@alchemy.run/modal 0.0.0-stage → 2.0.0-beta.86

package/src/AuthProvider.ts

@@ -0,0 +1,295 @@
+import { anonymous, DEFAULT_API_BASE_URL } from "@distilled.cloud/modal/Credentials";
+import * as token from "@distilled.cloud/modal/token";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureField,
+  type ConfigureMethod,
+  type ProviderDetails,
+} from "alchemy/Auth/AuthProvider";
+import { displayRedacted } from "alchemy/Auth/Credentials";
+import { getEnv, getEnvRedacted, mapPromptCancellation } from "alchemy/Auth/Env";
+import {
+  collectFieldValues,
+  storedSecret,
+  storedValueText,
+  validateFieldValues,
+  type StoredValues,
+} from "alchemy/Auth/StoredAuthProvider";
+import * as Interaction from "alchemy/Interaction";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+
+/**
+ * Canonical name registered in the AuthProviders registry. Use this key to
+ * look up the Modal AuthProvider from inside provider Layers.
+ */
+export const MODAL_AUTH_PROVIDER_NAME = "Modal";
+
+/**
+ * A Modal profile entry. Both methods store a workspace token pair, the
+ * same kind `modal token new` writes to `~/.modal.toml`:
+ *
+ * - `browser`: Alchemy runs Modal's browser token flow, you approve it on
+ *   modal.com, and Modal mints the pair.
+ * - `stored`: you paste a pair created at https://modal.com/settings/tokens.
+ *
+ * Modal tokens don't expire unless created with an expiry, so there is
+ * nothing to refresh. A revoked token fails with Modal's auth error; run
+ * `alchemy profile edit --reconfigure Modal` to get a new one.
+ */
+export const ModalAuthConfigSchema = Schema.Union([
+  Schema.Struct({
+    method: Schema.Literal("browser"),
+    tokenId: Schema.String,
+    tokenSecret: Schema.String,
+    workspace: Schema.optional(Schema.String),
+  }),
+  Schema.Struct({
+    method: Schema.Literal("stored"),
+    tokenId: Schema.String,
+    tokenSecret: Schema.String,
+  }),
+]);
+export type ModalAuthConfig = typeof ModalAuthConfigSchema.Type;
+
+/** Resolved Modal credentials: a workspace token pair. */
+export interface ModalResolvedCredentials {
+  type: "token";
+  tokenId: Redacted.Redacted<string>;
+  tokenSecret: Redacted.Redacted<string>;
+  apiBaseUrl: string;
+  source: { type: ModalAuthConfig["method"] | "env"; details?: string };
+}
+
+const trimmed = (value: Redacted.Redacted<string> | undefined) =>
+  value === undefined || Redacted.value(value).trim().length === 0
+    ? undefined
+    : Redacted.make(Redacted.value(value).trim());
+
+const tokenFields: ReadonlyArray<ConfigureField> = [
+  {
+    name: "tokenId",
+    label: "Modal Token ID",
+    description:
+      "Create one at https://modal.com/settings/tokens, or run `modal token new` and copy token_id from ~/.modal.toml.",
+    validate: (value) => (value.trim().startsWith("ak-") ? undefined : "Expected an ak-… id"),
+  },
+  {
+    name: "tokenSecret",
+    label: "Modal Token Secret",
+    secret: true,
+    validate: (value) => (value.trim().startsWith("as-") ? undefined : "Expected an as-… secret"),
+  },
+];
+
+const storedConfig = (values: StoredValues): ModalAuthConfig => ({
+  method: "stored",
+  tokenId: (storedValueText(values.tokenId) ?? "").trim(),
+  tokenSecret: Redacted.value(storedSecret(values.tokenSecret) ?? Redacted.make("")).trim(),
+});
+
+const methods: Array<{
+  value: ModalAuthConfig["method"];
+  label: string;
+  description?: string;
+}> = [
+  {
+    value: "browser",
+    label: "Browser login",
+    description: "recommended — approve on modal.com and Modal mints a token",
+  },
+  {
+    value: "stored",
+    label: "Token",
+    description: "paste a token pair from modal.com/settings/tokens",
+  },
+];
+
+/** How long one `waitTokenFlow` call long-polls, as `modal token new` does. */
+const WAIT_SECONDS = 40;
+
+/** Long-polls before the login gives up: 8 × 40s, about five minutes. */
+const WAIT_ATTEMPTS = 8;
+
+const loginFailed = (cause: unknown) =>
+  AuthError.make({ message: "Modal: browser login failed.", cause });
+
+/**
+ * Modal's browser token flow, the one `modal token new` runs: create a flow,
+ * open its page for the user to approve, then long-poll until Modal hands
+ * back the new token pair. Both calls run without a token.
+ */
+const browserLogin = Effect.gen(function* () {
+  const anonymousApi = Layer.mergeAll(anonymous(), FetchHttpClient.layer);
+  const flow = yield* token
+    .createTokenFlow({ utmSource: "alchemy" })
+    .pipe(Effect.provide(anonymousApi), Effect.mapError(loginFailed));
+  if (!flow.tokenFlowId || !flow.webUrl) {
+    return yield* AuthError.make({ message: "Modal: the token flow returned no login page." });
+  }
+  const waitOnce = token
+    .waitTokenFlow({
+      tokenFlowId: flow.tokenFlowId,
+      waitSecret: flow.waitSecret,
+      timeout: WAIT_SECONDS,
+    })
+    .pipe(Effect.provide(anonymousApi), Effect.mapError(loginFailed));
+  const approved = waitOnce.pipe(
+    Effect.repeat({ until: (result) => result.timeout !== true, times: WAIT_ATTEMPTS - 1 }),
+    Effect.flatMap((result) =>
+      result.timeout === true || !result.tokenId || !result.tokenSecret
+        ? Effect.fail(
+            AuthError.make({
+              message: "Modal: the browser login wasn't approved within five minutes.",
+            }),
+          )
+        : Effect.succeed({
+            tokenId: result.tokenId,
+            tokenSecret: Redacted.isRedacted(result.tokenSecret)
+              ? Redacted.value(result.tokenSecret)
+              : result.tokenSecret,
+            workspace: result.workspaceUsername || undefined,
+          }),
+    ),
+  );
+  const minted = yield* Interaction.browserLogin({
+    provider: "Modal",
+    url: flow.webUrl,
+    code: flow.code || undefined,
+    waitFor: approved,
+  }).pipe(Effect.mapError((e) => (e._tag === "AuthError" ? e : loginFailed(e))));
+  yield* Interaction.success(
+    minted.workspace
+      ? `Modal: logged in to the ${minted.workspace} workspace.`
+      : "Modal: logged in.",
+  );
+  return { method: "browser" as const, ...minted } satisfies ModalAuthConfig;
+});
+
+const readEnvironment = Effect.gen(function* () {
+  const tokenId = trimmed(yield* getEnvRedacted("MODAL_TOKEN_ID"));
+  const tokenSecret = trimmed(yield* getEnvRedacted("MODAL_TOKEN_SECRET"));
+  if (tokenId === undefined || tokenSecret === undefined) {
+    return yield* AuthError.make({
+      message: "Modal CI credentials not found. Set MODAL_TOKEN_ID and MODAL_TOKEN_SECRET.",
+    });
+  }
+  return {
+    type: "token" as const,
+    tokenId,
+    tokenSecret,
+    apiBaseUrl: (yield* getEnv("MODAL_SERVER_URL")) ?? DEFAULT_API_BASE_URL,
+    source: { type: "env" as const, details: "MODAL_TOKEN_ID" },
+  } satisfies ModalResolvedCredentials;
+});
+
+const resolve = (config: ModalAuthConfig): ModalResolvedCredentials => ({
+  type: "token",
+  tokenId: Redacted.make(config.tokenId),
+  tokenSecret: Redacted.make(config.tokenSecret),
+  apiBaseUrl: DEFAULT_API_BASE_URL,
+  source: {
+    type: config.method,
+    details: config.method === "browser" ? config.workspace : undefined,
+  },
+});
+
+/**
+ * Layer that registers the Modal {@link AuthProvider} into the
+ * `AuthProviders` registry when built. Included in `Modal.providers()` so
+ * `alchemy profile edit` can configure it.
+ *
+ * Supported methods:
+ * - `browser`: Modal's browser token flow (interactive only).
+ * - `stored`: a pasted token pair (`--method stored --set tokenId=… --set tokenSecret=…`).
+ */
+export const ModalAuth = AuthProviderLayer<ModalAuthConfig, ModalResolvedCredentials>()(
+  MODAL_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const pasteToken = collectFieldValues(tokenFields).pipe(
+      Effect.map(storedConfig),
+      Effect.tap(() => Interaction.success("Modal: credentials saved.")),
+    );
+
+    const configure = (_profileName: string) =>
+      Interaction.select({ message: "Modal authentication method", options: methods }).pipe(
+        mapPromptCancellation,
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("browser", () => browserLogin),
+            Match.when("stored", () => pasteToken),
+            Match.exhaustive,
+          ),
+        ),
+        Effect.mapError((e) =>
+          e._tag === "AuthError"
+            ? e
+            : AuthError.make({ message: "failed to configure credentials", cause: e }),
+        ),
+      );
+
+    /** The browser flow needs a person, so only `stored` takes flags. */
+    const configureMethods: ReadonlyArray<ConfigureMethod> = [
+      { method: "stored", fields: tokenFields },
+    ];
+
+    const configureWith = (
+      _profileName: string,
+      input: { readonly method: string; readonly values: Record<string, string> },
+    ) =>
+      input.method === "stored"
+        ? validateFieldValues(MODAL_AUTH_PROVIDER_NAME, tokenFields, input.values).pipe(
+            Effect.map(storedConfig),
+            Effect.tap(() => Interaction.success("Modal: credentials saved.")),
+          )
+        : Effect.fail(
+            AuthError.make({
+              message: `Modal: unknown method '${input.method}'. Valid methods: stored. (Browser login is interactive-only.)`,
+            }),
+          );
+
+    // A token pair doesn't expire on its own, so logging in again only
+    // repeats the browser flow; a pasted token stays as it is.
+    const login = (_profileName: string, config: ModalAuthConfig) =>
+      config.method === "browser" ? browserLogin : Effect.succeed(config);
+
+    const details = (_profileName: string, config: ModalAuthConfig) =>
+      Effect.succeed<ProviderDetails>({
+        lines: [
+          { key: "tokenId", value: config.tokenId },
+          { key: "tokenSecret", value: displayRedacted(Redacted.make(config.tokenSecret)) },
+          ...(config.method === "browser" && config.workspace
+            ? [{ key: "workspace", value: config.workspace }]
+            : []),
+          { key: "source", value: config.method },
+        ],
+      });
+
+    return {
+      configSchema: ModalAuthConfigSchema,
+      configure,
+      configureWith,
+      configureMethods,
+      login,
+      logout: () => Effect.void,
+      details,
+      read: (_profileName: string, config: ModalAuthConfig) => Effect.succeed(resolve(config)),
+      readEnvironment,
+      environment: [
+        { name: "MODAL_TOKEN_ID", required: true, description: "Modal token id (`ak-…`)." },
+        {
+          name: "MODAL_TOKEN_SECRET",
+          required: true,
+          secret: true,
+          description: "Modal token secret (`as-…`).",
+        },
+        { name: "MODAL_SERVER_URL", required: false, description: "Modal API URL override." },
+      ],
+    };
+  }),
+);

package/src/BindingHttp.ts

@@ -0,0 +1,112 @@
+import type { Input } from "alchemy/Input";
+import type { ResourceLike } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import type { OperationServices } from "./internal.ts";
+import * as ModalBindings from "./ModalBindings.ts";
+
+/**
+ * Shared scaffolding for Modal's HTTP bindings. NOT exported from `index.ts`.
+ *
+ * Every `{Cap}Http.ts` is a thin `Layer.effect(Cap, makeModalBinding({ … }))`:
+ * the operations it calls (resolved once with the host's credentials by
+ * {@link ModalBindings.withCredentials}), the environment role it grants the
+ * host's identity on the bound resource's environment, and the client it
+ * builds. `make` runs in the construction phase, so it reads the resource's
+ * attribute accessors there (`yield* volume.volumeId`) and yields them per call.
+ */
+
+/** A role on an environment, granted to the host's identity. */
+export type Role = ModalBindings.EnvironmentGrant["role"];
+
+const GrantRole = Effect.gen(function* () {
+  const bind = yield* ModalBindings.Bind;
+  return Effect.fn(function* (
+    label: TemplateStringsArray,
+    args: ReadonlyArray<unknown>,
+    environment: Input<string | undefined>,
+    role: Role,
+  ) {
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+      yield* bind(label, ...args)({ roles: [{ environment, role }] });
+    }
+  });
+});
+
+/** A binding over one resource that lives in an environment. */
+export const makeModalBinding = <
+  Res extends ResourceLike & { readonly environment: unknown },
+  Ops,
+  Client,
+>(options: {
+  /** Fully qualified binding tag, e.g. `Modal.WriteQueue`. */
+  readonly tag: string;
+  /** The distilled operations the client calls, e.g. `operations({ put: queue.putQueue })`. */
+  readonly operations: Effect.Effect<Ops, never, OperationServices>;
+  /** The role the host needs on the resource's environment. */
+  readonly role: Role;
+  readonly make: (resource: Res, ops: Ops) => Effect.Effect<Client>;
+}) =>
+  Effect.gen(function* () {
+    const ops = yield* ModalBindings.withCredentials(options.operations);
+    const grant = yield* GrantRole;
+    return Effect.fn(options.tag)(function* (resource: Res) {
+      yield* grant(
+        labelOf(options.tag),
+        [resource],
+        resource.environment as Input<string | undefined>,
+        options.role,
+      );
+      return yield* options.make(resource, ops);
+    });
+  });
+
+/**
+ * A binding with no bound resource (get-or-create by name at runtime): the
+ * role is granted on the environment `environmentOf(args)` names, the
+ * workspace default when `undefined`.
+ */
+export const makeOpenModalBinding = <Args extends ReadonlyArray<unknown>, Ops, Client>(options: {
+  readonly tag: string;
+  readonly operations: Effect.Effect<Ops, never, OperationServices>;
+  readonly role: Role;
+  /** The environment the client acts in (an `Input`, read at deploy). */
+  readonly environmentOf: (...args: Args) => Input<string | undefined>;
+  readonly make: (ops: Ops, ...args: Args) => Effect.Effect<Client>;
+}) =>
+  Effect.gen(function* () {
+    const ops = yield* ModalBindings.withCredentials(options.operations);
+    const grant = yield* GrantRole;
+    return Effect.fn(options.tag)(function* (...args: Args) {
+      yield* grant(openLabelOf(options.tag), [], options.environmentOf(...args), options.role);
+      return yield* options.make(ops, ...args);
+    });
+  });
+
+/** `<tag>(<resource>)` as a template label. */
+const labelOf = (tag: string): TemplateStringsArray =>
+  Object.assign([`${tag}(`, ")"], { raw: [`${tag}(`, ")"] }) as unknown as TemplateStringsArray;
+
+/** `<tag>` as a template label. */
+const openLabelOf = (tag: string): TemplateStringsArray =>
+  Object.assign([tag], { raw: [tag] }) as unknown as TemplateStringsArray;
+
+/** A stored value isn't JSON (e.g. a pickled value written by Modal's Python client). */
+export class ModalValueNotJson extends Data.TaggedError("Modal.ValueNotJson")<{
+  readonly message: string;
+}> {}
+
+/** JSON-encode a value as base64 bytes, Modal's `bytes` wire form. */
+export const encodeJson = (value: unknown) =>
+  Effect.sync(() => Buffer.from(JSON.stringify(value), "utf8").toString("base64"));
+
+/** Decode base64 JSON bytes written by {@link encodeJson} or any JSON writer. */
+export const decodeJson = <A = unknown>(data: string) =>
+  Effect.try({
+    try: () => JSON.parse(Buffer.from(data, "base64").toString("utf8")) as A,
+    catch: () =>
+      new ModalValueNotJson({
+        message:
+          "The stored value isn't JSON. Values written by Modal's Python client are pickled; write them as JSON (bytes of json.dumps) to share them.",
+      }),
+  });

package/src/Blob.ts

@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+import * as blob from "@distilled.cloud/modal/blob";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import { operations } from "./internal.ts";
+
+/** Inputs and results above this size travel through Modal's blob store. */
+export const MAX_INLINE_BYTES = 2 * 1024 * 1024;
+
+/** A payload Modal's blob store couldn't take or give back. */
+export class BlobTransferFailed extends Data.TaggedError("Modal.BlobTransferFailed")<{
+  readonly message: string;
+}> {}
+
+/** The blob operations, resolved by `ModalBindings.withCredentials`. */
+export const BlobOps = operations({
+  create: blob.createBlob,
+  get: blob.getBlob,
+  http: HttpClient.HttpClient,
+});
+
+export type BlobOps = Effect.Success<typeof BlobOps>;
+
+/** Upload bytes to Modal's blob store and return the blob id. */
+export const uploadBlob = Effect.fn(function* (ops: BlobOps, bytes: Uint8Array) {
+  const digests = yield* Effect.sync(() => ({
+    md5: createHash("md5").update(bytes).digest("base64"),
+    sha256: createHash("sha256").update(bytes).digest("base64"),
+  }));
+  const created = yield* ops.create({
+    contentMd5: digests.md5,
+    contentSha256Base64: digests.sha256,
+    contentLength: String(bytes.length),
+  });
+  if (!created.blobId || !created.uploadUrl) {
+    return yield* new BlobTransferFailed({
+      message: `Modal asked for a multipart upload of ${bytes.length} bytes, which this client doesn't send`,
+    });
+  }
+  // A presigned upload URL Modal handed back: used as-is.
+  const response = yield* ops.http.execute(
+    HttpClientRequest.put(created.uploadUrl).pipe(
+      HttpClientRequest.bodyUint8Array(bytes, "application/octet-stream"),
+      HttpClientRequest.setHeader("content-md5", digests.md5),
+    ),
+  );
+  if (response.status >= 300) {
+    return yield* new BlobTransferFailed({
+      message: `Uploading a blob failed with HTTP ${response.status}`,
+    });
+  }
+  return created.blobId;
+});
+
+/** Download a blob's bytes. */
+export const downloadBlob = Effect.fn(function* (ops: BlobOps, blobId: string) {
+  const { downloadUrl } = yield* ops.get({ blobId });
+  if (!downloadUrl) {
+    return yield* new BlobTransferFailed({ message: `Modal returned no URL for blob ${blobId}` });
+  }
+  // A presigned download URL Modal handed back: used as-is.
+  const response = yield* ops.http.get(downloadUrl);
+  if (response.status >= 300) {
+    return yield* new BlobTransferFailed({
+      message: `Downloading blob ${blobId} failed with HTTP ${response.status}`,
+    });
+  }
+  return new Uint8Array(yield* response.arrayBuffer);
+});

package/src/Bootstrap.ts

@@ -0,0 +1,52 @@
+/**
+ * Process bootstrap for `Modal.Sandbox` (a Node process in a Modal sandbox serving the
+ * bundled program). The generated entry imports this module and the user's
+ * `main`, nothing else — see `alchemy/Runtime/Bootstrap` for why.
+ */
+import { NodeServices } from "@effect/platform-node";
+import { NodeHttpServer } from "alchemy/Http";
+import { reifyBoundConfigProvider } from "alchemy/Runtime";
+import {
+  entrypointLayer,
+  resolveProgram,
+  runProcess,
+  stackFromEnv,
+} from "alchemy/Runtime/Bootstrap";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+
+/**
+ * Resolve the bundled program (the runners registered via `host.run` /
+ * serve) and run it with a Node HTTP server bound to `PORT`, so the
+ * returned `{ fetch }` handler is actually served and `host.run` loops
+ * stay alive.
+ */
+export const bootstrap = (entrypoint: unknown): Promise<void> => {
+  const platform = Layer.mergeAll(
+    NodeServices.layer,
+    FetchHttpClient.layer,
+    Logger.layer([Logger.consolePretty()]),
+  );
+
+  const program = resolveProgram("program").pipe(
+    Effect.provide(
+      entrypointLayer(entrypoint).pipe(
+        Layer.provideMerge(stackFromEnv),
+        Layer.provideMerge(NodeHttpServer({ hostname: "0.0.0.0" })),
+        Layer.provideMerge(platform),
+        Layer.provideMerge(
+          Layer.succeed(
+            ConfigProvider.ConfigProvider,
+            reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env),
+          ),
+        ),
+      ),
+    ),
+    Effect.scoped,
+  );
+
+  return runProcess("Modal sandbox", program);
+};

package/src/Cbor.ts

@@ -0,0 +1,158 @@
+/**
+ * Minimal CBOR (RFC 8949) codec for Modal function arguments and results
+ * (`DATA_FORMAT_CBOR`): null, booleans, numbers, strings, byte strings,
+ * arrays and string-keyed maps. NOT exported from `index.ts`.
+ */
+
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+
+class Out {
+  bytes: number[] = [];
+  head(major: number, n: number) {
+    if (n < 24) this.bytes.push((major << 5) | n);
+    else if (n < 0x100) this.bytes.push((major << 5) | 24, n);
+    else if (n < 0x10000) this.bytes.push((major << 5) | 25, n >> 8, n & 0xff);
+    else if (n < 0x100000000)
+      this.bytes.push(
+        (major << 5) | 26,
+        (n >>> 24) & 0xff,
+        (n >>> 16) & 0xff,
+        (n >>> 8) & 0xff,
+        n & 0xff,
+      );
+    else {
+      const big = BigInt(n);
+      this.bytes.push((major << 5) | 27);
+      for (let i = 7; i >= 0; i--) this.bytes.push(Number((big >> BigInt(i * 8)) & 0xffn));
+    }
+  }
+}
+
+const write = (out: Out, value: unknown): void => {
+  if (value === null || value === undefined) {
+    out.bytes.push(0xf6);
+  } else if (value === false) {
+    out.bytes.push(0xf4);
+  } else if (value === true) {
+    out.bytes.push(0xf5);
+  } else if (typeof value === "number") {
+    if (Number.isSafeInteger(value)) {
+      if (value >= 0) out.head(0, value);
+      else out.head(1, -1 - value);
+    } else {
+      const view = new DataView(new ArrayBuffer(8));
+      view.setFloat64(0, value);
+      out.bytes.push(0xfb, ...new Uint8Array(view.buffer));
+    }
+  } else if (typeof value === "bigint") {
+    write(out, Number(value));
+  } else if (typeof value === "string") {
+    const bytes = enc.encode(value);
+    out.head(3, bytes.length);
+    out.bytes.push(...bytes);
+  } else if (value instanceof Uint8Array) {
+    out.head(2, value.length);
+    out.bytes.push(...value);
+  } else if (Array.isArray(value)) {
+    out.head(4, value.length);
+    for (const item of value) write(out, item);
+  } else if (typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+    out.head(5, entries.length);
+    for (const [key, item] of entries) {
+      write(out, key);
+      write(out, item);
+    }
+  } else {
+    throw new TypeError(`Can't encode ${typeof value} as CBOR`);
+  }
+};
+
+/** Encode a value as CBOR. Throws a `TypeError` for functions and symbols. */
+export const encodeCbor = (value: unknown): Uint8Array => {
+  const out = new Out();
+  write(out, value);
+  return new Uint8Array(out.bytes);
+};
+
+/** Decode CBOR. Throws a `RangeError` on malformed input. */
+export const decodeCbor = (bytes: Uint8Array): unknown => {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let pos = 0;
+  const need = (n: number) => {
+    if (pos + n > bytes.length) throw new RangeError("Truncated CBOR");
+  };
+  const length = (info: number): number => {
+    if (info < 24) return info;
+    if (info === 24) return (need(1), bytes[pos++]!);
+    if (info === 25) return (need(2), (pos += 2), view.getUint16(pos - 2));
+    if (info === 26) return (need(4), (pos += 4), view.getUint32(pos - 4));
+    if (info === 27) return (need(8), (pos += 8), Number(view.getBigUint64(pos - 8)));
+    throw new RangeError(`Unsupported CBOR length ${info}`);
+  };
+  const read = (): unknown => {
+    need(1);
+    const first = bytes[pos++]!;
+    const major = first >> 5;
+    const info = first & 31;
+    switch (major) {
+      case 0:
+        return length(info);
+      case 1:
+        return -1 - length(info);
+      case 2: {
+        const n = length(info);
+        need(n);
+        pos += n;
+        return bytes.slice(pos - n, pos);
+      }
+      case 3: {
+        const n = length(info);
+        need(n);
+        pos += n;
+        return dec.decode(bytes.subarray(pos - n, pos));
+      }
+      case 4: {
+        const n = length(info);
+        return Array.from({ length: n }, read);
+      }
+      case 5: {
+        const n = length(info);
+        const out: Record<string, unknown> = {};
+        for (let i = 0; i < n; i++) {
+          const key = read();
+          out[String(key)] = read();
+        }
+        return out;
+      }
+      case 6:
+        length(info);
+        return read();
+      case 7:
+        if (info === 20) return false;
+        if (info === 21) return true;
+        if (info === 22 || info === 23) return null;
+        if (info === 25) {
+          need(2);
+          pos += 2;
+          return view.getFloat16 ? view.getFloat16(pos - 2) : halfToFloat(view.getUint16(pos - 2));
+        }
+        if (info === 26) return (need(4), (pos += 4), view.getFloat32(pos - 4));
+        if (info === 27) return (need(8), (pos += 8), view.getFloat64(pos - 8));
+        throw new RangeError(`Unsupported CBOR simple value ${info}`);
+      default:
+        throw new RangeError(`Unsupported CBOR major type ${major}`);
+    }
+  };
+  return read();
+};
+
+const halfToFloat = (h: number): number => {
+  const sign = h & 0x8000 ? -1 : 1;
+  const exp = (h >> 10) & 0x1f;
+  const frac = h & 0x3ff;
+  if (exp === 0) return sign * 2 ** -14 * (frac / 1024);
+  if (exp === 31) return frac ? Number.NaN : sign * Number.POSITIVE_INFINITY;
+  return sign * 2 ** (exp - 15) * (1 + frac / 1024);
+};