@alchemy.run/modal 0.0.0-stage → 2.0.0-beta.86

package/lib/CreateSandbox.d.ts

@@ -0,0 +1,186 @@
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { App } from "./App.ts";
+import type { Image } from "./Image.ts";
+import type { ErrorOf } from "./internal.ts";
+import type { Sandbox } from "./Sandbox.ts";
+import type { createPersistentSandbox, createSandbox, listSandboxes, PersistentSandboxCreateOptions, PersistentSandboxHandle, restoreSandbox, SandboxCreateOptions, SandboxHandle, sandboxFromName, SandboxOpError } from "./SandboxClient.ts";
+export type { ExecOptions, PersistentSandboxCreateOptions, PersistentSandboxHandle, ExecResult, HeaderReplacement, SandboxCreateOptions, SandboxFileEntry, SandboxHandle, SandboxTunnel, } from "./SandboxClient.ts";
+/** A sandbox as `list` reports it. */
+export interface SandboxSummary {
+    readonly sandboxId: string;
+    readonly name: string | undefined;
+    readonly createdAt: number | undefined;
+    readonly tags: Record<string, string>;
+}
+/** Sandbox cost for one combination of tag values. */
+export interface SandboxUsageGroup {
+    /** The grouped tags' values. */
+    readonly tags: Record<string, string>;
+    /** Total cost in USD. */
+    readonly cost: number;
+    /** Cost by resource (`cpu`, `memory`, `gpu`, ...). */
+    readonly costByResource: Record<string, number>;
+}
+/** Create and find sandboxes in one App. Every handle method calls Modal. */
+export interface SandboxesClient {
+    /** The App sandboxes are created in. */
+    readonly appId: Effect.Effect<string>;
+    /** Create a sandbox. Modal's own sandbox parameters; the bound image is the default `image`. */
+    create(options?: SandboxCreateOptions): Effect.Effect<SandboxHandle, ErrorOf<typeof createSandbox>, RuntimeContext>;
+    /** A running sandbox by name, or `undefined`. */
+    fromName(name: string): Effect.Effect<SandboxHandle | undefined, ErrorOf<typeof sandboxFromName>, RuntimeContext>;
+    /** A sandbox by id. */
+    fromId(sandboxId: string): Effect.Effect<SandboxHandle>;
+    /** Running sandboxes of the App, optionally filtered by tags. */
+    list(options?: {
+        readonly tags?: Record<string, string>;
+        readonly includeFinished?: boolean;
+    }): Effect.Effect<ReadonlyArray<SandboxSummary>, ErrorOf<typeof listSandboxes>, RuntimeContext>;
+    /**
+     * Create a persistent sandbox: one box whose filesystem outlives its
+     * sessions. Each session runs up to an hour and pauses after five idle
+     * minutes; `session()` resumes it from where it stopped.
+     */
+    createPersistent(options?: PersistentSandboxCreateOptions): Effect.Effect<PersistentSandboxHandle, ErrorOf<typeof createPersistentSandbox>, RuntimeContext>;
+    /** A persistent sandbox by id (a `Modal.PersistentSandbox`, or one `createPersistent` made). */
+    persistent(box: string | {
+        readonly persistentSandboxId: string;
+    }): Effect.Effect<PersistentSandboxHandle>;
+    /**
+     * What the App's sandboxes cost over a time range, grouped by tag values
+     * (`groupByTags: ["user"]` gives one group per user). Modal reports
+     * whole hours: `since` rounds down and `until` (default now) up to the
+     * hour.
+     */
+    usage(query: {
+        readonly since: Date | string | number;
+        readonly until?: Date | string | number;
+        readonly groupByTags?: ReadonlyArray<string>;
+        readonly tags?: Record<string, string>;
+    }): Effect.Effect<ReadonlyArray<SandboxUsageGroup>, SandboxOpError<"usage">, RuntimeContext>;
+    /** Start a new sandbox from a memory snapshot (`handle.snapshotMemory()`). */
+    restore(snapshot: {
+        readonly snapshotId: string;
+    }, options?: {
+        readonly name?: string;
+    }): Effect.Effect<SandboxHandle, ErrorOf<typeof restoreSandbox> | SandboxOpError<"setTags">, RuntimeContext>;
+}
+/**
+ * Create and drive Modal Sandboxes from any runtime: a Worker, a Lambda, a
+ * Durable Object, or a script.
+ *
+ * Bind it to an App (sandboxes boot from the image you pass to `create`) or
+ * to an Image (it is the default image, and sandboxes go in the image's
+ * App). A sandbox lives at most 24 hours; to keep work across sandboxes, use
+ * a Volume, or snapshot it (`snapshotFilesystem`, `snapshotMemory`) and
+ * start the next one from the snapshot.
+ *
+ * Sandboxes are runtime objects: they aren't in Alchemy state. Stopping the
+ * App (destroying the `Modal.App` resource) terminates every sandbox in it.
+ *
+ * Objects created at run time are tagged with the stack, stage and binding
+ * (`alchemy::stack`, `alchemy::stage`, `alchemy::id`) and are not deleted when
+ * the stack is destroyed. List them by those tags to clean them up:
+ * `sandboxes.list({ tags: { "alchemy::stack": "my-app" } })`, or Modal's
+ * `SandboxList` with `tags`. Your own `tags` merge under the three. A
+ * persistent sandbox takes neither tags nor a name, so it carries no owner;
+ * it lives in the App.
+ *
+ * ### Create a sandbox per request
+ * **Example:** Run a command and terminate
+ * ```typescript
+ * import * as Cloudflare from "@alchemy.run/cloudflare";
+ * import * as Modal from "@alchemy.run/modal";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/http/HttpServerResponse";
+ * import { Warm } from "./Coder.ts";
+ *
+ * export default class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const sandboxes = yield* Modal.CreateSandbox(Warm);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const sandbox = yield* Effect.acquireRelease(
+ *           sandboxes.create({ timeout: "10 minutes" }),
+ *           (sandbox) => Effect.ignore(sandbox.terminate()),
+ *         );
+ *         const test = yield* sandbox.exec(["pnpm", "test"], { cwd: "/work" });
+ *         return yield* HttpServerResponse.json(test);
+ *       }).pipe(Effect.scoped, Effect.orDie),
+ *     };
+ *   }).pipe(Effect.provide(Modal.CreateSandboxHttp)),
+ * ) {}
+ * ```
+ *
+ * ### One sandbox per session
+ * **Example:** Find it by name, else create it
+ * ```typescript
+ * const sandbox =
+ *   (yield* sandboxes.fromName(`session-${user}`)) ??
+ *   (yield* sandboxes.create({ name: `session-${user}`, idleTimeout: "10 minutes" }));
+ * ```
+ *
+ * ### Secrets the sandbox never sees
+ * **Example:** Inject an API key into outbound requests
+ * ```typescript
+ * // construction phase: read the Secret's id
+ * const openaiId = yield* (yield* OpenAI).secretId;
+ * // in a handler
+ * const openai = { secretId: yield* openaiId };
+ * const sandbox = yield* sandboxes.create({
+ *   outboundPolicy: {
+ *     routes: [
+ *       {
+ *         https: {
+ *           domains: ["api.openai.com"],
+ *           headerReplacements: [{ secret: openai, headers: { Authorization: "Bearer $OPENAI_API_KEY" } }],
+ *         },
+ *       },
+ *       { any: { redirect: "block" } },
+ *     ],
+ *   },
+ * });
+ * ```
+ *
+ * ### A cloud identity, not a key
+ * **Example:** Assume an AWS role with the token Modal signs
+ * ```typescript
+ * const sandbox = yield* sandboxes.create({
+ *   image: "amazon/aws-cli",
+ *   includeOidcIdentityToken: true,
+ * });
+ * // MODAL_IDENTITY_TOKEN is an OIDC token from https://oidc.modal.com
+ * const role = yield* sandbox.exec(
+ *   `aws sts assume-role-with-web-identity --role-arn ${roleArn} --role-session-name sandbox --web-identity-token "$MODAL_IDENTITY_TOKEN"`,
+ * );
+ * ```
+ *
+ * ### Persistent sandboxes
+ * **Example:** A box per user that keeps its files between sessions
+ * ```typescript
+ * const box = yield* sandboxes.createPersistent({ image: "node:22-bookworm" });
+ * const session = yield* box.session();
+ * yield* session.exec("echo hi >> /root/notes.txt");
+ * // later, from any request: resumes the box if it paused
+ * const again = yield* (yield* sandboxes.persistent(box.persistentSandboxId)).session();
+ * ```
+ *
+ * ### Snapshots
+ * **Example:** Save a warmed sandbox and boot the next one from it
+ * ```typescript
+ * yield* sandbox.exec(["pnpm", "install"], { cwd: "/work" });
+ * const image = yield* sandbox.snapshotFilesystem();
+ * const next = yield* sandboxes.create({ image });
+ * ```
+ *
+ * @binding
+ * @product Sandbox
+ */
+export interface CreateSandbox extends Binding.Service<CreateSandbox, "Modal.CreateSandbox", (target: App | Image | Sandbox) => Effect.Effect<SandboxesClient>> {
+}
+export declare const CreateSandbox: CreateSandbox;
+//# sourceMappingURL=CreateSandbox.d.ts.map

package/lib/CreateSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSandbox.d.ts","sources":["../src/CreateSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,uBAAuB,EACvB,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,cAAc,EACf,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,WAAW,EACX,8BAA8B,EAC9B,uBAAuB,EACvB,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjD;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,gGAAgG;IAChG,MAAM,CACJ,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;IAC/E,iDAAiD;IACjD,QAAQ,CACN,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,OAAO,CAAC,OAAO,eAAe,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7F,uBAAuB;IACvB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,iEAAiE;IACjE,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;KACpC,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,OAAO,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;IAChG;;;;OAIG;IACH,gBAAgB,CACd,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAAC,MAAM,CACd,uBAAuB,EACvB,OAAO,CAAC,OAAO,uBAAuB,CAAC,EACvC,cAAc,CACf,CAAC;IACF,gGAAgG;IAChG,UAAU,CACR,GAAG,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GACrD,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;QACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;QACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACxC,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7F,8EAA8E;IAC9E,OAAO,CACL,QAAQ,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EACzC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,MAAM,CAAC,MAAM,CACd,aAAa,EACb,OAAO,CAAC,OAAO,cAAc,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,EAC1D,cAAc,CACf,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,MAAM,WAAW,aAAc,SAAQ,OAAO,CAAC,OAAO,CACpD,aAAa,EACb,qBAAqB,EACrB,CAAC,MAAM,EAAE,GAAG,GAAG,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAClE;CAAG;AAEJ,eAAO,MAAM,aAAa,eAAwD,CAAC"}

package/lib/CreateSandbox.js

@@ -0,0 +1,3 @@
+import * as Binding from "alchemy/Binding";
+export const CreateSandbox = Binding.Service("Modal.CreateSandbox");
+//# sourceMappingURL=CreateSandbox.js.map

package/lib/CreateSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSandbox.js","sources":["../src/CreateSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAmO3C,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAgB,qBAAqB,CAAC,CAAC"}

package/lib/CreateSandboxHttp.d.ts

@@ -0,0 +1,17 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { CreateSandbox, type SandboxesClient } from "./CreateSandbox.ts";
+import { type RuntimeOwner } from "./RuntimeOwner.ts";
+import { SandboxOps, type SandboxTarget } from "./SandboxClient.ts";
+/** A sandboxes client over a target resolved per call. */
+export declare const makeSandboxesClient: (target: Effect.Effect<SandboxTarget>, ops: SandboxOps, owner?: Effect.Effect<RuntimeOwner | undefined>) => SandboxesClient;
+/**
+ * {@link CreateSandbox} over Modal's API. Grants the host's identity (a scoped
+ * `Modal.ServiceUser`) the `contributor` role on the App's environment.
+ *
+ * @layer
+ * @product Sandbox
+ * @provides Modal.CreateSandbox
+ */
+export declare const CreateSandboxHttp: Layer.Layer<CreateSandbox, never, never>;
+//# sourceMappingURL=CreateSandboxHttp.d.ts.map

package/lib/CreateSandboxHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSandboxHttp.d.ts","sources":["../src/CreateSandboxHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,KAAK,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAGjG,OAAO,EAAE,KAAK,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAML,UAAU,EAGV,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAQ5B,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,WACtB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAC/B,UAAU,UACR,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,KAC7C,eAyDD,CAAC;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,0CAwD7B,CAAC"}

package/lib/CreateSandboxHttp.js

@@ -0,0 +1,117 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeModalBinding } from "./BindingHttp.js";
+import { CreateSandbox } from "./CreateSandbox.js";
+import { timestampOf } from "./internal.js";
+import { RuntimeOwnerOf, runtimeTags } from "./RuntimeOwner.js";
+import { createPersistentSandbox, createSandbox, listSandboxes, persistentSandboxHandle, restoreSandbox, SandboxOps, sandboxFromName, sandboxHandle, } from "./SandboxClient.js";
+const HOUR_MS = 3_600_000;
+/** A time rounded to an hour boundary, as Modal's usage query wants it. */
+const hourOf = (value, round) => timestampOf(round(new Date(value).getTime() / HOUR_MS) * HOUR_MS);
+/** A sandboxes client over a target resolved per call. */
+export const makeSandboxesClient = (target, ops, owner = Effect.undefined) => ({
+    appId: Effect.map(target, (t) => t.appId),
+    create: (options) => Effect.flatMap(Effect.all([target, owner]), ([t, o]) => createSandbox(ops, t, {
+        ...options,
+        // The owner's tags win over a user tag of the same key.
+        tags: o === undefined ? options?.tags : { ...options?.tags, ...runtimeTags(o) },
+    })),
+    fromName: (name) => Effect.flatMap(target, (t) => sandboxFromName(ops, t, name)),
+    fromId: (sandboxId) => Effect.map(target, (t) => sandboxHandle(ops, sandboxId, t)),
+    list: (options) => Effect.flatMap(target, (t) => listSandboxes(ops, t, options)),
+    usage: (query) => Effect.gen(function* () {
+        const t = yield* target;
+        const groups = [];
+        let pageToken;
+        for (let page = 0; page < 100; page++) {
+            const response = yield* ops.usage({
+                appId: t.appId,
+                // Modal reports usage by whole hours.
+                since: hourOf(query.since, Math.floor),
+                until: query.until === undefined ? undefined : hourOf(query.until, Math.ceil),
+                groupByTags: query.groupByTags ? [...query.groupByTags] : undefined,
+                tags: query.tags,
+                pageToken,
+            });
+            for (const group of response.groups ?? []) {
+                groups.push({
+                    tags: Object.fromEntries(Object.entries(group.tags ?? {}).map(([key, value]) => [key, value?.value ?? ""])),
+                    cost: group.cost ?? 0,
+                    costByResource: Object.fromEntries(Object.entries(group.costByResource ?? {}).map(([key, value]) => [key, value ?? 0])),
+                });
+            }
+            pageToken = response.nextPageToken || undefined;
+            if (pageToken === undefined)
+                break;
+        }
+        return groups;
+    }),
+    createPersistent: (options) => Effect.flatMap(target, (t) => createPersistentSandbox(ops, t, options)),
+    persistent: (box) => Effect.map(target, (t) => persistentSandboxHandle(ops, typeof box === "string" ? box : box.persistentSandboxId, t)),
+    restore: (snapshot, options) => Effect.gen(function* () {
+        const restored = yield* restoreSandbox(ops, yield* target, snapshot, options);
+        const o = yield* owner;
+        if (o !== undefined)
+            yield* restored.setTags(runtimeTags(o));
+        return restored;
+    }),
+});
+const isImage = (target) => target.Type === "Modal.Image";
+const isProgram = (target) => target.Type === "Modal.Sandbox";
+/**
+ * {@link CreateSandbox} over Modal's API. Grants the host's identity (a scoped
+ * `Modal.ServiceUser`) the `contributor` role on the App's environment.
+ *
+ * @layer
+ * @product Sandbox
+ * @provides Modal.CreateSandbox
+ */
+export const CreateSandboxHttp = Layer.effect(CreateSandbox, makeModalBinding({
+    tag: "Modal.CreateSandbox",
+    operations: SandboxOps,
+    role: "contributor",
+    make: Effect.fn(function* (resource, ops) {
+        const owner = yield* RuntimeOwnerOf();
+        if (isProgram(resource)) {
+            const imageId = yield* resource.imageId;
+            const appId = yield* resource.appId;
+            const appName = yield* resource.appName;
+            const environment = yield* resource.environment;
+            const secretId = yield* resource.secretId;
+            const command = yield* resource.command;
+            const port = yield* resource.port;
+            const mounts = yield* resource.mounts;
+            const target = Effect.all({
+                imageId,
+                appId,
+                appName,
+                environment,
+                secretId,
+                command,
+                port,
+                mounts,
+            }).pipe(Effect.map((t) => ({
+                imageId: t.imageId,
+                appId: t.appId,
+                appName: t.appName,
+                environment: t.environment,
+                program: { secretId: t.secretId, command: t.command, port: t.port, mounts: t.mounts },
+            })));
+            return makeSandboxesClient(target, ops, owner);
+        }
+        if (isImage(resource)) {
+            const imageId = yield* resource.imageId;
+            const appId = yield* resource.appId;
+            const appName = yield* resource.appName;
+            const environment = yield* resource.environment;
+            const target = Effect.all({ imageId, appId, appName, environment }).pipe(Effect.map((t) => t));
+            return makeSandboxesClient(target, ops, owner);
+        }
+        const appId = yield* resource.appId;
+        const appName = yield* resource.name;
+        const environment = yield* resource.environment;
+        const target = Effect.all({ appId, appName, environment }).pipe(Effect.map((t) => t));
+        return makeSandboxesClient(target, ops, owner);
+    }),
+}));
+//# sourceMappingURL=CreateSandboxHttp.js.map

package/lib/CreateSandboxHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSandboxHttp.js","sources":["../src/CreateSandboxHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAgD,MAAM,oBAAoB,CAAC;AAEjG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAqB,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,eAAe,EACf,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,MAAM,GAAG,CAAC,KAA6B,EAAE,KAA4B,EAAU,EAAE,CACrF,WAAW,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAEpE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAoC,EACpC,GAAe,EACf,KAAK,GAA4C,MAAM,CAAC,SAAS,EAChD,EAAE,CAAC,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACrD,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE;QACpB,GAAG,OAAO;QACV,wDAAwD;QACxD,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE;KAChF,CAAC,CACH;IACH,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAChF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,IAAI,SAA6B,CAAC;QAClC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;gBAChC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,sCAAsC;gBACtC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;gBACtC,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;gBAC7E,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS;aACV,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,MAAM,CAAC,WAAW,CACtB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAClF;oBACD,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;oBACrB,cAAc,EAAE,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CACpF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,SAAS,GAAG,QAAQ,CAAC,aAAa,IAAI,SAAS,CAAC;YAChD,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACJ,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAClB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACvB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CACzF;IACH,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS;YAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;CACL,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,MAA6B,EAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC;AAClG,MAAM,SAAS,GAAG,CAAC,MAA6B,EAAqB,EAAE,CACrE,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAC3C,aAAa,EACb,gBAAgB,CAAC;IACf,GAAG,EAAE,qBAAqB;IAC1B,UAAU,EAAE,UAAU;IACtB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAA+B,EAAE,GAAG;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;gBACxB,OAAO;gBACP,KAAK;gBACL,OAAO;gBACP,WAAW;gBACX,QAAQ;gBACR,OAAO;gBACP,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;aACtF,CAAC,CAAC,CACJ,CAAC;YACF,OAAO,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,CAAC,CACpC,CAAC;YACF,OAAO,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,CAAC,CACpC,CAAC;QACF,OAAO,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC;CACH,CAAC,CACH,CAAC"}

package/lib/CreateSecret.d.ts

@@ -0,0 +1,95 @@
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import type { SecretsOps } from "./CreateSecretHttp.ts";
+import type { Environment } from "./Environment.ts";
+import type { ErrorOf, OpError } from "./internal.ts";
+import type { lookupSecret, putSecret } from "./Secret.ts";
+import type { SecretAttributes } from "./Secret.ts";
+/** Write, find, list and delete secrets by name in one environment. */
+export interface SecretsClientOf<R> {
+    /**
+     * Create or overwrite the secret named `name` with `env`. Returns its
+     * attributes, to pass as a sandbox `secrets` entry or in an outbound
+     * header replacement.
+     */
+    put(name: string, env: Record<string, string | Redacted.Redacted<string>>): Effect.Effect<SecretAttributes, ErrorOf<typeof putSecret>, R>;
+    /** The secret named `name` (its variable names, never its values), or `undefined`. */
+    get(name: string): Effect.Effect<SecretAttributes | undefined, ErrorOf<typeof lookupSecret>, R>;
+    /** Delete the secret named `name` (no-op when missing). */
+    delete(name: string): Effect.Effect<void, ErrorOf<typeof lookupSecret> | Exclude<OpError<SecretsOps, "delete">, {
+        readonly _tag: "SecretNotFound";
+    }>, R>;
+    /** Names of every secret in the environment. */
+    list(): Effect.Effect<ReadonlyArray<string>, OpError<SecretsOps, "list">, R>;
+}
+/** A SecretsClient whose calls run inside a deployed runtime. */
+export type SecretsClient = SecretsClientOf<RuntimeContext>;
+/**
+ * Store secrets by name at runtime, such as one per user, and hand them to
+ * that user's sandboxes. With an outbound header replacement the sandbox
+ * never sees the value: Modal adds it to matching requests on the way out.
+ *
+ * Bind it to a `Modal.Environment` to keep these runtime secrets in their
+ * own namespace. They aren't in Alchemy state: deleting the environment
+ * removes them.
+ *
+ * Objects created at run time are tagged with the stack, stage and binding
+ * (`alchemy::stack`, `alchemy::stage`, `alchemy::id`) and are not deleted when
+ * the stack is destroyed. A Modal secret has only a name, so the tags become
+ * its name prefix, `Modal.runtimePrefix({ stack, stage, id })`: list them
+ * with `modal secret list` and delete the ones whose name starts with it.
+ *
+ * ### A user's token, injected at egress
+ * **Example:** From a Cloudflare Worker
+ * ```typescript
+ * import * as Cloudflare from "@alchemy.run/cloudflare";
+ * import * as Modal from "@alchemy.run/modal";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ * import { HttpServerRequest } from "effect/http/HttpServerRequest";
+ * import * as HttpServerResponse from "effect/http/HttpServerResponse";
+ * import { Agents, Coder } from "./Coder.ts";
+ *
+ * export default class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const secrets = yield* Modal.CreateSecret(Agents);
+ *     const sandboxes = yield* Modal.CreateSandbox(Coder);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         const user = request.headers["x-user"] ?? "anonymous";
+ *         const github = yield* secrets.put(`github-${user}`, {
+ *           GITHUB_TOKEN: request.headers["x-github-token"] ?? "",
+ *         });
+ *         const sandbox = yield* sandboxes.create({
+ *           outboundPolicy: {
+ *             routes: [
+ *               {
+ *                 https: {
+ *                   domains: ["api.github.com"],
+ *                   headerReplacements: [{ secret: github, headers: { Authorization: "Bearer $GITHUB_TOKEN" } }],
+ *                 },
+ *               },
+ *               { tls: { domains: ["github.com"] } },
+ *               { any: { redirect: "block" } },
+ *             ],
+ *           },
+ *         });
+ *         return HttpServerResponse.text(sandbox.sandboxId);
+ *       }).pipe(Effect.orDie),
+ *     };
+ *   }).pipe(Effect.provide(Layer.mergeAll(Modal.CreateSecretHttp, Modal.CreateSandboxHttp))),
+ * ) {}
+ * ```
+ *
+ * @binding
+ * @product Secret
+ */
+export interface CreateSecret extends Binding.Service<CreateSecret, "Modal.CreateSecret", (environment?: Environment) => Effect.Effect<SecretsClient>> {
+}
+export declare const CreateSecret: CreateSecret;
+//# sourceMappingURL=CreateSecret.d.ts.map

package/lib/CreateSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSecret.d.ts","sources":["../src/CreateSecret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,uEAAuE;AACvE,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC;;;;OAIG;IACH,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GACtD,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,sFAAsF;IACtF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,EAAE,OAAO,CAAC,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,2DAA2D;IAC3D,MAAM,CACJ,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,CACd,IAAI,EACF,OAAO,CAAC,OAAO,YAAY,CAAC,GAC5B,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,EAC7E,CAAC,CACF,CAAC;IACF,gDAAgD;IAChD,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9E;AAED,iEAAiE;AACjE,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO,CAAC,OAAO,CACnD,YAAY,EACZ,oBAAoB,EACpB,CAAC,WAAW,CAAC,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAC5D;CAAG;AAEJ,eAAO,MAAM,YAAY,cAAsD,CAAC"}

package/lib/CreateSecret.js

@@ -0,0 +1,3 @@
+import * as Binding from "alchemy/Binding";
+export const CreateSecret = Binding.Service("Modal.CreateSecret");
+//# sourceMappingURL=CreateSecret.js.map

package/lib/CreateSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSecret.js","sources":["../src/CreateSecret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AA4G3C,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAe,oBAAoB,CAAC,CAAC"}

package/lib/CreateSecretHttp.d.ts

@@ -0,0 +1,24 @@
+import * as secret from "@distilled.cloud/modal/secret";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { CreateSecret, type SecretsClientOf } from "./CreateSecret.ts";
+import { type RuntimeOwner } from "./RuntimeOwner.ts";
+/** The operations the client calls, resolved by `ModalBindings.withCredentials`. */
+export declare const SecretsOps: Effect.Effect<{
+    readonly getOrCreate: (input: secret.SecretGetOrCreateRequest) => Effect.Effect<secret.SecretGetOrCreateResponse, secret.SecretGetOrCreateError, never>;
+    readonly delete: (input: secret.DeleteSecretRequest) => Effect.Effect<secret.DeleteSecretResponse, secret.DeleteSecretError, never>;
+    readonly list: import("@distilled.cloud/core/api").PaginatedCall<secret.ListSecretRequest, secret.ListSecretResponse, secret.ListSecretError, never, secret.SecretListItem>;
+}, never, import("./internal.ts").OperationServices>;
+export type SecretsOps = Effect.Success<typeof SecretsOps>;
+/** A secrets client over an environment name resolved per call. */
+export declare const makeSecretsClient: (environment: Effect.Effect<string | undefined>, ops: SecretsOps, owner?: Effect.Effect<RuntimeOwner | undefined>) => SecretsClientOf<never>;
+/**
+ * {@link CreateSecret} over Modal's API. Grants the host's identity (a scoped
+ * `Modal.ServiceUser`) the `contributor` role on the environment.
+ *
+ * @layer
+ * @product Secret
+ * @provides Modal.CreateSecret
+ */
+export declare const CreateSecretHttp: Layer.Layer<CreateSecret, never, never>;
+//# sourceMappingURL=CreateSecretHttp.d.ts.map

package/lib/CreateSecretHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSecretHttp.d.ts","sources":["../src/CreateSecretHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAa,KAAK,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAG9F,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;;oDAIrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAC;AAE3D,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,gBACf,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,OACzC,UAAU,UACR,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,KAC7C,eAAe,CAAC,KAAK,CAmCtB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,yCAa5B,CAAC"}

package/lib/CreateSecretHttp.js

@@ -0,0 +1,60 @@
+import * as secret from "@distilled.cloud/modal/secret";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { makeOpenModalBinding } from "./BindingHttp.js";
+import { CreateSecret } from "./CreateSecret.js";
+import { environmentOf, listAll, operations } from "./internal.js";
+import { ownedName, RuntimeOwnerOf, unownedName } from "./RuntimeOwner.js";
+import { lookupSecret, putSecret } from "./Secret.js";
+/** The operations the client calls, resolved by `ModalBindings.withCredentials`. */
+export const SecretsOps = operations({
+    getOrCreate: secret.secretGetOrCreate,
+    delete: secret.deleteSecret,
+    list: secret.listSecret,
+});
+/** A secrets client over an environment name resolved per call. */
+export const makeSecretsClient = (environment, ops, owner = Effect.undefined) => ({
+    put: (name, env) => Effect.flatMap(Effect.all([environment, owner]), ([e, stamp]) => putSecret(ops.getOrCreate, ownedName(stamp, name), e, env)),
+    get: (name) => Effect.flatMap(Effect.all([environment, owner]), ([e, stamp]) => lookupSecret(ops.getOrCreate, ownedName(stamp, name), e)),
+    delete: (name) => Effect.gen(function* () {
+        const env = yield* environment;
+        const found = yield* lookupSecret(ops.getOrCreate, ownedName(yield* owner, name), env);
+        if (!found)
+            return;
+        yield* ops
+            .delete({ secretId: found.secretId })
+            .pipe(Effect.catchTag("SecretNotFound", () => Effect.void));
+    }),
+    list: () => Effect.gen(function* () {
+        const env = yield* environment;
+        const stamp = yield* owner;
+        const items = yield* listAll((pagination) => ops
+            .list({ environmentName: environmentOf(env), pagination })
+            .pipe(Effect.map((response) => response.items ?? [])), (item) => item.createdAt);
+        return items.flatMap((item) => {
+            const name = item.label ?? item.metadata?.name;
+            const own = name ? unownedName(stamp, name) : undefined;
+            return own ? [own] : [];
+        });
+    }),
+});
+/**
+ * {@link CreateSecret} over Modal's API. Grants the host's identity (a scoped
+ * `Modal.ServiceUser`) the `contributor` role on the environment.
+ *
+ * @layer
+ * @product Secret
+ * @provides Modal.CreateSecret
+ */
+export const CreateSecretHttp = Layer.effect(CreateSecret, makeOpenModalBinding({
+    tag: "Modal.CreateSecret",
+    operations: SecretsOps,
+    role: "contributor",
+    environmentOf: (environment) => environment?.name,
+    make: Effect.fn(function* (ops, environment) {
+        const name = environment ? yield* environment.name : Effect.undefined;
+        const owner = yield* RuntimeOwnerOf();
+        return makeSecretsClient(name, ops, owner);
+    }),
+}));
+//# sourceMappingURL=CreateSecretHttp.js.map

package/lib/CreateSecretHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateSecretHttp.js","sources":["../src/CreateSecretHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAwB,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,SAAS,EAAqB,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC,iBAAiB;IACrC,MAAM,EAAE,MAAM,CAAC,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC,UAAU;CACxB,CAAC,CAAC;AAIH,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,WAA8C,EAC9C,GAAe,EACf,KAAK,GAA4C,MAAM,CAAC,SAAS,EACzC,EAAE,CAAC,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAC9D,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAC3D;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CACZ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAC9D,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CACzD;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,CAAC,GAAG;aACP,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACJ,IAAI,EAAE,GAAG,EAAE,CACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,GAAG;aACA,IAAI,CAAC,EAAE,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;aACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EACzD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CACzB,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACL,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAC1C,YAAY,EACZ,oBAAoB,CAAC;IACnB,GAAG,EAAE,oBAAoB;IACzB,UAAU,EAAE,UAAU;IACtB,IAAI,EAAE,aAAa;IACnB,aAAa,EAAE,CAAC,WAAyB,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI;IAC/D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,WAAyB;QACvD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;CACH,CAAC,CACH,CAAC"}

package/lib/CreateVolume.d.ts

@@ -0,0 +1,84 @@
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { VolumesOps } from "./CreateVolumeHttp.ts";
+import type { Environment } from "./Environment.ts";
+import type { ErrorOf, OpError } from "./internal.ts";
+import type { ensureVolume, lookupVolume } from "./Volume.ts";
+import type { VolumeAttributes } from "./Volume.ts";
+import type { ReadWriteVolumeClient } from "./VolumeClient.ts";
+/** A volume created or found at runtime: its attributes plus a read-write client. */
+export interface VolumeHandle extends ReadWriteVolumeClient {
+    readonly volumeId: Effect.Effect<string>;
+    readonly name: string;
+    /** The attributes, to pass where a `Modal.Volume` is accepted (e.g. sandbox mounts). */
+    readonly attributes: VolumeAttributes;
+}
+/** Get, create, list and delete volumes by name in one environment. */
+export interface VolumesClientOf<R> {
+    /** The volume named `name`, created when missing (Modal's own get-or-create). */
+    getOrCreate(name: string): Effect.Effect<VolumeHandle, ErrorOf<typeof ensureVolume>, R>;
+    /** The volume named `name`, or `undefined`. */
+    get(name: string): Effect.Effect<VolumeHandle | undefined, ErrorOf<typeof lookupVolume>, R>;
+    /** Delete the volume named `name` (no-op when missing). */
+    delete(name: string): Effect.Effect<void, ErrorOf<typeof lookupVolume> | Exclude<OpError<VolumesOps, "delete">, {
+        readonly _tag: "VolumeNotFound";
+    }>, R>;
+    /** Names of every volume in the environment. */
+    list(): Effect.Effect<ReadonlyArray<string>, OpError<VolumesOps, "list">, R>;
+}
+/** A VolumesClient whose calls run inside a deployed runtime. */
+export type VolumesClient = VolumesClientOf<RuntimeContext>;
+/**
+ * Create volumes by name at runtime: one per user, session or task.
+ * Modal's native shape is get-or-create by name, so `getOrCreate` is
+ * idempotent and safe to call on every request.
+ *
+ * Bind it to a `Modal.Environment` to keep these runtime objects in their
+ * own namespace (or to nothing, for the workspace's default environment).
+ * They aren't in Alchemy state: deleting the environment removes them.
+ *
+ * Objects created at run time are tagged with the stack, stage and binding
+ * (`alchemy::stack`, `alchemy::stage`, `alchemy::id`) and are not deleted when
+ * the stack is destroyed. A Modal volume has only a name, so the tags become
+ * its name prefix, `Modal.runtimePrefix({ stack, stage, id })`: list them
+ * with `modal volume list` and delete the ones whose name starts with it.
+ *
+ * ### One volume per user
+ * **Example:** From a Cloudflare Worker
+ * ```typescript
+ * import * as Cloudflare from "@alchemy.run/cloudflare";
+ * import * as Modal from "@alchemy.run/modal";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ * import { HttpServerRequest } from "effect/http/HttpServerRequest";
+ * import * as HttpServerResponse from "effect/http/HttpServerResponse";
+ * import { Agents, Coder } from "./Coder.ts";
+ *
+ * export default class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const volumes = yield* Modal.CreateVolume(Agents);
+ *     const sandboxes = yield* Modal.CreateSandbox(Coder);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         const user = request.headers["x-user"] ?? "anonymous";
+ *         const home = yield* volumes.getOrCreate(`user-${user}`);
+ *         yield* home.writeFile("/notes.md", "hello");
+ *         const sandbox = yield* sandboxes.create({ mounts: [{ volume: home, path: "/home/user" }] });
+ *         return HttpServerResponse.text("ok");
+ *       }).pipe(Effect.orDie),
+ *     };
+ *   }).pipe(Effect.provide(Layer.mergeAll(Modal.CreateVolumeHttp, Modal.CreateSandboxHttp))),
+ * ) {}
+ * ```
+ *
+ * @binding
+ * @product Volume
+ */
+export interface CreateVolume extends Binding.Service<CreateVolume, "Modal.CreateVolume", (environment?: Environment) => Effect.Effect<VolumesClient>> {
+}
+export declare const CreateVolume: CreateVolume;
+//# sourceMappingURL=CreateVolume.d.ts.map