1import * as Effect from "effect/Effect";
2import * as Binding from "../../Binding.ts";
3import type * as Output from "../../Output.ts";
4import { isBindingHost } from "../Lambda/Function.ts";
5import type { BrowserCustom } from "./BrowserCustom.ts";
6import type { CodeInterpreter } from "./CodeInterpreter.ts";
7import type { Memory } from "./Memory.ts";
8import type { Runtime } from "./Runtime.ts";
9
10/**
11 * Shared scaffolding for Bedrock AgentCore data-plane HTTP bindings.
12 *
13 * NOT exported from `index.ts` — every single-operation `{Op}Http.ts` in this
14 * service is a thin `Layer.effect(Cap, makeAgentCoreHttpBinding({ … }))` over
15 * the builder below. Everything except the operation, the IAM action list,
16 * the injected identifier, and the granted ARNs is boilerplate: the runtime
17 * callable injects the bound resource's identifier (memory id, code
18 * interpreter id, browser id, or agent runtime ARN) as `requestKey`, and the
19 * deploy-time half grants `actions` on `arns`.
20 *
21 * Genuinely-different bindings (custom request shaping like the
22 * `sessionTimeout` duration conversion in `StartCodeInterpreterSession` /
23 * `StartBrowserSession`) stay bespoke.
24 */
25
26/** The AgentCore resources data-plane bindings can scope to. */
27export type AgentCoreBindable =
28 | Memory
29 | CodeInterpreter
30 | BrowserCustom
31 | Runtime;
32
33/**
34 * Build the impl Effect for a single-operation AgentCore data-plane binding.
35 * The runtime callable injects the resolved `identifier` as the request's
36 * `requestKey` field; the deploy-time half grants `actions` on `arns`.
37 */
38export const makeAgentCoreHttpBinding = <
39 Res extends AgentCoreBindable,
40 I extends object,
41 K extends keyof I & string,
42 A,
43 E,
44 R,
45 IdReq = never,
46>(options: {
47 /** Fully-qualified binding tag, e.g. `AWS.BedrockAgentCore.GetEvent`. */
48 tag: string;
49 /** The distilled operation; `requestKey` is injected from the resource. */
50 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
51 /** IAM actions granted on `arns`. */
52 actions: readonly string[];
53 /** The request field the resolved identifier is injected as. */
54 requestKey: K;
55 /** Resolve the injected identifier from the bound resource. */
56 identifier: (resource: Res) => Output.Output<string, IdReq>;
57 /** IAM resource ARNs granted `actions`. */
58 arns: (resource: Res) => readonly Output.Output<string>[];
59}) =>
60 Effect.gen(function* () {
61 const op = yield* options.operation;
62
63 return Effect.fn(function* (resource: Res) {
64 const Identifier = yield* options.identifier(resource);
65 if (!globalThis.__ALCHEMY_RUNTIME__) {
66 const host = yield* Binding.Host;
67 if (isBindingHost(host)) {
68 yield* host.bind`Allow(${host}, ${options.tag}(${resource}))`({
69 policyStatements: [
70 {
71 Effect: "Allow",
72 Action: [...options.actions],
73 Resource: [...options.arns(resource)],
74 },
75 ],
76 });
77 }
78 }
79 return Effect.fn(`${options.tag}(${resource.LogicalId})`)(function* (
80 request?: Omit<I, K>,
81 ) {
82 return yield* op({
83 ...request,
84 [options.requestKey]: yield* Identifier,
85 } as I);
86 });
87 });
88 });