ignotum 0.0.11 → 0.0.13

package/dist/runtime/server.js

@@ -1,9 +1,11 @@
-import { d as Result$1 } from "./descriptor-C5VA9qRl-DuQsowaQ.js";
-import { r as defineSchema$1 } from "./schema-ERFjT8-m.js";
+import { _ as Result$1 } from "./id-Bt9XWRGL.js";
+import { a as defineSchema$1, i as defineEnv$1, l as Secret$1 } from "./schema-1Zs03-iS.js";
 //#region src/server/index.ts
 const Result = Result$1;
+const defineEnv = defineEnv$1;
 const defineSchema = defineSchema$1;
+const Secret = Secret$1;
 //#endregion
-export { Result, defineSchema };
+export { Result, Secret, defineEnv, defineSchema };
 
 //# sourceMappingURL=server.js.map

package/dist/runtime/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":["contractResult","defineContractSchema"],"sources":["../../src/server/index.ts"],"sourcesContent":["import { Result as contractResult } from \"@ignotum/contracts/runtime/result\";\nimport type { ErrorValue, Result as ContractResult } from \"@ignotum/contracts/runtime/result\";\nimport { defineSchema as defineContractSchema } from \"@ignotum/contracts/schema\";\n\nexport const Result: typeof contractResult = contractResult;\nexport type Result<Success, Failure extends ErrorValue> = ContractResult<Success, Failure>;\nexport const defineSchema: typeof defineContractSchema = defineContractSchema;\nexport type {\n  DefinedSchema,\n  FileFormat,\n  FileMetadata,\n  FileMimeType,\n  FileValue,\n  SchemaAuthoring,\n} from \"@ignotum/contracts/schema\";\n"],"mappings":";;;AAIA,MAAa,SAAgCA;AAE7C,MAAa,eAA4CC"}
+{"version":3,"file":"server.js","names":["contractResult","defineContractEnv","defineContractSchema","contractSecret"],"sources":["../../src/server/index.ts"],"sourcesContent":["import { Result as contractResult } from \"@ignotum/contracts/runtime/result\";\nimport type { ErrorValue, Result as ContractResult } from \"@ignotum/contracts/runtime/result\";\nimport {\n  defineEnv as defineContractEnv,\n  defineSchema as defineContractSchema,\n  Secret as contractSecret,\n} from \"@ignotum/contracts/schema\";\nimport type { Secret as ContractSecret } from \"@ignotum/contracts/schema\";\n\nexport const Result: typeof contractResult = contractResult;\nexport type Result<Success, Failure extends ErrorValue> = ContractResult<Success, Failure>;\nexport const defineEnv: typeof defineContractEnv = defineContractEnv;\nexport const defineSchema: typeof defineContractSchema = defineContractSchema;\nexport const Secret: typeof contractSecret = contractSecret;\nexport type Secret<Value> = ContractSecret<Value>;\nexport type {\n  DefinedEnv,\n  DefinedSchema,\n  EnvironmentAuthoring,\n  FileFormat,\n  FileMetadata,\n  FileMimeType,\n  FileValue,\n  SchemaAuthoring,\n} from \"@ignotum/contracts/schema\";\n\nexport type { User, UserId } from \"@ignotum/contracts/id\";\n"],"mappings":";;;AASA,MAAa,SAAgCA;AAE7C,MAAa,YAAsCC;AACnD,MAAa,eAA4CC;AACzD,MAAa,SAAgCC"}

package/dist/runtime/{sync-a2EdGSdY.d.ts → sync-Bs8J3fIr.d.ts}

@@ -1,8 +1,8 @@
-import "./id-Cs82tq9Q-hmYFyqTa.js";
+import "./id-BzFHf3Wo-DGPCjgrf.js";
 import { Schema } from "effect";
 //#region ../contracts/dist/runtime/sync.d.ts
 declare const FunctionAddress: Schema.TemplateLiteral<readonly ["api.", Schema.String, ".", Schema.String]>;
 type FunctionAddress = typeof FunctionAddress.Type;
 //#endregion
 export { FunctionAddress as t };
-//# sourceMappingURL=sync-a2EdGSdY.d.ts.map
+//# sourceMappingURL=sync-Bs8J3fIr.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ignotum",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "description": "Ignotum is an opinionated TypeScript application cloud.",
   "author": "Johannes Schießl",
   "repository": {
@@ -80,10 +80,10 @@
     "@effect/platform-node": "4.0.0-rc.111",
     "@effect/sql-sqlite-node": "4.0.0-rc.111",
     "redis": "6.2.1",
-    "@ignotum/runtime": "1.0.0",
     "@ignotum/contracts": "1.0.0",
-    "@ignotum/shared": "1.0.0",
-    "@ignotum/deployment": "1.0.0"
+    "@ignotum/deployment": "1.0.0",
+    "@ignotum/runtime": "1.0.0",
+    "@ignotum/shared": "1.0.0"
   },
   "engines": {
     "node": ">=22.18.0"

package/src/cli/agent-files.ts

@@ -1,3 +1,6 @@
+import authentication from "../../../../docs/user/authentication.md?raw";
+import profileSharing from "../../../../docs/user/profile-sharing.md?raw";
+import localAuthentication from "../../../../docs/user/local-authentication.md?raw";
 import agents from "../../../../docs/agent/AGENTS.md?raw";
 import skill from "../../../../docs/agent/skills/ignotum/SKILL.md?raw";
 import api from "../../../../docs/user/api.md?raw";
@@ -8,6 +11,7 @@ import deployApp from "../../../../docs/user/deploy-app.md?raw";
 import deploymentModel from "../../../../docs/user/deployment-model.md?raw";
 import deployments from "../../../../docs/user/deployments.md?raw";
 import errors from "../../../../docs/user/errors.md?raw";
+import environmentVariables from "../../../../docs/user/environment-variables.md?raw";
 import files from "../../../../docs/user/files.md?raw";
 import functions from "../../../../docs/user/functions.md?raw";
 import generatedCode from "../../../../docs/user/generated-code.md?raw";
@@ -37,6 +41,9 @@ export interface AppFile {
 }
 
 const references = [
+  ["authentication.md", authentication],
+  ["profile-sharing.md", profileSharing],
+  ["local-authentication.md", localAuthentication],
   ["api.md", api],
   ["app-entry.md", appEntry],
   ["cli.md", cli],
@@ -45,6 +52,7 @@ const references = [
   ["deployment-model.md", deploymentModel],
   ["deployments.md", deployments],
   ["errors.md", errors],
+  ["environment-variables.md", environmentVariables],
   ["files.md", files],
   ["functions.md", functions],
   ["generated-code.md", generatedCode],

package/src/cli/auth-client.ts

@@ -30,7 +30,7 @@ const AuthUrl = Schema.URL.check(
   Schema.makeFilter(
     (url) =>
       url.protocol === "https:" ||
-      (url.protocol === "http:" && ["127.0.0.1", "::1", "localhost"].includes(url.hostname)),
+      (url.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname)),
     { message: "The auth URL must use HTTPS unless it targets localhost." },
   ),
 );

package/src/cli/bin.ts

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 
+// @effect-diagnostics-next-line nodeBuiltinImport:off The isolated worker returns sensitive metadata over a dedicated inherited pipe.
+import { writeSync } from "node:fs";
 import process from "node:process";
 
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
@@ -9,15 +11,23 @@ import { main } from "./command.js";
 import { runServerDiscoveryWorker } from "./build/server.js";
 
 const discoveryWorker = process.argv[2] === "__ignotum_discover_server";
+const writeDiscovery = (encoded: string): void => {
+  const bytes = new TextEncoder().encode(encoded);
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    offset += writeSync(3, bytes, offset, bytes.byteLength - offset);
+  }
+};
 
 if (discoveryWorker) {
   const appDirectory = process.argv[3];
   const moduleNames = process.argv[4];
-  const outputPath = process.argv[5];
   globalThis.fetch = () => Promise.reject(new Error("Network access is disabled during builds."));
-  (appDirectory === undefined || moduleNames === undefined || outputPath === undefined
+  (appDirectory === undefined || moduleNames === undefined
     ? Effect.die("Invalid isolated discovery arguments.")
-    : runServerDiscoveryWorker(appDirectory, moduleNames, outputPath)
+    : runServerDiscoveryWorker(appDirectory, moduleNames).pipe(
+        Effect.tap((encoded) => Effect.sync(() => writeDiscovery(encoded))),
+      )
   ).pipe(
     // @effect-diagnostics-next-line strictEffectProvide:off The isolated worker is a process entry point.
     Effect.provide(NodeServices.layer),

package/src/cli/build/server.ts

@@ -3,7 +3,18 @@ import process from "node:process";
 import { fileURLToPath } from "node:url";
 
 import * as Config from "effect/Config";
-import { Array, Effect, FileSystem, Path, Predicate, Schema, String } from "effect";
+import {
+  Array,
+  Crypto,
+  Effect,
+  Encoding,
+  FileSystem,
+  Path,
+  Predicate,
+  Schema,
+  Stream,
+  String,
+} from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { createServer, defaultServerConditions, normalizePath } from "vite";
 import type { Plugin, ViteDevServer } from "vite";
@@ -11,7 +22,10 @@ import type { Plugin, ViteDevServer } from "vite";
 import {
   ServerBuildManifest,
   SchemaSnapshot,
+  SchemaSnapshotField,
+  EnvironmentArtifact,
   schemaSnapshotPath,
+  serverEnvironmentPath,
   type ServerFunctionArtifact,
 } from "@ignotum/contracts/deployment";
 import { FunctionAddress } from "@ignotum/contracts/runtime/sync";
@@ -19,7 +33,9 @@ import type { FunctionKind } from "@ignotum/contracts/runtime/functions";
 import {
   descriptorContainsFile,
   descriptorFields,
+  emptyEnv,
   getValueDescriptor,
+  isDefinedEnv,
   isDefinedSchema,
   ValueDescriptor,
   type DefinedSchema,
@@ -34,6 +50,7 @@ import {
 } from "@ignotum/deployment";
 
 import { inspectRuntimeFunctionDefinition } from "../../internal/function-definition.js";
+import { loadEnvironment } from "../environment.js";
 import { moduleBoundariesPlugin, BuildBoundaryViolation } from "../module-boundaries.js";
 import {
   causeMessage,
@@ -69,6 +86,11 @@ interface DiscoveredServerFunction {
 }
 
 const ServerDiscoveryManifest = Schema.Struct({
+  environment: Schema.Struct({
+    fields: Schema.Array(SchemaSnapshotField),
+    hasDefinition: Schema.Boolean,
+    values: Schema.Record(Schema.String, Schema.String),
+  }),
   functions: Schema.Array(DiscoveredServerFunction),
   schema: SchemaSnapshot,
 });
@@ -77,6 +99,10 @@ const ServerDiscoveryManifestJson = Schema.fromJsonString(ServerDiscoveryManifes
 const ServerModuleNamesJson = Schema.fromJsonString(Schema.Array(Schema.String));
 
 export interface ServerBuildResult {
+  readonly environment: {
+    readonly bytes: Uint8Array;
+    readonly path: typeof serverEnvironmentPath;
+  };
   readonly functions: number;
   readonly manifestPath: string;
 }
@@ -268,6 +294,7 @@ const discoverServerFunctionsInProcess = Effect.fn("Deploy.discoverServerFunctio
   return yield* Effect.scoped(
     Effect.gen(function* () {
       const server = yield* acquireModuleRunner(appDirectory, conditions);
+      const fileSystem = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const schemaPath = path.join(appDirectory, "server", "schema.ts");
       const loadedSchemaModule = yield* Effect.tryPromise({
@@ -295,14 +322,59 @@ const discoverServerFunctionsInProcess = Effect.fn("Deploy.discoverServerFunctio
           message: "The default export from server/schema.ts is not an Ignotum schema.",
         });
       }
+      const environmentPath = path.join(appDirectory, "server", "env.ts");
+      const hasEnvironmentDefinition = yield* fileSystem.exists(environmentPath);
+      const environment = hasEnvironmentDefinition
+        ? yield* Effect.gen(function* () {
+            const loadedEnvironmentModule = yield* Effect.tryPromise({
+              try: () => server.ssrLoadModule(normalizePath(environmentPath)),
+              catch: (cause) =>
+                ServerFunctionDiscoveryFailed.make({
+                  cause,
+                  message: "Could not load the application environment declaration.",
+                  path: environmentPath,
+                }),
+            });
+            if (
+              !Predicate.isObject(loadedEnvironmentModule.default) ||
+              !isDefinedEnv(loadedEnvironmentModule.default)
+            ) {
+              return yield* InvalidBuildOutput.make({
+                message: "The default export from server/env.ts is not an Ignotum environment.",
+              });
+            }
+            const loaded = yield* loadEnvironment(
+              appDirectory,
+              loadedEnvironmentModule.default,
+              true,
+            );
+            return {
+              fields: loadedEnvironmentModule.default.descriptors,
+              hasDefinition: true,
+              values: loaded.raw,
+            } as const;
+          })
+        : yield* loadEnvironment(appDirectory, emptyEnv, false).pipe(
+            Effect.map((loaded) => ({
+              fields: [],
+              hasDefinition: false,
+              values: loaded.raw,
+            })),
+          );
       const modules = yield* Effect.forEach(moduleNames, (moduleName) =>
         discoverModuleFunctions(server, appDirectory, moduleName),
       );
       return {
         functions: Array.flatten(modules),
+        environment,
         schema: schemaCandidate,
       } satisfies {
         readonly functions: ReadonlyArray<DiscoveredServerFunction>;
+        readonly environment: {
+          readonly fields: ReadonlyArray<SchemaSnapshotField>;
+          readonly hasDefinition: boolean;
+          readonly values: Readonly<Record<string, string>>;
+        };
         readonly schema: DefinedSchema<Tables>;
       };
     }),
@@ -312,9 +384,7 @@ const discoverServerFunctionsInProcess = Effect.fn("Deploy.discoverServerFunctio
 export const runServerDiscoveryWorker = Effect.fn("Deploy.runServerDiscoveryWorker")(function* (
   appDirectory: string,
   moduleNamesJson: string,
-  outputPath: string,
 ) {
-  const fileSystem = yield* FileSystem.FileSystem;
   const moduleNames = yield* Schema.decodeEffect(ServerModuleNamesJson)(moduleNamesJson).pipe(
     Effect.orDie,
   );
@@ -327,11 +397,11 @@ export const runServerDiscoveryWorker = Effect.fn("Deploy.runServerDiscoveryWork
         message: "The application schema does not have canonical Ignotum descriptors.",
       }),
   });
-  const encoded = yield* Schema.encodeEffect(ServerDiscoveryManifestJson)({
+  return yield* Schema.encodeEffect(ServerDiscoveryManifestJson)({
+    environment: discovered.environment,
     functions: discovered.functions,
     schema,
   });
-  yield* fileSystem.writeFileString(outputPath, encoded);
 });
 
 const discoveryWorkerEntry = Effect.fn("Deploy.discoveryWorkerEntry")(function* () {
@@ -365,7 +435,6 @@ const discoverServerFunctions = Effect.fn("Deploy.discoverServerFunctionsIsolate
         (temporary) =>
           fileSystem.remove(temporary, { force: true, recursive: true }).pipe(Effect.orDie),
       );
-      const outputPath = path.join(directory, "discovery.json");
       const encodedModuleNames = yield* Schema.encodeEffect(ServerModuleNamesJson)(moduleNames);
       const packageRoot = path.resolve(path.dirname(workerEntry), "../..");
       const workspaceProbes: Array<string> = [];
@@ -387,23 +456,25 @@ const discoverServerFunctions = Effect.fn("Deploy.discoverServerFunctionsIsolate
       const readPermissions = [
         appDirectory,
         nodeModulesDirectory(),
+        path.dirname(nodeModulesDirectory()),
         packageRoot,
         path.join(packageRoot, "node_modules"),
+        path.resolve(packageRoot, "../..", "node_modules"),
         ...workspaceProbes,
       ].map((allowedPath) => `--allow-fs-read=${allowedPath}`);
-      const exitCode = yield* spawner.exitCode(
+      const handle = yield* spawner.spawn(
         ChildProcess.make(
           process.execPath,
           [
             "--permission",
             "--allow-addons",
+            "--conditions=@ignotum/source",
             ...readPermissions,
             `--allow-fs-write=${directory}`,
             workerEntry,
             "__ignotum_discover_server",
             appDirectory,
             encodedModuleNames,
-            outputPath,
           ],
           {
             cwd: appDirectory,
@@ -414,9 +485,14 @@ const discoverServerFunctions = Effect.fn("Deploy.discoverServerFunctionsIsolate
             },
             stderr: "inherit",
             stdout: "ignore",
+            additionalFds: { fd3: { type: "output" } },
           },
         ),
       );
+      const [encoded, exitCode] = yield* Effect.all(
+        [Stream.mkString(Stream.decodeText(handle.getOutputFd(3))), handle.exitCode],
+        { concurrency: "unbounded" },
+      );
       if (exitCode !== ChildProcessSpawner.ExitCode(0)) {
         return yield* ServerFunctionDiscoveryFailed.make({
           cause: new Error(`Discovery worker exited with code ${exitCode}.`),
@@ -424,13 +500,12 @@ const discoverServerFunctions = Effect.fn("Deploy.discoverServerFunctionsIsolate
           path: appDirectory,
         });
       }
-      const encoded = yield* fileSystem.readFileString(outputPath);
       return yield* Schema.decodeEffect(ServerDiscoveryManifestJson)(encoded).pipe(
         Effect.mapError((cause) =>
           ServerFunctionDiscoveryFailed.make({
             cause,
             message: "The isolated build process returned invalid application metadata.",
-            path: outputPath,
+            path: appDirectory,
           }),
         ),
       );
@@ -445,8 +520,8 @@ const serverFunctionEntryPlugin = (definition: DiscoveredServerFunction): Plugin
 import { invoke } from "ignotum/internal/host"
 import { ${definition.exportName} as definition } from ${encodeJavaScriptString(normalizePath(definition.modulePath))}
 
-export default async function handler(encodedRequest) {
-  return invoke(definition, JSON.parse(encodedRequest), call)
+export default async function handler(encodedRequest, encodedEnvironment) {
+  return invoke(definition, JSON.parse(encodedRequest), call, JSON.parse(encodedEnvironment))
 }
 `;
 
@@ -573,6 +648,15 @@ export const buildServer = Effect.fn("Deploy.buildServer")(function* (
   const path = yield* Path.Path;
   const conditions = yield* serverConditions();
   const discovered = yield* discoverServerFunctions(appDirectory, functionModules);
+  const crypto = yield* Crypto.Crypto;
+  const environmentArtifact = {
+    formatVersion: 1,
+    nonce: Encoding.encodeBase64Url(yield* crypto.randomBytes(32)),
+    values: discovered.environment.values,
+  } satisfies EnvironmentArtifact;
+  const environmentBytes = utf8Bytes(
+    `${encodeCanonical(EnvironmentArtifact, environmentArtifact)}\n`,
+  );
 
   yield* fileSystem.makeDirectory(outputDirectory, { recursive: true });
   const encodedSnapshot = encodeSchemaSnapshot(discovered.schema);
@@ -584,7 +668,11 @@ export const buildServer = Effect.fn("Deploy.buildServer")(function* (
     { concurrency: 4 },
   );
   const manifest = {
-    formatVersion: 2,
+    formatVersion: 3,
+    environment: {
+      artifact: yield* artifactReference(serverEnvironmentPath, environmentBytes),
+      fields: discovered.environment.fields,
+    },
     schema: yield* artifactReference(schemaSnapshotPath, snapshotBytes),
     functions,
   } satisfies ServerBuildManifest;
@@ -598,6 +686,7 @@ export const buildServer = Effect.fn("Deploy.buildServer")(function* (
   );
 
   return {
+    environment: { bytes: environmentBytes, path: serverEnvironmentPath },
     functions: functions.length,
     manifestPath,
   } satisfies ServerBuildResult;

package/src/cli/codegen.ts

@@ -41,6 +41,7 @@ const isFunctionModuleFile = (fileName: string): boolean =>
   !fileName.endsWith(".test.ts") &&
   !fileName.endsWith(".spec.ts") &&
   fileName !== "index.ts" &&
+  fileName !== "env.ts" &&
   fileName !== "schema.ts" &&
   !fileName.startsWith("_");
 
@@ -57,13 +58,13 @@ const moduleNameFromFile = (filePath: string, fileName: string) => {
   );
 };
 
-const renderServerBindings = (): string => `${generatedHeader}
+const renderServerBindings = (hasEnvironment: boolean): string => `${generatedHeader}
 
 import { bindSchema } from "ignotum/internal/server";
 
-import schema from "../server/schema.js";
+${hasEnvironment ? 'import environment from "../server/env.js";\n' : ""}import schema from "../server/schema.js";
 
-export const { mutation, query, values } = bindSchema(schema);
+export const { mutation, query, values } = bindSchema(schema${hasEnvironment ? ", environment" : ""});
 `;
 
 const renderTypes = (): string => `${generatedHeader}
@@ -157,6 +158,7 @@ export const generate = Effect.fn("Codegen.generate")(function* (appDirectory: s
   const path = yield* Path.Path;
   const serverDirectory = path.join(appDirectory, "server");
   const schemaPath = path.join(serverDirectory, "schema.ts");
+  const environmentPath = path.join(serverDirectory, "env.ts");
   const schemaExists = yield* fileSystem.exists(schemaPath);
 
   if (!schemaExists) {
@@ -167,13 +169,14 @@ export const generate = Effect.fn("Codegen.generate")(function* (appDirectory: s
   }
 
   const entries = yield* fileSystem.readDirectory(serverDirectory);
+  const hasEnvironment = yield* fileSystem.exists(environmentPath);
   const functionFiles = Array.sort(String.Order)(Array.filter(entries, isFunctionModuleFile));
   const functionModules = yield* Effect.forEach(functionFiles, (fileName) =>
     moduleNameFromFile(path.join(serverDirectory, fileName), fileName),
   );
   const outputs: ReadonlyArray<GeneratedOutput> = [
     {
-      content: renderServerBindings(),
+      content: renderServerBindings(hasEnvironment),
       path: path.join(appDirectory, "_generated", "server.ts"),
     },
     {

package/src/cli/control-client.ts

@@ -102,11 +102,12 @@ export class ControlClientUnavailable extends Schema.TaggedError<ControlClientUn
 ) {}
 
 export interface DeploymentUploadFile {
+  readonly bytes?: Uint8Array;
   readonly contentType: string;
   readonly path: string;
   readonly sha256: string;
   readonly size: number;
-  readonly sourcePath: string;
+  readonly sourcePath?: string;
 }
 
 interface ControlClientService {
@@ -168,6 +169,7 @@ export const deploymentUploadFiles = Effect.fn("ControlClient.deploymentUploadFi
   inventorySha256: string,
   inventorySize: number,
   buildDirectory: string,
+  memoryFiles: ReadonlyMap<string, Uint8Array> = new Map(),
 ) {
   const path = yield* Path.Path;
   return [
@@ -178,7 +180,18 @@ export const deploymentUploadFiles = Effect.fn("ControlClient.deploymentUploadFi
       size: inventorySize,
       sourcePath: path.join(buildDirectory, deploymentInventoryPath),
     },
-    ...inventory.files.map((file) => uploadFile(file, path.join(buildDirectory, file.path))),
+    ...inventory.files.map((file) => {
+      const bytes = memoryFiles.get(file.path);
+      return bytes === undefined
+        ? uploadFile(file, path.join(buildDirectory, file.path))
+        : {
+            bytes,
+            contentType: file.contentType,
+            path: file.path,
+            sha256: file.sha256,
+            size: file.size,
+          };
+    }),
   ];
 });
 
@@ -304,17 +317,26 @@ export const controlClientLayer = Layer.effect(
       deploymentId: DeploymentId,
       file: DeploymentUploadFile,
     ) {
-      const request = yield* HttpClientRequest.put(
+      const baseRequest = HttpClientRequest.put(
         endpoint(config.apiUrl, controlDeploymentFilePath(appId, deploymentId, file.path)),
       ).pipe(
         HttpClientRequest.setHeader(controlUploadHeaderNames.contentLength, String(file.size)),
         HttpClientRequest.setHeader(controlUploadHeaderNames.sha256, file.sha256),
-        HttpClientRequest.bodyFile(file.sourcePath, { contentType: file.contentType }),
-        Effect.provideService(FileSystem.FileSystem, fileSystem),
-        Effect.mapError((cause) =>
-          unavailable(`Deployment file '${file.path}' could not be opened.`, cause),
-        ),
       );
+      const request = yield* file.bytes === undefined
+        ? file.sourcePath === undefined
+          ? Effect.fail(unavailable(`Deployment file '${file.path}' has no upload source.`, {}))
+          : HttpClientRequest.bodyFile(baseRequest, file.sourcePath, {
+              contentType: file.contentType,
+            }).pipe(
+              Effect.provideService(FileSystem.FileSystem, fileSystem),
+              Effect.mapError((cause) =>
+                unavailable(`Deployment file '${file.path}' could not be opened.`, cause),
+              ),
+            )
+        : Effect.succeed(
+            HttpClientRequest.bodyUint8Array(baseRequest, file.bytes, file.contentType),
+          );
       const response = yield* executeIdempotent(request, DeploymentFileUploadResponse);
       return response.status;
     });

package/src/cli/deploy.ts

@@ -22,6 +22,7 @@ export interface DeploymentBuildResult {
   readonly inventory: DeploymentInventory;
   readonly inventoryBytes: Uint8Array;
   readonly outputDirectory: string;
+  readonly memoryFiles?: ReadonlyMap<string, Uint8Array>;
   readonly serverFunctions: number;
 }
 
@@ -119,13 +120,15 @@ export const buildDeploymentArtifact = Effect.fn("Deploy.buildArtifact")(functio
       const serverOutput = path.join(stagingDirectory, "server");
       const client = yield* buildClient(appDirectory, clientOutput);
       const server = yield* buildServer(appDirectory, serverOutput, codegen.functionModules);
-      const payloadFiles = yield* readArtifactDirectory(stagingDirectory);
+      const diskPayloadFiles = yield* readArtifactDirectory(stagingDirectory);
+      const payloadFiles = [...diskPayloadFiles, server.environment];
       const inventory = yield* makeDeploymentInventory(payloadFiles);
       yield* fileSystem.writeFile(
         path.join(stagingDirectory, deploymentInventoryPath),
         inventory.bytes,
       );
-      const artifactFiles = yield* readArtifactDirectory(stagingDirectory);
+      const diskArtifactFiles = yield* readArtifactDirectory(stagingDirectory);
+      const artifactFiles = [...diskArtifactFiles, server.environment];
       yield* validateDeploymentArtifact(artifactFiles);
       yield* Effect.logInfo("Built deployment artifact").pipe(
         Effect.annotateLogs({
@@ -140,6 +143,7 @@ export const buildDeploymentArtifact = Effect.fn("Deploy.buildArtifact")(functio
         clientAssets: client.assets,
         inventory: inventory.inventory,
         inventoryBytes: inventory.bytes,
+        memoryFiles: new Map([[server.environment.path, server.environment.bytes]]),
         outputDirectory: buildDirectory,
         serverFunctions: server.functions,
       } satisfies DeploymentBuildResult;
@@ -158,6 +162,7 @@ export const uploadDeployment = Effect.fn("Deploy.upload")(function* (
     inventorySha256,
     build.inventoryBytes.byteLength,
     build.outputDirectory,
+    build.memoryFiles,
   );
   const deployment = yield* control.beginDeployment(configuration.appId, build.inventory);