@alchemy.run/fly 0.0.0-stage → 2.0.0-beta.84

package/lib/App.js

@@ -0,0 +1,340 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Retry from "@distilled.cloud/fly-io/Retry";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import { resolveOrgSlug } from "./Environment.js";
+import { createFlyAppName, isAlchemyOwnedMetadata, matchesAlchemyPhysicalName, sanitizeFlyAppName, } from "./Metadata.js";
+import { findPortConflict, portsOfProps, withBindingPort } from "./ports.js";
+import { DEFAULT_BINDING_PORT } from "./rpc.js";
+export class AppDeletionAmbiguous extends Data.TaggedError("Fly.AppDeletionAmbiguous") {
+    get message() {
+        return `Deletion of ${this.appName} is uncertain (${this.evidence}); reconcile the App before retrying or recreating its name. Machine leases cannot fence App deletion.`;
+    }
+}
+/**
+ * A Fly.App is a global namespace in your account. It contains Machines,
+ * Secrets, IPs, and certificates. A {@link Service} creates its own App,
+ * so declare an App yourself for {@link Machine}s, or to group Services
+ * that share Secrets or a custom domain (the Service `app` prop).
+ *
+ * @see https://fly.io/docs/machines/api/apps-resource/
+ *
+ * ### Create an App
+ * Alchemy generates a unique name unless you pass one. `url` is
+ * `https://{appName}.fly.dev`. Nothing answers there until a
+ * {@link Machine} (or a Service with `app`) publishes a proxy service and
+ * the App has an {@link IpAssignment}.
+ *
+ * **Example:** Generated name
+ * ```typescript
+ * const site = yield* Fly.App("Site");
+ * ```
+ *
+ * :::note
+ * Prefer omitting `name` in tests and CI so names stay unique and
+ * reclaimable.
+ * :::
+ *
+ * ### A stable hostname
+ * Pass `name` when you need a stable `fly.dev` hostname.
+ *
+ * **Example:** Explicit name
+ * ```typescript
+ * const site = yield* Fly.App("Site", {
+ *   name: "my-site",
+ * });
+ * ```
+ *
+ * :::caution[Changing `name` replaces the App]
+ * Fly cannot have two Apps with the same name. Alchemy deletes the
+ * old App first, then creates the new one.
+ * :::
+ *
+ * ### Organization
+ * Org defaults to the current token. Pass `orgSlug` to pin it.
+ *
+ * **Example:** Pin an org
+ * ```typescript
+ * const site = yield* Fly.App("Site", {
+ *   name: "my-site",
+ *   orgSlug: "my-org",
+ * });
+ * ```
+ *
+ * :::caution[Changing `orgSlug` replaces the App]
+ * The App is created in the new org. The old App is deleted.
+ * :::
+ *
+ * ### Subdomains
+ * `enableSubdomains: true` turns on `*.{appName}.fly.dev`.
+ *
+ * **Example:** Enable subdomains
+ * ```typescript
+ * const site = yield* Fly.App("Site", {
+ *   name: "my-site",
+ *   enableSubdomains: true,
+ * });
+ * ```
+ *
+ * :::note[Create-only]
+ * Flipping `enableSubdomains` later is ignored.
+ * :::
+ *
+ * ### Isolated network
+ * `network` is an optional 6PN name.
+ *
+ * **Example:** Custom network
+ * ```typescript
+ * const site = yield* Fly.App("Site", {
+ *   name: "my-site",
+ *   network: "private",
+ * });
+ * ```
+ *
+ * :::caution[Changing `network` replaces the App]
+ * The App is recreated on the new network.
+ * :::
+ *
+ * ### Module-scope declarations
+ * Declare the App once. Pass it into every child. Resource-valued props
+ * accept the resource or an Effect producing it. Do not unwrap it just
+ * to pass it along.
+ *
+ * **Example:** Module-scope App
+ * ```typescript
+ * // src/app.ts
+ * import * as Fly from "@alchemy.run/fly";
+ *
+ * export const Site = Fly.App("Site");
+ * ```
+ *
+ * @resource
+ * @product App
+ */
+export const App = Resource("Fly.App");
+export class AppNotCreated extends Data.TaggedError("Fly.AppNotCreated") {
+    get message() {
+        return `Fly App ${this.name} was not created${this.reason ? `: ${this.reason}` : ""}`;
+    }
+}
+const toAttrs = (app, fallbackName) => {
+    const appName = app.name ?? fallbackName ?? "";
+    return {
+        appId: app.id ?? appName,
+        appName,
+        internalNumericId: app.internal_numeric_id,
+        network: app.network,
+        status: app.status,
+        orgSlug: app.organization?.slug,
+        machineCount: app.machine_count,
+        volumeCount: app.volume_count,
+        url: `https://${appName}.fly.dev`,
+    };
+};
+const resolveAppName = (id, name, existing) => Effect.gen(function* () {
+    if (name !== undefined)
+        return sanitizeFlyAppName(name);
+    if (existing !== undefined)
+        return existing;
+    return yield* createFlyAppName(id);
+});
+const getByName = (appName) => machines
+    .getApp({ app_name: appName })
+    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+const hasAlchemyMachines = (appName) => machines.listMachines({ app_name: appName }).pipe(Effect.map((machines) => machines.some((machine) => isAlchemyOwnedMetadata(machine.config?.metadata))), Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed(false)));
+const hasAlchemyNamed = (names) => names.some((name) => matchesAlchemyPhysicalName(name));
+const hasAlchemyVolumes = (appName) => machines.listVolumes({ app_name: appName }).pipe(Effect.map((volumes) => hasAlchemyNamed(volumes.map((volume) => volume.name))), Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed(false)));
+const hasAlchemySecrets = (appName) => machines.listSecrets({ app_name: appName }).pipe(Effect.map((res) => hasAlchemyNamed((res.secrets ?? []).map((secret) => secret.name))), Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed(false)));
+const hasAlchemySecretKeys = (appName) => machines.listSecretKeys({ app_name: appName }).pipe(Effect.map((res) => hasAlchemyNamed((res.secret_keys ?? []).map((key) => key.name))), Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed(false)));
+const isOwnedApp = (app) => Effect.gen(function* () {
+    if (matchesAlchemyPhysicalName(app.name))
+        return true;
+    const appName = app.name;
+    if (appName === undefined || appName.length === 0)
+        return false;
+    const flags = yield* Effect.all([
+        hasAlchemyMachines(appName),
+        hasAlchemyVolumes(appName),
+        hasAlchemySecrets(appName),
+        hasAlchemySecretKeys(appName),
+    ], { concurrency: 4 });
+    return flags.some(Boolean);
+});
+/**
+ * Apps in the current token's org that Alchemy owns. Used by {@link App}
+ * `list()` and by child resources (Machine / Volume / Secret) so nuke
+ * never enumerates the whole org unfiltered.
+ */
+export const listOwnedApps = Effect.fn(function* () {
+    const orgSlug = yield* resolveOrgSlug();
+    const { apps } = yield* machines.listApps({ org_slug: orgSlug });
+    const flagged = yield* Effect.forEach(apps ?? [], (app) => isOwnedApp(app).pipe(Effect.map((owned) => (owned ? toAttrs(app) : undefined))), { concurrency: 8 });
+    return flagged.filter((attrs) => attrs !== undefined);
+});
+/**
+ * Observe an App by name and create it when missing. Shared by
+ * {@link App} and by Services that own their App.
+ */
+export const ensureApp = Effect.fn(function* (input) {
+    let current = input.previousName !== undefined ? yield* getByName(input.previousName) : undefined;
+    if (current === undefined && input.previousName !== input.name) {
+        current = yield* getByName(input.name);
+    }
+    if (current === undefined) {
+        const orgSlug = input.orgSlug ?? (yield* resolveOrgSlug());
+        // A name race surfaces as Conflict or UnprocessableEntity; the lookup
+        // decides whether the App now exists. Apps created at the same time on
+        // a network that does not exist yet race to create it, and the losers
+        // are rejected with "uniqueness constraint violated", so retry them.
+        const create = machines
+            .createApp({
+            name: input.name,
+            org_slug: orgSlug,
+            network: input.network,
+            enable_subdomains: input.enableSubdomains,
+        })
+            .pipe(Effect.as(undefined), Effect.catchTag(["Conflict", "UnprocessableEntity"], (error) => Effect.succeed(error)));
+        // A new App can take a moment to become readable.
+        const observe = getByName(input.name).pipe(Effect.repeat({
+            schedule: Schedule.spaced("1 second"),
+            until: (app) => app !== undefined,
+            times: 5,
+        }));
+        let rejection;
+        for (let attempt = 0; attempt < 5 && current === undefined; attempt++) {
+            if (attempt > 0)
+                yield* Effect.sleep(`${attempt * 2} seconds`);
+            rejection = (yield* create)?.message;
+            current = yield* observe;
+        }
+        if (current === undefined) {
+            return yield* new AppNotCreated({ name: input.name, reason: rejection });
+        }
+    }
+    if (current === undefined) {
+        return yield* new AppNotCreated({ name: input.name });
+    }
+    return current;
+});
+/**
+ * Delete an App and the Alchemy-owned Volumes in it. Idempotent: a missing
+ * App is not an error. Fly deletes the App's Machines, addresses, secrets,
+ * and certificates with it.
+ */
+export const deleteApp = Effect.fn(function* (appName) {
+    if (appName.length === 0)
+        return;
+    const volumes = yield* machines
+        .listVolumes({ app_name: appName })
+        .pipe(Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed([])));
+    yield* Effect.forEach(volumes, (volume) => {
+        const volumeId = volume.id;
+        if (volumeId === undefined ||
+            volumeId.length === 0 ||
+            !matchesAlchemyPhysicalName(volume.name)) {
+            return Effect.void;
+        }
+        return machines.deleteVolume({ app_name: appName, volume_id: volumeId }).pipe(Effect.asVoid, Effect.catchTag(["NotFound", "Conflict"], () => Effect.void));
+    }, { concurrency: 4 });
+    const http = yield* HttpClient.HttpClient;
+    const fetchOptions = yield* Effect.serviceOption(FetchHttpClient.RequestInit);
+    yield* machines.deleteApp({ app_name: appName }).pipe(Retry.none, 
+    // Bun can replay DELETE on a reused socket below the SDK retry policy.
+    Effect.provideService(HttpClient.HttpClient, HttpClient.mapRequest(http, HttpClientRequest.setHeader("connection", "close"))), Effect.provideService(FetchHttpClient.RequestInit, {
+        ...Option.getOrUndefined(fetchOptions),
+        keepalive: false,
+        redirect: "error",
+    }), Effect.timeout("30 seconds"), Effect.catchTag("NotFound", () => Effect.void), Effect.catchTag([
+        "HttpClientError",
+        "TimeoutError",
+        "InternalServerError",
+        "BadGateway",
+        "ServiceUnavailable",
+        "GatewayTimeout",
+    ], (error) => Effect.fail(new AppDeletionAmbiguous({ appName, evidence: error._tag }))));
+    const gone = yield* getByName(appName).pipe(Effect.map((app) => app === undefined), Effect.repeat({ schedule: Schedule.spaced("1 second"), until: (gone) => gone, times: 8 }), Effect.timeout("30 seconds"), Effect.mapError((error) => new AppDeletionAmbiguous({
+        appName,
+        evidence: `delete accepted but absence verification failed: ${error._tag}`,
+    })));
+    if (!gone)
+        return yield* new AppDeletionAmbiguous({
+            appName,
+            evidence: "delete accepted but absence not observed",
+        });
+});
+/** Fail when two Services placed in the App publish the same port. */
+const validateServicePorts = (appName, bindings) => {
+    const conflict = findPortConflict(appName, bindings
+        .filter((binding) => binding.action !== "delete")
+        .map((binding) => ({
+        id: binding.data.service,
+        // A Service in a shared App is public: default ports are 80 and 443.
+        ports: withBindingPort(portsOfProps(binding.data.services, true), binding.data.bindingPort ?? DEFAULT_BINDING_PORT),
+    })));
+    return conflict === undefined ? Effect.void : Effect.fail(conflict);
+};
+export const AppProvider = () => Provider.succeed(App, {
+    stables: ["appId", "appName", "orgSlug", "network", "internalNumericId"],
+    diff: Effect.fn(function* ({ id, news, output, newBindings }) {
+        // At plan time, including for an App created in the same deploy.
+        if (isResolved(newBindings)) {
+            yield* validateServicePorts(output?.appName ?? (isResolved(news) ? news?.name : undefined) ?? id, newBindings);
+        }
+        if (news === undefined || !isResolved(news))
+            return undefined;
+        if (output === undefined)
+            return undefined;
+        const desiredName = news.name !== undefined ? sanitizeFlyAppName(news.name) : output.appName;
+        const nameChanged = desiredName !== output.appName;
+        const orgChanged = news.orgSlug !== undefined && news.orgSlug !== output.orgSlug;
+        const networkChanged = news.network !== undefined && news.network !== output.network;
+        if (nameChanged || orgChanged || networkChanged) {
+            return {
+                action: "replace",
+                // Same physical name cannot exist twice — delete the old App first.
+                deleteFirst: !nameChanged,
+            };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+        const name = yield* resolveAppName(id, olds?.name, output?.appName);
+        const found = (output?.appName !== undefined ? yield* getByName(output.appName) : undefined) ??
+            (yield* getByName(name));
+        if (found === undefined)
+            return undefined;
+        const attrs = toAttrs(found, name);
+        if (output !== undefined)
+            return attrs;
+        return (yield* isOwnedApp(found)) ? attrs : Unowned(attrs);
+    }),
+    list: listOwnedApps,
+    reconcile: Effect.fn(function* ({ id, news, output, bindings }) {
+        const props = news ?? {};
+        const name = yield* resolveAppName(id, props.name, output?.appName);
+        // Before creating anything, so a conflict leaves the App untouched.
+        yield* validateServicePorts(name, bindings);
+        const current = yield* ensureApp({
+            name,
+            orgSlug: props.orgSlug,
+            network: props.network,
+            enableSubdomains: props.enableSubdomains,
+            previousName: output?.appName,
+        });
+        // No update API. enableSubdomains is create-only.
+        return toAttrs(current, name);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* deleteApp(output.appName);
+    }),
+});
+//# sourceMappingURL=App.js.map

package/lib/App.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"App.js","sourceRoot":"","sources":["../src/App.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kCAAkC,CAAC;AAC7D,OAAO,KAAK,KAAK,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAwB,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEhD,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAGnF;IACA,IAAI,OAAO;QACT,OAAO,eAAe,IAAI,CAAC,OAAO,kBAAkB,IAAI,CAAC,QAAQ,wGAAwG,CAAC;IAC5K,CAAC;CACF;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,QAAQ,CAAM,SAAS,CAAC,CAAC;AAE5C,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAIrE;IACA,IAAI,OAAO;QACT,OAAO,WAAW,IAAI,CAAC,IAAI,mBAAmB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;CACF;AAED,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,YAAqB,EAAqB,EAAE;IACxE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,YAAY,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,OAAO;QACxB,OAAO;QACP,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;QAC1C,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI;QAC/B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,GAAG,EAAE,WAAW,OAAO,UAAU;KAClC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,QAAiB,EAAE,EAAE,CACjF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CACpC,QAAQ;KACL,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;KAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAExE,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAE,EAAE,CAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAC7E,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;AAEJ,MAAM,eAAe,GAAG,CAAC,KAAgC,EAAE,EAAE,CAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;AAEzD,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,EAAE,CAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAC9E,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;AAEJ,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,EAAE,CAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EACtF,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;AAEJ,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EACpF,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAC7B;QACE,kBAAkB,CAAC,OAAO,CAAC;QAC3B,iBAAiB,CAAC,OAAO,CAAC;QAC1B,iBAAiB,CAAC,OAAO,CAAC;QAC1B,oBAAoB,CAAC,OAAO,CAAC;KAC9B,EACD,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnC,IAAI,IAAI,EAAE,EACV,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACxF,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAO7C;IACC,IAAI,OAAO,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/D,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3D,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,MAAM,GAAG,QAAQ;aACpB,SAAS,CAAC;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;SAC1C,CAAC;aACD,IAAI,CACH,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EACpB,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACvF,CAAC;QACJ,kDAAkD;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS;YACjC,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QACF,IAAI,SAA6B,CAAC;QAClC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YACtE,IAAI,OAAO,GAAG,CAAC;gBAAE,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/D,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;YACrC,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAe;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ;SAC5B,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,EACP,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QAC3B,IACE,QAAQ,KAAK,SAAS;YACtB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,EACxC,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC7D,CAAC;IACJ,CAAC,EACD,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9E,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CACnD,KAAK,CAAC,IAAI;IACV,uEAAuE;IACvE,MAAM,CAAC,cAAc,CACnB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAChF,EACD,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,WAAW,EAAE;QACjD,GAAG,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC;QACtC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,OAAO;KAClB,CAAC,EACF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,QAAQ,CACb;QACE,iBAAiB;QACjB,cAAc;QACd,qBAAqB;QACrB,YAAY;QACZ,oBAAoB;QACpB,gBAAgB;KACjB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACpF,CACF,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,EACtC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EACzF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAC5B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;QACvB,OAAO;QACP,QAAQ,EAAE,oDAAoD,KAAK,CAAC,IAAI,EAAE;KAC3E,CAAC,CACL,CACF,CAAC;IACF,IAAI,CAAC,IAAI;QACP,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;YACrC,OAAO;YACP,QAAQ,EAAE,0CAA0C;SACrD,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,CAC3B,OAAe,EACf,QAA0E,EAC1E,EAAE;IACF,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,OAAO,EACP,QAAQ;SACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;SAChD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;QACxB,qEAAqE;QACrE,KAAK,EAAE,eAAe,CACpB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EACzC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CACjD;KACF,CAAC,CAAC,CACN,CAAC;IACF,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAC9B,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE;IACpB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,CAAC;IAExE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE;QAC1D,iEAAiE;QACjE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,CAAC,oBAAoB,CACzB,MAAM,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EACpE,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7F,MAAM,WAAW,GAAG,WAAW,KAAK,MAAM,CAAC,OAAO,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QACjF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QACrF,IAAI,WAAW,IAAI,UAAU,IAAI,cAAc,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,SAAkB;gBAC1B,oEAAoE;gBACpE,WAAW,EAAE,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,KAAK,GACT,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,IAAI,EAAE,aAAa;IAEnB,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5D,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpE,oEAAoE;QACpE,KAAK,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;YAC/B,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,YAAY,EAAE,MAAM,EAAE,OAAO;SAC9B,CAAC,CAAC;QACH,kDAAkD;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/AuthProvider.d.ts

@@ -0,0 +1,22 @@
+import { type StoredAuthConfig } from "alchemy/Auth/StoredAuthProvider";
+import * as Redacted from "effect/Redacted";
+export declare const FLY_AUTH_PROVIDER_NAME = "Fly";
+export declare const FLY_API_TOKEN_ENV = "FLY_API_TOKEN";
+export declare const FLY_API_HOSTNAME_ENV = "FLY_API_HOSTNAME";
+export type FlyAuthConfig = StoredAuthConfig;
+export type FlyResolvedCredentials = {
+    type: "token";
+    apiKey: Redacted.Redacted<string>;
+    apiBaseUrl: string;
+    source: {
+        type: FlyAuthConfig["method"] | "env";
+        details?: string;
+    };
+};
+/**
+ * Layer that registers the Fly {@link AuthProvider} into the
+ * {@link AuthProviders} registry. Fly uses a stored API token locally and
+ * `FLY_API_TOKEN` in CI; `FLY_API_HOSTNAME` optionally overrides the API root.
+ */
+export declare const FlyAuth: import("effect/Layer").Layer<never, never, import("alchemy/Auth/AuthProvider").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAC5C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE7C,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE,CAAC;AAwCF;;;;GAIG;AACH,eAAO,MAAM,OAAO,qKAAgB,CAAC"}

package/lib/AuthProvider.js

@@ -0,0 +1,48 @@
+import { DEFAULT_API_BASE_URL, normalizeApiBaseUrl } from "@distilled.cloud/fly-io";
+import { getEnv, getEnvRedactedRequired } from "alchemy/Auth/Env";
+import { makeStoredAuthProvider, storedSecret, storedValueText, } from "alchemy/Auth/StoredAuthProvider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+export const FLY_AUTH_PROVIDER_NAME = "Fly";
+export const FLY_API_TOKEN_ENV = "FLY_API_TOKEN";
+export const FLY_API_HOSTNAME_ENV = "FLY_API_HOSTNAME";
+const resolveApiBaseUrl = (explicit) => getEnv(FLY_API_HOSTNAME_ENV).pipe(Effect.map((fromEnv) => normalizeApiBaseUrl(explicit ?? fromEnv)));
+const flyAuth = makeStoredAuthProvider({
+    provider: FLY_AUTH_PROVIDER_NAME,
+    fields: [
+        { name: "apiKey", label: "Fly.io API Token", secret: true },
+        {
+            name: "apiBaseUrl",
+            label: "Fly API hostname",
+            placeholder: DEFAULT_API_BASE_URL,
+            optional: true,
+        },
+    ],
+    toResolved: (values) => ({
+        type: "token",
+        apiKey: storedSecret(values.apiKey) ?? Redacted.make(""),
+        apiBaseUrl: normalizeApiBaseUrl(storedValueText(values.apiBaseUrl)),
+        source: { type: "stored" },
+    }),
+    readEnvironment: Effect.gen(function* () {
+        const apiKey = yield* getEnvRedactedRequired(FLY_API_TOKEN_ENV);
+        const apiBaseUrl = yield* resolveApiBaseUrl();
+        return {
+            type: "token",
+            apiKey,
+            apiBaseUrl,
+            source: { type: "env", details: FLY_API_TOKEN_ENV },
+        };
+    }),
+    environment: [
+        { name: FLY_API_TOKEN_ENV, required: true, secret: true },
+        { name: FLY_API_HOSTNAME_ENV, required: false },
+    ],
+});
+/**
+ * Layer that registers the Fly {@link AuthProvider} into the
+ * {@link AuthProviders} registry. Fly uses a stored API token locally and
+ * `FLY_API_TOKEN` in CI; `FLY_API_HOSTNAME` optionally overrides the API root.
+ */
+export const FlyAuth = flyAuth.layer;
+//# sourceMappingURL=AuthProvider.js.map

package/lib/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../src/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,eAAe,GAEhB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAWvD,MAAM,iBAAiB,GAAG,CAAC,QAAiB,EAAE,EAAE,CAC9C,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAClE,CAAC;AAEJ,MAAM,OAAO,GAAG,sBAAsB,CAAyB;IAC7D,QAAQ,EAAE,sBAAsB;IAChC,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE;QAC3D;YACE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,IAAI;SACf;KACF;IACD,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,UAAU,EAAE,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC3B,CAAC;IACF,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,OAAgB;YACtB,MAAM;YACN,UAAU;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE;SAC7D,CAAC;IACJ,CAAC,CAAC;IACF,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QACzD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE;KAChD;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC"}

package/lib/BindService.d.ts

@@ -0,0 +1,159 @@
+import { type Rpc } from "alchemy/Rpc";
+import { type RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import type * as HttpClientError from "effect/http/HttpClientError";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import type * as HttpClientResponse from "effect/http/HttpClientResponse";
+import type { Service } from "./Service.ts";
+declare const BoundServiceUnavailable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Fly.BoundServiceUnavailable";
+} & Readonly<A>;
+/** The deployed caller has no address for the bound Service. */
+export declare class BoundServiceUnavailable extends BoundServiceUnavailable_base<{
+    service: string;
+}> {
+    get message(): string;
+}
+/**
+ * Client for a Service bound with {@link bindService}: its RPC methods,
+ * plus `fetch` for its HTTP routes.
+ */
+export type ServiceClient<Shape> = Omit<Shape, "fetch" | "run"> & {
+    /**
+     * Send a request to the Service's `fetch` handler over Fly's private
+     * network. A relative URL such as `/users/u1` resolves against the
+     * Service's private address.
+     */
+    fetch(request: HttpClientRequest.HttpClientRequest): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError | BoundServiceUnavailable, RuntimeContext>;
+};
+/** A published port of a Service bound with {@link bindEndpoint}. */
+export interface EndpointClient {
+    /** `{appName}.flycast`, the bound Service's private hostname. */
+    host: Effect.Effect<string, BoundServiceUnavailable, RuntimeContext>;
+    /** The published port. */
+    port: number;
+    /** `http://{appName}.flycast:{port}`, for a port that serves plain HTTP. */
+    url: Effect.Effect<string, BoundServiceUnavailable, RuntimeContext>;
+    /** An `HttpClient` whose relative requests go to {@link url}. */
+    client: HttpClient.HttpClient.With<HttpClientError.HttpClientError | BoundServiceUnavailable>;
+}
+type Target<Shape> = Service & Rpc<Shape>;
+/** Machine env vars the caller's reconcile writes for a bound Service. */
+export declare const boundTargetEnvKeys: (id: string) => {
+    appName: string;
+    url: string;
+    token: string;
+};
+/**
+ * Bind another {@link Service} and get a typed client for it. The client
+ * calls the Service's methods (everything its program returns besides
+ * `fetch` and `run`) and forwards `fetch` requests, over Fly's private
+ * network.
+ *
+ * Binding makes the caller deploy after the Service and hands it the
+ * Service's private address and caller token. Only callers that bind a
+ * Service receive its token, so other Services on the same network cannot
+ * call its methods. Every call must also carry Fly's signed `Fly-Src`
+ * header from the same organization, so the public internet cannot call
+ * them. Calls are plain HTTP inside Fly's WireGuard-encrypted network.
+ *
+ * ### Call a private Service
+ * **Example:** Methods on the target
+ * ```typescript
+ * export default class Users extends Fly.Service<Users>()(
+ *   "Users",
+ *   { main: import.meta.url, public: false },
+ *   Effect.gen(function* () {
+ *     return {
+ *       list: () => Effect.succeed(USERS),
+ *       get: (id: string) =>
+ *         Effect.succeed(USERS.find((user) => user.id === id)),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * **Example:** Bind it and call a method
+ * ```typescript
+ * export default class Orders extends Fly.Service<Orders>()(
+ *   "Orders",
+ *   { main: import.meta.url, public: false },
+ *   Effect.gen(function* () {
+ *     const users = yield* Fly.bindService(Users);
+ *     return {
+ *       list: () =>
+ *         Effect.forEach(ORDERS, (order) =>
+ *           users
+ *             .get(order.userId)
+ *             .pipe(Effect.map((user) => ({ ...order, user }))),
+ *         ),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * ### Stream and forward HTTP
+ * **Example:** A method that returns a Stream
+ * ```typescript
+ * const all = yield* users.streamAll().pipe(Stream.runCollect);
+ * ```
+ *
+ * **Example:** Send a request to the Service's `fetch`
+ * ```typescript
+ * const response = yield* users.fetch(HttpClientRequest.get("/users/u1"));
+ * ```
+ *
+ * ### Bind one port
+ * {@link bindEndpoint} targets one published port, such as an admin API
+ * or a raw TCP protocol. Deploy fails with `Fly.EndpointNotPublished`
+ * when the Service does not publish it.
+ *
+ * **Example:** An admin API on port 9000
+ * ```typescript
+ * const admin = yield* Fly.bindEndpoint(Users, { port: 9000 });
+ * const stats = yield* admin.client.get("/stats");
+ * const host = yield* admin.host; // "{appName}.flycast"
+ * ```
+ *
+ * ### Two Services that bind each other
+ * Declare each as a tag class with its method shape, and implement each
+ * in its own file as the default export of `.make`.
+ *
+ * **Example:** Ping and Pong
+ * ```typescript
+ * // src/services.ts
+ * export class Ping extends Fly.Service<Ping, Named>()("Ping") {}
+ * export class Pong extends Fly.Service<Pong, Named>()("Pong") {}
+ *
+ * // src/ping.ts
+ * export default Ping.make(
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const pong = yield* Fly.bindService(Pong);
+ *     return { name: () => Effect.succeed("ping") };
+ *   }),
+ * );
+ * ```
+ *
+ * ### Errors
+ * Each fails the caller's deploy before the caller is created:
+ * `Fly.ServiceUnreachable` when the caller and the Service are on
+ * different networks, `Fly.ServiceNotBindable` when the Service publishes
+ * no ports, and `Fly.EndpointNotPublished` for a port it does not publish.
+ *
+ * @binding
+ * @product Service
+ */
+export declare const bindService: <Shape, Req = never>(target: Target<Shape> | Effect.Effect<Target<Shape>, never, Req>) => Effect.Effect<ServiceClient<Shape>, never, Req | HttpClient.HttpClient>;
+/**
+ * Bind one published port of another {@link Service}: an admin API on
+ * its own port, or a raw TCP protocol. Returns the port's private host,
+ * its URL when it serves plain HTTP, and an `HttpClient` whose relative
+ * requests go there. See {@link bindService}.
+ */
+export declare const bindEndpoint: <Shape, Req = never>(target: Target<Shape> | Effect.Effect<Target<Shape>, never, Req>, options: {
+    port: number;
+}) => Effect.Effect<EndpointClient, never, Req | HttpClient.HttpClient>;
+export {};
+//# sourceMappingURL=BindService.d.ts.map

package/lib/BindService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BindService.d.ts","sourceRoot":"","sources":["../src/BindService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqC,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAyB,KAAK,cAAc,EAAe,MAAM,wBAAwB,CAAC;AAGjG,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,KAAK,eAAe,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,KAAK,kBAAkB,MAAM,gCAAgC,CAAC;AAI1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;;;;AAE5C,gEAAgE;AAChE,qBAAa,uBAAwB,SAAQ,6BAAgD;IAC3F,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;IACA,IAAI,OAAO,WAEV;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG;IAChE;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,GAC3C,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC,eAAe,CAAC,eAAe,GAAG,uBAAuB,EACzD,cAAc,CACf,CAAC;CACH,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;IACrE,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;IACpE,iEAAiE;IACjE,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,GAAG,uBAAuB,CAAC,CAAC;CAC/F;AAED,KAAK,MAAM,CAAC,KAAK,IAAI,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;AAiB1C,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,OAAQ,MAAM;IAC3C,OAAO;IACP,GAAG;IACH,KAAK;CACL,CAAC;AAqEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,EAAE,GAAG,GAAG,KAAK,UACpC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAC/D,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,UAAU,CAAC,UAAU,CAuBrE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,EAAE,GAAG,GAAG,KAAK,UACrC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WACvD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,KACxB,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,GAAG,UAAU,CAAC,UAAU,CAoB/D,CAAC"}