alchemy 2.0.0-beta.59 → 2.0.0-beta.60

package/lib/AWS/Lambda/ListMicrovmImageVersions.d.ts

@@ -0,0 +1,18 @@
+import type * as microvms from "@distilled.cloud/aws/lambda-microvms";
+import type * as Effect from "effect/Effect";
+import * as Binding from "../../Binding.ts";
+import type { MicrovmImage } from "./MicrovmImage.ts";
+export interface ListMicrovmImageVersionsRequest extends Omit<microvms.ListMicrovmImageVersionsInput, "imageIdentifier"> {
+}
+/**
+ * Runtime binding for `ListMicrovmImageVersions`.
+ *
+ * Bind it to a {@link MicrovmImage} to list the image's versions (the
+ * `imageIdentifier` is injected).
+ * @binding
+ * @section Image Reads
+ */
+export interface ListMicrovmImageVersions extends Binding.Service<ListMicrovmImageVersions, "AWS.Lambda.ListMicrovmImageVersions", (image: MicrovmImage) => Effect.Effect<(request: ListMicrovmImageVersionsRequest) => Effect.Effect<microvms.ListMicrovmImageVersionsOutput, microvms.ListMicrovmImageVersionsError>>> {
+}
+export declare const ListMicrovmImageVersions: ListMicrovmImageVersions;
+//# sourceMappingURL=ListMicrovmImageVersions.d.ts.map

package/lib/AWS/Lambda/ListMicrovmImageVersions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovmImageVersions.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovmImageVersions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACtE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,+BAAgC,SAAQ,IAAI,CAC3D,QAAQ,CAAC,6BAA6B,EACtC,iBAAiB,CAClB;CAAG;AAEJ;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAyB,SAAQ,OAAO,CAAC,OAAO,CAC/D,wBAAwB,EACxB,qCAAqC,EACrC,CACE,KAAK,EAAE,YAAY,KAChB,MAAM,CAAC,MAAM,CAChB,CACE,OAAO,EAAE,+BAA+B,KACrC,MAAM,CAAC,MAAM,CAChB,QAAQ,CAAC,8BAA8B,EACvC,QAAQ,CAAC,6BAA6B,CACvC,CACF,CACF;CAAG;AACJ,eAAO,MAAM,wBAAwB,0BAGlC,CAAC"}

package/lib/AWS/Lambda/ListMicrovmImageVersions.js

@@ -0,0 +1,3 @@
+import * as Binding from "../../Binding.js";
+export const ListMicrovmImageVersions = Binding.Service("AWS.Lambda.ListMicrovmImageVersions");
+//# sourceMappingURL=ListMicrovmImageVersions.js.map

package/lib/AWS/Lambda/ListMicrovmImageVersions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovmImageVersions.js","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovmImageVersions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AA8B5C,MAAM,CAAC,MAAM,wBAAwB,GACnC,OAAO,CAAC,OAAO,CACb,qCAAqC,CACtC,CAAC"}

package/lib/AWS/Lambda/ListMicrovmImageVersionsHttp.d.ts

@@ -0,0 +1,3 @@
+import { ListMicrovmImageVersions } from "./ListMicrovmImageVersions.ts";
+export declare const ListMicrovmImageVersionsHttp: import("effect/Layer").Layer<ListMicrovmImageVersions, never, never>;
+//# sourceMappingURL=ListMicrovmImageVersionsHttp.d.ts.map

package/lib/AWS/Lambda/ListMicrovmImageVersionsHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovmImageVersionsHttp.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovmImageVersionsHttp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAGzE,eAAO,MAAM,4BAA4B,sEAOvC,CAAC"}

package/lib/AWS/Lambda/ListMicrovmImageVersionsHttp.js

@@ -0,0 +1,12 @@
+import * as microvms from "@distilled.cloud/aws/lambda-microvms";
+import { ListMicrovmImageVersions } from "./ListMicrovmImageVersions.js";
+import { makeImageBinding } from "./MicrovmBinding.js";
+export const ListMicrovmImageVersionsHttp = makeImageBinding({
+    binding: ListMicrovmImageVersions,
+    name: "ListMicrovmImageVersions",
+    actions: ["lambda:ListMicrovmImageVersions"],
+    operation: microvms.listMicrovmImageVersions,
+    scope: "image",
+    injectImageIdentifier: true,
+});
+//# sourceMappingURL=ListMicrovmImageVersionsHttp.js.map

package/lib/AWS/Lambda/ListMicrovmImageVersionsHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovmImageVersionsHttp.js","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovmImageVersionsHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,wBAAwB;IACjC,IAAI,EAAE,0BAA0B;IAChC,OAAO,EAAE,CAAC,iCAAiC,CAAC;IAC5C,SAAS,EAAE,QAAQ,CAAC,wBAAwB;IAC5C,KAAK,EAAE,OAAO;IACd,qBAAqB,EAAE,IAAI;CAC5B,CAAC,CAAC"}

package/lib/AWS/Lambda/ListMicrovms.d.ts

@@ -0,0 +1,23 @@
+import type * as microvms from "@distilled.cloud/aws/lambda-microvms";
+import type * as Effect from "effect/Effect";
+import * as Binding from "../../Binding.ts";
+import type { MicrovmImage } from "./MicrovmImage.ts";
+export interface ListMicrovmsRequest extends Omit<microvms.ListMicrovmsRequest, "imageIdentifier"> {
+}
+/**
+ * Runtime binding for `ListMicrovms`.
+ *
+ * Bind it to a {@link MicrovmImage} to get a callable that lists the MicroVMs
+ * launched from that image (the `imageIdentifier` filter is injected).
+ * @binding
+ * @section Inspecting MicroVMs
+ * @example List MicroVMs
+ * ```typescript
+ * const listMicrovms = yield* AWS.Lambda.ListMicrovms(Sandbox);
+ * const { items } = yield* listMicrovms({});
+ * ```
+ */
+export interface ListMicrovms extends Binding.Service<ListMicrovms, "AWS.Lambda.ListMicrovms", (image: MicrovmImage) => Effect.Effect<(request: ListMicrovmsRequest) => Effect.Effect<microvms.ListMicrovmsResponse, microvms.ListMicrovmsError>>> {
+}
+export declare const ListMicrovms: ListMicrovms;
+//# sourceMappingURL=ListMicrovms.d.ts.map

package/lib/AWS/Lambda/ListMicrovms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovms.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACtE,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,QAAQ,CAAC,mBAAmB,EAC5B,iBAAiB,CAClB;CAAG;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO,CAAC,OAAO,CACnD,YAAY,EACZ,yBAAyB,EACzB,CACE,KAAK,EAAE,YAAY,KAChB,MAAM,CAAC,MAAM,CAChB,CACE,OAAO,EAAE,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAChB,QAAQ,CAAC,oBAAoB,EAC7B,QAAQ,CAAC,iBAAiB,CAC3B,CACF,CACF;CAAG;AACJ,eAAO,MAAM,YAAY,cAExB,CAAC"}

package/lib/AWS/Lambda/ListMicrovms.js

@@ -0,0 +1,3 @@
+import * as Binding from "../../Binding.js";
+export const ListMicrovms = Binding.Service("AWS.Lambda.ListMicrovms");
+//# sourceMappingURL=ListMicrovms.js.map

package/lib/AWS/Lambda/ListMicrovms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovms.js","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAmC5C,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CACzC,yBAAyB,CAC1B,CAAC"}

package/lib/AWS/Lambda/ListMicrovmsHttp.d.ts

@@ -0,0 +1,3 @@
+import { ListMicrovms } from "./ListMicrovms.ts";
+export declare const ListMicrovmsHttp: import("effect/Layer").Layer<ListMicrovms, never, never>;
+//# sourceMappingURL=ListMicrovmsHttp.d.ts.map

package/lib/AWS/Lambda/ListMicrovmsHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovmsHttp.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovmsHttp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,eAAO,MAAM,gBAAgB,0DAO3B,CAAC"}

package/lib/AWS/Lambda/ListMicrovmsHttp.js

@@ -0,0 +1,12 @@
+import * as microvms from "@distilled.cloud/aws/lambda-microvms";
+import { ListMicrovms } from "./ListMicrovms.js";
+import { makeImageBinding } from "./MicrovmBinding.js";
+export const ListMicrovmsHttp = makeImageBinding({
+    binding: ListMicrovms,
+    name: "ListMicrovms",
+    actions: ["lambda:ListMicrovms"],
+    operation: microvms.listMicrovms,
+    scope: "account",
+    injectImageIdentifier: true,
+});
+//# sourceMappingURL=ListMicrovmsHttp.js.map

package/lib/AWS/Lambda/ListMicrovmsHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListMicrovmsHttp.js","sourceRoot":"","sources":["../../../src/AWS/Lambda/ListMicrovmsHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;IAC/C,OAAO,EAAE,YAAY;IACrB,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,CAAC,qBAAqB,CAAC;IAChC,SAAS,EAAE,QAAQ,CAAC,YAAY;IAChC,KAAK,EAAE,SAAS;IAChB,qBAAqB,EAAE,IAAI;CAC5B,CAAC,CAAC"}

package/lib/AWS/Lambda/MicrovmBinding.d.ts

@@ -0,0 +1,61 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { MicrovmImage } from "./MicrovmImage.ts";
+/** The distilled operation method, yielded to its request callable. */
+type Operation<Res, Err> = Effect.Effect<(req: any) => Effect.Effect<Res, Err, any>, any, any>;
+export interface ImageBindingOptions<Req, Res, Err, Self> {
+    /** The `Binding.Service` contract this layer implements. */
+    binding: Binding.Service<Self, string, (image: MicrovmImage) => Effect.Effect<(req: Req) => Effect.Effect<Res, Err>>>;
+    /** Operation name, used for the SID label and tracing, e.g. `"RunMicrovm"`. */
+    name: string;
+    /** IAM action(s) the host Function needs, e.g. `["lambda:RunMicrovm"]`. */
+    actions: string[];
+    /** The distilled operation, e.g. `microvms.runMicrovm`. */
+    operation: Operation<Res, Err>;
+    /**
+     * Policy scope (always limited to the bound image's identity — never `["*"]`):
+     * - `"image"` (default) scopes to the exact image ARN (e.g. `RunMicrovm`,
+     *   image-read ops).
+     * - `"microvm"` scopes to the MicroVM instances launched from this image via
+     *   a `microvm:*` glob derived from the image ARN (same partition, region,
+     *   and account). MicroVM instance ARNs are minted at runtime, so an exact
+     *   ARN can't be known at deploy time, but the action stays bounded to this
+     *   account/region's MicroVMs rather than `["*"]`.
+     * - `"account"` uses `["*"]`. Reserved for collection-level list actions
+     *   (e.g. `ListMicrovms`) that AWS only authorizes against `*` and cannot be
+     *   resource-scoped, analogous to `ec2:DescribeInstances`.
+     */
+    scope?: "image" | "microvm" | "account";
+    /** Inject `imageIdentifier: <imageArn>` into each request. */
+    injectImageIdentifier?: boolean;
+    /**
+     * Also grant `lambda:PassNetworkConnector` on network connectors in the
+     * image's region — both the account's own connectors and the AWS-managed
+     * ones (e.g. `INTERNET_EGRESS`). Required by `RunMicrovm`, which passes a
+     * network connector (defaulting to the managed `INTERNET_EGRESS`) to the
+     * launched MicroVM.
+     */
+    passNetworkConnector?: boolean;
+}
+/**
+ * Build a MicroVM runtime binding bound to a {@link MicrovmImage}. At deploy it
+ * registers the IAM grant on the host — the Lambda execution role directly, or
+ * (for a Cloudflare Worker) a dedicated assume-role Role whose credentials are
+ * bound onto the worker. At runtime it calls the distilled operation with the
+ * host-appropriate credentials.
+ */
+export declare const makeImageBinding: <Req, Res, Err, Self>(options: ImageBindingOptions<Req, Res, Err, Self>) => Layer.Layer<Self>;
+export interface AccountBindingOptions<Req, Res, Err, Self> {
+    binding: Binding.Service<Self, string, () => Effect.Effect<(req: Req) => Effect.Effect<Res, Err>>>;
+    name: string;
+    actions: string[];
+    operation: Operation<Res, Err>;
+}
+/**
+ * Build an account-scoped MicroVM binding (no resource argument), e.g. for
+ * listing AWS-managed base images. IAM `Resource` is `["*"]`.
+ */
+export declare const makeAccountBinding: <Req, Res, Err, Self>(options: AccountBindingOptions<Req, Res, Err, Self>) => Layer.Layer<Self>;
+export {};
+//# sourceMappingURL=MicrovmBinding.d.ts.map

package/lib/AWS/Lambda/MicrovmBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrovmBinding.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/MicrovmBinding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAOtC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAc5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOtD,uEAAuE;AACvE,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC1C,GAAG,EACH,GAAG,CACJ,CAAC;AA8DF,MAAM,WAAW,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI;IACtD,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC,OAAO,CACtB,IAAI,EACJ,MAAM,EACN,CACE,KAAK,EAAE,YAAY,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAC1D,CAAC;IACF,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACxC,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAwMD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,WACzC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAChD,KAAK,CAAC,KAAK,CAAC,IAAI,CA4CgB,CAAC;AAEpC,MAAM,WAAW,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI;IACxD,OAAO,EAAE,OAAO,CAAC,OAAO,CACtB,IAAI,EACJ,MAAM,EACN,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAC3D,CAAC;IACF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,WAC3C,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAClD,KAAK,CAAC,KAAK,CAAC,IAAI,CAiCgB,CAAC"}

package/lib/AWS/Lambda/MicrovmBinding.js

@@ -0,0 +1,279 @@
+import * as Effect from "effect/Effect";
+import * as HashMap from "effect/HashMap";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Ref from "effect/Ref";
+import * as Scope from "effect/Scope";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Binding from "../../Binding.js";
+import * as Output from "../../Output.js";
+import { Credentials, makeAssumeRoleResolver } from "../Credentials.js";
+import { AccessKey } from "../IAM/AccessKey.js";
+import { Role } from "../IAM/Role.js";
+import { User } from "../IAM/User.js";
+import { isFunction } from "./Function.js";
+// We resolve the host (Worker vs Lambda) at both deploy AND runtime to decide
+// how credentials are supplied. A Cloudflare Worker is structurally tagged with
+// this Type id; a hard import of the Cloudflare module graph is avoided.
+const WORKER_TYPE_ID = "Cloudflare.Worker";
+const isWorkerHost = (host) => host.Type === WORKER_TYPE_ID;
+/** Region segment of an AWS ARN (`arn:partition:service:<region>:...`). */
+const regionFromArn = (arn) => arn.split(":")[3] ?? "us-east-1";
+// ---------------------------------------------------------------------------
+// Per-scope singleton store. A Worker reaching AWS must create exactly ONE IAM
+// User + AccessKey + Role (and one assumed-role credential cache) regardless of
+// how many of the ~16 MicroVM `*Http` bindings it uses. A
+// `WeakMap<Scope, Ref<HashMap>>` memoizes any keyed effect for the lifetime of
+// the surrounding scope (the deploy plan, or the worker's runtime init scope),
+// so every binding shares the same resources and the same credentials.
+// ---------------------------------------------------------------------------
+const perScope = new WeakMap();
+// Fallback when no `Scope` is in context — notably a deployed Worker's init
+// phase, which runs outside any scope. Process-wide is an acceptable singleton
+// granularity there (one isolate == one logical host).
+const globalStore = new Map();
+const storeRef = Effect.gen(function* () {
+    const scope = yield* Effect.serviceOption(Scope.Scope);
+    if (Option.isNone(scope))
+        return undefined;
+    let ref = perScope.get(scope.value);
+    if (!ref) {
+        ref = yield* Ref.make(HashMap.empty());
+        perScope.set(scope.value, ref);
+    }
+    return ref;
+});
+const memoize = (key, build) => Effect.gen(function* () {
+    const ref = yield* storeRef;
+    if (ref) {
+        const existing = HashMap.get(yield* Ref.get(ref), key);
+        if (Option.isSome(existing))
+            return existing.value;
+        const value = yield* build;
+        yield* Ref.update(ref, HashMap.set(key, value));
+        return value;
+    }
+    if (globalStore.has(key))
+        return globalStore.get(key);
+    const value = yield* build;
+    globalStore.set(key, value);
+    return value;
+});
+/**
+ * Derive the `microvm:*` instance-ARN glob from an image ARN by swapping the
+ * `microvm-image:<name>` resource segment for `microvm:*`, keeping the same
+ * `arn:<partition>:lambda:<region>:<account>:` prefix.
+ */
+const microvmGlob = (imageArn) => `${imageArn.replace(/:microvm-image[:/].*$/, "")}:microvm:*`;
+/**
+ * Derive the network-connector ARN globs from an image ARN: the account's own
+ * connectors (`arn:<partition>:lambda:<region>:<account>:network-connector:*`)
+ * and the AWS-managed connectors (same prefix but account `aws`).
+ */
+const networkConnectorGlobs = (imageArn) => {
+    // arn:<partition>:lambda:<region>:<account>
+    const prefix = imageArn.replace(/:microvm-image[:/].*$/, "");
+    // arn:<partition>:lambda:<region>
+    const regionPrefix = prefix.replace(/:[^:]*$/, "");
+    return [
+        `${prefix}:network-connector:*`,
+        `${regionPrefix}:aws:network-connector:*`,
+    ];
+};
+/** The IAM policy statements an image-scoped MicroVM operation requires. */
+const imagePolicyStatements = (image, options) => [
+    {
+        Effect: "Allow",
+        Action: options.actions,
+        Resource: options.scope === "account"
+            ? // Collection-level list actions only authorize on `*`.
+                ["*"]
+            : options.scope === "microvm"
+                ? [
+                    // Instance ops (GetMicrovm, TerminateMicrovm, CreateAuthToken,
+                    // …) are authorized by AWS against the image ARN as well as the
+                    // instance ARN, so grant both: the exact image and the
+                    // `microvm:*` instance glob derived from it.
+                    Output.interpolate `${image.imageArn}`,
+                    image.imageArn.pipe(Output.map(microvmGlob)),
+                ]
+                : [Output.interpolate `${image.imageArn}`],
+    },
+    ...(options.passNetworkConnector
+        ? [
+            {
+                Effect: "Allow",
+                Action: ["lambda:PassNetworkConnector"],
+                Resource: [
+                    image.imageArn.pipe(Output.map((a) => networkConnectorGlobs(a)[0])),
+                    image.imageArn.pipe(Output.map((a) => networkConnectorGlobs(a)[1])),
+                ],
+            },
+        ]
+        : []),
+];
+/**
+ * Create — once per scope, per host worker — the IAM identity a Cloudflare
+ * Worker uses to reach AWS:
+ *   - an IAM **User** allowed to assume any role that trusts it,
+ *   - a long-lived **AccessKey** for that user,
+ *   - a least-privilege **Role** the user assumes (trusts only this user;
+ *     MicroVM permissions accumulate on it via `role.bind`).
+ *
+ * The user's access key + the role ARN are read as {@link Output} *accessors*
+ * (`yield* accessKey.accessKeyId`, …) — yielding an attribute both registers
+ * the binding on the worker (deploy) and returns an `Effect` that reads it at
+ * runtime. At runtime those accessors feed an assume-role credentials layer
+ * (single-flight, expiry-aware) built once and shared across all bindings.
+ */
+const ensureWorkerAwsAccess = (host) => memoize(`microvm-aws:${host.LogicalId}`, Effect.gen(function* () {
+    const id = host.LogicalId;
+    // The user may assume any role that trusts it (Resource `*`); the role's
+    // trust policy is what actually restricts assumption to this user, which
+    // avoids a User↔Role ARN dependency cycle while staying safe.
+    const user = yield* User(`${id}-microvm-user`, {
+        inlinePolicies: {
+            "assume-microvm-role": {
+                Version: "2012-10-17",
+                Statement: [
+                    { Effect: "Allow", Action: ["sts:AssumeRole"], Resource: ["*"] },
+                ],
+            },
+        },
+    });
+    const accessKey = yield* AccessKey(`${id}-microvm-key`, {
+        userName: user.userName,
+    });
+    const role = yield* Role(`${id}-microvm-role`, {
+        assumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Effect: "Allow",
+                    Principal: { AWS: user.userArn },
+                    Action: ["sts:AssumeRole"],
+                },
+            ],
+        },
+    });
+    // Bind the user's credentials + role ARN onto the worker via accessors:
+    // at deploy this registers the env (the secret as `secret_text`); at
+    // runtime these resolve to the deployed values.
+    const accessKeyId = yield* accessKey.accessKeyId;
+    const secretAccessKey = yield* accessKey.secretAccessKey;
+    const roleArn = yield* role.roleArn;
+    // The long-lived IAM-user credentials that sign `AssumeRole`. Read lazily
+    // from the worker environment on each refresh (NOT captured eagerly, so
+    // this is valid at deploy time where the env isn't populated yet).
+    const base = Layer.succeed(Credentials, Effect.gen(function* () {
+        const id = yield* accessKeyId;
+        const secret = yield* secretAccessKey;
+        return {
+            accessKeyId: Redacted.make(id),
+            secretAccessKey: secret
+                ? Redacted.isRedacted(secret)
+                    ? secret
+                    : Redacted.make(secret)
+                : Redacted.make(""),
+            sessionToken: undefined,
+        };
+    }));
+    // Build the single-flight, expiry-aware assume-role cache ONCE. STS is
+    // global, so the endpoint region is a fixed default; the per-request
+    // operation provides its own image-derived `Region` separately.
+    const credentials = yield* makeAssumeRoleResolver({
+        roleArn,
+        base,
+        region: "us-east-1",
+    });
+    return { role, credentials };
+}));
+/**
+ * Run a MicroVM operation with host-appropriate AWS credentials:
+ * - Lambda Function host → the execution-role credentials already in the
+ *   ambient environment (nothing to provide).
+ * - Cloudflare Worker host → the assumed-role credentials, plus a `Region`
+ *   derived from the image ARN and an `HttpClient`.
+ */
+const withRuntimeCredentials = (access, region, eff) => access
+    ? Effect.gen(function* () {
+        const reg = yield* region;
+        // Provide the SHARED cached resolver built once in
+        // `ensureWorkerAwsAccess` — NOT a fresh assume-role layer per request —
+        // so the assumed-role credentials are reused (and only refreshed near
+        // expiry) instead of re-assuming the role on every call.
+        return yield* eff.pipe(Effect.provide(Layer.succeed(Credentials, access.credentials)), Effect.provide(Layer.succeed(Region, Effect.succeed(reg))), Effect.provide(FetchHttpClient.layer));
+    })
+    : eff;
+/**
+ * Build a MicroVM runtime binding bound to a {@link MicrovmImage}. At deploy it
+ * registers the IAM grant on the host — the Lambda execution role directly, or
+ * (for a Cloudflare Worker) a dedicated assume-role Role whose credentials are
+ * bound onto the worker. At runtime it calls the distilled operation with the
+ * host-appropriate credentials.
+ */
+export const makeImageBinding = (options) => Layer.effect(options.binding, Effect.gen(function* () {
+    const run = yield* options.operation;
+    return Effect.fn(function* (image) {
+        const host = yield* Binding.Host;
+        const statements = imagePolicyStatements(image, options);
+        const label = `Allow(${host.LogicalId}, AWS.Lambda.${options.name}(${image.LogicalId}))`;
+        // Accessors (registered on the host at deploy, resolved at runtime).
+        const imageArn = yield* image.imageArn;
+        // Region is derived from the resolved image ARN — via `Effect.map` of
+        // the accessor, NOT a second Output binding (whose env key would embed
+        // the mapper's source text and is brittle).
+        const region = Effect.map(imageArn, regionFromArn);
+        let access;
+        if (isFunction(host)) {
+            if (!globalThis.__ALCHEMY_RUNTIME__) {
+                yield* host.bind `${label}`({ policyStatements: statements });
+            }
+        }
+        else if (isWorkerHost(host)) {
+            access = yield* ensureWorkerAwsAccess(host);
+            if (!globalThis.__ALCHEMY_RUNTIME__) {
+                yield* access.role.bind `${label}`({ policyStatements: statements });
+            }
+        }
+        return Effect.fn(`AWS.Lambda.${options.name}(${image.LogicalId})`)(function* (request) {
+            return yield* withRuntimeCredentials(access, region, run(options.injectImageIdentifier
+                ? { ...request, imageIdentifier: yield* imageArn }
+                : request));
+        });
+    });
+}));
+/**
+ * Build an account-scoped MicroVM binding (no resource argument), e.g. for
+ * listing AWS-managed base images. IAM `Resource` is `["*"]`.
+ */
+export const makeAccountBinding = (options) => Layer.effect(options.binding, Effect.gen(function* () {
+    const run = yield* options.operation;
+    return Effect.fn(function* () {
+        const host = yield* Binding.Host;
+        const label = `Allow(${host.LogicalId}, AWS.Lambda.${options.name}())`;
+        const statements = [
+            { Effect: "Allow", Action: options.actions, Resource: ["*"] },
+        ];
+        let access;
+        if (isFunction(host)) {
+            if (!globalThis.__ALCHEMY_RUNTIME__) {
+                yield* host.bind `${label}`({ policyStatements: statements });
+            }
+        }
+        else if (isWorkerHost(host)) {
+            access = yield* ensureWorkerAwsAccess(host);
+            if (!globalThis.__ALCHEMY_RUNTIME__) {
+                yield* access.role.bind `${label}`({ policyStatements: statements });
+            }
+        }
+        return Effect.fn(`AWS.Lambda.${options.name}()`)(function* (request) {
+            // Account-level operations are global; default the STS/endpoint region.
+            const region = Effect.succeed("us-east-1");
+            return yield* withRuntimeCredentials(access, region, run(request));
+        });
+    });
+}));
+//# sourceMappingURL=MicrovmBinding.js.map

package/lib/AWS/Lambda/MicrovmBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrovmBinding.js","sourceRoot":"","sources":["../../../src/AWS/Lambda/MicrovmBinding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,GAAG,MAAM,YAAY,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAM1C,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAe3C,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAM3C,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAsB,EAAE,CAC7D,IAA0B,CAAC,IAAI,KAAK,cAAc,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;AAEhF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,0DAA0D;AAC1D,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAGzB,CAAC;AACJ,4EAA4E;AAC5E,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAmB,CAAC,CAAC;QACxD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAU,GAAW,EAAE,KAA6B,EAAE,EAAE,CACtE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAU,CAAC;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;QAC3B,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAgB,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAM,CAAC;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC,CAA2B,CAAC;AA2C/B;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC/C,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,YAAY,CAAC;AAE/D;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAY,EAAE;IAC3D,4CAA4C;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC7D,kCAAkC;IAClC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,MAAM,sBAAsB;QAC/B,GAAG,YAAY,0BAA0B;KAC1C,CAAC;AACJ,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,CAC5B,KAAmB,EACnB,OAAiD,EACvB,EAAE,CAAC;IAC7B;QACE,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,OAAO,CAAC,OAAO;QACvB,QAAQ,EACN,OAAO,CAAC,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,uDAAuD;gBACvD,CAAC,GAAG,CAAC;YACP,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC3B,CAAC,CAAC;oBACE,+DAA+D;oBAC/D,gEAAgE;oBAChE,uDAAuD;oBACvD,6CAA6C;oBAC7C,MAAM,CAAC,WAAW,CAAA,GAAG,KAAK,CAAC,QAAQ,EAAE;oBACrC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;iBAC7C;gBACH,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAA,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;KAChD;IACD,GAAG,CAAC,OAAO,CAAC,oBAAoB;QAC9B,CAAC,CAAC;YACE;gBACE,MAAM,EAAE,OAAgB;gBACxB,MAAM,EAAE,CAAC,6BAA6B,CAAC;gBACvC,QAAQ,EAAE;oBACR,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAChD;oBACD,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAChD;iBACF;aACF;SACF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC;AAiBF;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG,CAAC,IAAgB,EAAE,EAAE,CACjD,OAAO,CACL,eAAgB,IAAqB,CAAC,SAAS,EAAE,EACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAI,IAAqB,CAAC,SAAS,CAAC;IAE5C,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE;QAC7C,cAAc,EAAE;YACd,qBAAqB,EAAE;gBACrB,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE;iBACjE;aACF;SACF;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE;QACtD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE;QAC7C,wBAAwB,EAAE;YACxB,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE;oBAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;iBAC3B;aACF;SACF;KACF,CAAC,CAAC;IAEH,wEAAwE;IACxE,qEAAqE;IACrE,gDAAgD;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAEpC,0EAA0E;IAC1E,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CACxB,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACtC,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,EAAE,MAAM;gBACrB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;oBAC3B,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;gBACzB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,YAAY,EAAE,SAAS;SACM,CAAC;IAClC,CAAC,CAAC,CACH,CAAC;IAEF,uEAAuE;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;QAChD,OAAO;QACP,IAAI;QACJ,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC,CAAC,CACH,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAC7B,MAAmC,EACnC,MAA6B,EAC7B,GAA6B,EACH,EAAE,CAC5B,MAAM;IACJ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QAC1B,mDAAmD;QACnD,wEAAwE;QACxE,sEAAsE;QACtE,yDAAyD;QACzD,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CACpB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,EAC9D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAC1D,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC,CAAC;IACJ,CAAC,CAAC,GAAG,CAAC;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAiD,EAC9B,EAAE,CACrB,KAAK,CAAC,MAAM,CACV,OAAO,CAAC,OAAc,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACrC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAmB;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,SAAS,gBAAgB,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC;QAEzF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEnD,IAAI,MAAmC,CAAC;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACpC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACpC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC,cAAc,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAChE,QAAQ,CAAC,EAAE,OAAY;YACrB,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAClC,MAAM,EACN,MAAM,EACN,GAAG,CACD,OAAO,CAAC,qBAAqB;gBAC3B,CAAC,CAAC,EAAE,GAAI,OAAkB,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE;gBAC9D,CAAC,CAAC,OAAO,CACZ,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAC6B,CAAC;AAapC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAmD,EAChC,EAAE,CACrB,KAAK,CAAC,MAAM,CACV,OAAO,CAAC,OAAc,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACrC,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,SAAS,gBAAgB,OAAO,CAAC,IAAI,KAAK,CAAC;QACvE,MAAM,UAAU,GAA6B;YAC3C,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE;SAC9D,CAAC;QAEF,IAAI,MAAmC,CAAC;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACpC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACpC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC,cAAc,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EACxD,OAAY;YAEZ,wEAAwE;YACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAC6B,CAAC"}

package/lib/AWS/Lambda/MicrovmBundle.d.ts

@@ -0,0 +1,62 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import { Stack } from "../../Stack.ts";
+/**
+ * The AWS-managed base image MicroVM Dockerfiles build on. The MicroVM build
+ * runs the Dockerfile server-side and snapshots the result with Firecracker.
+ */
+export declare const MICROVM_BASE_DOCKER_IMAGE = "public.ecr.aws/lambda/microvms:al2023-minimal";
+/** The default port the in-VM HTTP server listens on. */
+export declare const DEFAULT_MICROVM_PORT = 8080;
+/**
+ * Build the final Dockerfile for an effectful MicroVM image. Starts from the
+ * user-provided base (or the managed MicroVM base), installs the JS runtime,
+ * copies the bundled program, and runs it as the entrypoint. Mirrors the
+ * Cloudflare Container `buildFinalDockerfile`, but targets the MicroVM base.
+ */
+export declare const buildMicrovmDockerfile: (userDockerfile: string | undefined, runtime: "bun" | "node", port: number) => string;
+/**
+ * Bundle an Effect-native MicroVM program with Rolldown and wrap it in a
+ * generated bootstrap that boots an HTTP server (the MicroVM endpoint). Returns
+ * every emitted file so the full set can be zipped into the code artifact.
+ *
+ * Mirrors `bundleContainerProgram`; the bootstrap provides AWS runtime services
+ * (FetchHttpClient + region from env) so in-VM HTTP capability bindings
+ * (e.g. S3 `*Http`) resolve against the MicroVM's execution role.
+ */
+export declare const bundleMicrovmProgram: (args_0: {
+    main: string;
+    runtime: "bun" | "node";
+    handler?: string | undefined;
+    isExternal?: boolean;
+    external?: string[];
+    port: number;
+}) => Effect.Effect<{
+    files: {
+        path: string;
+        content: Uint8Array<ArrayBufferLike>;
+    }[];
+    hash: string;
+}, Bundle.BundleError | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path | Stack>;
+export interface ArtifactFile {
+    path: string;
+    content: string | Uint8Array;
+}
+/**
+ * Zip a flat list of files into a deterministic (fixed mtime) archive. Used to
+ * package the MicroVM code artifact (Dockerfile + bundled program, or a build
+ * context) before uploading it to S3.
+ */
+export declare const zipFiles: (files: readonly ArtifactFile[]) => Effect.Effect<Buffer<ArrayBufferLike>, never, never>;
+/**
+ * Recursively read a build-context directory into a flat list of files
+ * (relative paths + bytes) for zipping into the code artifact. Used by the
+ * external (bring-your-own-Dockerfile) MicroVM mode.
+ */
+export declare const readContextDirectory: (dir: string) => Effect.Effect<{
+    path: string;
+    content: Uint8Array;
+}[], any, FileSystem.FileSystem | Path.Path>;
+//# sourceMappingURL=MicrovmBundle.d.ts.map

package/lib/AWS/Lambda/MicrovmBundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrovmBundle.d.ts","sourceRoot":"","sources":["../../../src/AWS/Lambda/MicrovmBundle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,kDACW,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,mBACjB,MAAM,GAAG,SAAS,WACzB,KAAK,GAAG,MAAM,QACjB,MAAM,KACX,MAwBF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;UAQzB,MAAM;aACH,KAAK,GAAG,MAAM;cACb,MAAM,GAAG,SAAS;iBACf,OAAO;eACT,MAAM,EAAE;UACb,MAAM;;;;;;;gHAuHZ,CAAC;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,0FAenB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;UAON,MAAM;aAAW,UAAU;4CAkBpD,CAAC"}