alchemy 2.0.0-beta.59 → 2.0.0-beta.60

package/src/AWS/ECS/Task.ts

@@ -3,31 +3,28 @@ import * as ecr from "@distilled.cloud/aws/ecr";
 import * as ecs from "@distilled.cloud/aws/ecs";
 import * as iam from "@distilled.cloud/aws/iam";
 import { Region } from "@distilled.cloud/aws/Region";
-import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Stream from "effect/Stream";
 import type * as rolldown from "rolldown";
 import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
-import {
-  dockerBuild,
-  materializeDockerfile,
-  pushImage,
-  writeContextFiles,
-} from "../../Bundle/Docker.ts";
 import {
   findCwdForBundle,
   getStableContextDir,
+  resolveMainPath,
 } from "../../Bundle/TempRoot.ts";
 import { isResolved } from "../../Diff.ts";
-import * as Output from "../../Output.ts";
+import { Docker } from "../../Docker/Docker.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
-import type { ProcessContext, ServerHost } from "../../Server/Process.ts";
+import {
+  createHostRuntimeContext,
+  type HostRuntimeContext,
+  type ServerHost,
+} from "../../Server/Process.ts";
 import { Stack } from "../../Stack.ts";
 import {
   createInternalTags,
@@ -57,7 +54,7 @@ export class TaskEnvironment extends Context.Service<
 export interface TaskProps extends PlatformProps {
   /**
    * Module entrypoint for the bundled task program. This should typically be
-   * `import.meta.filename` from an inline Effect program.
+   * `import.meta.url` from an inline Effect program.
    */
   main: string;
   /**
@@ -235,7 +232,7 @@ export type TaskServices = Credentials | Region | ServerHost | AWSEnvironment;
 
 export type TaskShape = Main<TaskServices>;
 
-export interface TaskRuntimeContext extends ProcessContext {
+export interface TaskRuntimeContext extends HostRuntimeContext {
   readonly Type: "AWS.ECS.Task";
 }
 
@@ -255,7 +252,7 @@ export interface TaskRuntimeContext extends ProcessContext {
  * @example Basic Task
  * ```typescript
  * const task = yield* Task("ApiTask", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   cpu: 256,
  *   memory: 512,
  *   port: 3000,
@@ -266,7 +263,7 @@ export interface TaskRuntimeContext extends ProcessContext {
  * @example Task with a Sidecar
  * ```typescript
  * const task = yield* Task("ApiTask", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   port: 3000,
  *   sidecars: [
  *     {
@@ -283,7 +280,7 @@ export interface TaskRuntimeContext extends ProcessContext {
  * @example ARM64 with EFS Volume and Ephemeral Storage
  * ```typescript
  * const task = yield* Task("WorkerTask", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   runtimePlatform: { cpuArchitecture: "ARM64", operatingSystemFamily: "LINUX" },
  *   ephemeralStorage: { sizeInGiB: 40 },
  *   volumes: [
@@ -300,44 +297,9 @@ export interface TaskRuntimeContext extends ProcessContext {
  */
 export const Task: Platform<Task, TaskServices, TaskShape, TaskRuntimeContext> =
   Platform("AWS.ECS.Task", {
-    createRuntimeContext: (id): TaskRuntimeContext => {
-      const runners: Effect.Effect<void, never, any>[] = [];
-      const env: Record<string, any> = {};
-
-      return {
-        Type: "AWS.ECS.Task",
-        id,
-        env,
-        set: (bindingId: string, output: Output.Output) =>
-          Effect.sync(() => {
-            const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
-            env[key] = output.pipe(
-              Output.map((value) => JSON.stringify(value)),
-            );
-            return key;
-          }),
-        get: <T>(key: string) =>
-          Config.string(key).pipe(
-            Effect.flatMap((value) =>
-              Effect.try({
-                try: () => JSON.parse(value) as T,
-                catch: (error) => error as Error,
-              }),
-            ),
-            Effect.catch((cause) =>
-              Effect.die(
-                new Error(`Failed to get environment variable: ${key}`, {
-                  cause,
-                }),
-              ),
-            ),
-          ),
-        run: (effect: Effect.Effect<void, never, any>) =>
-          Effect.sync(() => {
-            runners.push(effect);
-          }),
-      };
-    },
+    createRuntimeContext: createHostRuntimeContext("AWS.ECS.Task") as (
+      id: string,
+    ) => TaskRuntimeContext,
   });
 
 export const TaskProvider = () =>
@@ -345,9 +307,9 @@ export const TaskProvider = () =>
     Task,
     Effect.gen(function* () {
       const stack = yield* Stack;
+      const docker = yield* Docker;
 
       const { dotAlchemy } = yield* AlchemyContext;
-      const fs = yield* FileSystem.FileSystem;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
 
       const alchemyEnv = {
@@ -576,7 +538,7 @@ export const TaskProvider = () =>
 
       const bundleProgram = Effect.fn(function* (id: string, props: TaskProps) {
         const handler = props.handler ?? "default";
-        const realMain = yield* fs.realPath(props.main);
+        const realMain = yield* resolveMainPath(props.main);
         const cwd = yield* findCwdForBundle(realMain);
 
         const buildBundle = Effect.fn(function* (
@@ -589,14 +551,27 @@ export const TaskProvider = () =>
               input: entry,
               cwd,
               platform: "node",
+              // The container runs on `bun`; keep `bun`/`bun:*` external (the
+              // runtime provides them) and resolve the `bun` export condition
+              // so `@effect/platform-bun` picks its Bun implementations.
+              external: [
+                "bun",
+                "bun:*",
+                ...((props.build?.input?.external as string[] | undefined) ??
+                  []),
+              ],
+              resolve: {
+                conditionNames: ["bun", "import", "module", "default"],
+                ...props.build?.input?.resolve,
+              },
               plugins: [props.build?.input?.plugins, plugins],
             },
             {
               ...props.build?.output,
               format: "esm",
               sourcemap: props.build?.output?.sourcemap ?? false,
-              minify: props.build?.output?.minify ?? true,
-              entryFileNames: "index.js",
+              minify: props.build?.output?.minify ?? false,
+              entryFileNames: "index.mjs",
             },
           );
         });
@@ -607,7 +582,8 @@ export const TaskProvider = () =>
               realMain,
               virtualEntryPlugin(
                 (importPath) => `
-import { NodeServices } from "@effect/platform-node";
+import { BunServices } from "@effect/platform-bun";
+import { BunHttpServer } from "alchemy/Http";
 import { Stack } from "alchemy/Stack";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
@@ -621,13 +597,17 @@ import * as Region from "@distilled.cloud/aws/Region";
 import { ${handler} as handler } from ${JSON.stringify(importPath)};
 
 const platform = Layer.mergeAll(
-  NodeServices.layer,
+  BunServices.layer,
   FetchHttpClient.layer,
   Logger.layer([Logger.consolePretty()]),
 );
 
+// Resolve the bundled program (the runners registered via host.run / serve)
+// and run it with a Bun HTTP server bound to PORT, so a returned { fetch }
+// handler is actually served and host.run loops stay alive.
 const program = handler.pipe(
-  Effect.flatMap((task) => task.RuntimeContext.exports.program),
+  Effect.flatMap((task) => task.RuntimeContext.exports),
+  Effect.flatMap((exports) => exports.program),
   Effect.provide(
     Layer.effect(
       Stack,
@@ -645,6 +625,7 @@ const program = handler.pipe(
     ).pipe(
       Layer.provideMerge(Credentials.fromEnv()),
       Layer.provideMerge(Region.fromEnv()),
+      Layer.provideMerge(BunHttpServer()),
       Layer.provideMerge(platform),
       Layer.provideMerge(
         Layer.succeed(
@@ -657,34 +638,43 @@ const program = handler.pipe(
   Effect.scoped
 );
 
-await Effect.runPromise(program);
+console.log("Task bootstrap starting...");
+await Effect.runPromise(program).catch((err) => {
+  console.error("Task bootstrap failed:", err);
+  process.exit(1);
+});
 `,
               ),
             );
 
-        const mainFile = bundleOutput.files[0];
-        const code =
-          typeof mainFile.content === "string"
-            ? new TextEncoder().encode(mainFile.content)
-            : mainFile.content;
+        // Return every emitted file (entry + shared chunks). Dynamic imports in
+        // the Bun HTTP server / AWS SDK split into chunks; dropping any of them
+        // crashes the container with `Cannot find module './chunk-XXX.js'`.
+        const files = bundleOutput.files.map((file) => ({
+          path: file.path,
+          content:
+            typeof file.content === "string"
+              ? new TextEncoder().encode(file.content)
+              : file.content,
+        }));
 
-        return { code, hash: bundleOutput.hash };
+        return { files, hash: bundleOutput.hash };
       });
 
       const buildAndPushImage = Effect.fn(function* ({
         id,
         repositoryUri,
         hash,
-        code,
+        files,
         props,
       }: {
         id: string;
         repositoryUri: string;
         hash: string;
-        code: Uint8Array<ArrayBufferLike>;
+        files: { path: string; content: Uint8Array<ArrayBufferLike> }[];
         props: TaskProps;
       }) {
-        const realMain = yield* fs.realPath(props.main);
+        const realMain = yield* resolveMainPath(props.main);
         const contextDir = yield* getStableContextDir(
           realMain,
           dotAlchemy,
@@ -699,6 +689,10 @@ await Effect.runPromise(program);
             `FROM ${base}`,
             `WORKDIR /app`,
             `COPY index.mjs /app/index.mjs`,
+            // Copy any additional rolldown chunks (`chunk-XXX.js`,
+            // `BunServices-YYY.js`, …). Non-trivial bundles always emit at
+            // least one; minimal bundles emit none and the COPY no-ops.
+            `COPY *.js /app/`,
           ];
           if (props.port !== undefined) {
             lines.push(
@@ -724,15 +718,31 @@ await Effect.runPromise(program);
         );
         const registry = credentials.proxyEndpoint.replace(/^https?:\/\//, "");
 
-        yield* materializeDockerfile(dockerfile, contextDir);
-        yield* writeContextFiles(contextDir, [
-          { path: "index.mjs", content: code },
-        ]);
-        yield* dockerBuild({
+        yield* docker.materialize({
+          context: contextDir,
+          dockerfile: dockerfile,
+          // Entry chunk becomes `index.mjs`; all other chunks keep their
+          // emitted `*.js` names so the entry's relative imports resolve.
+          files: files.map((file, index) => ({
+            path: index === 0 ? "index.mjs" : file.path,
+            content: file.content,
+          })),
+        });
+        // Build for the architecture the task definition declares (Fargate
+        // defaults to X86_64 when `runtimePlatform` is unset). Without this, an
+        // image built on an ARM64 host (e.g. Apple Silicon) is rejected at task
+        // start with `image Manifest does not contain descriptor matching
+        // platform 'linux/amd64'`.
+        const buildPlatform =
+          props.runtimePlatform?.cpuArchitecture === "ARM64"
+            ? "linux/arm64"
+            : "linux/amd64";
+        yield* docker.image.build({
           tag: imageUri,
           context: contextDir,
+          platform: buildPlatform,
         });
-        yield* pushImage(imageUri, {
+        yield* docker.image.push(imageUri, {
           username: "AWS",
           password,
           server: registry,
@@ -999,12 +1009,12 @@ await Effect.runPromise(program);
           // definitions are versioned in AWS, so registering a new revision
           // is the unit of "update" — the prior revision is deregistered
           // only on `delete` of the resource.
-          const { code, hash } = yield* bundleProgram(id, news);
+          const { files, hash } = yield* bundleProgram(id, news);
           const imageUri = yield* buildAndPushImage({
             id,
             repositoryUri,
             hash,
-            code,
+            files,
             props: {
               ...news,
               env: {
@@ -1158,6 +1168,11 @@ await Effect.runPromise(program);
               RoleName: output.taskRoleName,
             })
             .pipe(
+              // The role may already be gone (delete re-run / race) — treat a
+              // missing role as "no policies to delete" so delete is idempotent.
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed({ PolicyNames: [] as string[] }),
+              ),
               Effect.flatMap((policies) =>
                 Effect.all(
                   (policies.PolicyNames ?? []).map((policyName) =>
@@ -1186,6 +1201,9 @@ await Effect.runPromise(program);
                 RoleName: roleName,
               })
               .pipe(
+                Effect.catchTag("NoSuchEntityException", () =>
+                  Effect.succeed({ AttachedPolicies: [] }),
+                ),
                 Effect.flatMap((policies) =>
                   Effect.all(
                     (policies.AttachedPolicies ?? []).map((policy) =>

package/src/AWS/IAM/Role.ts

@@ -1,11 +1,12 @@
 import * as iam from "@distilled.cloud/aws/iam";
 import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
-import { Resource } from "../../Resource.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
 import {
   createInternalTags,
   createTagsList,
@@ -15,7 +16,7 @@ import {
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { Providers } from "../Providers.ts";
-import type { PolicyDocument } from "./Policy.ts";
+import type { PolicyDocument, PolicyStatement } from "./Policy.ts";
 import {
   parsePolicyDocument,
   stringifyPolicyDocument,
@@ -25,6 +26,22 @@ import {
 export type RoleName = string;
 export type RoleArn = `arn:aws:iam::${AccountID}:role/${RoleName}`;
 
+/**
+ * IAM misuses `MalformedPolicyDocument` for an eventual-consistency case: a
+ * trust policy whose `Principal` names a *freshly created* user/role is
+ * rejected with "Invalid principal in policy" until that principal finishes
+ * propagating through IAM (typically a few seconds). That specific message is
+ * retryable; a genuinely malformed document (bad syntax/fields) is not and
+ * fails fast because its message never matches.
+ */
+const invalidPrincipalRetry = {
+  while: (e: { _tag: string; message?: string }) =>
+    e._tag === "MalformedPolicyDocumentException" &&
+    (e.message?.includes("Invalid principal") ?? false),
+  schedule: Schedule.exponential("2 seconds"),
+  times: 5,
+} as const;
+
 export interface RoleProps {
   /**
    * Name of the role. If omitted, a unique name will be generated.
@@ -36,9 +53,11 @@ export interface RoleProps {
    */
   path?: string;
   /**
-   * IAM trust policy for the role.
+   * IAM trust policy for the role. Optional when a binding contributes the
+   * trust statements (see the `assumeRolePolicyStatements` binding field) — at
+   * least one of the two must supply a statement.
    */
-  assumeRolePolicyDocument: PolicyDocument;
+  assumeRolePolicyDocument?: PolicyDocument;
   /**
    * Managed policy ARNs to attach to the role.
    */
@@ -81,10 +100,69 @@ export interface Role extends Resource<
     permissionsBoundary: string | undefined;
     tags: Record<string, string>;
   },
-  never,
+  {
+    /**
+     * IAM policy statements contributed by bindings (e.g. a consumer granting
+     * this role access to a resource). They are folded into a managed inline
+     * policy named `alchemy-bindings` on the role.
+     */
+    policyStatements?: PolicyStatement[];
+    /**
+     * Trust-policy (assume-role) statements contributed by bindings — e.g. a
+     * consumer declaring which service principal may assume this role. They are
+     * merged into the role's `assumeRolePolicyDocument`.
+     */
+    assumeRolePolicyStatements?: PolicyStatement[];
+  },
   Providers
 > {}
 
+/**
+ * Name of the inline policy the role provider synthesizes from binding-supplied
+ * {@link PolicyStatement}s.
+ */
+const BINDINGS_POLICY_NAME = "alchemy-bindings";
+
+/**
+ * Merge the user's inline policies with a synthetic `alchemy-bindings` policy
+ * built from binding-supplied statements (deduped by JSON identity, sorted for
+ * a stable document).
+ */
+const mergeBoundInlinePolicies = (
+  inlinePolicies: Record<string, PolicyDocument> | undefined,
+  bindings: ResourceBinding<Role["Binding"]>[],
+): Record<string, PolicyDocument> => {
+  const statements = bindings
+    .filter((binding) => (binding as { action?: string }).action !== "delete")
+    .flatMap((binding) => binding.data?.policyStatements ?? []);
+  if (statements.length === 0) return inlinePolicies ?? {};
+  const deduped = Array.from(
+    new Map(statements.map((s) => [JSON.stringify(s), s])).values(),
+  ).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+  return {
+    ...inlinePolicies,
+    [BINDINGS_POLICY_NAME]: { Version: "2012-10-17", Statement: deduped },
+  };
+};
+
+/**
+ * Merge the user's trust policy with binding-supplied assume-role statements
+ * (deduped by JSON identity, sorted for a stable document).
+ */
+const mergeBoundAssumeRolePolicy = (
+  doc: PolicyDocument | undefined,
+  bindings: ResourceBinding<Role["Binding"]>[],
+): PolicyDocument => {
+  const bound = bindings
+    .filter((binding) => (binding as { action?: string }).action !== "delete")
+    .flatMap((binding) => binding.data?.assumeRolePolicyStatements ?? []);
+  const statements = [...(doc?.Statement ?? []), ...bound];
+  const deduped = Array.from(
+    new Map(statements.map((s) => [JSON.stringify(s), s])).values(),
+  ).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+  return { Version: "2012-10-17", Statement: deduped };
+};
+
 /**
  * An IAM role for AWS services and runtimes.
  * @resource
@@ -109,8 +187,6 @@ export const RoleProvider = () =>
   Provider.effect(
     Role,
     Effect.gen(function* () {
-      yield* AWSEnvironment;
-
       const toRoleName = (id: string, props: { roleName?: string } = {}) =>
         props.roleName
           ? Effect.succeed(props.roleName)
@@ -249,7 +325,13 @@ export const RoleProvider = () =>
             const roles = yield* iam.listRoles.pages({}).pipe(
               Stream.runCollect,
               Effect.map((chunk) =>
-                Array.from(chunk).flatMap((page) => page.Roles ?? []),
+                Array.from(chunk)
+                  .flatMap((page) => page.Roles ?? [])
+                  // Service-linked roles are owned by AWS and cannot be
+                  // modified or deleted by us (UnmodifiableEntityException).
+                  .filter(
+                    (role) => !role.Path?.startsWith("/aws-service-role/"),
+                  ),
               ),
             );
 
@@ -297,7 +379,7 @@ export const RoleProvider = () =>
                 attrs !== undefined,
             );
           }),
-        diff: Effect.fn(function* ({ id, olds, news }) {
+        diff: Effect.fn(function* ({ id, olds, news = {} }) {
           if (!isResolved(news)) return;
           if (
             (yield* toRoleName(id, olds ?? {})) !==
@@ -305,7 +387,7 @@ export const RoleProvider = () =>
           ) {
             return { action: "replace" } as const;
           }
-          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+          if ((olds?.path ?? "/") !== (news?.path ?? "/")) {
             return { action: "replace" } as const;
           }
         }),
@@ -354,8 +436,29 @@ export const RoleProvider = () =>
           };
           return (yield* hasAlchemyTags(id, tags)) ? attrs : Unowned(attrs);
         }),
-        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+        reconcile: Effect.fn(function* ({
+          id,
+          news = {},
+          output,
+          session,
+          bindings,
+        }) {
           const roleName = output?.roleName ?? (yield* toRoleName(id, news));
+          // Fold binding-supplied policy statements into the inline policies.
+          const inlinePolicies = mergeBoundInlinePolicies(
+            news.inlinePolicies,
+            bindings,
+          );
+          // Merge binding-supplied trust statements into the trust policy.
+          const assumeRolePolicyDocument = mergeBoundAssumeRolePolicy(
+            news.assumeRolePolicyDocument,
+            bindings,
+          );
+          if (assumeRolePolicyDocument.Statement.length === 0) {
+            return yield* Effect.die(
+              "Role requires a trust policy: set `assumeRolePolicyDocument` or bind `assumeRolePolicyStatements`.",
+            );
+          }
           const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
@@ -381,7 +484,7 @@ export const RoleProvider = () =>
                 Path: news.path,
                 RoleName: roleName,
                 AssumeRolePolicyDocument: stringifyPolicyDocument(
-                  news.assumeRolePolicyDocument,
+                  assumeRolePolicyDocument,
                 ),
                 Description: news.description,
                 MaxSessionDuration: news.maxSessionDuration,
@@ -389,6 +492,7 @@ export const RoleProvider = () =>
                 Tags: createTagsList(desiredTags),
               })
               .pipe(
+                Effect.retry(invalidPrincipalRetry),
                 Effect.catchTag("EntityAlreadyExistsException", () =>
                   iam.getRole({ RoleName: roleName }),
                 ),
@@ -408,14 +512,16 @@ export const RoleProvider = () =>
           // when the document actually differs.
           if (
             JSON.stringify(observedAssumePolicy ?? null) !==
-            JSON.stringify(news.assumeRolePolicyDocument)
+            JSON.stringify(assumeRolePolicyDocument)
           ) {
-            yield* iam.updateAssumeRolePolicy({
-              RoleName: roleName,
-              PolicyDocument: stringifyPolicyDocument(
-                news.assumeRolePolicyDocument,
-              ),
-            });
+            yield* iam
+              .updateAssumeRolePolicy({
+                RoleName: roleName,
+                PolicyDocument: stringifyPolicyDocument(
+                  assumeRolePolicyDocument,
+                ),
+              })
+              .pipe(Effect.retry(invalidPrincipalRetry));
           }
 
           // Sync description / maxSessionDuration via updateRole.
@@ -465,7 +571,7 @@ export const RoleProvider = () =>
           yield* syncInlinePolicies({
             roleName,
             olds: observedInlinePolicies,
-            news: news.inlinePolicies ?? {},
+            news: inlinePolicies,
           });
 
           // Sync tags against the cloud's actual tags so adoption /
@@ -501,9 +607,9 @@ export const RoleProvider = () =>
               observedRole.Role?.Path ??
               news.path ??
               "/",
-            assumeRolePolicyDocument: news.assumeRolePolicyDocument,
+            assumeRolePolicyDocument,
             managedPolicyArns: news.managedPolicyArns ?? [],
-            inlinePolicies: news.inlinePolicies ?? {},
+            inlinePolicies,
             description: liveRole.Role?.Description ?? news.description,
             maxSessionDuration:
               liveRole.Role?.MaxSessionDuration ?? news.maxSessionDuration,
@@ -538,6 +644,8 @@ export const RoleProvider = () =>
                 ),
               ),
             ),
+            // The role itself may already be gone.
+            Effect.catchTag("NoSuchEntityException", () => Effect.void),
           );
 
           yield* iam
@@ -560,6 +668,8 @@ export const RoleProvider = () =>
                   ),
                 ),
               ),
+              // The role itself may already be gone.
+              Effect.catchTag("NoSuchEntityException", () => Effect.void),
             );
 
           yield* iam

package/src/AWS/Lambda/CreateAuthToken.ts

@@ -0,0 +1,43 @@
+import type * as microvms from "@distilled.cloud/aws/lambda-microvms";
+import type * as Effect from "effect/Effect";
+import * as Binding from "../../Binding.ts";
+import type { MicrovmImage } from "./MicrovmImage.ts";
+
+export interface CreateAuthTokenRequest
+  extends microvms.CreateMicrovmAuthTokenRequest {}
+
+/**
+ * Runtime binding for `CreateMicrovmAuthToken`.
+ *
+ * Bind it to a {@link MicrovmImage} to get a callable that mints a short-lived
+ * token for a running MicroVM. Send it on the MicroVM `endpoint` in the
+ * `X-aws-proxy-auth` header.
+ * @binding
+ * @section Auth Tokens
+ * @example Mint an auth token
+ * ```typescript
+ * const createAuthToken = yield* AWS.Lambda.CreateAuthToken(Sandbox);
+ * const { authToken } = yield* createAuthToken({
+ *   microvmIdentifier: vm.microvmId,
+ *   expirationInMinutes: 5,
+ *   allowedPorts: [{ port: 5000 }],
+ * });
+ * ```
+ */
+export interface CreateAuthToken extends Binding.Service<
+  CreateAuthToken,
+  "AWS.Lambda.CreateAuthToken",
+  (
+    image: MicrovmImage,
+  ) => Effect.Effect<
+    (
+      request: CreateAuthTokenRequest,
+    ) => Effect.Effect<
+      microvms.CreateMicrovmAuthTokenResponse,
+      microvms.CreateMicrovmAuthTokenError
+    >
+  >
+> {}
+export const CreateAuthToken = Binding.Service<CreateAuthToken>(
+  "AWS.Lambda.CreateAuthToken",
+);

package/src/AWS/Lambda/CreateAuthTokenHttp.ts

@@ -0,0 +1,11 @@
+import * as microvms from "@distilled.cloud/aws/lambda-microvms";
+import { CreateAuthToken } from "./CreateAuthToken.ts";
+import { makeImageBinding } from "./MicrovmBinding.ts";
+
+export const CreateAuthTokenHttp = makeImageBinding({
+  binding: CreateAuthToken,
+  name: "CreateAuthToken",
+  actions: ["lambda:CreateMicrovmAuthToken"],
+  operation: microvms.createMicrovmAuthToken,
+  scope: "microvm",
+});