@alchemy.run/modal 0.0.0 → 2.0.0-beta.86

package/lib/ModalBindings.js

@@ -0,0 +1,223 @@
+import { GrpcTransport } from "@distilled.cloud/core/grpc-transport";
+import { withAuthToken } from "@distilled.cloud/modal/AuthToken";
+import { containerSocket, Credentials, CredentialsFromEnv, credentials, fromContainer, streamTaskCommandRouter, withTaskCommandRouter, } from "@distilled.cloud/modal/Credentials";
+import { orDieCredentialsUnavailable } from "alchemy/Auth/Resolve";
+import * as Binding from "alchemy/Binding";
+import * as Output from "alchemy/Output";
+import { CurrentRuntimeContext } from "alchemy/RuntimeContext";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import { withAuthTokens } from "./Credentials.js";
+import { ModalTransport } from "./internal/Transport.js";
+import { ServiceUser } from "./ServiceUser.js";
+/**
+ * How a Modal binding reaches Modal from its host.
+ *
+ * Modal grants access per environment, as a `viewer` or a `contributor`. So:
+ *
+ * - a Modal Function or Server: nothing is bound. It calls Modal as its own
+ *   container, over the API socket Modal gives every container
+ *   (`fromContainer`), the way Modal's Python client does there. No
+ *   credential is stored. A host with `restrictModalAccess` has no such
+ *   access, so it gets a service user like any other host;
+ * - any other host (a Cloudflare Worker, a Lambda, a Modal Sandbox):
+ *   {@link Bind} creates a scoped `Modal.ServiceUser` for the
+ *   host (`<host>ModalIdentity`), grants it the role each binding asks for
+ *   on the bound resource's environment, and binds its token pair into the
+ *   host's env (`MODAL_TOKEN_ID`, and `MODAL_TOKEN_SECRET` kept `Redacted`);
+ * - no host (a script or a deploy-time Action): nothing is bound, and calls
+ *   use the deployer's credentials.
+ *
+ * Modal's Starter plan has no service users. There, provide
+ * {@link DeployerHostIdentity} to bind the deployer's own token pair into
+ * each host instead: hosts then act with the deployer's workspace-wide
+ * access, not the roles their bindings ask for.
+ *
+ * Import it as a namespace. A binding resolves its operations with
+ * {@link withCredentials} and gets its `bind` from {@link Bind} when its layer
+ * is built, then binds behind its own `__ALCHEMY_RUNTIME__` guard:
+ *
+ * ```ts
+ * Effect.gen(function* () {
+ *   const put = yield* ModalBindings.withCredentials(modalQueue.putQueue);
+ *   const bind = yield* ModalBindings.Bind;
+ *   return Effect.fn(function* (queue: Queue) {
+ *     if (!globalThis.__ALCHEMY_RUNTIME__) {
+ *       yield* bind`Modal.WriteQueue(${queue})`({
+ *         roles: [{ environment: queue.environment, role: "contributor" }],
+ *       });
+ *     }
+ *     const queueId = yield* queue.queueId;
+ *     return (value) => put({ queueId: yield* queueId, values: [...] });
+ *   });
+ * })
+ * ```
+ */
+export const TOKEN_ENV = {
+    id: "MODAL_TOKEN_ID",
+    secret: "MODAL_TOKEN_SECRET",
+    // Not MODAL_SERVER_URL: inside a Modal container, Modal sets that to the
+    // container's own socket (`unix:/run/modal.sock`), shadowing ours.
+    serverUrl: "ALCHEMY_MODAL_SERVER_URL",
+};
+/**
+ * The identity {@link Bind} gives a binding's host:
+ *
+ * - `"service-user"`: a scoped `Modal.ServiceUser` per host with only the
+ *   roles its bindings ask for (needs Modal's Team or Enterprise plan);
+ * - `"deployer"`: the deployer's own token pair, with its workspace-wide
+ *   access (for the Starter plan, which has no service users).
+ *
+ * Set it with {@link DeployerHostIdentity}.
+ */
+export const HostIdentity = Context.Reference("Modal/HostIdentity", {
+    defaultValue: () => "service-user",
+});
+/**
+ * Bind the deployer's own Modal token into binding hosts instead of a
+ * scoped service user per host. Use it on Modal's Starter plan, which has
+ * no service users; hosts then have the deployer's workspace-wide access.
+ *
+ * @example
+ * ```ts
+ * export default Alchemy.Stack(
+ *   "App",
+ *   { providers: Layer.mergeAll(Cloudflare.providers(), Modal.providers(), Modal.DeployerHostIdentity) },
+ *   Effect.gen(function* () { ... }),
+ * );
+ * ```
+ */
+export const DeployerHostIdentity = Layer.succeed(HostIdentity, "deployer");
+const labelled = (verb, label) => {
+    const strings = [`${verb}(`, `, ${label[0]}`, ...label.slice(1)];
+    strings[strings.length - 1] += ")";
+    return Object.assign(strings, { raw: strings });
+};
+/**
+ * The `bind` for a binding's layer: yield it while the layer is built, then
+ * call it from the returned function behind a literal
+ * `if (!globalThis.__ALCHEMY_RUNTIME__)` so the bundler drops it. On a host it
+ * grants `data.roles` to the host's service user and binds that user's token
+ * pair (and `data.env`) into the host's env; with no host it does nothing.
+ */
+export const Bind = Effect.gen(function* () {
+    // Bindings only bind at deploy, so a host bundle captures nothing here
+    // and drops the identity resource.
+    if (globalThis.__ALCHEMY_RUNTIME__)
+        return () => () => Effect.void;
+    const Identity = yield* ServiceUser;
+    const identity = yield* HostIdentity;
+    const ambient = yield* Effect.serviceOption(Credentials);
+    return (label, ...args) => Effect.fn(function* (data = {}) {
+        const host = yield* Binding.Host;
+        if (host === undefined)
+            return;
+        const runtime = yield* CurrentRuntimeContext;
+        if (runtime === undefined)
+            return;
+        // A binding that calls no Modal API (only `env`) needs no identity, and
+        // a Modal Function or Server calls as its own container.
+        if (data.roles !== undefined && data.roles.length > 0 && !callsAsContainer(host)) {
+            // The host talks to the deployer's Modal control plane.
+            const resolve = Option.isSome(ambient)
+                ? ambient.value
+                : yield* Credentials.pipe(Effect.provide(CredentialsFromEnv));
+            // Binding initialization can't fail; the engine reports this defect as
+            // `CredentialsRequired`.
+            const creds = yield* resolve.pipe(orDieCredentialsUnavailable("Modal"));
+            if (identity === "deployer") {
+                yield* runtime.set(TOKEN_ENV.id, creds.tokenId.pipe(Redacted.value, Output.literal));
+                yield* runtime.set(TOKEN_ENV.secret, Output.literal(creds.tokenSecret));
+            }
+            else {
+                const user = yield* Identity(`${host.LogicalId}ModalIdentity`, { scoped: true });
+                yield* user.bind(labelled("Allow", label), host, ...args)({ environments: data.roles });
+                yield* runtime.set(TOKEN_ENV.id, user.tokenId);
+                yield* runtime.set(TOKEN_ENV.secret, user.tokenSecret);
+            }
+            yield* runtime.set(TOKEN_ENV.serverUrl, Output.literal(creds.apiBaseUrl));
+        }
+        for (const [name, value] of Object.entries(data.env ?? {})) {
+            yield* runtime.set(name, Output.isOutput(value) ? value : Output.literal(value));
+        }
+    });
+});
+/** Host types whose containers call Modal over their own API socket. */
+const CONTAINER_HOSTS = new Set(["Modal.Function", "Modal.Server"]);
+/** Whether `host` calls Modal as its container instead of with a bound token. */
+const callsAsContainer = (host) => CONTAINER_HOSTS.has(host.Type ?? "") &&
+    !host.Props?.restrictModalAccess;
+/**
+ * The credentials, HTTP client and gRPC transport distilled operations run
+ * with on this host. A resolved operation keeps them as a fallback under its
+ * caller's context, so a Worker's own `HttpClient` doesn't displace the
+ * transport.
+ */
+const operationContext = Effect.gen(function* () {
+    const runtime = yield* CurrentRuntimeContext;
+    if (globalThis.__ALCHEMY_RUNTIME__ && runtime !== undefined) {
+        const tokenId = yield* runtime.get(TOKEN_ENV.id);
+        const tokenSecret = yield* runtime.get(TOKEN_ENV.secret);
+        if (tokenId !== undefined && tokenSecret !== undefined) {
+            const serverUrl = yield* runtime.get(TOKEN_ENV.serverUrl);
+            return yield* Layer.build(Layer.mergeAll(withAuthTokens(credentials({
+                tokenId: Redacted.make(tokenId),
+                tokenSecret: Redacted.isRedacted(tokenSecret)
+                    ? tokenSecret
+                    : Redacted.make(tokenSecret),
+                apiBaseUrl: serverUrl,
+            })), ModalTransport)).pipe(Effect.scoped);
+        }
+        // A Modal Function or Server: call as the container (see `Bind`).
+        const socket = yield* containerSocket;
+        if (socket !== undefined) {
+            return yield* Layer.build(Layer.mergeAll(withAuthToken.pipe(Layer.provide(Layer.mergeAll(fromContainer, FetchHttpClient.layer))), fromContainer, FetchHttpClient.layer)).pipe(Effect.orDie, Effect.scoped);
+        }
+    }
+    // No bound identity (deploy, scripts, Actions): the ambient Modal
+    // credentials, falling back to `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET`.
+    const ambientCredentials = yield* Effect.serviceOption(Credentials);
+    const ambientHttp = yield* Effect.serviceOption(HttpClient.HttpClient);
+    const transport = yield* Effect.provide(Effect.service(GrpcTransport), ModalTransport);
+    return Context.make(Credentials, Option.isSome(ambientCredentials)
+        ? ambientCredentials.value
+        : yield* Credentials.pipe(Effect.provide(withAuthTokens(CredentialsFromEnv)))).pipe(Context.add(HttpClient.HttpClient, Option.isSome(ambientHttp)
+        ? ambientHttp.value
+        : yield* HttpClient.HttpClient.pipe(Effect.provide(ModalTransport))), Context.add(GrpcTransport, transport));
+});
+/**
+ * Resolve a distilled operation (or several, with `Effect.all`) once when
+ * the binding's layer is built: with the token pair {@link Bind} bound into
+ * the host, or the deployer's credentials when there is none.
+ *
+ * @example
+ * ```ts
+ * const ops = yield* ModalBindings.withCredentials(
+ *   operations({ getFile: volume.volumeGetFile2, putFiles: volume.volumePutFiles2 }),
+ * );
+ * ```
+ */
+export const withCredentials = Effect.fn(function* (operation) {
+    const context = yield* operationContext;
+    return yield* operation.pipe(Effect.provide(context));
+});
+/**
+ * Resolve a task command router operation for one sandbox: the router runs
+ * per task, at a URL with its own JWT (from `sandboxGetCommandRouterAccess`).
+ * The router credentials are applied on every call, because a resolved
+ * operation runs with its caller's `Credentials` (the control plane's) over
+ * the ones it captured. `withTaskCommandRouter` also supplies the HTTP/2
+ * client the router requires.
+ */
+export const withRouter = (operation) => (access) => Effect.succeed((input) => operation(input).pipe(withTaskCommandRouter(access)));
+/**
+ * {@link withRouter} for a server-streaming router operation: its `.stream`,
+ * which emits each message as the router sends it.
+ */
+export const streamRouter = (operation) => (access) => Effect.succeed((input) => operation.stream(input).pipe(streamTaskCommandRouter(access)));
+//# sourceMappingURL=ModalBindings.js.map

package/lib/ModalBindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ModalBindings.js","sources":["../src/ModalBindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EACL,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,EAAE,EAAE,gBAAgB;IACpB,MAAM,EAAE,oBAAoB;IAC5B,yEAAyE;IACzE,mEAAmE;IACnE,SAAS,EAAE,0BAA0B;CAC7B,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAA8B,oBAAoB,EAAE;IAC/F,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc;CACnC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAuB,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AA2BhG,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAA2B,EAAwB,EAAE;IACnF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAoC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAA4B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/D,uEAAuE;IACvE,mCAAmC;IACnC,IAAI,UAAU,CAAC,mBAAmB;QAAE,OAAO,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACzD,OAAO,CAAC,KAA2B,EAAE,GAAG,IAAe,EAAE,EAAE,CACzD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAgB,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAElC,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,wDAAwD;YACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,KAAK;gBACf,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAChE,uEAAuE;YACvE,yBAAyB;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;YACxE,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrF,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,KAAK,CAAC,CAAE,IAA8B,CAAC,IAAI,CACzC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EACxB,IAAI,EACJ,GAAG,IAAI,CACR,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,IAA0D,EAAE,EAAE,CACtF,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,CAAE,IAAI,CAAC,KAAgE,EAAE,mBAAmB,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;IAC7C,IAAI,UAAU,CAAC,mBAAmB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAS,SAAS,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAqC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7F,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAS,SAAS,CAAC,SAAS,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CACvB,KAAK,CAAC,QAAQ,CACZ,cAAc,CACZ,WAAW,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC/B,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;oBAC3C,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC9B,UAAU,EAAE,SAAS;aACtB,CAAC,CACH,EACD,cAAc,CACf,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,kEAAkE;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CACvB,KAAK,CAAC,QAAQ,CACZ,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EACvF,aAAa,EACb,eAAe,CAAC,KAAK,CACtB,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC,IAAI,CACjB,WAAW,EACX,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC/B,CAAC,CAAC,kBAAkB,CAAC,KAAK;QAC1B,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAChF,CAAC,IAAI,CACJ,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACxB,CAAC,CAAC,WAAW,CAAC,KAAK;QACnB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CACtE,EACD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CACtC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAEH,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC1C,SAAsD;IAEtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IACxC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GACrB,CAAU,SAA+D,EAAE,EAAE,CAC7E,CAAC,MAAoB,EAAoD,EAAE,CACzE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GACvB,CAAU,SAAoF,EAAE,EAAE,CAClG,CAAC,MAAoB,EAAoD,EAAE,CACzE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC"}

package/lib/MountBucket.d.ts

@@ -0,0 +1,80 @@
+import * as Binding from "alchemy/Binding";
+import type * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { type BucketMount, type BucketMountOptions, type MountedBucket } from "./Mounts.ts";
+import type { Secret } from "./Secret.ts";
+/**
+ * A bucket resource of another provider: an AWS S3 Bucket, a Cloudflare R2
+ * Bucket, a GCS bucket. Its name (and, for R2, its account endpoint) is
+ * read from its attributes.
+ */
+export interface BucketResource {
+    readonly Type: string;
+    readonly bucketName: Output.Output<string, never>;
+}
+/** Options for `Modal.MountBucket`: Modal's cloud bucket mount fields, plus the keys' secret. */
+export interface MountBucketOptions extends BucketMountOptions {
+    /**
+     * A `Modal.Secret` holding the bucket's keys (`AWS_ACCESS_KEY_ID` /
+     * `AWS_SECRET_ACCESS_KEY`, or GCS HMAC keys). Omit it with `oidcAuthRoleArn`.
+     */
+    readonly secret?: Secret;
+}
+/** What `Modal.MountBucket` returns: a mount entry, ready for `mounts`. */
+export type BucketMountRef = BucketMount<string | MountedBucket, {
+    readonly secretId: Effect.Effect<string>;
+}>;
+/**
+ * Mount a cloud bucket at `path` with Modal's cloud bucket mounts: a bucket
+ * name, or a bucket resource of another provider (an AWS S3 Bucket, a
+ * Cloudflare R2 Bucket, whose account endpoint is filled in).
+ *
+ * - In a `Modal.Function`, `Modal.Server` or `Modal.Sandbox` program, the
+ *   bucket is mounted into every container the program runs in.
+ * - In any other runtime, the binding returns the entry to pass to
+ *   `sandboxes.create({ mounts })`.
+ *
+ * Modal reads the bucket with the keys in `secret`, or by assuming
+ * `oidcAuthRoleArn` with its OIDC identity.
+ *
+ * ### Mount an R2 bucket
+ * **Example:** A sandbox program reading uploads from Cloudflare R2
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ * import * as Effect from "effect/Effect";
+ * import * as FileSystem from "effect/FileSystem";
+ * import * as HttpServerResponse from "effect/http/HttpServerResponse";
+ * import { Coder, R2Keys, Uploads } from "./Storage.ts";
+ *
+ * export default class Agent extends Modal.Sandbox<Agent>()(
+ *   "Agent",
+ *   { main: import.meta.url, app: Coder },
+ *   Effect.gen(function* () {
+ *     const uploads = yield* Modal.MountBucket(Uploads, { path: "/uploads", secret: R2Keys });
+ *     const fs = yield* FileSystem.FileSystem;
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         return yield* HttpServerResponse.json(yield* fs.readDirectory(uploads.path));
+ *       }).pipe(Effect.orDie),
+ *     };
+ *   }).pipe(Effect.provide(Modal.MountBucketLive)),
+ * ) {}
+ * ```
+ *
+ * @binding
+ * @product Volume
+ */
+export interface MountBucket extends Binding.Service<MountBucket, "Modal.MountBucket", (bucket: string | BucketResource, options: MountBucketOptions) => Effect.Effect<BucketMountRef>> {
+}
+export declare const MountBucket: MountBucket;
+/**
+ * {@link MountBucket}: binds the entry into a Modal runtime's `mounts`, or
+ * resolves it for `sandboxes.create` in any other runtime.
+ *
+ * @layer
+ * @product Volume
+ * @provides Modal.MountBucket
+ */
+export declare const MountBucketLive: Layer.Layer<MountBucket, never, never>;
+//# sourceMappingURL=MountBucket.d.ts.map

package/lib/MountBucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MountBucket.d.ts","sources":["../src/MountBucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAEnB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CACnD;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,WAAW,CACtC,MAAM,GAAG,aAAa,EACtB;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;CAAE,CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,OAAO,CAClD,WAAW,EACX,mBAAmB,EACnB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,OAAO,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAChG;CAAG;AAEJ,eAAO,MAAM,WAAW,aAAoD,CAAC;AAI7E;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,wCAwC3B,CAAC"}

package/lib/MountBucket.js

@@ -0,0 +1,44 @@
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { r2Endpoint, } from "./Mounts.js";
+import { MODAL_RUNTIMES } from "./MountVolume.js";
+export const MountBucket = Binding.Service("Modal.MountBucket");
+const R2_BUCKET = "Cloudflare.R2.Bucket";
+/**
+ * {@link MountBucket}: binds the entry into a Modal runtime's `mounts`, or
+ * resolves it for `sandboxes.create` in any other runtime.
+ *
+ * @layer
+ * @product Volume
+ * @provides Modal.MountBucket
+ */
+export const MountBucketLive = Layer.effect(MountBucket, Effect.succeed(Effect.fn("Modal.MountBucket")(function* (bucket, options) {
+    const { secret, ...rest } = options;
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+        const host = yield* Binding.Host;
+        if (host !== undefined && MODAL_RUNTIMES.has(host.Type)) {
+            yield* host.bind `Modal.MountBucket(${bucket})`({
+                mounts: [{ ...rest, bucket, secret }],
+            });
+        }
+    }
+    const secretRef = secret === undefined ? undefined : { secretId: yield* secret.secretId };
+    if (typeof bucket === "string") {
+        return { ...rest, bucket, secret: secretRef };
+    }
+    const bucketName = yield* bucket.bucketName;
+    if (bucket.Type === R2_BUCKET) {
+        const r2 = bucket;
+        const accountId = yield* r2.accountId;
+        const jurisdiction = yield* r2.jurisdiction;
+        const endpointUrl = Effect.map(Effect.all([accountId, jurisdiction]), ([account, j]) => r2Endpoint(account, j));
+        return {
+            ...rest,
+            bucket: { bucketName, endpointUrl, type: "r2" },
+            secret: secretRef,
+        };
+    }
+    return { ...rest, bucket: { bucketName }, secret: secretRef };
+})));
+//# sourceMappingURL=MountBucket.js.map

package/lib/MountBucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MountBucket.js","sources":["../src/MountBucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAIL,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAkB,MAAM,kBAAkB,CAAC;AA0ElE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,mBAAmB,CAAC,CAAC;AAE7E,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CACzC,WAAW,EACX,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EACtC,MAA+B,EAC/B,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,CAAE,IAA6B,CAAC,IAAI,CAAA,qBAAqB,MAAM,GAAG,CAAC;gBACvE,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1F,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAA2B,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAGV,CAAC;QACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC;QACtC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACrF,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CACvB,CAAC;QACF,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,SAAS;SACO,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAA2B,CAAC;AACzF,CAAC,CAAC,CACH,CACF,CAAC"}

package/lib/MountVolume.d.ts

@@ -0,0 +1,77 @@
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { MountedVolume, VolumeMount, VolumeMountOptions } from "./Mounts.ts";
+import type { Volume } from "./Volume.ts";
+/** What `Modal.MountVolume` returns: a mount entry, ready for `mounts`. */
+export type VolumeMountRef = VolumeMount<MountedVolume>;
+/**
+ * Mount a `Modal.Volume` at `path`.
+ *
+ * - In a `Modal.Function`, `Modal.Server` or `Modal.Sandbox` program, the
+ *   volume is mounted into every container the program runs in: read it at
+ *   `path` with the filesystem.
+ * - In any other runtime (a Worker, a Lambda), the binding grants the
+ *   runtime's Modal identity access to the volume's environment and returns
+ *   the entry to pass to `sandboxes.create({ mounts })`.
+ *
+ * The returned reference holds the same fields as a plain entry
+ * (`{ volume, path, readOnly?, subPath? }`).
+ *
+ * ### Mount into a program
+ * **Example:** A Function reading model weights from a volume
+ * ```typescript
+ * import * as Modal from "@alchemy.run/modal";
+ * import * as Effect from "effect/Effect";
+ * import * as FileSystem from "effect/FileSystem";
+ * import * as HttpServerResponse from "effect/http/HttpServerResponse";
+ * import { Backend, Weights } from "./Backend.ts";
+ *
+ * export default class Embed extends Modal.Function<Embed>()(
+ *   "Embed",
+ *   { main: import.meta.url, app: Backend, gpu: "L4" },
+ *   Effect.gen(function* () {
+ *     const weights = yield* Modal.MountVolume(Weights, { path: "/weights", readOnly: true });
+ *     const fs = yield* FileSystem.FileSystem;
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         return yield* HttpServerResponse.json(yield* fs.readDirectory(weights.path));
+ *       }).pipe(Effect.orDie),
+ *     };
+ *   }).pipe(Effect.provide(Modal.MountVolumeLive)),
+ * ) {}
+ * ```
+ *
+ * ### Mount into a sandbox you create
+ * **Example:** From a Cloudflare Worker
+ * ```typescript
+ * const data = yield* Modal.MountVolume(Data, { path: "/data" });
+ * const sandboxes = yield* Modal.CreateSandbox(Coder);
+ * // per request
+ * const sandbox = yield* sandboxes.create({ mounts: [data] });
+ * ```
+ *
+ * @binding
+ * @product Volume
+ */
+export interface MountVolume extends Binding.Service<MountVolume, "Modal.MountVolume", (volume: Volume, options: VolumeMountOptions) => Effect.Effect<VolumeMountRef>> {
+}
+export declare const MountVolume: MountVolume;
+/** Runtimes that mount volumes into their own containers. */
+export declare const MODAL_RUNTIMES: Set<string>;
+/** A Modal runtime's `bind`, typed for the `mounts` slice of its binding contract. */
+export type MountHost = {
+    bind: (label: TemplateStringsArray, ...args: unknown[]) => (data: {
+        readonly mounts: ReadonlyArray<unknown>;
+    }) => Effect.Effect<void>;
+};
+/**
+ * {@link MountVolume}: binds the entry into a Modal runtime's `mounts`, or
+ * grants another runtime's identity access to the volume's environment.
+ *
+ * @layer
+ * @product Volume
+ * @provides Modal.MountVolume
+ */
+export declare const MountVolumeLive: Layer.Layer<MountVolume, never, never>;
+//# sourceMappingURL=MountVolume.d.ts.map

package/lib/MountVolume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MountVolume.d.ts","sources":["../src/MountVolume.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,OAAO,CAClD,WAAW,EACX,mBAAmB,EACnB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAC/E;CAAG;AAEJ,eAAO,MAAM,WAAW,aAAoD,CAAC;AAE7E,6DAA6D;AAC7D,eAAO,MAAM,cAAc,aAA+D,CAAC;AAE3F,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,CACJ,KAAK,EAAE,oBAAoB,EAC3B,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;KAAE,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACjF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,wCA0B3B,CAAC"}

package/lib/MountVolume.js

@@ -0,0 +1,41 @@
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ModalBindings from "./ModalBindings.js";
+export const MountVolume = Binding.Service("Modal.MountVolume");
+/** Runtimes that mount volumes into their own containers. */
+export const MODAL_RUNTIMES = new Set(["Modal.Function", "Modal.Server", "Modal.Sandbox"]);
+/**
+ * {@link MountVolume}: binds the entry into a Modal runtime's `mounts`, or
+ * grants another runtime's identity access to the volume's environment.
+ *
+ * @layer
+ * @product Volume
+ * @provides Modal.MountVolume
+ */
+export const MountVolumeLive = Layer.effect(MountVolume, Effect.gen(function* () {
+    const bind = yield* ModalBindings.Bind;
+    return Effect.fn("Modal.MountVolume")(function* (volume, options) {
+        if (!globalThis.__ALCHEMY_RUNTIME__) {
+            const host = yield* Binding.Host;
+            if (host !== undefined && MODAL_RUNTIMES.has(host.Type)) {
+                yield* host.bind `Modal.MountVolume(${volume})`({
+                    mounts: [{ volume, ...options }],
+                });
+            }
+            else {
+                yield* bind `Modal.MountVolume(${volume})`({
+                    roles: [
+                        {
+                            environment: volume.environment,
+                            role: options.readOnly ? "viewer" : "contributor",
+                        },
+                    ],
+                });
+            }
+        }
+        const volumeId = yield* volume.volumeId;
+        return { ...options, volume: { volumeId } };
+    });
+}));
+//# sourceMappingURL=MountVolume.js.map

package/lib/MountVolume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MountVolume.js","sources":["../src/MountVolume.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AA8DpD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,mBAAmB,CAAC,CAAC;AAE7E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAU3F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CACzC,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;IACvC,OAAO,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAc,EAAE,OAA2B;QAC1F,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,KAAK,CAAC,CAAE,IAA6B,CAAC,IAAI,CAAA,qBAAqB,MAAM,GAAG,CAAC;oBACvE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,CAAC,IAAI,CAAA,qBAAqB,MAAM,GAAG,CAAC;oBACxC,KAAK,EAAE;wBACL;4BACE,WAAW,EAAE,MAAM,CAAC,WAAW;4BAC/B,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;yBAClD;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxC,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAA2B,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/lib/Mounts.d.ts

@@ -0,0 +1,134 @@
+import type * as sandbox from "@distilled.cloud/modal/sandbox";
+import { type MountCapability } from "alchemy/Mount";
+import * as Effect from "effect/Effect";
+import type { Ref } from "./Container.ts";
+/** A value known at deploy, or an Effect that reads it at runtime. */
+type Lazy<T> = T | Effect.Effect<T>;
+/** A volume entry's options besides the volume: Modal's own volume mount fields. */
+export interface VolumeMountOptions {
+    /** Absolute path the volume is mounted at. */
+    readonly path: string;
+    /** Mount read-only. */
+    readonly readOnly?: boolean;
+    /** Mount this directory of the volume instead of its root. */
+    readonly subPath?: string;
+}
+/** A bucket entry's options besides the bucket: Modal's own cloud bucket mount fields. */
+export interface BucketMountOptions {
+    /** Absolute path the bucket is mounted at. */
+    readonly path: string;
+    /**
+     * The bucket's storage API.
+     * @default "r2" for a Cloudflare R2 bucket, "s3" otherwise
+     */
+    readonly type?: "s3" | "r2" | "gcp";
+    /**
+     * S3-compatible endpoint.
+     * @default the account endpoint, for a Cloudflare R2 bucket
+     */
+    readonly endpointUrl?: string;
+    /** Mount only keys under this prefix. */
+    readonly keyPrefix?: string;
+    /** Mount read-only. */
+    readonly readOnly?: boolean;
+    /** Assume this AWS role with Modal's OIDC identity instead of a secret. */
+    readonly oidcAuthRoleArn?: string;
+}
+/** The fields of a bucket resource a mount reads: AWS S3, Cloudflare R2, GCS. */
+export interface BucketLike {
+    readonly bucketName: string;
+    /** Cloudflare R2: the account the bucket's endpoint is under. */
+    readonly accountId?: string;
+    /** Cloudflare R2: `"eu"` or `"fedramp"` buckets have their own endpoint. */
+    readonly jurisdiction?: string;
+}
+/**
+ * A `Modal.Volume` mounted at `path`. In Stack props the volume is the
+ * declared `Modal.Volume`; at runtime it's a handle (`CreateVolume`) or
+ * the reference `Modal.MountVolume` returns.
+ */
+export interface VolumeMount<V = Ref<{
+    readonly volumeId: string;
+}>> extends VolumeMountOptions {
+    readonly volume: V;
+}
+/**
+ * A cloud bucket mounted at `path` with Modal's cloud bucket mounts: a
+ * bucket name, or a bucket resource of another provider (an AWS S3 Bucket,
+ * a Cloudflare R2 Bucket). Without `oidcAuthRoleArn`, `secret` holds the
+ * bucket's keys (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`, or GCS HMAC
+ * keys).
+ */
+export interface BucketMount<B = string | Ref<BucketLike>, S = Ref<{
+    readonly secretId: string;
+}>> extends BucketMountOptions {
+    readonly bucket: B;
+    readonly secret?: S;
+}
+/** A mount in Stack props (`Modal.Function`, `Server`, `Sandbox`, `PersistentSandbox`). */
+export type Mount = VolumeMount | BucketMount;
+/** The volume of a runtime mount entry: a volume handle, or a `MountVolume` reference. */
+export interface MountedVolume {
+    readonly volumeId: Lazy<string>;
+}
+/** The bucket of a runtime mount entry, as `MountBucket` resolves it. */
+export interface MountedBucket {
+    readonly bucketName: Lazy<string>;
+    readonly endpointUrl?: Lazy<string | undefined>;
+    readonly type?: "s3" | "r2" | "gcp";
+}
+/** A mount for `sandboxes.create`: a plain entry over handles, or a `Mount<Noun>` reference. */
+export type SandboxMount = VolumeMount<MountedVolume> | BucketMount<string | MountedBucket, {
+    readonly secretId: Lazy<string>;
+}>;
+declare const MountNotBound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Modal.MountNotBound";
+} & Readonly<A>;
+/** A mount entry referenced a resource that isn't bound into this runtime. */
+export declare class MountNotBound extends MountNotBound_base<{
+    readonly path: string;
+    readonly message: string;
+}> {
+}
+/** Modal's mount fields for a set of entries. */
+export interface ModalMounts {
+    readonly volumeMounts: sandbox.VolumeMount[];
+    readonly cloudBucketMounts: sandbox.CloudBucketMount[];
+}
+/** Cloudflare R2's S3 endpoint for an account (and jurisdiction). */
+export declare const r2Endpoint: (accountId: string, jurisdiction?: string) => string;
+/**
+ * Modal's `volumeMounts` and `cloudBucketMounts` for mount entries whose
+ * resources are resolved: attributes at reconcile, handles or `Mount<Noun>`
+ * references at runtime.
+ */
+export declare const modalMountsOf: (mounts: ReadonlyArray<Mount | SandboxMount> | undefined) => Effect.Effect<ModalMounts, MountNotBound>;
+/**
+ * What a Modal runtime's `mounts` binding contract holds: volume and bucket
+ * entries (`Modal.MountVolume`, `Modal.MountBucket`), and the install lines
+ * of other providers' mount clients (`alchemy/Mount`).
+ */
+export type MountContract = ReadonlyArray<Mount | MountCapability>;
+/** A host's binding data, for its `mounts` slice. */
+export type MountBindings = ReadonlyArray<{
+    readonly data: {
+        readonly mounts?: MountContract;
+    };
+}>;
+/** The volume and bucket entries a host's bindings contributed, in binding order. */
+export declare const boundMounts: (bindings: MountBindings) => ReadonlyArray<Mount>;
+/** The mount clients other providers' bindings asked the host's image to install. */
+export declare const boundCapabilities: (bindings: MountBindings) => ReadonlyArray<MountCapability>;
+/**
+ * What a Modal container provides to mount clients. Modal runs containers
+ * under gVisor without `CAP_SYS_ADMIN`: `/dev/fuse` exists, but `mount`
+ * fails with permission denied, for FUSE and NFS alike.
+ */
+export declare const MODAL_MOUNT_SUPPORT: {
+    readonly fuse: false;
+    readonly nfs: false;
+};
+/** Fail when a mount client needs what a Modal container can't provide. */
+export declare const checkModalMounts: (host: string, capabilities: ReadonlyArray<MountCapability>) => Effect.Effect<void, never, never> | Effect.Effect<never, import("alchemy/Mount").MountUnsupported, never>;
+export {};
+//# sourceMappingURL=Mounts.d.ts.map

package/lib/Mounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Mounts.d.ts","sources":["../src/Mounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,OAAO,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAA+C,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGlG,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAE1C,sEAAsE;AACtE,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uBAAuB;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,GAAG,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAE,SAAQ,kBAAkB;IAC7F,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,EAC5B,CAAC,GAAG,GAAG,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CACtC,SAAQ,kBAAkB;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACrB;AAED,2FAA2F;AAC3F,MAAM,MAAM,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC;AAE9C,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,CAAC;CACrC;AAED,gGAAgG;AAChG,MAAM,MAAM,YAAY,GACpB,WAAW,CAAC,aAAa,CAAC,GAC1B,WAAW,CAAC,MAAM,GAAG,aAAa,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;;;;AAE7E,8EAA8E;AAC9E,qBAAa,aAAc,SAAQ,mBAAwC;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;CACxD;AAID,qEAAqE;AACrE,eAAO,MAAM,UAAU,cAAe,MAAM,iBAAiB,MAAM,KAAG,MAGzC,CAAC;AAmB9B;;;;GAIG;AACH,eAAO,MAAM,aAAa,WAChB,aAAa,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,SAAS,KACtD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CA6CvC,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;AAEnE,qDAAqD;AACrD,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC;AAKlG,qFAAqF;AACrF,eAAO,MAAM,WAAW,aAAc,aAAa,KAAG,aAAa,CAAC,KAAK,CAGtE,CAAC;AAEJ,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,aAAc,aAAa,KAAG,aAAa,CAAC,eAAe,CAKtF,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;aAAK,IAAI;aAAS,GAAG;CAAkB,CAAC;AAExE,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,SAAU,MAAM,gBAAgB,aAAa,CAAC,eAAe,CAAC,8GAQ1F,CAAC"}