SnapshotSourceInvalid_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Daytona.SnapshotSourceInvalid";
+} & Readonly<A>;
+/** The snapshot props name more than one of `image`, `dockerfile` and `from`, or none. */
+export declare class SnapshotSourceInvalid extends SnapshotSourceInvalid_base<{
+    readonly message: string;
+}> {
+}
+declare const SnapshotContextUnsupported_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Daytona.SnapshotContextUnsupported";
+} & Readonly<A>;
+/** A runtime build's Dockerfile copies local files, which only a deploy-time `context` can provide. */
+export declare class SnapshotContextUnsupported extends SnapshotContextUnsupported_base<{
+    readonly line: string;
+}> {
+    get message(): string;
+}
+declare const SnapshotRunFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Daytona.SnapshotRunFailed";
+} & Readonly<A>;
+/** A `run` command exited non-zero while building a snapshot from a sandbox. */
+export declare class SnapshotRunFailed extends SnapshotRunFailed_base<{
+    readonly command: string;
+    readonly exitCode: number;
+    readonly output: string;
+}> {
+    get message(): string;
+}
+declare const SnapshotImageTagInvalid_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Daytona.SnapshotImageTagInvalid";
+} & Readonly<A>;
+/** The image has no tag, or a moving one Daytona rejects. */
+export declare class SnapshotImageTagInvalid extends SnapshotImageTagInvalid_base<{
+    readonly image: string;
+}> {
+    get message(): string;
+}
+/**
+ * Check Dockerfile content built at runtime (a Worker has no file system,
+ * so there is no context to copy from).
+ */
+export declare const checkRuntimeDockerfile: (content: string) => Effect.Effect<undefined, DockerfileParser.DockerfileSyntaxError | SnapshotContextUnsupported | BuildPlan.UnsupportedDockerfile, never>;
+export declare const toSnapshotAttributes: (s: snapshots.SnapshotDto, buildHash: string) => SnapshotAttributes;
+export declare const getSnapshot: (idOrName: string) => Effect.Effect<snapshots.SnapshotDto | undefined, dockerRegistry.DaytonaOpError, dockerRegistry.DaytonaOpContext>;
+/** Wait for a snapshot to become usable, reactivating it when Daytona has deactivated it. */
+export declare const waitForSnapshot: (idOrName: string) => Effect.Effect<snapshots.SnapshotDto, import("./internal/Wait.ts").StateFailed | import("./internal/Wait.ts").StateTimeout | snapshots.GetSnapshotError, dockerRegistry.DaytonaOpContext>;
+/** Delete a snapshot by name (Daytona deletes by id). Deleting a missing one succeeds. */
+export declare const deleteSnapshotByName: (name: string) => Effect.Effect<void, import("./internal/Wait.ts").StateTimeout | dockerRegistry.DaytonaOpError, dockerRegistry.DaytonaOpContext>;
+export declare const deleteSnapshot: (idOrName: string) => Effect.Effect<void, import("./internal/Wait.ts").StateTimeout | dockerRegistry.DaytonaOpError, dockerRegistry.DaytonaOpContext>;
+/**
+ * Start a sandbox from `from`, run the commands in it and capture it as a
+ * snapshot named `name`. The build sandbox is deleted whatever happens, and
+ * deletes itself after an hour if this process dies first.
+ */
+export declare const captureSnapshot: (input: {
+    readonly labels: Record<string, string>;
+    readonly name: string;
+    readonly from: string;
+    readonly run: readonly string[];
+    readonly note: (message: string) => Effect.Effect<void>;
+}) => Effect.Effect<snapshots.SnapshotDto, import("@distilled.cloud/core/errors").BadGateway | import("@distilled.cloud/core/errors").BadRequest | import("@distilled.cloud/core/config").ConfigError | import("@distilled.cloud/core/errors").Conflict | import("@distilled.cloud/daytona/Errors").DaytonaParseError | import("@distilled.cloud/core/errors").Forbidden | import("@distilled.cloud/core/errors").GatewayTimeout | sandboxes.GpuCreditsRequired | sandboxes.GpuSandboxNotEphemeral | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/core/errors").InternalServerError | import("@distilled.cloud/core/protocol-http").InvalidInput | import("@distilled.cloud/core/errors").Locked | sandboxes.NetworkAccessRestricted | import("@distilled.cloud/core/errors").NotFound | sandboxes.QueueTimeoutNotEnabled | sandboxes.SandboxAlreadyExists | sandboxes.SandboxNotFound | sandboxes.SandboxResourcesFromSnapshot | import("@distilled.cloud/core/sdk-error").SdkError | import("@distilled.cloud/core/errors").ServiceUnavailable | snapshots.SnapshotNotFound | SnapshotRunFailed | import("./internal/Wait.ts").StateFailed | import("./internal/Wait.ts").StateTimeout | import("@distilled.cloud/core/errors").TooManyRequests | import("@distilled.cloud/core/errors").Unauthorized | import("@distilled.cloud/daytona/Errors").UnknownDaytonaError | import("@distilled.cloud/core/errors").UnprocessableEntity | sandboxes.WindowsSandboxesUnavailable, dockerRegistry.DaytonaOpContext>;
+/** A snapshot's source with every input resolved (Dockerfile as content). */
+export interface ResolvedSnapshotSource {
+    readonly image?: string | undefined;
+    readonly dockerfile?: string | undefined;
+    readonly from?: string | undefined;
+    readonly run?: readonly string[] | undefined;
+    readonly entrypoint?: string[] | undefined;
+    readonly cpu?: number | undefined;
+    readonly memory?: number | undefined;
+    readonly disk?: number | undefined;
+    readonly gpu?: number | undefined;
+    readonly gpuType?: GpuType[] | undefined;
+    readonly regionId?: string | undefined;
+    readonly sandboxClass?: snapshots.SandboxClass | undefined;
+    /** Uploaded build contexts the Dockerfile copies from (`buildInfo.contextHashes`). */
+    readonly contextHashes?: string[] | undefined;
+}
+/**
+ * Build a snapshot named `name` and wait until it is active: pull or
+ * build on Daytona's builders, or capture it from a `from` sandbox after
+ * running `run`. Shared by the resource and the runtime binding.
+ */
+export declare const buildSnapshot: (input: {
+    readonly name: string;
+    readonly source: ResolvedSnapshotSource;
+    readonly labels: Record<string, string>;
+    readonly note: (message: string) => Effect.Effect<void>;
+}) => Effect.Effect<snapshots.SnapshotDto, sandboxes.GpuCreditsRequired | sandboxes.GpuSandboxNotEphemeral | sandboxes.NetworkAccessRestricted | sandboxes.QueueTimeoutNotEnabled | sandboxes.SandboxAlreadyExists | sandboxes.SandboxNotFound | sandboxes.SandboxResourcesFromSnapshot | SnapshotImageTagInvalid | snapshots.SnapshotNotFound | SnapshotRunFailed | import("./internal/Wait.ts").StateFailed | import("./internal/Wait.ts").StateTimeout | sandboxes.WindowsSandboxesUnavailable | dockerRegistry.DaytonaOpError, dockerRegistry.DaytonaOpContext>;
+export declare const SnapshotProvider: () => import("effect/Layer").Layer<Provider.Provider<Snapshot>, never, import("alchemy/AlchemyContext").AlchemyContext | import("@alchemy.run/docker/Docker").Docker | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("alchemy/Stack").Stack | import("alchemy/Stage").Stage | dockerRegistry.DaytonaOpContext>;
+export {};
+//# sourceMappingURL=Snapshot.d.ts.map

package/lib/Snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Snapshot.d.ts","sources":["../src/Snapshot.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,gBAAgB,MAAM,sCAAsC,CAAC;AAOzE,OAAO,KAAK,cAAc,MAAM,0CAA0C,CAAC;AAC3E,OAAO,KAAK,SAAS,MAAM,kCAAkC,CAAC;AAC9D,OAAO,KAAK,SAAS,MAAM,oCAAoC,CAAC;AAGhE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAOjD,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,YAAY,CAAC,EAAE,SAAS,CAAC,YAAY,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,mBAAmB;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC;IAC/B,iCAAiC;IACjC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gCAAgC;IAChC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAC7B,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,SAAS,EACT,cAAc,CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;qIAAiE,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,CAAC,YAKpC,CAAC;;;;AAEF,0FAA0F;AAC1F,qBAAa,qBAAsB,SAAQ,2BAAkD;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,uGAAuG;AACvG,qBAAa,0BAA2B,SAAQ,gCAE9C;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,uBAA8C;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,6DAA6D;AAC7D,qBAAa,uBAAwB,SAAQ,6BAAoD;IAC/F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;AAuBD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,6JAoBjC,CAAC;AA4DH,eAAO,MAAM,oBAAoB,MAC5B,SAAS,CAAC,WAAW,aACb,MAAM,KAChB,kBAYD,CAAC;AAEH,eAAO,MAAM,WAAW,aAAc,MAAM,qHAG0B,CAAC;AAEvE,6FAA6F;AAC7F,eAAO,MAAM,eAAe,gNAY1B,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,mJAG/B,CAAC;AAEH,eAAO,MAAM,cAAc,uJAUzB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe;qBACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;mBACxB,MAAM;mBACN,MAAM;kBACP,SAAS,MAAM,EAAE;mBAChB,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;k9CAwCxC,CAAC;AAElB,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;IAC3D,sFAAsF;IACtF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/C;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa;mBACT,MAAM;qBACJ,sBAAsB;qBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;mBACxB,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;miBAqCvD,CAAC;AAsBH,eAAO,MAAM,gBAAgB,+UA2F1B,CAAC"}