@alchemy.run/fly 0.0.0 → 2.0.0-beta.84

package/lib/Bucket.js

@@ -0,0 +1,658 @@
+import * as addons from "@distilled.cloud/fly-io/addons";
+import * as machines from "@distilled.cloud/fly-io/machines";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import { createInternalTags } from "alchemy/Tags";
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Result from "effect/Result";
+import * as Schedule from "effect/Schedule";
+import { resolveOrgSlug } from "./Environment.js";
+import { TigrisCredentialsMissing } from "./Errors.js";
+import { createFlyAppName, matchesAlchemyPhysicalName } from "./Metadata.js";
+/** Env-var names Tigris HTTP bindings write onto an App (same as `fly storage create`). */
+export const BUCKET_SECRET_NAMES = [
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_ENDPOINT_URL_S3",
+    "AWS_REGION",
+    "BUCKET_NAME",
+];
+/**
+ * A Fly.Bucket is Tigris S3-compatible object storage, billed through
+ * Fly. It is an org-scoped GraphQL add-on (`AddOnType` `tigris`).
+ *
+ * @see https://fly.io/docs/tigris/
+ *
+ * ### Create a Bucket
+ * Alchemy generates a unique name unless you pass one.
+ *
+ * **Example:** Generated name
+ * ```typescript
+ * const data = yield* Fly.Bucket("Data");
+ * ```
+ *
+ * ### A stable name
+ * Pass `name` when you need a stable Tigris bucket name.
+ *
+ * **Example:** Explicit name
+ * ```typescript
+ * const data = yield* Fly.Bucket("Data", {
+ *   name: "my-bucket",
+ * });
+ * ```
+ *
+ * :::caution[Changing `name` replaces the Bucket]
+ * Tigris cannot rename a bucket. Alchemy creates the new name, then
+ * deletes the old one.
+ * :::
+ *
+ * ### Organization
+ * Org defaults to the current token. Pass `orgSlug` to pin it.
+ *
+ * **Example:** Pin an org
+ * ```typescript
+ * const data = yield* Fly.Bucket("Data", {
+ *   orgSlug: "my-org",
+ * });
+ * ```
+ *
+ * :::caution[Changing `orgSlug` replaces the Bucket]
+ * The bucket is created in the new org. The old bucket is deleted.
+ * :::
+ *
+ * ### Public access
+ * Buckets are private by default. `public: true` serves objects
+ * without credentials.
+ *
+ * **Example:** Public bucket
+ * ```typescript
+ * const assets = yield* Fly.Bucket("Assets", {
+ *   public: true,
+ * });
+ * ```
+ *
+ * ### Custom domain
+ * `domainName` sets `website.domain_name` on the add-on. Point a
+ * CNAME at `{name}.t3.tigrisbucket.io`.
+ *
+ * **Example:** Custom domain
+ * ```typescript
+ * const assets = yield* Fly.Bucket("Assets", {
+ *   public: true,
+ *   domainName: "assets.example.com",
+ * });
+ * ```
+ *
+ * ### Put and get objects
+ * Tigris speaks the S3 API. Bind {@link PutObject} / {@link GetObject}
+ * (and the other S3 object ops) in Service init. Alchemy injects the
+ * Tigris endpoint and credentials; you never read `AWS_*` yourself.
+ *
+ * **Example:** Put an object from a Service
+ * ```typescript
+ * import * as HttpServerResponse from "effect/http/HttpServerResponse";
+ *
+ * export default class Api extends Fly.Service<Api>()(
+ *   "Api",
+ *   { app: Site, main: import.meta.url, port: 3000 },
+ *   Effect.gen(function* () {
+ *     const putObject = yield* Fly.PutObject(Data);
+ *     const getObject = yield* Fly.GetObject(Data);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         yield* putObject({
+ *           Key: "hello.txt",
+ *           Body: "hello",
+ *           ContentType: "text/plain",
+ *         });
+ *         const obj = yield* getObject({ Key: "hello.txt" });
+ *         return HttpServerResponse.json({ ok: obj.ETag !== undefined });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide([Fly.PutObjectHttp, Fly.GetObjectHttp])),
+ * ) {}
+ * ```
+ *
+ * ### Fly.Secret
+ * You can also set each key yourself with {@link Secret}.
+ *
+ * **Example:** Manual secrets
+ * ```typescript
+ * yield* Fly.Secret("BucketName", {
+ *   app: Site,
+ *   name: "BUCKET_NAME",
+ *   value: Data.bucketName,
+ * });
+ * ```
+ *
+ * @resource
+ * @product Bucket
+ */
+export const Bucket = Resource("Fly.Bucket");
+export class BucketNotCreated extends Data.TaggedError("Fly.BucketNotCreated") {
+}
+export class BucketOrgMissing extends Data.TaggedError("Fly.BucketOrgMissing") {
+}
+export class BucketProvisionFailed extends Data.TaggedError("Fly.BucketProvisionFailed") {
+}
+class BucketPending extends Data.TaggedError("Fly.BucketPending") {
+}
+const TIGRIS = "tigris";
+const backoff = Schedule.min([
+    Schedule.exponential(Duration.millis(500), 1.5),
+    Schedule.spaced(Duration.seconds(5)),
+]);
+const sanitizeFlyBucketName = (name) => {
+    const lowered = name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    const clipped = lowered.length > 63 ? lowered.slice(0, 63).replace(/-+$/g, "") : lowered;
+    const raw = clipped.length === 0 ? "f" : clipped;
+    return /^[a-z]/.test(raw) ? raw : `f${raw}`.slice(0, 63);
+};
+const resolveBucketName = (id, name, existing) => Effect.gen(function* () {
+    if (name !== undefined)
+        return sanitizeFlyBucketName(name);
+    if (existing !== undefined)
+        return existing;
+    return yield* createFlyAppName(id);
+});
+const asRecord = (value) => {
+    if (Redacted.isRedacted(value)) {
+        return value.pipe(Redacted.value, asRecord);
+    }
+    if (typeof value === "string") {
+        try {
+            return asRecord(JSON.parse(value));
+        }
+        catch {
+            return {};
+        }
+    }
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return {};
+};
+const asString = (value) => {
+    if (typeof value === "string") {
+        return value.length > 0 ? value : undefined;
+    }
+    if (Redacted.isRedacted(value)) {
+        return value.pipe(Redacted.value, asString);
+    }
+    return undefined;
+};
+const redact = (value) => value !== undefined && value.length > 0 ? Redacted.make(value) : undefined;
+const keepSecret = (next, previous) => next ?? previous;
+const envString = (env, key) => asString(env[key]);
+const unwrapSecret = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
+const desiredOptions = (props) => {
+    const options = {
+        public: props.public ?? false,
+        accelerate: props.accelerate ?? false,
+        website: { domain_name: props.domainName ?? "" },
+    };
+    if (props.shadowBucket !== undefined) {
+        options.shadow_bucket = {
+            access_key: props.shadowBucket.accessKey,
+            secret_key: unwrapSecret(props.shadowBucket.secretKey),
+            region: props.shadowBucket.region,
+            name: props.shadowBucket.name,
+            endpoint: props.shadowBucket.endpoint,
+            write_through: props.shadowBucket.writeThrough ?? false,
+        };
+    }
+    return options;
+};
+const websiteDomain = (options) => {
+    const website = asRecord(options.website);
+    return asString(website.domain_name);
+};
+const toAttrs = (addOn, previous, fallback) => {
+    const options = asRecord(addOn.options);
+    const env = asRecord(addOn.environment);
+    const name = addOn.name ?? fallback?.name ?? previous?.name ?? "";
+    const orgSlug = asString(addOn.organization?.slug) ??
+        asString(addOn.organization?.rawSlug) ??
+        fallback?.orgSlug ??
+        previous?.orgSlug;
+    return {
+        addOnId: addOn.id,
+        name,
+        status: addOn.status ?? undefined,
+        orgSlug,
+        public: typeof options.public === "boolean" ? options.public : (previous?.public ?? false),
+        domainName: websiteDomain(options),
+        accelerate: options.accelerate === true,
+        ssoLink: addOn.ssoLink ?? undefined,
+        createdAt: addOn.createdAt,
+        accessKeyId: keepSecret(redact(envString(env, "AWS_ACCESS_KEY_ID")), previous?.accessKeyId),
+        secretAccessKey: keepSecret(redact(envString(env, "AWS_SECRET_ACCESS_KEY")), previous?.secretAccessKey),
+        endpoint: keepSecret(redact(envString(env, "AWS_ENDPOINT_URL_S3")), previous?.endpoint),
+        region: keepSecret(redact(envString(env, "AWS_REGION")), previous?.region),
+        bucketName: keepSecret(redact(envString(env, "BUCKET_NAME") ?? name), previous?.bucketName),
+    };
+};
+const stringRecordOf = (value) => Object.fromEntries(Object.entries(asRecord(value)).flatMap(([key, item]) => {
+    const text = asString(item);
+    return text !== undefined ? [[key, text]] : [];
+}));
+const hasAlchemyMetadata = (metadata) => {
+    const tags = stringRecordOf(metadata);
+    const stack = tags["alchemy::stack"] ?? tags["alchemy.stack"];
+    return stack !== undefined && stack.length > 0;
+};
+const isOwnedAddOn = (addOn) => matchesAlchemyPhysicalName(addOn.name ?? undefined) || hasAlchemyMetadata(addOn.metadata);
+export const listTigrisAddOns = Effect.fn(function* () {
+    const rows = [];
+    let after;
+    for (let i = 0; i < 8; i++) {
+        const page = yield* addons.addOns({
+            type: TIGRIS,
+            first: 50,
+            after,
+        });
+        for (const edge of page.edges ?? []) {
+            if (edge?.node != null)
+                rows.push(edge.node);
+        }
+        if (!page.pageInfo.hasNextPage)
+            break;
+        after = page.pageInfo.endCursor ?? undefined;
+        if (after === undefined || after.length === 0)
+            break;
+    }
+    return rows;
+});
+const findById = (addOnId) => listTigrisAddOns().pipe(Effect.map((addOns) => addOns.find((addOn) => addOn.id === addOnId)));
+const findByName = (name) => listTigrisAddOns().pipe(Effect.map((addOns) => addOns.find((addOn) => addOn.name === name)));
+const failedStatus = (status) => status === "error" || status === "failed";
+const pendingStatus = (status) => status === "creating" ||
+    status === "provisioning" ||
+    status === "pending" ||
+    status === "pending_create";
+const waitUntilReady = (name, addOnId) => findById(addOnId).pipe(Effect.flatMap((addOn) => {
+    if (addOn === undefined) {
+        return Effect.fail(new BucketPending({ name, status: "missing" }));
+    }
+    const status = addOn.status ?? undefined;
+    if (failedStatus(status)) {
+        return Effect.fail(new BucketProvisionFailed({
+            name,
+            status,
+            errorMessage: addOn.errorMessage ?? undefined,
+        }));
+    }
+    if (pendingStatus(status)) {
+        return Effect.fail(new BucketPending({ name, status: status ?? "creating" }));
+    }
+    return Effect.succeed(addOn);
+}), Effect.retry({
+    while: (e) => e._tag === "Fly.BucketPending",
+    times: 8,
+    schedule: backoff,
+}), Effect.catchTag("Fly.BucketPending", () => findById(addOnId)));
+const waitUntilGone = (addOnId, name) => Effect.gen(function* () {
+    // Best-effort: Tigris often answers "The specified bucket does not
+    // exist" (untyped UnknownFlyIoError) for a delete that already
+    // succeeded. Never fail the wait on that — only on the add-on still
+    // showing up in list.
+    yield* Effect.result(addons.deleteAddOn({
+        input: addOnId.length > 0 ? { addOnId } : { name, provider: TIGRIS },
+    }));
+    const still = (yield* findById(addOnId)) ?? (name.length > 0 ? yield* findByName(name) : undefined);
+    if (still !== undefined) {
+        return yield* new BucketPending({
+            name,
+            status: still.status ?? "deleting",
+        });
+    }
+}).pipe(Effect.retry({
+    while: (e) => e._tag === "Fly.BucketPending",
+    schedule: Schedule.spaced("2 seconds"),
+    times: 20,
+}));
+const resolveOrganization = (orgSlug) => addons
+    .organization({ slug: orgSlug })
+    .pipe(Effect.catchTag("FlyIoParseError", () => Effect.succeed(undefined)));
+const ensureTos = (orgSlug, organizationId) => Effect.gen(function* () {
+    const agreed = yield* addons.agreedToProviderTos({
+        slug: orgSlug,
+        providerName: TIGRIS,
+    });
+    if (agreed === true)
+        return;
+    const tos = yield* Effect.result(addons.createExtensionTosAgreement({
+        input: {
+            addOnProviderName: TIGRIS,
+            organizationId,
+        },
+    }));
+    if (Result.isFailure(tos))
+        return;
+});
+const optionsEqual = (observed, desired) => {
+    const observedPublic = observed.public === true;
+    const desiredPublic = desired.public === true;
+    const observedAccelerate = observed.accelerate === true;
+    const desiredAccelerate = desired.accelerate === true;
+    const observedDomain = websiteDomain(observed) ?? "";
+    const desiredDomain = websiteDomain(desired) ?? "";
+    if (observedPublic !== desiredPublic ||
+        observedAccelerate !== desiredAccelerate ||
+        observedDomain !== desiredDomain) {
+        return false;
+    }
+    if (desired.shadow_bucket !== undefined) {
+        return deepEqual(asRecord(observed.shadow_bucket), desired.shadow_bucket);
+    }
+    return true;
+};
+export const BucketProvider = () => Provider.succeed(Bucket, {
+    stables: ["addOnId", "name", "orgSlug"],
+    diff: Effect.fn(function* ({ news, output }) {
+        if (news === undefined || !isResolved(news))
+            return undefined;
+        if (output === undefined)
+            return undefined;
+        const desiredName = news.name !== undefined ? sanitizeFlyBucketName(news.name) : output.name;
+        const nameChanged = desiredName !== output.name;
+        const orgChanged = news.orgSlug !== undefined && news.orgSlug !== output.orgSlug;
+        if (nameChanged || orgChanged) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+        const name = yield* resolveBucketName(id, olds?.name, output?.name);
+        const found = (output?.addOnId !== undefined && output.addOnId.length > 0
+            ? yield* findById(output.addOnId)
+            : undefined) ?? (yield* findByName(name));
+        if (found === undefined)
+            return undefined;
+        const attrs = toAttrs(found, output, {
+            name,
+            orgSlug: output?.orgSlug ?? olds?.orgSlug,
+        });
+        if (output !== undefined)
+            return attrs;
+        return isOwnedAddOn(found) ? attrs : Unowned(attrs);
+    }),
+    list: Effect.fn(function* () {
+        const addOns = yield* listTigrisAddOns();
+        return addOns.flatMap((addOn) => (isOwnedAddOn(addOn) ? [toAttrs(addOn)] : []));
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const props = news ?? {};
+        const name = yield* resolveBucketName(id, props.name, output?.name);
+        const orgSlug = props.orgSlug ?? output?.orgSlug ?? (yield* resolveOrgSlug());
+        let previous = output;
+        // Observe by cached id, then the desired name.
+        let current = output?.addOnId !== undefined && output.addOnId.length > 0
+            ? yield* findById(output.addOnId)
+            : undefined;
+        if (current === undefined) {
+            current = yield* findByName(name);
+        }
+        const org = yield* resolveOrganization(orgSlug);
+        if (org === undefined) {
+            return yield* new BucketOrgMissing({ orgSlug });
+        }
+        if (current === undefined) {
+            yield* ensureTos(orgSlug, org.id);
+            const created = yield* Effect.result(addons.createAddOn({
+                input: {
+                    type: TIGRIS,
+                    name,
+                    organizationId: org.id,
+                    options: desiredOptions(props),
+                },
+            }));
+            if (Result.isSuccess(created)) {
+                current = created.success.addOn;
+            }
+            else {
+                current = yield* findByName(name);
+                if (current === undefined) {
+                    return yield* created.failure;
+                }
+            }
+            const createdSecrets = current;
+            if (current.id.length > 0) {
+                current = (yield* waitUntilReady(name, current.id)) ?? current;
+            }
+            // List/get omit `environment` after create. Keep the create
+            // payload as the secrets source for keepSecret below.
+            previous = toAttrs(createdSecrets, previous, { name, orgSlug });
+        }
+        if (current === undefined || current.id.length === 0) {
+            return yield* new BucketNotCreated({ name });
+        }
+        const status = current.status ?? undefined;
+        if (failedStatus(status)) {
+            return yield* new BucketProvisionFailed({
+                name,
+                status,
+                errorMessage: current.errorMessage ?? undefined,
+            });
+        }
+        const observedOptions = asRecord(current.options);
+        const desired = desiredOptions(props);
+        const internal = yield* createInternalTags(id);
+        const observedMeta = stringRecordOf(current.metadata);
+        const nextMeta = { ...observedMeta, ...internal };
+        const optionsChanged = !optionsEqual(observedOptions, desired);
+        const metaChanged = !deepEqual(observedMeta, nextMeta);
+        if (optionsChanged || metaChanged) {
+            const nextOptions = {
+                ...observedOptions,
+                ...desired,
+            };
+            const updated = yield* Effect.result(addons.updateAddOn({
+                input: {
+                    addOnId: current.id,
+                    options: optionsChanged ? nextOptions : undefined,
+                    metadata: metaChanged ? nextMeta : undefined,
+                },
+            }));
+            if (Result.isSuccess(updated)) {
+                current = {
+                    ...current,
+                    ...updated.success.addOn,
+                };
+            }
+            else {
+                current = (yield* findById(current.id)) ?? current;
+            }
+        }
+        const latest = (yield* findById(current.id)) ?? current;
+        // GraphQL list/get omit `environment` after create. Keep credentials
+        // from the create payload (or last persisted attrs) via keepSecret.
+        const attrs = toAttrs(latest, toAttrs(current, previous, { name, orgSlug }), {
+            name,
+            orgSlug,
+        });
+        const observedPublic = asRecord(latest.options).public;
+        return {
+            ...attrs,
+            public: typeof observedPublic === "boolean" ? observedPublic : (props.public ?? attrs.public),
+            domainName: websiteDomain(asRecord(latest.options)) ?? props.domainName ?? attrs.domainName,
+            accelerate: typeof asRecord(latest.options).accelerate === "boolean"
+                ? asRecord(latest.options).accelerate
+                : (props.accelerate ?? attrs.accelerate),
+        };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        const addOnId = output.addOnId;
+        const name = output.name;
+        if (addOnId.length === 0 && name.length === 0)
+            return;
+        // Always wait for the add-on to leave the list. A failed
+        // deleteAddOn plus a single list miss is not gone — Tigris
+        // list lags, and a bucket still attached to an App is a
+        // transient error. waitUntilGone retries delete and only
+        // succeeds once list (id and name) is empty.
+        yield* waitUntilGone(addOnId, name);
+    }),
+});
+class BucketSecretVersionMissing extends Data.TaggedError("Fly.BucketSecretVersionMissing") {
+}
+const bucketSecretVersion = (appName, response) => {
+    const version = response.version ?? response.Version;
+    return version !== undefined && Number.isSafeInteger(version) && version >= 0
+        ? Effect.succeed(version)
+        : Effect.fail(new BucketSecretVersionMissing({ appName }));
+};
+const requireBucketSecrets = Effect.fn(function* (appName, values) {
+    const required = [
+        "BUCKET_NAME",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_ENDPOINT_URL_S3",
+    ];
+    if (required.some((key) => !values[key]?.trim())) {
+        return yield* new TigrisCredentialsMissing({
+            name: values.BUCKET_NAME || appName,
+        });
+    }
+});
+const putSecretValues = (appName, values) => Effect.gen(function* () {
+    yield* requireBucketSecrets(appName, values);
+    return yield* machines
+        .updateSecrets({
+        app_name: appName,
+        values,
+    })
+        .pipe(Effect.flatMap((response) => bucketSecretVersion(appName, response)), Effect.catchTag("NotFound", () => Effect.gen(function* () {
+        const versions = [];
+        for (const [secretName, value] of Object.entries(values)) {
+            const version = yield* machines
+                .createSecret({
+                app_name: appName,
+                secret_name: secretName,
+                value,
+            })
+                .pipe(Effect.flatMap((response) => bucketSecretVersion(appName, response)), Effect.catchTag("Conflict", () => machines
+                .updateSecrets({
+                app_name: appName,
+                values: { [secretName]: value },
+            })
+                .pipe(Effect.flatMap((response) => bucketSecretVersion(appName, response)))));
+            versions.push(version);
+        }
+        return Math.max(...versions);
+    })));
+});
+const envValuesOf = (addOn) => {
+    const env = asRecord(addOn.environment);
+    const values = {};
+    for (const key of BUCKET_SECRET_NAMES) {
+        const value = envString(env, key);
+        if (value !== undefined)
+            values[key] = value;
+    }
+    if (values.BUCKET_NAME === undefined && addOn.name != null) {
+        values.BUCKET_NAME = addOn.name;
+    }
+    if (values.AWS_ENDPOINT_URL === undefined && values.AWS_ENDPOINT_URL_S3 !== undefined) {
+        values.AWS_ENDPOINT_URL = values.AWS_ENDPOINT_URL_S3;
+    }
+    return values;
+};
+const findAttachedBucket = (input) => Effect.gen(function* () {
+    const listed = input.id !== undefined && input.id.length > 0
+        ? ((yield* findById(input.id)) ??
+            (input.name.length > 0 ? yield* findByName(input.name) : undefined))
+        : input.name.length > 0
+            ? yield* findByName(input.name)
+            : undefined;
+    if (listed === undefined) {
+        return yield* new BucketPending({
+            name: input.name || input.id || "",
+            status: "missing",
+        });
+    }
+    const detail = yield* addons
+        .addOn({
+        id: listed.id,
+        name: listed.name ?? input.name,
+        provider: TIGRIS,
+    })
+        .pipe(Effect.catchTag("FlyIoParseError", () => Effect.succeed(undefined)));
+    return detail ?? listed;
+});
+const secretsFromBoundEnv = (env) => {
+    const values = {};
+    for (const key of BUCKET_SECRET_NAMES) {
+        const value = env[key];
+        if (value !== undefined && value.length > 0)
+            values[key] = value;
+    }
+    if (values.AWS_ENDPOINT_URL === undefined && values.AWS_ENDPOINT_URL_S3 !== undefined) {
+        values.AWS_ENDPOINT_URL = values.AWS_ENDPOINT_URL_S3;
+    }
+    return values;
+};
+/**
+ * Write Tigris `AWS_*` / `BUCKET_NAME` secrets onto an App. Called from
+ * {@link Service} reconcile so the secrets exist before Machines boot.
+ *
+ * Looks up the add-on by id/name (retrying while Tigris is still
+ * provisioning) and also copies any already-evaluated `AWS_*` /
+ * `BUCKET_NAME` values from binding env — GraphQL `environment` is often
+ * empty after create. A missing add-on may use bound values only when the
+ * bucket name, credential pair, and S3 endpoint are complete. Partial values
+ * are never written. Region is optional, as in the Tigris bindings.
+ * Without an attachment, only an explicit `BUCKET_NAME` requests this mode;
+ * ordinary AWS region or credential settings do not imply a Bucket.
+ * Returns the highest accepted secret-version floor, or `undefined` when
+ * no Bucket was requested; this is not a vault snapshot.
+ */
+export const attachBucketSecrets = Effect.fn(function* (appName, attached, boundEnv = {}) {
+    if (appName.length === 0)
+        return undefined;
+    if (attached.length === 0 && boundEnv.BUCKET_NAME === undefined) {
+        return undefined;
+    }
+    const fromEnv = secretsFromBoundEnv(boundEnv);
+    if (attached.length === 0) {
+        return yield* putSecretValues(appName, fromEnv);
+    }
+    const versions = [];
+    for (const item of attached) {
+        const name = item.name;
+        const id = item.id;
+        const fallbackValues = {
+            ...fromEnv,
+            ...item.values,
+        };
+        if (fallbackValues.AWS_ENDPOINT_URL === undefined &&
+            fallbackValues.AWS_ENDPOINT_URL_S3 !== undefined) {
+            fallbackValues.AWS_ENDPOINT_URL = fallbackValues.AWS_ENDPOINT_URL_S3;
+        }
+        if (fallbackValues.BUCKET_NAME === undefined && name.length > 0) {
+            fallbackValues.BUCKET_NAME = name;
+        }
+        const row = yield* findAttachedBucket({ id, name }).pipe(Effect.retry({
+            while: (error) => error._tag === "Fly.BucketPending",
+            times: 8,
+            schedule: backoff,
+        }), Effect.catchTag("Fly.BucketPending", () => requireBucketSecrets(appName, fallbackValues).pipe(Effect.as(undefined))));
+        const values = {
+            ...fallbackValues,
+            ...(row === undefined ? {} : envValuesOf(row)),
+        };
+        versions.push(yield* putSecretValues(appName, values));
+    }
+    return versions.length > 0 ? Math.max(...versions) : undefined;
+});
+//# sourceMappingURL=Bucket.js.map