@alchemy.run/fly 0.0.0 → 2.0.0-beta.84

package/src/PostgresMigrations.ts

@@ -0,0 +1,153 @@
+import {
+  makePgMigrationExecutor,
+  runMigrations,
+  type NormalizedMigrationsInput,
+  type StampedMigrationsState,
+} from "@alchemy.run/sql/Migrations";
+import { importPg } from "@alchemy.run/sql/PostgresDriver";
+import { readSqlFile } from "@alchemy.run/sql/SqlFile";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import type { Client } from "pg";
+
+export class PostgresMigrationError extends Data.TaggedError("Fly.PostgresMigrationError")<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+/**
+ * Strip query-string SSL flags so `pg-connection-string` does not treat
+ * `sslmode=require` as `verify-full`. TLS and certificate verification
+ * are set on the client (`ssl.rejectUnauthorized: true`).
+ */
+export const stripSslQueryParams = (uri: string): string => {
+  try {
+    const url = new URL(uri);
+    url.searchParams.delete("sslmode");
+    url.searchParams.delete("channel_binding");
+    return url.toString();
+  } catch {
+    return uri;
+  }
+};
+
+const toMigrationError = (cause: unknown) =>
+  new PostgresMigrationError({
+    message: cause instanceof Error ? cause.message : String(cause),
+    cause,
+  });
+
+/**
+ * A freshly-provisioned Fly Managed Postgres cluster reports `ready` on the
+ * API before its hostname is resolvable and its endpoint accepts
+ * connections — reconcile's first migration connect can fail with
+ * `ENOTFOUND` (DNS still propagating) or a refused/reset socket. These are
+ * eventual consistency, not failures: retry the connect on a bounded
+ * schedule (~45s) before surfacing the error.
+ */
+const TRANSIENT_CONNECT_CODES = new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+]);
+
+const isTransientConnectError = (error: PostgresMigrationError): boolean => {
+  const code = (error.cause as { code?: unknown } | null | undefined)?.code;
+  return typeof code === "string" && TRANSIENT_CONNECT_CODES.has(code);
+};
+
+/** Open a pg client for the scope of `use`, closing it afterwards. */
+export const withPgClient = <A, E, R>(
+  connectionUri: Redacted.Redacted<string>,
+  use: (client: Client) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, PostgresMigrationError | E, R> =>
+  Effect.acquireUseRelease(
+    Effect.tryPromise({
+      try: async () => {
+        const { Client } = await importPg();
+        const client = new Client({
+          connectionString: connectionUri.pipe(Redacted.value, stripSslQueryParams),
+          ssl: { rejectUnauthorized: true },
+        });
+        await client.connect();
+        return client;
+      },
+      catch: toMigrationError,
+    }).pipe(
+      Effect.retry({
+        while: isTransientConnectError,
+        schedule: Schedule.spaced("3 seconds"),
+        times: 15,
+      }),
+      // Still unreachable after the bounded retry: almost always a missing
+      // route rather than propagation — MPG hostnames only exist on the org
+      // private network. Say so instead of a bare `getaddrinfo ENOTFOUND`.
+      Effect.mapError((error) =>
+        isTransientConnectError(error)
+          ? new PostgresMigrationError({
+              message:
+                `${error.message} — Fly Managed Postgres is only reachable ` +
+                "on the org's private network. Run the deploy behind a " +
+                "WireGuard peer or `fly mpg proxy`, or from a machine on " +
+                "6PN. See https://fly.io/docs/mpg/create-and-connect/",
+              cause: error.cause,
+            })
+          : error,
+      ),
+    ),
+    use,
+    (client) => Effect.promise(() => client.end().catch(() => {})),
+  );
+
+/**
+ * Fly Managed Postgres's migration adaptation is the shared pipeline
+ * with a connection-URI-scoped pg client as its executor. Use the
+ * direct (non-PgBouncer) URI so DDL and advisory locks work.
+ */
+export const runPgMigrations = (options: {
+  connectionUri: Redacted.Redacted<string>;
+  input: NormalizedMigrationsInput;
+  stamped: StampedMigrationsState;
+}) =>
+  runMigrations({
+    ...options,
+    withExecutor: (apply) =>
+      withPgClient(options.connectionUri, (client) => apply(makePgMigrationExecutor(client))),
+  });
+
+/** Run a single SQL script against the database (used for `importFiles`). */
+export const runSql = (connectionUri: Redacted.Redacted<string>, sql: string) =>
+  withPgClient(connectionUri, (client) =>
+    Effect.tryPromise({
+      try: () => client.query(sql),
+      catch: toMigrationError,
+    }),
+  ).pipe(Effect.asVoid);
+
+export const runImports = (
+  connectionUri: Redacted.Redacted<string>,
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+  previous: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = { ...previous };
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      if (previous[filePath] === file.hash) {
+        hashes[filePath] = file.hash;
+        continue;
+      }
+      yield* runSql(connectionUri, file.sql);
+      hashes[filePath] = file.hash;
+    }
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+      if (!tracked.has(key)) delete hashes[key];
+    }
+    return hashes;
+  });

package/src/Providers.ts

@@ -0,0 +1,155 @@
+import { CredentialsStoreLive } from "alchemy/Auth/Credentials";
+import { ProfileStoreLive } from "alchemy/Auth/Profile";
+import * as Command from "alchemy/Command";
+import * as Provider from "alchemy/Provider";
+import { Random, RandomProvider } from "alchemy/Random";
+import {
+  Server as WebsiteServer,
+  ServerProvider as WebsiteServerProvider,
+} from "alchemy/Website/Server";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { App, AppProvider } from "./App.ts";
+import { FlyAuth } from "./AuthProvider.ts";
+import { Bucket, BucketProvider } from "./Bucket.ts";
+import { Certificate, CertificateProvider } from "./Certificate.ts";
+import { CheckpointHttp } from "./CheckpointHttp.ts";
+import { ConnectPostgresHttp } from "./ConnectPostgresHttp.ts";
+import * as Credentials from "./Credentials.ts";
+import { DecryptHttp } from "./DecryptHttp.ts";
+import { DeleteObjectHttp } from "./DeleteObjectHttp.ts";
+import { EncryptHttp } from "./EncryptHttp.ts";
+import { fromCredentials } from "./Environment.ts";
+import { ExecHttp } from "./ExecHttp.ts";
+import { GetObjectHttp } from "./GetObjectHttp.ts";
+import { GetSecretHttp } from "./GetSecretHttp.ts";
+import { HeadObjectHttp } from "./HeadObjectHttp.ts";
+import { IpAssignment, IpAssignmentProvider } from "./IpAssignment.ts";
+import { ListObjectsV2Http } from "./ListObjectsV2Http.ts";
+import { ListSecretsHttp } from "./ListSecretsHttp.ts";
+import { Machine, MachineProvider } from "./Machine.ts";
+import { MountVolumeLive } from "./MountVolume.ts";
+import { Postgres, PostgresProvider } from "./Postgres.ts";
+import { PutObjectHttp } from "./PutObjectHttp.ts";
+import { ReadRedisHttp } from "./ReadRedisHttp.ts";
+import { ReadWriteRedisHttp } from "./ReadWriteRedisHttp.ts";
+import { Redis, RedisProvider } from "./Redis.ts";
+import { Secret, SecretProvider } from "./Secret.ts";
+import { SecretKey, SecretKeyProvider } from "./SecretKey.ts";
+import { Service, ServiceProvider } from "./Service.ts";
+import { SignHttp } from "./SignHttp.ts";
+import { Sprite, SpriteProvider } from "./Sprite.ts";
+import { VerifyHttp } from "./VerifyHttp.ts";
+import { VolumeSnapshot, VolumeSnapshotProvider } from "./VolumeSnapshot.ts";
+import { AssetDeployment, AssetDeploymentProvider } from "./Website/AssetDeployment.ts";
+import { WriteCertificatesHttp } from "./WriteCertificatesHttp.ts";
+import { WriteRedisHttp } from "./WriteRedisHttp.ts";
+import { WriteSecretHttp } from "./WriteSecretHttp.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()("Fly") {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Build a layer that registers Fly resource providers, the Fly
+ * `AuthProvider`, the resolved `Credentials`, and an `HttpClient`. Include
+ * this from your stack alongside other cloud `providers()` layers.
+ *
+ * Resource providers are inserted into {@link Provider.collection} as they
+ * land. The collection starts empty so App / Machine / Service agents can
+ * make a single minimal insertion.
+ *
+ * @example
+ * ```typescript
+ * import * as Alchemy from "alchemy";
+ * import * as Fly from "@alchemy.run/fly";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ *   "MyStack",
+ *   {
+ *     providers: Fly.providers(),
+ *     state: Alchemy.localState(),
+ *   },
+ *   Effect.gen(function* () {
+ *     return {};
+ *   }),
+ * );
+ * ```
+ */
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      App,
+      AssetDeployment,
+      Bucket,
+      Certificate,
+      IpAssignment,
+      Machine,
+      Postgres,
+      Random,
+      Redis,
+      Secret,
+      SecretKey,
+      Service,
+      Sprite,
+      VolumeSnapshot,
+      WebsiteServer,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        AppProvider(),
+        AssetDeploymentProvider(),
+        BucketProvider(),
+        CertificateProvider(),
+        IpAssignmentProvider(),
+        MachineProvider(),
+        PostgresProvider(),
+        RandomProvider(),
+        RedisProvider(),
+        SecretProvider(),
+        SecretKeyProvider(),
+        ServiceProvider(),
+        SpriteProvider(),
+        VolumeSnapshotProvider(),
+        WebsiteServerProvider(),
+      ),
+    ),
+    // The binding layers are mutually independent — they all draw on the
+    // Credentials/HttpClient layers below. Merge them into one group so
+    // `.pipe` stays under its 20-argument overload ceiling.
+    Layer.provideMerge(
+      Layer.mergeAll(
+        MountVolumeLive,
+        ConnectPostgresHttp,
+        PutObjectHttp,
+        GetObjectHttp,
+        DeleteObjectHttp,
+        HeadObjectHttp,
+        ListObjectsV2Http,
+        ReadRedisHttp,
+        WriteRedisHttp,
+        ReadWriteRedisHttp,
+        CheckpointHttp,
+        ExecHttp,
+        GetSecretHttp,
+        ListSecretsHttp,
+        WriteSecretHttp,
+        WriteCertificatesHttp,
+        EncryptHttp,
+        DecryptHttp,
+        SignHttp,
+        VerifyHttp,
+      ),
+    ),
+    Layer.provideMerge(fromCredentials()),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(FlyAuth),
+    Layer.provideMerge(ProfileStoreLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(Command.providers()),
+    Layer.orDie,
+  );

package/src/PutObject.ts

@@ -0,0 +1,49 @@
+import type * as S3 from "@distilled.cloud/aws/s3";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { Bucket } from "./Bucket.ts";
+import type { TigrisCredentialsMissing } from "./Errors.ts";
+
+export interface PutObjectRequest extends Omit<S3.PutObjectRequest, "Bucket"> {}
+
+/**
+ * Runtime binding for Tigris `PutObject` over the S3 API.
+ *
+ * Bind this operation to a {@link Bucket} in Service init. The Tigris
+ * bucket name, endpoint, and credentials are injected automatically.
+ * Provide {@link PutObjectHttp}.
+ *
+ *
+ * ### Writing Objects
+ * **Example:** Put an Object
+ * ```typescript
+ * const putObject = yield* Fly.PutObject(Data);
+ *
+ * yield* putObject({
+ *   Key: "hello.txt",
+ *   Body: "Hello, world!",
+ *   ContentType: "text/plain",
+ * });
+ * ```
+ *
+ * @binding
+ * @product Bucket
+ */
+export interface PutObject extends Binding.Service<
+  PutObject,
+  "Fly.PutObject",
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: PutObjectRequest,
+    ) => Effect.Effect<
+      S3.PutObjectOutput,
+      S3.PutObjectError | TigrisCredentialsMissing,
+      RuntimeContext
+    >
+  >
+> {}
+
+export const PutObject = Binding.Service<PutObject>("Fly.PutObject");

package/src/PutObjectHttp.ts

@@ -0,0 +1,20 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Layer from "effect/Layer";
+import { makeTigrisS3Binding } from "./BucketBinding.ts";
+import { PutObject } from "./PutObject.ts";
+
+/**
+ * HTTP implementation of {@link PutObject}. Calls distilled S3
+ * `putObject` against the Tigris endpoint with the bucket's credentials.
+ *
+ * @layer
+ * @product Bucket
+ * @provides Fly.PutObject
+ */
+export const PutObjectHttp = Layer.effect(
+  PutObject,
+  makeTigrisS3Binding({
+    tag: "Fly.PutObject",
+    operation: S3.putObject,
+  }),
+);

package/src/ReadRedis.ts

@@ -0,0 +1,31 @@
+import type { ReadClient } from "@alchemy.run/redis";
+import * as Binding from "alchemy/Binding";
+import type * as Effect from "effect/Effect";
+import type { Redis } from "./Redis.ts";
+
+/**
+ * Bind a {@link Redis} database with read access (`get`, `ping`).
+ *
+ * `ReadRedis` is the Context tag, the type, and the callable —
+ * `yield* Fly.ReadRedis(Cache)`. Provide {@link ReadRedisHttp}.
+ *
+ *
+ * ### Read
+ * **Example:** Get a key
+ * ```typescript
+ * const cache = yield* Fly.ReadRedis(Cache);
+ * const value = yield* cache.get("marker");
+ * ```
+ *
+ * @binding
+ * @product Redis
+ */
+export interface ReadRedis extends Binding.Service<
+  ReadRedis,
+  "Fly.ReadRedis",
+  (redis: Redis) => Effect.Effect<ReadRedisClient>
+> {}
+
+export const ReadRedis = Binding.Service<ReadRedis>("Fly.ReadRedis");
+
+export type ReadRedisClient = ReadClient;

package/src/ReadRedisHttp.ts

@@ -0,0 +1,18 @@
+import * as Layer from "effect/Layer";
+import { ReadRedis } from "./ReadRedis.ts";
+import { makeRedisBinding } from "./RedisBinding.ts";
+import { makeReadRedisClient } from "./RedisHttp.ts";
+
+/**
+ * HTTP implementation of {@link ReadRedis}.
+ *
+ * @layer
+ * @product Redis
+ * @provides Fly.ReadRedis
+ */
+export const ReadRedisHttp = Layer.effect(
+  ReadRedis,
+  makeRedisBinding({
+    makeClient: makeReadRedisClient,
+  }),
+);

package/src/ReadWriteRedis.ts

@@ -0,0 +1,33 @@
+import * as Binding from "alchemy/Binding";
+import type * as Effect from "effect/Effect";
+import type { ReadRedisClient } from "./ReadRedis.ts";
+import type { Redis } from "./Redis.ts";
+import type { WriteRedisClient } from "./WriteRedis.ts";
+
+/**
+ * Bind a {@link Redis} database with read + write access.
+ *
+ * `ReadWriteRedis` is the Context tag, the type, and the callable —
+ * `yield* Fly.ReadWriteRedis(Cache)`. Provide {@link ReadWriteRedisHttp}.
+ *
+ *
+ * ### Read and write
+ * **Example:** Round-trip a key
+ * ```typescript
+ * const cache = yield* Fly.ReadWriteRedis(Cache);
+ * yield* cache.set("marker", "hello");
+ * const value = yield* cache.get("marker");
+ * ```
+ *
+ * @binding
+ * @product Redis
+ */
+export interface ReadWriteRedis extends Binding.Service<
+  ReadWriteRedis,
+  "Fly.ReadWriteRedis",
+  (redis: Redis) => Effect.Effect<ReadWriteRedisClient>
+> {}
+
+export const ReadWriteRedis = Binding.Service<ReadWriteRedis>("Fly.ReadWriteRedis");
+
+export interface ReadWriteRedisClient extends ReadRedisClient, WriteRedisClient {}

package/src/ReadWriteRedisHttp.ts

@@ -0,0 +1,18 @@
+import * as Layer from "effect/Layer";
+import { ReadWriteRedis } from "./ReadWriteRedis.ts";
+import { makeRedisBinding } from "./RedisBinding.ts";
+import { makeReadWriteRedisClient } from "./RedisHttp.ts";
+
+/**
+ * HTTP implementation of {@link ReadWriteRedis}.
+ *
+ * @layer
+ * @product Redis
+ * @provides Fly.ReadWriteRedis
+ */
+export const ReadWriteRedisHttp = Layer.effect(
+  ReadWriteRedis,
+  makeRedisBinding({
+    makeClient: makeReadWriteRedisClient,
+  }),
+);