@alchemy.run/daytona 0.0.0 → 2.0.0-beta.86

package/src/internal/Derived.ts

@@ -0,0 +1,97 @@
+import * as BuildPlan from "@alchemy.run/docker/BuildPlan";
+import * as DockerfileParser from "@alchemy.run/docker/DockerfileParser";
+import * as config from "@distilled.cloud/daytona/config";
+import * as snapshots from "@distilled.cloud/daytona/snapshots";
+import {
+  checkMountSupport,
+  collectMountCapabilities,
+  mountInstallLines,
+  type MountCapability,
+} from "alchemy/Mount";
+import * as Effect from "effect/Effect";
+import {
+  buildSnapshot,
+  capabilities,
+  deleteSnapshot,
+  getSnapshot,
+  waitForSnapshot,
+} from "../Snapshot.ts";
+
+/**
+ * INTERNAL — the snapshot a sandbox boots from when its bindings bind
+ * `alchemy/Mount` capabilities: `FROM` the base snapshot's image plus the
+ * capabilities' install lines, built on Daytona. It is named from the
+ * sandbox and a hash of its Dockerfile, belongs to the sandbox, and is
+ * deleted with it.
+ */
+
+/** What Daytona sandboxes provide to mount clients (checked live 2026-11-04). */
+export const MOUNT_SUPPORT = {
+  // `/dev/fuse` exists and the sandbox has CAP_SYS_ADMIN.
+  fuse: true,
+  // No NFS client is installed, and `mount -t nfs` was never verified.
+  nfs: false,
+} as const;
+
+/** A binding entry that is a mount capability (not a volume to mount). */
+export const isMountCapability = (entry: unknown): entry is MountCapability =>
+  typeof entry === "object" && entry !== null && "install" in entry && "id" in entry;
+
+/** The capabilities bound onto a sandbox, de-duplicated in a stable order. */
+export const capabilitiesOf = (
+  bindings: ReadonlyArray<{ readonly data?: { readonly mounts?: ReadonlyArray<unknown> } }>,
+) =>
+  collectMountCapabilities(
+    bindings.map((binding) => ({
+      data: { mounts: (binding.data?.mounts ?? []).filter(isMountCapability) },
+    })),
+  );
+
+/** The capabilities' install lines; run as root, as `alchemy/Mount` specifies. */
+export const installLinesOf = (caps: ReadonlyArray<MountCapability>) =>
+  caps.length === 0 ? [] : ["USER root", ...mountInstallLines(caps)];
+
+/** Fail the plan when a capability needs what a sandbox can't provide. */
+export const checkSupport = (caps: ReadonlyArray<MountCapability>) => {
+  const unsupported = checkMountSupport("Daytona.Sandbox", caps, MOUNT_SUPPORT);
+  return unsupported ? Effect.fail(unsupported) : Effect.void;
+};
+
+/** The image a snapshot (or, without one, Daytona's default) was made from. */
+const baseImageOf = Effect.fn(function* (snapshot: string | undefined) {
+  const name = snapshot ?? (yield* config.getConfigControllerConfig({})).defaultSnapshot;
+  return (yield* snapshots.getSnapshot({ id: name })).imageName;
+});
+
+/**
+ * Build (or reuse) the derived snapshot for a sandbox and return its name.
+ */
+export const ensureDerivedSnapshot = Effect.fn(function* (input: {
+  readonly sandboxName: string;
+  readonly snapshot: string | undefined;
+  readonly caps: ReadonlyArray<MountCapability>;
+  readonly note: (message: string) => Effect.Effect<void>;
+}) {
+  const baseImage = yield* baseImageOf(input.snapshot);
+  const plan = yield* BuildPlan.plan(
+    { dockerfile: { content: `FROM ${baseImage}\n` } },
+    { capabilities, install: installLinesOf(input.caps) },
+  );
+  const name = `${input.sandboxName.slice(0, 40)}-${plan.hash.slice(0, 12)}`.toLowerCase();
+  let existing = yield* getSnapshot(name);
+  // A failed build is rebuilt; the name is free once the old one is gone.
+  if (existing !== undefined && ["error", "build_failed", "removing"].includes(existing.state)) {
+    yield* deleteSnapshot(existing.id);
+    existing = undefined;
+  }
+  if (existing === undefined) {
+    yield* buildSnapshot({
+      name,
+      source: { dockerfile: DockerfileParser.render(plan.dockerfile), run: [] },
+      labels: {},
+      note: input.note,
+    });
+  }
+  yield* waitForSnapshot(name);
+  return name;
+});

package/src/internal/Errors.ts

@@ -0,0 +1,4 @@
+import type * as process from "@distilled.cloud/daytona/process";
+
+/** Errors a toolbox command run can fail with. */
+export type ProcessError = process.ExecuteCommandError;

package/src/internal/Labels.ts

@@ -0,0 +1,39 @@
+import { createInternalTags, hasTags } from "alchemy/Tags";
+import * as Effect from "effect/Effect";
+
+/**
+ * Daytona sandbox labels carry alchemy's ownership tags. Tag keys
+ * (`alchemy::stack`) are written as `alchemy.stack` to stay within the
+ * conservative key alphabet every label API accepts.
+ */
+export const ALCHEMY_LABEL_PREFIX = "alchemy.";
+const TAG_PREFIX = "alchemy::";
+
+export const toLabelKey = (key: string) =>
+  key.startsWith(TAG_PREFIX) ? `${ALCHEMY_LABEL_PREFIX}${key.slice(TAG_PREFIX.length)}` : key;
+
+export const toLabels = (tags: Record<string, string> | undefined): Record<string, string> =>
+  Object.fromEntries(Object.entries(tags ?? {}).map(([k, v]) => [toLabelKey(k), v]));
+
+export const createInternalLabels = Effect.fn(function* (id: string) {
+  return toLabels(yield* createInternalTags(id));
+});
+
+/** A label map as Daytona returns it (values typed optional). */
+export type LabelMap = { readonly [key: string]: string | undefined };
+
+/** Drop undefined values from a label map. */
+export const definedLabels = (labels: LabelMap | undefined): Record<string, string> =>
+  Object.fromEntries(
+    Object.entries(labels ?? {}).filter((e): e is [string, string] => e[1] !== undefined),
+  );
+
+export const hasAlchemyLabels = Effect.fn(function* (id: string, labels: LabelMap | undefined) {
+  return hasTags(yield* createInternalLabels(id), definedLabels(labels));
+});
+
+/** Labels without alchemy's ownership keys: what the user declared. */
+export const userLabels = (labels: LabelMap | undefined): Record<string, string> =>
+  Object.fromEntries(
+    Object.entries(definedLabels(labels)).filter(([k]) => !k.startsWith(ALCHEMY_LABEL_PREFIX)),
+  );

package/src/internal/Names.ts

@@ -0,0 +1,37 @@
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Effect from "effect/Effect";
+
+/**
+ * The name alchemy generates for a Daytona object when the user gives none:
+ * `<stack>-<id>-<stage>-<suffix>`, lowercase. Daytona volumes, secrets,
+ * snapshots and registries have no labels, so this name is also their
+ * ownership marker: only alchemy produces the random suffix, so an object
+ * with exactly this name was created by this logical id.
+ */
+export const physicalName = (id: string, maxLength = 63) =>
+  createPhysicalName({ id, maxLength, delimiter: "-", lowercase: true });
+
+/** The user's name, the name already in state, or the generated name. */
+export const resolveName = Effect.fn(function* (
+  id: string,
+  name: string | undefined,
+  existing?: string,
+  maxLength?: number,
+) {
+  return name ?? existing ?? (yield* physicalName(id, maxLength));
+});
+
+/**
+ * Whether an object found by `name` is ours: a name in state always is; a
+ * user-chosen name with no state is not (adopting it needs `--adopt`); a
+ * generated name is.
+ */
+export const isOwnedName = Effect.fn(function* (
+  id: string,
+  name: string,
+  inState: boolean,
+  maxLength?: number,
+) {
+  if (inState) return true;
+  return name === (yield* physicalName(id, maxLength));
+});

package/src/internal/Organization.ts

@@ -0,0 +1,40 @@
+import * as apiKeys from "@distilled.cloud/daytona/api_keys";
+import { Credentials } from "@distilled.cloud/daytona/Credentials";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { resolved, type Ref } from "./Ref.ts";
+
+/** The credentials don't name an organization and the API key reports none. */
+export class OrganizationUnknown extends Data.TaggedError("Daytona.OrganizationUnknown")<{}> {
+  override get message() {
+    return "Could not determine the Daytona organization: set organizationId in the profile or use an organization API key";
+  }
+}
+
+/**
+ * The organization the credentials act on: the profile's `organizationId`,
+ * else the organization the API key belongs to.
+ */
+export const currentOrganizationId = Effect.gen(function* () {
+  const credentials = yield* Credentials;
+  const config = yield* credentials;
+  if (config.organizationId) return config.organizationId;
+  const key = yield* apiKeys.getCurrentApiKey({});
+  if (!key.organizationId) return yield* new OrganizationUnknown();
+  return key.organizationId;
+});
+
+/** An organization, by id. Accepts a `Daytona.Organization` or `{ organizationId }`. */
+export type OrganizationRef = { readonly organizationId: string };
+
+/** The organization a resource acts on: its `organization` prop, else the credentials'. */
+export const organizationIdFor = (organization: Ref<OrganizationRef> | undefined) =>
+  organization === undefined
+    ? currentOrganizationId
+    : Effect.succeed(resolved(organization).organizationId);
+
+/** Whether the props now point the resource at a different organization (a replacement). */
+export const movesOrganization = (
+  organization: Ref<OrganizationRef> | undefined,
+  output: { readonly organizationId: string },
+) => Effect.map(organizationIdFor(organization), (id) => id !== output.organizationId);

package/src/internal/Process.ts

@@ -0,0 +1,25 @@
+import * as process from "@distilled.cloud/daytona/process";
+import * as Effect from "effect/Effect";
+import { inSandbox } from "./Toolbox.ts";
+
+/**
+ * Run a shell command in a sandbox through the toolbox. The command is
+ * passed base64-encoded to `sh`, as Daytona's own SDKs do, so pipes,
+ * quotes and `&&` behave as in a shell.
+ */
+export const runCommand = (
+  sandboxId: string,
+  toolboxProxyUrl: string | undefined,
+  request: { command: string; cwd?: string; env?: Record<string, string>; timeout?: number },
+) =>
+  Effect.sync(() => Buffer.from(request.command).toString("base64")).pipe(
+    Effect.flatMap((encoded) =>
+      process.executeCommand({
+        command: `sh -c "echo '${encoded}' | base64 -d | sh"`,
+        cwd: request.cwd,
+        envs: request.env,
+        timeout: request.timeout,
+      }),
+    ),
+    inSandbox(sandboxId, toolboxProxyUrl),
+  );

package/src/internal/Program.ts

@@ -0,0 +1,239 @@
+import * as fileSystem from "@distilled.cloud/daytona/file_system";
+import * as port from "@distilled.cloud/daytona/port";
+import * as process from "@distilled.cloud/daytona/process";
+import * as sandboxes from "@distilled.cloud/daytona/sandbox";
+import * as Toolbox from "@distilled.cloud/daytona/Toolbox";
+import * as Bundle from "alchemy/Bundle/Bundle";
+import { findCwdForBundle, resolveMainPath } from "alchemy/Bundle/TempRoot";
+import { sha256Object } from "alchemy/Util/sha256";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type * as rolldown from "rolldown";
+import { inSandbox } from "./Toolbox.ts";
+
+/**
+ * INTERNAL — the program a `Daytona.Sandbox` with `main` runs: bundled with
+ * rolldown, uploaded into the sandbox, and run with Node in a session.
+ */
+
+/** The program didn't come up: it exited, or never listened on its port. */
+export class ProgramStartFailed extends Data.TaggedError("Daytona.ProgramStartFailed")<{
+  readonly message: string;
+  readonly stdout: string;
+  readonly stderr: string;
+}> {}
+
+/** What a sandbox's program is: the props that shape its bundle. */
+export interface ProgramSource {
+  readonly main: string;
+  readonly handler?: string;
+  readonly isExternal?: boolean;
+  readonly build?: Bundle.BundleConfig;
+}
+
+/** The running program, as recorded in the sandbox's attributes. */
+export interface ProgramState {
+  /** Port the program listens on. */
+  readonly port: number;
+  /** Session the process runs in. */
+  readonly sessionId: string;
+  /** The session command running the process. */
+  readonly commandId: string;
+  /** Content hash of the bundled program. */
+  readonly codeHash: string;
+  /** Hash of the process environment. */
+  readonly envHash: string;
+}
+
+export const DEFAULT_PORT = 3000;
+const DIR = "/home/daytona/.alchemy/program";
+const SESSION = "alchemy-program";
+
+/** The generated entry: a shim importing only the bootstrap and `main`. */
+const makeBootstrap =
+  (handler: string) =>
+  (importPath: string): string =>
+    `
+import { bootstrap } from "@alchemy.run/daytona/Bootstrap";
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+await bootstrap(entrypoint);
+`;
+
+const shellQuote = (value: unknown) => {
+  const text = typeof value === "string" ? value : JSON.stringify(value ?? null);
+  return `'${text.replaceAll("'", `'\\''`)}'`;
+};
+
+/** The process environment as a shell file, sorted so its hash is stable. */
+export const renderEnv = (env: Record<string, unknown>) =>
+  Object.entries(env)
+    .filter(([, value]) => value !== undefined)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([key, value]) => `${key}=${shellQuote(value)}`)
+    .join("\n") + "\n";
+
+/** Bundle `main` for Node, with the Daytona bootstrap around an Effect program. */
+export const bundleProgram = Effect.fn(function* (source: ProgramSource) {
+  const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+  const realMain = yield* resolveMainPath(source.main);
+  const cwd = yield* findCwdForBundle(realMain);
+  const plugins: rolldown.RolldownPluginOption = source.isExternal
+    ? undefined
+    : virtualEntryPlugin(makeBootstrap(source.handler ?? "default"));
+  const output = yield* Bundle.build(
+    {
+      ...source.build?.input,
+      input: realMain,
+      cwd,
+      platform: "node",
+      resolve: {
+        conditionNames: [...Bundle.NODE_CONDITION_NAMES],
+        ...source.build?.input?.resolve,
+      },
+      plugins: [source.build?.input?.plugins, plugins],
+    },
+    {
+      ...source.build?.output,
+      format: "esm",
+      sourcemap: source.build?.output?.sourcemap ?? false,
+      minify: source.build?.output?.minify ?? false,
+      entryFileNames: "index.mjs",
+    },
+    source.build,
+  );
+  const files = output.files.map((file) => ({
+    path: file.path,
+    content:
+      typeof file.content === "string" ? new TextEncoder().encode(file.content) : file.content,
+  }));
+  return { files, hash: (yield* sha256Object({ bundle: output.hash })).slice(0, 16) };
+});
+
+/** The hash of a process environment. */
+export const envHashOf = (env: Record<string, unknown>) =>
+  Effect.map(sha256Object({ env: renderEnv(env) }), (hash) => hash.slice(0, 16));
+
+/**
+ * Whether the program's process still runs. A stopped or deleted sandbox,
+ * or a gone session, is not running.
+ */
+export const isProgramRunning = (sandboxId: string, state: ProgramState) =>
+  process.getSessionCommand({ sessionId: state.sessionId, commandId: state.commandId }).pipe(
+    inSandbox(sandboxId),
+    Effect.map((command) => command.exitCode === undefined),
+    Effect.orElseSucceed(() => false),
+  );
+
+/**
+ * Upload the bundle and (re)start the process, unless the same bundle and
+ * environment already run. Returns the program's state and its URL.
+ */
+export const deployProgram = Effect.fn(function* (input: {
+  readonly id: string;
+  readonly sandboxId: string;
+  readonly toolboxProxyUrl: string;
+  readonly source: ProgramSource;
+  readonly port: number;
+  readonly env: Record<string, unknown>;
+  readonly previous: ProgramState | undefined;
+  readonly note: (message: string) => Effect.Effect<void>;
+}) {
+  const { id, sandboxId, port: programPort } = input;
+  const inBox = inSandbox(sandboxId, input.toolboxProxyUrl);
+  const envFile = renderEnv(input.env);
+  const envHash = yield* envHashOf(input.env);
+  const { files, hash } = yield* bundleProgram(input.source);
+
+  const previous = input.previous;
+  const running =
+    previous !== undefined &&
+    previous.codeHash === hash &&
+    previous.envHash === envHash &&
+    previous.port === programPort &&
+    (yield* isProgramRunning(sandboxId, previous));
+
+  let commandId = previous?.commandId ?? "";
+  if (!running) {
+    const dir = `${DIR}/${hash}`;
+    yield* input.note(`Uploading ${id}'s program...`);
+    yield* Toolbox.uploadFiles({
+      files: [
+        // Rolldown's entry chunk is `index.mjs`; other chunks keep their names.
+        ...files.map((file, i) => ({
+          path: `${dir}/${i === 0 ? "index.mjs" : file.path}`,
+          content: file.content,
+        })),
+        { path: `${dir}/.env`, content: envFile },
+      ],
+    }).pipe(inBox);
+    yield* fileSystem.setFilePermissions({ path: `${dir}/.env`, mode: "600" }).pipe(inBox);
+
+    // Replace the running process: deleting its session ends it.
+    yield* process.deleteSession({ sessionId: SESSION }).pipe(
+      inBox,
+      Effect.catchTag("SessionNotFound", () => Effect.void),
+    );
+    yield* process.createSession({ sessionId: SESSION }).pipe(inBox);
+    const started = yield* process
+      .sessionExecuteCommand({
+        sessionId: SESSION,
+        command: `cd ${dir} && set -a && . ./.env && set +a && exec node index.mjs`,
+        runAsync: true,
+      })
+      .pipe(inBox);
+    commandId = started.cmdId;
+
+    // Ready once the port listens; fail with the logs if the process exits.
+    yield* input.note(`Starting ${id}'s program on port ${programPort}...`);
+    const ready = yield* Effect.gen(function* () {
+      const command = yield* process
+        .getSessionCommand({ sessionId: SESSION, commandId })
+        .pipe(inBox);
+      if (command.exitCode !== undefined) return "exited" as const;
+      const { ports } = yield* port.getPorts({}).pipe(inBox);
+      return (ports ?? []).includes(programPort) ? ("listening" as const) : ("starting" as const);
+    }).pipe(
+      Effect.repeat({
+        schedule: Schedule.spaced("1 second"),
+        until: (state) => state !== "starting",
+        times: 60,
+      }),
+    );
+    if (ready !== "listening") {
+      const logs = yield* process
+        .getSessionCommandLogs({ sessionId: SESSION, commandId })
+        .pipe(inBox);
+      return yield* new ProgramStartFailed({
+        message:
+          ready === "exited"
+            ? `${id}'s program exited before listening on port ${programPort}`
+            : `${id}'s program did not listen on port ${programPort} within 60 seconds`,
+        stdout: logs.stdout,
+        stderr: logs.stderr,
+      });
+    }
+    // Keep only the running bundle.
+    yield* process
+      .executeCommand({
+        command: `find ${DIR} -mindepth 1 -maxdepth 1 ! -name ${hash} -exec rm -rf {} +`,
+      })
+      .pipe(inBox);
+  }
+
+  const preview = yield* sandboxes.getPortPreviewUrl({
+    sandboxIdOrName: sandboxId,
+    port: programPort,
+  });
+  return {
+    url: preview.url,
+    state: {
+      port: programPort,
+      sessionId: SESSION,
+      commandId,
+      codeHash: hash,
+      envHash,
+    } satisfies ProgramState,
+  };
+});

package/src/internal/Ref.ts

@@ -0,0 +1,15 @@
+import type * as Effect from "effect/Effect";
+import type { Providers } from "../Providers.ts";
+
+/**
+ * A prop that takes another resource, or a stub with the attributes it
+ * needs (`{ name }`, `{ volumeId }`). Users pass the declaration itself.
+ */
+export type Ref<T> = T | Effect.Effect<T, never, Providers>;
+
+/**
+ * A `Ref` prop as lifecycle operations see it. The engine resolves
+ * resource-valued props to their attributes before `diff`, `reconcile`
+ * and the other lifecycle operations run, so the value is always plain.
+ */
+export const resolved = <T>(ref: Ref<T>): T => ref as T;

package/src/internal/Scoped.ts

@@ -0,0 +1,102 @@
+import type { Credentials } from "@distilled.cloud/daytona/Credentials";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as SchemaAST from "effect/SchemaAST";
+
+/** A generated Daytona operation: callable with its input, and an Effect. */
+type Operation<I, O, E> = ((input: I) => Effect.Effect<O, E, Credentials | HttpClient.HttpClient>) &
+  Effect.Effect<unknown, never, unknown>;
+
+/** Members a sandbox-scoped client fills in itself. */
+export type SandboxFixed =
+  | "sandboxIdOrName"
+  | "sandboxId"
+  | "organizationId"
+  | "xDaytonaOrganizationID";
+
+/** Members an organization-scoped client fills in itself. */
+export type OrganizationFixed = "organizationId" | "xDaytonaOrganizationID";
+
+/** One operation, with the fields the client fixes removed from its input. */
+export type ScopedOperation<I, O, E, F extends PropertyKey = SandboxFixed> =
+  {} extends Omit<I, F>
+    ? (input?: Omit<I, F>) => Effect.Effect<O, E, RuntimeContext>
+    : (input: Omit<I, F>) => Effect.Effect<O, E, RuntimeContext>;
+
+/**
+ * Every operation of a generated service module (`@distilled.cloud/daytona/process`,
+ * `/git`, …), re-exposed with Daytona's own parameters and typed errors,
+ * minus the fields the client supplies (the sandbox and organization).
+ */
+export type ScopedModule<M, F extends PropertyKey = SandboxFixed> = {
+  readonly [
+    K in keyof M as M[K] extends Operation<any, any, any> ? K : never
+  ]: M[K] extends Operation<infer I, infer O, infer E> ? ScopedOperation<I, O, E, F> : never;
+};
+
+// Generated operations are plain callables, not Effects, so the name tells
+// them apart: a service module exports operations camelCase and its error
+// classes and schemas PascalCase.
+const isOperation = (
+  name: string,
+  value: unknown,
+): value is (input: unknown) => Effect.Effect<unknown, unknown, unknown> =>
+  typeof value === "function" && /^[a-z]/.test(name);
+
+/** The members an operation's input declares, read from its schema on first use. */
+const inputMembers = (op: object): ReadonlySet<string> | undefined => {
+  if (!("input" in op)) return undefined;
+  const schema = op.input;
+  if (typeof schema !== "object" || schema === null || !("ast" in schema)) return undefined;
+  let ast = schema.ast as SchemaAST.AST;
+  while (SchemaAST.isSuspend(ast)) ast = ast.thunk();
+  return SchemaAST.isObjects(ast)
+    ? new Set(ast.propertySignatures.map((p) => String(p.name)))
+    : undefined;
+};
+
+/**
+ * Wrap every operation of `module`: merge `fixed` into each input and run
+ * the call through `run` (which supplies credentials and sandbox scope).
+ * `fixed` may be an Effect when the fields are only known at runtime (a
+ * sandbox declared at deploy).
+ */
+export const scopeModule = <M extends object, F extends PropertyKey = SandboxFixed>(
+  module: M,
+  fixed: Record<string, unknown> | Effect.Effect<Record<string, unknown>, never, RuntimeContext>,
+  run: <A, E>(
+    effect: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>,
+): ScopedModule<M, F> => {
+  const fields = Effect.isEffect(fixed) ? fixed : Effect.succeed(fixed);
+  return Object.fromEntries(
+    Object.entries(module)
+      .filter(([name, value]) => isOperation(name, value))
+      .map(([name, op]) => {
+        // Only the fixed fields the operation takes: the protocol sends any
+        // member it doesn't model as a body, which a GET can't carry.
+        let members: ReadonlySet<string> | undefined;
+        const fixedFor = (all: Record<string, unknown>) => {
+          members ??= inputMembers(op) ?? new Set(Object.keys(all));
+          return Object.fromEntries(Object.entries(all).filter(([key]) => members!.has(key)));
+        };
+        const call = op as (
+          input: unknown,
+        ) => Effect.Effect<unknown, unknown, Credentials | HttpClient.HttpClient>;
+        return [
+          name,
+          (input?: Record<string, unknown>) =>
+            Effect.flatMap(fields, (all) => run(call({ ...input, ...fixedFor(all) }))),
+        ];
+      }),
+    // Object.fromEntries can't produce a mapped type; the entries are exactly
+    // the module's operations, each wrapped with the signature ScopedModule gives it.
+  ) as unknown as ScopedModule<M, F>;
+};
+
+/** The named operations of a module, as a module-shaped object. */
+export const pick = <M extends object, K extends keyof M>(
+  module: M,
+  names: readonly K[],
+): Pick<M, K> => Object.fromEntries(names.map((name) => [name, module[name]])) as Pick<M, K>;

package/src/internal/Tar.ts

@@ -0,0 +1,72 @@
+/**
+ * A minimal POSIX ustar writer: regular files and their parent
+ * directories, no compression. Enough for a Docker build context.
+ */
+export interface TarEntry {
+  /** `/`-separated, relative. */
+  readonly path: string;
+  readonly mode: number;
+  readonly bytes: Uint8Array;
+}
+
+const BLOCK = 512;
+const encoder = new TextEncoder();
+
+const octal = (value: number, width: number) => value.toString(8).padStart(width - 1, "0") + "\0";
+
+const splitPath = (path: string): { name: string; prefix: string } => {
+  if (encoder.encode(path).length <= 100) return { name: path, prefix: "" };
+  const cut = path.lastIndexOf("/", 155);
+  if (cut <= 0 || encoder.encode(path.slice(cut + 1)).length > 100) {
+    throw new Error(`path too long for a ustar archive: ${path}`);
+  }
+  return { name: path.slice(cut + 1), prefix: path.slice(0, cut) };
+};
+
+const header = (path: string, mode: number, size: number, type: "0" | "5") => {
+  const block = new Uint8Array(BLOCK);
+  const write = (offset: number, text: string) => block.set(encoder.encode(text), offset);
+  const { name, prefix } = splitPath(path);
+  write(0, name);
+  write(100, octal(mode & 0o7777, 8));
+  write(108, octal(0, 8));
+  write(116, octal(0, 8));
+  write(124, octal(size, 12));
+  write(136, octal(0, 12));
+  write(148, "        ");
+  write(156, type);
+  write(257, "ustar\0");
+  write(263, "00");
+  write(345, prefix);
+  let sum = 0;
+  for (const byte of block) sum += byte;
+  write(148, octal(sum, 7) + " ");
+  return block;
+};
+
+/** The archive bytes for `entries`, with a directory entry for every parent. */
+export const tar = (entries: ReadonlyArray<TarEntry>): Uint8Array => {
+  const parts: Uint8Array[] = [];
+  const dirs = new Set<string>();
+  for (const entry of entries) {
+    const segments = entry.path.split("/").slice(0, -1);
+    for (let i = 1; i <= segments.length; i++) {
+      const dir = segments.slice(0, i).join("/");
+      if (dirs.has(dir)) continue;
+      dirs.add(dir);
+      parts.push(header(`${dir}/`, 0o755, 0, "5"));
+    }
+    parts.push(header(entry.path, entry.mode, entry.bytes.length, "0"));
+    parts.push(entry.bytes);
+    const pad = (BLOCK - (entry.bytes.length % BLOCK)) % BLOCK;
+    if (pad > 0) parts.push(new Uint8Array(pad));
+  }
+  parts.push(new Uint8Array(BLOCK * 2));
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+};