@alchemy.run/e2b 0.0.0 → 2.0.0-beta.86

package/lib/internal/Declared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Declared.d.ts","sources":["../../src/internal/Declared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,KAAK,IAAI,GACL,MAAM,GACN,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,IAAI,GACJ,SAAS,GACT,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GACtB,UAAU,GACV,IAAI,GACJ,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC;AAE9B;;;GAGG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,GACpC,CAAC,GACD,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAC1B,CAAC,GACD,CAAC,SAAS,aAAa,CAAC,MAAM,CAAC,CAAC,GAC9B,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAClD;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAEhF,2DAA2D;AAC3D,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAgB1F,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAY7D,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,GACpB,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAA;CAAE,QACjC,CAAC,SAAS,MAAM,YACL,CAAC,KACV,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAM/E,CAAC"}

package/lib/internal/Declared.js

@@ -0,0 +1,31 @@
+import * as Output from "alchemy/Output";
+import { isResource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+const isPlain = (value) => typeof value === "object" &&
+    value !== null &&
+    (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+/** A declaration still to be yielded: an Effect that isn't an Output or a resource. */
+const isDeclaration = (value) => Effect.isEffect(value) && !Output.isOutput(value) && !isResource(value);
+const hasDeclarations = (value) => isDeclaration(value) ||
+    (Array.isArray(value) && value.some(hasDeclarations)) ||
+    (isPlain(value) && !isResource(value) && Object.values(value).some(hasDeclarations));
+/** Yield every declaration in `value`, at any depth. */
+export const resolveDeclarations = (value) => isDeclaration(value)
+    ? value
+    : Array.isArray(value)
+        ? Effect.forEach(value, resolveDeclarations)
+        : isPlain(value) && !isResource(value) && hasDeclarations(value)
+            ? Effect.map(Effect.forEach(Object.entries(value), ([key, entry]) => Effect.map(resolveDeclarations(entry), (resolved) => [key, resolved])), Object.fromEntries)
+            : Effect.succeed(value);
+/**
+ * Let a resource's props hold declarations of other resources, which are
+ * yielded when the resource is: `E2B.Sandbox("DevBox", { template: Node })`.
+ * Props without declarations are passed through unchanged.
+ */
+export const declarable = () => (resource) => new Proxy(resource, {
+    apply: (target, self, args) => typeof args[0] === "string" && hasDeclarations(args[1])
+        ? Reflect.apply(target, self, [args[0], resolveDeclarations(args[1])])
+        : Reflect.apply(target, self, args),
+});
+//# sourceMappingURL=Declared.js.map

package/lib/internal/Declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Declared.js","sources":["../../src/internal/Declared.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AA+B5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAoC,EAAE,CACnE,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAE/F,uFAAuF;AACvF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAqD,EAAE,CAC1F,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAE1E,MAAM,eAAe,GAAG,CAAC,KAAc,EAAW,EAAE,CAClD,aAAa,CAAC,KAAK,CAAC;IACpB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrD,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;AAEvF,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAA4C,EAAE,CAC9F,aAAa,CAAC,KAAK,CAAC;IAClB,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC;QAC5C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACrD,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAU,CAAC,CAC/E,EACD,MAAM,CAAC,WAAW,CACnB;YACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GACrB,GAAsC,EAAE,CACxC,CACE,QAAW,EACiF,EAAE,CAC9F,IAAI,KAAK,CAAC,QAAiD,EAAE;IAC3D,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAe,EAAE,EAAE,CACvC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;CACxC,CAAU,CAAC"}

package/lib/internal/Login.d.ts

@@ -0,0 +1,45 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+declare const E2BLoginError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "E2BLoginError";
+} & Readonly<A>;
+export declare class E2BLoginError extends E2BLoginError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+/** The grant E2B's console hands the loopback listener. */
+export interface E2BGrant {
+    readonly email: string;
+    readonly access: Redacted.Redacted<string>;
+    readonly refresh: Redacted.Redacted<string>;
+    readonly tokenEndpoint: string;
+    readonly revokeEndpoint: string;
+    readonly clientId: string;
+    /** Epoch millis the access token expires at. */
+    readonly expires: number;
+}
+/**
+ * The E2B CLI release whose login flow this mirrors. E2B's console reads
+ * `cliVersion` and refuses ("CLI update required") a login without a current
+ * one. Bump it with the E2B CLI if the console starts refusing it.
+ */
+export declare const E2B_CLI_COMPAT_VERSION = "2.23.0";
+/** A JWT's `exp`, in epoch millis; 0 when it has none, so it refreshes at once. */
+export declare const jwtExpiry: (token: string) => number;
+/** Parses a pasted loopback URL (the manual fallback when the listener can't be reached). */
+export declare const grantFromUrl: (input: string) => Effect.Effect<E2BGrant, E2BLoginError>;
+/**
+ * Starts the loopback listener on a free port and returns the console URL
+ * to open, plus the grant it receives. The listener closes with the scope.
+ */
+export declare const startLogin: (domain: string) => Effect.Effect<{
+    url: string;
+    grant: Effect.Effect<E2BGrant, E2BLoginError, never>;
+}, E2BLoginError, import("effect/Scope").Scope>;
+/** Exchanges the refresh token for a fresh access token (refresh tokens may rotate). */
+export declare const refreshGrant: (grant: E2BGrant) => Effect.Effect<E2BGrant, E2BLoginError>;
+/** Revokes the refresh token; best effort, like `e2b auth logout`. */
+export declare const revokeGrant: (grant: Pick<E2BGrant, "refresh" | "revokeEndpoint" | "clientId">) => Effect.Effect<void, never, never>;
+export {};
+//# sourceMappingURL=Login.d.ts.map

package/lib/internal/Login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Login.d.ts","sources":["../../src/internal/Login.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;;;;AAG5C,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,2DAA2D;AAC3D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAM/C,mFAAmF;AACnF,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAWzC,CAAC;AAmCF,6FAA6F;AAC7F,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAQ9E,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,UAAU;;;+CAyCrB,CAAC;AAOH,wFAAwF;AACxF,eAAO,MAAM,YAAY,UAAW,QAAQ,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAkCjF,CAAC;AAEJ,sEAAsE;AACtE,eAAO,MAAM,WAAW,UAAW,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,gBAAgB,GAAG,UAAU,CAAC,sCAa7B,CAAC"}

package/lib/internal/Login.js

@@ -0,0 +1,157 @@
+/**
+ * E2B's browser login, as the E2B CLI runs it (`e2b auth login`).
+ *
+ * E2B's console signs the user in and redirects to a loopback URL with the
+ * OAuth grant in the query string: a short-lived JWT access token, a refresh
+ * token, and the token and revoke endpoints with the public client id they
+ * were issued to. Refresh and revoke are standard OAuth 2 requests against
+ * those endpoints.
+ */
+import * as http from "node:http";
+import * as Data from "effect/Data";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+export class E2BLoginError extends Data.TaggedError("E2BLoginError") {
+}
+/**
+ * The E2B CLI release whose login flow this mirrors. E2B's console reads
+ * `cliVersion` and refuses ("CLI update required") a login without a current
+ * one. Bump it with the E2B CLI if the console starts refusing it.
+ */
+export const E2B_CLI_COMPAT_VERSION = "2.23.0";
+/** Where the console's CLI login starts, and where it shows the outcome. */
+const loginBase = (domain) => `https://${domain === "e2b.app" ? "e2b.dev" : domain}/docs/api/cli`;
+/** A JWT's `exp`, in epoch millis; 0 when it has none, so it refreshes at once. */
+export const jwtExpiry = (token) => {
+    const payload = token.split(".")[1];
+    if (payload === undefined)
+        return 0;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.exp === "number" ? decoded.exp * 1000 : 0;
+    }
+    catch {
+        return 0;
+    }
+};
+const isLoginError = (value) => "_tag" in value;
+const grantOf = (params) => {
+    const error = params.get("error");
+    if (error)
+        return new E2BLoginError({ message: `E2B login failed: ${error}` });
+    const field = (name) => params.get(name) ?? "";
+    const grant = {
+        email: field("email"),
+        accessToken: field("accessToken"),
+        refreshToken: field("refreshToken"),
+        tokenEndpoint: field("tokenEndpoint"),
+        revokeEndpoint: field("revokeEndpoint"),
+        clientId: field("clientId"),
+    };
+    const missing = Object.entries(grant)
+        .filter(([, value]) => value === "")
+        .map(([key]) => key);
+    if (missing.length > 0) {
+        return new E2BLoginError({
+            message: `E2B login returned an incomplete grant (missing ${missing.join(", ")})`,
+        });
+    }
+    return {
+        email: grant.email,
+        access: Redacted.make(grant.accessToken),
+        refresh: Redacted.make(grant.refreshToken),
+        tokenEndpoint: grant.tokenEndpoint,
+        revokeEndpoint: grant.revokeEndpoint,
+        clientId: grant.clientId,
+        expires: jwtExpiry(grant.accessToken),
+    };
+};
+/** Parses a pasted loopback URL (the manual fallback when the listener can't be reached). */
+export const grantFromUrl = (input) => Effect.gen(function* () {
+    const url = yield* Effect.try({
+        try: () => new URL(input.trim()),
+        catch: () => new E2BLoginError({ message: "Paste the full URL the browser was sent to" }),
+    });
+    const grant = grantOf(url.searchParams);
+    return isLoginError(grant) ? yield* grant : grant;
+});
+/**
+ * Starts the loopback listener on a free port and returns the console URL
+ * to open, plus the grant it receives. The listener closes with the scope.
+ */
+export const startLogin = Effect.fn(function* (domain) {
+    const base = loginBase(domain);
+    const received = yield* Deferred.make();
+    const server = yield* Effect.acquireRelease(Effect.callback((resume) => {
+        const server = http.createServer((req, res) => {
+            const params = new URL(req.url ?? "/", "http://localhost").searchParams;
+            const grant = grantOf(params);
+            const outcome = new URL(base);
+            if (isLoginError(grant)) {
+                outcome.searchParams.set("state", "error");
+                outcome.searchParams.set("error", grant.message);
+            }
+            else {
+                outcome.searchParams.set("state", "success");
+                outcome.searchParams.set("email", grant.email);
+            }
+            res.writeHead(302, { Location: outcome.href, Connection: "close" });
+            res.end();
+            Deferred.doneUnsafe(received, isLoginError(grant) ? Effect.fail(grant) : Effect.succeed(grant));
+        });
+        server.once("error", (cause) => resume(Effect.fail(new E2BLoginError({ message: "Could not start the login listener", cause }))));
+        server.listen(0, "127.0.0.1", () => resume(Effect.succeed(server)));
+    }), (server) => Effect.sync(() => {
+        server.close();
+        server.closeAllConnections();
+    }));
+    const { port } = server.address();
+    const url = new URL(base);
+    url.searchParams.set("next", `http://localhost:${port}`);
+    url.searchParams.set("cliVersion", E2B_CLI_COMPAT_VERSION);
+    return { url: url.href, grant: Deferred.await(received) };
+});
+const TokenResponse = Schema.Struct({
+    access_token: Schema.String,
+    refresh_token: Schema.optional(Schema.String),
+});
+/** Exchanges the refresh token for a fresh access token (refresh tokens may rotate). */
+export const refreshGrant = (grant) => Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    // Raw HTTP: the token endpoint the console's login redirect handed back.
+    const response = yield* client.execute(HttpClientRequest.post(grant.tokenEndpoint).pipe(HttpClientRequest.setHeader("Accept", "application/json"), HttpClientRequest.bodyUrlParams({
+        grant_type: "refresh_token",
+        refresh_token: Redacted.value(grant.refresh),
+        client_id: grant.clientId,
+    })));
+    if (response.status >= 400) {
+        const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
+        return yield* new E2BLoginError({
+            message: `E2B token refresh failed (${response.status}): ${body.slice(0, 200)}`,
+        });
+    }
+    const tokens = yield* Schema.decodeUnknownEffect(TokenResponse)(yield* response.json);
+    return {
+        ...grant,
+        access: Redacted.make(tokens.access_token),
+        refresh: tokens.refresh_token === undefined ? grant.refresh : Redacted.make(tokens.refresh_token),
+        expires: jwtExpiry(tokens.access_token),
+    };
+}).pipe(Effect.catchIf((e) => e._tag !== "E2BLoginError", (cause) => Effect.fail(new E2BLoginError({ message: "E2B token refresh failed", cause }))), Effect.provide(FetchHttpClient.layer));
+/** Revokes the refresh token; best effort, like `e2b auth logout`. */
+export const revokeGrant = (grant) => Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    yield* client.execute(
+    // Raw HTTP: the revoke endpoint the console's login redirect handed back.
+    HttpClientRequest.post(grant.revokeEndpoint).pipe(HttpClientRequest.bodyUrlParams({
+        token: Redacted.value(grant.refresh),
+        token_type_hint: "refresh_token",
+        client_id: grant.clientId,
+    })));
+}).pipe(Effect.ignore, Effect.provide(FetchHttpClient.layer));
+//# sourceMappingURL=Login.js.map

package/lib/internal/Login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Login.js","sources":["../../src/internal/Login.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAGjE;CAAG;AAcL;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,WAAW,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC;AAEtE,mFAAmF;AACnF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAA+B,EAA0B,EAAE,CAAC,MAAM,IAAI,KAAK,CAAC;AAElG,MAAM,OAAO,GAAG,CAAC,MAAuB,EAA4B,EAAE;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,qBAAqB,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;QACrB,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;QACjC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC;QACrC,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;KAC5B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,aAAa,CAAC;YACvB,OAAO,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAClF,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACxC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;KACtC,CAAC;AACJ,CAAC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAA0C,EAAE,CACpF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;KAC1F,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAc;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAA2B,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CACzC,MAAM,CAAC,QAAQ,CAA6B,CAAC,MAAM,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC;YACxE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,QAAQ,CAAC,UAAU,CACjB,QAAQ,EACR,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC,CAAC,CACzF,CACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,EACF,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,CAAC,CACL,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC,MAAM;IAC3B,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CAC9C,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAe,EAA0C,EAAE,CACtF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,yEAAyE;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAC9C,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACzD,iBAAiB,CAAC,aAAa,CAAC;QAC9B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5C,SAAS,EAAE,KAAK,CAAC,QAAQ;KAC1B,CAAC,CACH,CACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;YAC9B,OAAO,EAAE,6BAA6B,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtF,OAAO;QACL,GAAG,KAAK;QACR,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1C,OAAO,EACL,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC1F,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;KACxC,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAAyC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,EACxE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,CAC1F,EACD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACtC,CAAC;AAEJ,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAgE,EAAE,EAAE,CAC9F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO;IACnB,0EAA0E;IAC1E,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,iBAAiB,CAAC,aAAa,CAAC;QAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,eAAe,EAAE,eAAe;QAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;KAC1B,CAAC,CACH,CACF,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/lib/internal/Ownership.d.ts

@@ -0,0 +1,29 @@
+import { Stack } from "alchemy/Stack";
+import { Stage } from "alchemy/Stage";
+import * as Effect from "effect/Effect";
+/** E2B names: letters, digits, `-` and `_`. Lowercased (secrets and templates are lowercased by E2B). */
+export declare const e2bName: (id: string, name: string | undefined, maxLength?: number) => Effect.Effect<string, never, import("alchemy/ResourceContext").ResourceContext | Stack | Stage>;
+/**
+ * Whether a name looks generated by `createPhysicalName` (lowercase, ending
+ * in a base32 instance suffix). Used by `list` to report only resources
+ * Alchemy created, for nuke.
+ */
+export declare const isGeneratedName: (name: string | undefined) => boolean;
+/** The `alchemy::stack` / `alchemy::stage` / `alchemy::id` stamp for metadata maps. */
+export declare const ownershipMetadata: (id: string) => Effect.Effect<{
+    "alchemy::stack": string;
+    "alchemy::stage": string;
+    "alchemy::id": string;
+}, never, Stack | Stage>;
+/**
+ * The stamp runtime-created objects carry: the stack and stage that created
+ * them and the binding's logical id. Destroy sweeps by it.
+ */
+export declare const runtimeMetadata: (bindingId: string) => Effect.Effect<Record<string, string>, never, Stack | Stage>;
+/** Whether a metadata map carries this resource's ownership stamp. */
+export declare const hasOwnershipMetadata: (id: string, metadata: Readonly<Record<string, string>> | null | undefined) => Effect.Effect<boolean, never, Stack | Stage>;
+/** Whether a metadata map was stamped by any Alchemy stack (for nuke). */
+export declare const hasAnyAlchemyMetadata: (metadata: Readonly<Record<string, string>> | null | undefined) => boolean;
+/** User metadata with the internal `alchemy::*` keys removed. */
+export declare const userMetadata: (metadata: Readonly<Record<string, string>> | null | undefined) => Record<string, string>;
+//# sourceMappingURL=Ownership.d.ts.map

package/lib/internal/Ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ownership.d.ts","sources":["../../src/internal/Ownership.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAWtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,yGAAyG;AACzG,eAAO,MAAM,OAAO,OAAQ,MAAM,QAAQ,MAAM,GAAG,SAAS,wHAGgB,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,GAAG,SAAS,KAAG,OACc,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,OAAQ,MAAM;;;;wBAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,eAAe,oFAQ1B,CAAC;AAEH,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,6HAM/B,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,aACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,KAC5D,OAAsF,CAAC;AAE1F,iEAAiE;AACjE,eAAO,MAAM,YAAY,aACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,KAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,CAGrB,CAAC"}

package/lib/internal/Ownership.js

@@ -0,0 +1,49 @@
+import { createPhysicalName } from "alchemy/PhysicalName";
+import { Stack } from "alchemy/Stack";
+import { Stage } from "alchemy/Stage";
+/**
+ * Naming and ownership helpers shared by every E2B resource and binding.
+ *
+ * E2B has metadata only on secrets and sandboxes. Templates, snapshots,
+ * volumes, webhooks and API keys carry nothing but a name, so a resource
+ * whose name the engine generated (stack, stage, logical id, instance
+ * suffix) is recognised as ours by that name; an explicit, user-chosen name
+ * found without prior state is reported `Unowned`.
+ */
+import { createInternalTags } from "alchemy/Tags";
+import * as Effect from "effect/Effect";
+/** E2B names: letters, digits, `-` and `_`. Lowercased (secrets and templates are lowercased by E2B). */
+export const e2bName = (id, name, maxLength = 64) => name !== undefined
+    ? Effect.succeed(name)
+    : createPhysicalName({ id, lowercase: true, maxLength, delimiter: "-" });
+/**
+ * Whether a name looks generated by `createPhysicalName` (lowercase, ending
+ * in a base32 instance suffix). Used by `list` to report only resources
+ * Alchemy created, for nuke.
+ */
+export const isGeneratedName = (name) => name !== undefined && /^[a-z0-9][a-z0-9_-]*-[a-z2-7]{8,16}$/.test(name);
+/** The `alchemy::stack` / `alchemy::stage` / `alchemy::id` stamp for metadata maps. */
+export const ownershipMetadata = (id) => createInternalTags(id);
+/**
+ * The stamp runtime-created objects carry: the stack and stage that created
+ * them and the binding's logical id. Destroy sweeps by it.
+ */
+export const runtimeMetadata = Effect.fn(function* (bindingId) {
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    return {
+        "alchemy::stack": stack.name,
+        "alchemy::stage": stage,
+        "alchemy::binding": bindingId,
+    };
+});
+/** Whether a metadata map carries this resource's ownership stamp. */
+export const hasOwnershipMetadata = Effect.fn(function* (id, metadata) {
+    const expected = yield* createInternalTags(id);
+    return Object.entries(expected).every(([key, value]) => metadata?.[key] === value);
+});
+/** Whether a metadata map was stamped by any Alchemy stack (for nuke). */
+export const hasAnyAlchemyMetadata = (metadata) => metadata !== undefined && metadata !== null && "alchemy::stack" in metadata;
+/** User metadata with the internal `alchemy::*` keys removed. */
+export const userMetadata = (metadata) => Object.fromEntries(Object.entries(metadata ?? {}).filter(([key]) => !key.startsWith("alchemy::")));
+//# sourceMappingURL=Ownership.js.map

package/lib/internal/Ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ownership.js","sources":["../../src/internal/Ownership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,yGAAyG;AACzG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,SAAS,GAAG,EAAE,EAAE,EAAE,CAC9E,IAAI,KAAK,SAAS;IAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAwB,EAAW,EAAE,CACnE,IAAI,KAAK,SAAS,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE1E,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAiB;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,IAAI;QAC5B,gBAAgB,EAAE,KAAK;QACvB,kBAAkB,EAAE,SAAS;KACJ,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACrD,EAAU,EACV,QAA6D;IAE7D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,QAA6D,EACpD,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,gBAAgB,IAAI,QAAQ,CAAC;AAE1F,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,QAA6D,EACrC,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAC/E,CAAC"}

package/lib/internal/Program.d.ts

@@ -0,0 +1,31 @@
+/**
+ * How a template runs its `main` program.
+ *
+ * `@alchemy.run/docker/BuildPlan` bundles `main` and adds the layer that
+ * runs it with Bun from `/app`; E2B starts that command when it builds the
+ * template and captures it running in the template's snapshot, so every
+ * sandbox boots with it already serving on `PORT`. An Effect program (the
+ * class form) is wrapped in the generated bootstrap entry; an async program
+ * (`main` with no Effect impl) is bundled and run as-is.
+ */
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+/** The port a template's program serves on unless `port` says otherwise. */
+export declare const DEFAULT_PORT = 3000;
+/**
+ * The generated entry: raises the runtime flag BEFORE the user's module is
+ * evaluated (hence the dynamic import), then boots the program. It imports
+ * only `@alchemy.run/e2b/Bootstrap` and `main` — see `alchemy/Runtime/Bootstrap`.
+ */
+export declare const makeBootstrap: (handler: string) => (importPath: string) => string;
+/** The program's environment: Alchemy's runtime vars, bound env, then the user's `env`. */
+export declare const programEnv: (port: number, bound: Readonly<Record<string, unknown>>, env: Readonly<Record<string, unknown>> | undefined) => Effect.Effect<{
+    ALCHEMY_STACK_NAME: string;
+    ALCHEMY_STAGE: string;
+    ALCHEMY_PHASE: string;
+    HOST: string;
+    PORT: string;
+}, never, Stack>;
+/** The template's snapshot is taken once the program answers HTTP. */
+export declare const programReadyCmd: (port: number) => string;
+//# sourceMappingURL=Program.d.ts.map

package/lib/internal/Program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Program.d.ts","sources":["../../src/internal/Program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,4EAA4E;AAC5E,eAAO,MAAM,YAAY,OAAO,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,aAAa,YACd,MAAM,kBACH,MAAM,KAAG,MAQvB,CAAC;AAiBF,2FAA2F;AAC3F,eAAO,MAAM,UAAU;;;;;;gBAoBrB,CAAC;AAEH,sEAAsE;AACtE,eAAO,MAAM,eAAe,SAAU,MAAM,WACiD,CAAC"}

package/lib/internal/Program.js

@@ -0,0 +1,60 @@
+/**
+ * How a template runs its `main` program.
+ *
+ * `@alchemy.run/docker/BuildPlan` bundles `main` and adds the layer that
+ * runs it with Bun from `/app`; E2B starts that command when it builds the
+ * template and captures it running in the template's snapshot, so every
+ * sandbox boots with it already serving on `PORT`. An Effect program (the
+ * class form) is wrapped in the generated bootstrap entry; an async program
+ * (`main` with no Effect impl) is bundled and run as-is.
+ */
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+/** The port a template's program serves on unless `port` says otherwise. */
+export const DEFAULT_PORT = 3000;
+/**
+ * The generated entry: raises the runtime flag BEFORE the user's module is
+ * evaluated (hence the dynamic import), then boots the program. It imports
+ * only `@alchemy.run/e2b/Bootstrap` and `main` — see `alchemy/Runtime/Bootstrap`.
+ */
+export const makeBootstrap = (handler) => (importPath) => `
+import { bootstrap } from "@alchemy.run/e2b/Bootstrap";
+
+globalThis.__ALCHEMY_RUNTIME__ = true;
+const { ${handler}: entrypoint } = await import(${JSON.stringify(importPath)});
+
+await bootstrap(entrypoint);
+`;
+/**
+ * A value as the env var the program reads, verbatim. Bound values arrive
+ * already packed by the host (`packEnvValue`, so a `Redacted` keeps its
+ * marker); packing again would double-encode them, and a user's `env` is read
+ * raw (`Config`, `process.env`).
+ */
+const envValue = (value) => value === undefined || value === null
+    ? undefined
+    : Redacted.isRedacted(value)
+        ? String(Redacted.value(value))
+        : typeof value === "string"
+            ? value
+            : JSON.stringify(value);
+/** The program's environment: Alchemy's runtime vars, bound env, then the user's `env`. */
+export const programEnv = Effect.fn(function* (port, bound, env) {
+    const stack = yield* Stack;
+    const values = Object.fromEntries(Object.entries({ ...bound, ...env }).flatMap(([key, value]) => {
+        const text = envValue(value);
+        return text === undefined ? [] : [[key, text]];
+    }));
+    return {
+        ALCHEMY_STACK_NAME: stack.name,
+        ALCHEMY_STAGE: stack.stage,
+        ALCHEMY_PHASE: "runtime",
+        HOST: "0.0.0.0",
+        PORT: String(port),
+        ...values,
+    };
+});
+/** The template's snapshot is taken once the program answers HTTP. */
+export const programReadyCmd = (port) => `bun -e "fetch('http://127.0.0.1:${port}/').then(()=>process.exit(0),()=>process.exit(1))"`;
+//# sourceMappingURL=Program.js.map

package/lib/internal/Program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Program.js","sources":["../../src/internal/Program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GACxB,CAAC,OAAe,EAAE,EAAE,CACpB,CAAC,UAAkB,EAAU,EAAE,CAC7B;;;;UAIM,OAAO,iCAAiC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;;CAG3E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CACtD,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;IACnC,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAEhC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC3C,IAAY,EACZ,KAAwC,EACxC,GAAkD;IAElD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CACuB,CAAC;IAC5B,OAAO;QACL,kBAAkB,EAAE,KAAK,CAAC,IAAI;QAC9B,aAAa,EAAE,KAAK,CAAC,KAAK;QAC1B,aAAa,EAAE,SAAS;QACxB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,GAAG,MAAM;KACV,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9C,mCAAmC,IAAI,oDAAoD,CAAC"}

package/lib/internal/SandboxHandle.d.ts

@@ -0,0 +1,25 @@
+import * as sandboxes from "@distilled.cloud/e2b/sandboxes";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { E2BAuth } from "../E2BBindings.ts";
+import type { ConnectedSandbox, E2BSandbox } from "../SandboxClient.ts";
+/**
+ * `allowOut` lists the only destinations a sandbox may reach: E2B allows
+ * everything else unless `denyOut` blocks it, so an `allowOut` without a
+ * `denyOut` denies all other traffic.
+ */
+export declare const denyUnlisted: <N extends {
+    allowOut?: ReadonlyArray<string>;
+    denyOut?: ReadonlyArray<string>;
+}>(network: N) => N;
+/** A handle to a sandbox created or connected at runtime, from what E2B returned. */
+export declare const makeSandboxHandle: (auth: E2BAuth, info: sandboxes.Sandbox, domain: string) => E2BSandbox;
+/**
+ * A handle to a sandbox declared in the stack. Its envd token is read from
+ * E2B on first use (without resuming it) and kept; `trafficTokenOf` comes
+ * from the sandbox's attributes, since E2B returns the traffic token only
+ * on create and connect.
+ */
+export declare const makeConnectedSandbox: (auth: E2BAuth, sandboxIdOf: Effect.Effect<string, never, RuntimeContext>, trafficTokenOf: Effect.Effect<Redacted.Redacted<string> | undefined, never, RuntimeContext>) => ConnectedSandbox;
+//# sourceMappingURL=SandboxHandle.d.ts.map

package/lib/internal/SandboxHandle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxHandle.d.ts","sources":["../../src/internal/SandboxHandle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAK7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAMxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,KAAK,EAEV,gBAAgB,EAEhB,UAAU,EASX,MAAM,qBAAqB,CAAC;AAqB7B;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAE,WAEtE,CAAC,KACT,CAGU,CAAC;AAuYd,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,SACtB,OAAO,QACP,SAAS,CAAC,OAAO,UACf,MAAM,KACb,UAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,SACzB,OAAO,eACA,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,kBACzC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,KAC1F,gBAiCF,CAAC"}