@alchemy.run/fly 0.0.0 → 2.0.0-beta.84

package/src/SpriteHttp.ts

@@ -0,0 +1,50 @@
+import { Credentials, CredentialsFromEnv } from "@distilled.cloud/fly-io";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import { bindFlyApiToken } from "./Credentials.ts";
+import type { Sprite } from "./Sprite.ts";
+
+/**
+ * Shared scaffolding for HTTP-backed Fly Sprite bindings.
+ *
+ * Captures ambient credentials during stack-eval (so Actions work
+ * in-process) and `yield*`s the org token plus sprite `name` so
+ * RuntimeContext.set runs. Runtime calls inside a deployed host read
+ * `FLY_API_TOKEN` via {@link CredentialsFromEnv} after Platform copies
+ * `runtimeContext.env` onto the host.
+ *
+ * NOT exported from `index.ts`.
+ */
+export const makeHttpSpriteBinding = <Client>(options: {
+  makeClient: (auth: SpriteAuth, spriteName: Effect.Effect<string>) => Client;
+}) =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context<Credentials | HttpClient.HttpClient>();
+
+    return Effect.fn(function* (sprite: Sprite) {
+      yield* bindFlyApiToken().pipe(Effect.provideContext(context));
+      const name = yield* sprite.name;
+      return options.makeClient(makeSpriteAuth(context), name);
+    });
+  });
+
+export interface SpriteAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+}
+
+export const makeSpriteAuth = (
+  ambient: Context.Context<Credentials | HttpClient.HttpClient>,
+): SpriteAuth => ({
+  authorize: (eff) => {
+    if (globalThis.__ALCHEMY_RUNTIME__) {
+      return eff.pipe(Effect.provide(Layer.mergeAll(CredentialsFromEnv, FetchHttpClient.layer)));
+    }
+    return eff.pipe(Effect.provideContext(ambient));
+  },
+});

package/src/Verify.ts

@@ -0,0 +1,47 @@
+import type { VerifySecretKeyError } from "@distilled.cloud/fly-io/machines";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { SecretKey } from "./SecretKey.ts";
+
+export interface VerifyRequest {
+  /** Original payload. */
+  plaintext: Uint8Array | ArrayLike<number>;
+  /** Signature produced by {@link Sign}. */
+  signature: Uint8Array | ArrayLike<number>;
+}
+
+export interface VerifyResult {
+  /** Fly returns 200 only when the signature is valid. */
+  valid: true;
+}
+
+/**
+ * Verify a signature with a Fly {@link SecretKey}. The App and key
+ * name are fixed by `Verify(key)`.
+ *
+ *
+ * ### Verify a signature
+ * Provide {@link VerifyHttp}. A bad signature is a typed error from
+ * the Machines API, not `valid: false`.
+ *
+ * **Example:** Verify
+ * ```typescript
+ * const verify = yield* Fly.Verify(Signing);
+ * const { valid } = yield* verify({ plaintext, signature });
+ * ```
+ *
+ * @binding
+ * @product Secret Key
+ */
+export interface Verify extends Binding.Service<
+  Verify,
+  "Fly.Verify",
+  (
+    key: SecretKey,
+  ) => Effect.Effect<
+    (request: VerifyRequest) => Effect.Effect<VerifyResult, VerifySecretKeyError, RuntimeContext>
+  >
+> {}
+
+export const Verify = Binding.Service<Verify>("Fly.Verify");

package/src/VerifyHttp.ts

@@ -0,0 +1,46 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { CredentialsFromAmbientOrEnv } from "./Credentials.ts";
+import { bytesToBase64, makeHttpSecretKeyBinding } from "./SecretKeyHttp.ts";
+import { Verify, type VerifyRequest } from "./Verify.ts";
+
+/**
+ * HTTP implementation of {@link Verify}. Provide it on the
+ * {@link Service} or Action Effect.
+ *
+ *
+ * ### Provide the layer
+ * **Example:** On a Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const verify = yield* Fly.Verify(Signing);
+ *   // ...
+ * }).pipe(Effect.provide(Fly.VerifyHttp))
+ * ```
+ *
+ * @layer
+ * @product Secret Key
+ * @provides Fly.Verify
+ */
+export const VerifyHttp = Layer.effect(
+  Verify,
+  Effect.suspend(() =>
+    makeHttpSecretKeyBinding({
+      makeClient: (auth, appName, secretName) =>
+        Effect.fn("Fly.Verify")(function* (request: VerifyRequest) {
+          // Fly answers 200 only when the signature checks out.
+          yield* auth.authorize(
+            machines.verifySecretKey({
+              app_name: yield* appName,
+              secret_name: yield* secretName,
+              plaintext: bytesToBase64(request.plaintext),
+              signature: bytesToBase64(request.signature),
+            }),
+          );
+          return { valid: true as const };
+        }),
+    }),
+  ),
+).pipe(Layer.provide(FetchHttpClient.layer), Layer.provide(CredentialsFromAmbientOrEnv));

package/src/Volume.ts

@@ -0,0 +1,264 @@
+import type { Volume as FlyVolume } from "@distilled.cloud/fly-io/machines";
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { listOwnedApps } from "./App.ts";
+import {
+  createFlyVolumeName,
+  matchesAlchemyPhysicalName,
+  sanitizeFlyVolumeName,
+} from "./Metadata.ts";
+import type { DiskSpec } from "./MountVolume.ts";
+
+export const DEFAULT_VOLUME_REGION = "iad";
+export const MIN_SIZE_GB = 1;
+
+export class VolumeNotCreated extends Data.TaggedError("Fly.VolumeNotCreated")<{
+  name: string;
+  appName: string;
+}> {}
+
+class VolumePending extends Data.TaggedError("Fly.VolumePending")<{
+  volumeId: string;
+  state: string;
+}> {}
+
+const backoff = Schedule.min([
+  Schedule.exponential(Duration.millis(500), 1.5),
+  Schedule.spaced(Duration.seconds(5)),
+]);
+
+export const destroying = (state: string | undefined) =>
+  state === "destroyed" || state === "pending_destroy" || state === "scheduled_for_destruction";
+
+const transientState = (state: string | undefined) =>
+  state === "creating" || state === "pending" || state === "extending";
+
+export const getVolumeById = (appName: string, volumeId: string) =>
+  machines.getVolumeById({ app_name: appName, volume_id: volumeId }).pipe(
+    Effect.map((volume) => (destroying(volume.state) ? undefined : volume)),
+    Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+  );
+
+export const listVolumesByApp = (appName: string) =>
+  machines.listVolumes({ app_name: appName }).pipe(
+    Effect.map((volumes) => volumes.filter((volume) => !destroying(volume.state))),
+    Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed([])),
+  );
+
+const newestFirst = (left: FlyVolume, right: FlyVolume) => {
+  const byCreated = Date.parse(left.created_at ?? "") - Date.parse(right.created_at ?? "");
+  if (byCreated !== 0) return byCreated;
+  return (left.id ?? "").localeCompare(right.id ?? "");
+};
+
+export const listVolumeGroup = (appName: string, name: string, region: string) =>
+  listVolumesByApp(appName).pipe(
+    Effect.map((volumes) =>
+      volumes
+        .filter((volume) => volume.name === name && volume.region === region)
+        .sort(newestFirst),
+    ),
+  );
+
+export const waitUntilVolumeReady = (appName: string, volumeId: string) =>
+  getVolumeById(appName, volumeId).pipe(
+    Effect.flatMap((volume) => {
+      if (volume === undefined) return Effect.succeed(undefined);
+      if (transientState(volume.state)) {
+        return Effect.fail(
+          new VolumePending({
+            volumeId,
+            state: volume.state ?? "creating",
+          }),
+        );
+      }
+      return Effect.succeed(volume);
+    }),
+    Effect.retry({
+      while: (e) => e._tag === "Fly.VolumePending",
+      times: 8,
+      schedule: backoff,
+    }),
+    Effect.catchTag("Fly.VolumePending", () => getVolumeById(appName, volumeId)),
+  );
+
+export const waitUntilVolumeGone = (appName: string, volumeId: string) =>
+  getVolumeById(appName, volumeId).pipe(
+    Effect.map((volume) => volume === undefined),
+    Effect.repeat({
+      schedule: Schedule.spaced("2 seconds"),
+      until: (gone) => gone,
+      times: 10,
+    }),
+  );
+
+export const pathKey = (path: string): string => {
+  const key = path
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+  return key.length === 0 ? "data" : key;
+};
+
+export const volumeGroupName = (id: string, disk: Pick<DiskSpec, "path" | "name">) =>
+  Effect.gen(function* () {
+    if (disk.name !== undefined) return sanitizeFlyVolumeName(disk.name);
+    return yield* createFlyVolumeName(`${id}/${pathKey(disk.path)}`);
+  });
+
+export const createVolume = Effect.fn(function* (input: {
+  appName: string;
+  name: string;
+  region: string;
+  disk: DiskSpec;
+}) {
+  const sizeGb = Math.max(input.disk.sizeGb, MIN_SIZE_GB);
+  const created = yield* machines
+    .createVolume({
+      app_name: input.appName,
+      name: input.name,
+      region: input.region,
+      size_gb: sizeGb,
+      encrypted: input.disk.encrypted,
+      fstype: input.disk.fstype,
+      auto_backup_enabled: input.disk.autoBackupEnabled,
+      snapshot_retention: input.disk.snapshotRetention,
+      snapshot_id: input.disk.snapshotId,
+      source_volume_id: input.disk.sourceVolumeId,
+      require_unique_zone: input.disk.requireUniqueZone,
+    })
+    .pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+  if (created?.id !== undefined && created.id.length > 0) {
+    return (yield* waitUntilVolumeReady(input.appName, created.id)) ?? created;
+  }
+  const group = yield* listVolumeGroup(input.appName, input.name, input.region);
+  const hit = group.at(-1);
+  if (hit === undefined || hit.id === undefined) {
+    return yield* new VolumeNotCreated({
+      name: input.name,
+      appName: input.appName,
+    });
+  }
+  return (yield* waitUntilVolumeReady(input.appName, hit.id)) ?? hit;
+});
+
+export const syncVolume = Effect.fn(function* (appName: string, volume: FlyVolume, disk: DiskSpec) {
+  const volumeId = volume.id;
+  if (volumeId === undefined || volumeId.length === 0) return volume;
+  let current = volume;
+  const sizeGb = Math.max(disk.sizeGb, MIN_SIZE_GB);
+  const observedSize = current.size_gb ?? 0;
+  if (sizeGb > observedSize) {
+    const extended = yield* machines.extendVolume({
+      app_name: appName,
+      volume_id: volumeId,
+      size_gb: sizeGb,
+    });
+    current = extended.volume ?? (yield* waitUntilVolumeReady(appName, volumeId)) ?? current;
+  }
+
+  const backupChanged =
+    disk.autoBackupEnabled !== undefined && disk.autoBackupEnabled !== current.auto_backup_enabled;
+  const retentionChanged =
+    disk.snapshotRetention !== undefined && disk.snapshotRetention !== current.snapshot_retention;
+  if (backupChanged || retentionChanged) {
+    current = yield* machines.updateVolume({
+      app_name: appName,
+      volume_id: volumeId,
+      auto_backup_enabled: disk.autoBackupEnabled,
+      snapshot_retention: disk.snapshotRetention,
+    });
+  }
+  return current;
+});
+
+/**
+ * Observe-ensure-sync a Fly volume group (`name` shared, `count`
+ * independent volumes). Extras are left in place for the caller to
+ * delete after the Machines that mount them are gone.
+ */
+export const ensureVolumeGroup = Effect.fn(function* (input: {
+  appName: string;
+  name: string;
+  region: string;
+  count: number;
+  disk: DiskSpec;
+  preferIds?: readonly string[];
+}) {
+  const prefer = new Set((input.preferIds ?? []).filter((id) => id.length > 0));
+  let group = yield* listVolumeGroup(input.appName, input.name, input.region);
+  const preferred = group.filter((volume) => volume.id !== undefined && prefer.has(volume.id));
+  const rest = group.filter((volume) => volume.id === undefined || !prefer.has(volume.id));
+  group = [...preferred, ...rest];
+
+  let attempts = 0;
+  while (group.length < input.count && attempts < input.count + 3) {
+    attempts += 1;
+    const created = yield* createVolume({
+      appName: input.appName,
+      name: input.name,
+      region: input.region,
+      disk: input.disk,
+    });
+    if (created.id !== undefined && !group.some((volume) => volume.id === created.id)) {
+      group.push(created);
+    } else {
+      group = yield* listVolumeGroup(input.appName, input.name, input.region);
+    }
+  }
+  if (group.length < input.count) {
+    return yield* new VolumeNotCreated({
+      name: input.name,
+      appName: input.appName,
+    });
+  }
+
+  const kept = group.slice(0, input.count);
+  const extras = group.slice(input.count);
+  const synced: FlyVolume[] = [];
+  for (const volume of kept) {
+    synced.push(yield* syncVolume(input.appName, volume, input.disk));
+  }
+  return { volumes: synced, extras };
+});
+
+export const deleteVolume = Effect.fn(function* (appName: string, volumeId: string) {
+  if (appName.length === 0 || volumeId.length === 0) return;
+  yield* machines
+    .deleteVolume({
+      app_name: appName,
+      volume_id: volumeId,
+    })
+    .pipe(
+      Effect.catchTag("NotFound", () => Effect.void),
+      Effect.retry({
+        while: (e) => e._tag === "Conflict",
+        times: 8,
+        schedule: backoff,
+      }),
+    );
+  yield* waitUntilVolumeGone(appName, volumeId);
+});
+
+export const listOwnedVolumes = Effect.fn(function* () {
+  const apps = yield* listOwnedApps();
+  const groups = yield* Effect.forEach(
+    apps,
+    (app) =>
+      listVolumesByApp(app.appName).pipe(
+        Effect.map((volumes) =>
+          volumes.flatMap((volume) => {
+            if (!matchesAlchemyPhysicalName(volume.name)) return [];
+            const volumeId = volume.id;
+            if (volumeId === undefined || volumeId.length === 0) return [];
+            return [{ appName: app.appName, volumeId, volume }];
+          }),
+        ),
+      ),
+    { concurrency: 8 },
+  );
+  return groups.flat();
+});