@alchemy.run/fly 0.0.0 → 2.0.0-beta.84

package/lib/ConnectPostgresHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectPostgresHttp.d.ts","sourceRoot":"","sources":["../src/ConnectPostgresHttp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,eAAe,EAGhB,MAAM,sBAAsB,CAAC;AAsB9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,4CAuB/B,CAAC"}

package/lib/ConnectPostgresHttp.js

@@ -0,0 +1,57 @@
+import * as Binding from "alchemy/Binding";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { ConnectPostgres, PostgresUrlMissing, } from "./ConnectPostgres.js";
+import {} from "./Postgres.js";
+const isFlyHost = (value) => typeof value === "object" &&
+    value !== null &&
+    (value.Type === "Fly.Service" ||
+        value.Type === "Fly.Machine");
+const asRedactedUrl = (value, name) => {
+    const plain = typeof value === "string" ? value : Redacted.isRedacted(value) ? Redacted.value(value) : "";
+    const url = typeof plain === "string" ? plain : "";
+    return url.length > 0
+        ? Effect.succeed(Redacted.make(url))
+        : Effect.fail(new PostgresUrlMissing({ name }));
+};
+/**
+ * Implementation of {@link ConnectPostgres}. Provide it on the
+ * {@link Service} Effect.
+ *
+ * Registers the cluster attachment for Fly's private network. Alchemy
+ * transports each cluster's connection URIs through resource Outputs,
+ * so callers do not configure connection-string environment variables.
+ *
+ *
+ * ### Provide the layer
+ * **Example:** On a Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const conn = yield* Fly.ConnectPostgres(Db);
+ *   const db = yield* Drizzle.Postgres(conn.connectionString);
+ * }).pipe(Effect.provide(Fly.ConnectPostgresHttp))
+ * ```
+ *
+ * @layer
+ * @product Postgres
+ * @provides Fly.ConnectPostgres
+ */
+export const ConnectPostgresHttp = Layer.effect(ConnectPostgres, Effect.succeed(Effect.fn(function* (postgres) {
+    const name = postgres.LogicalId;
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+        const host = yield* Binding.Host;
+        if (isFlyHost(host)) {
+            yield* host.bind `${postgres}`({
+                postgres: { clusterId: postgres.clusterId },
+            });
+        }
+    }
+    const pooled = yield* postgres.pooledConnectionUri;
+    const direct = yield* postgres.connectionUri;
+    return {
+        connectionString: pooled.pipe(Effect.flatMap((value) => asRedactedUrl(value, name))),
+        directConnectionString: direct.pipe(Effect.flatMap((value) => asRedactedUrl(value, name))),
+    };
+})));
+//# sourceMappingURL=ConnectPostgresHttp.js.map

package/lib/ConnectPostgresHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectPostgresHttp.js","sourceRoot":"","sources":["../src/ConnectPostgresHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAiB,MAAM,eAAe,CAAC;AAE9C,MAAM,SAAS,GAAG,CAAC,KAAc,EAAuD,EAAE,CACxF,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,CAAE,KAA2B,CAAC,IAAI,KAAK,aAAa;QACjD,KAA2B,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;AAEzD,MAAM,aAAa,GAAG,CACpB,KAAc,EACd,IAAY,EACkD,EAAE;IAChE,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAC7C,eAAe,EACf,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAkB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;IAE7C,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACpF,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;AACpC,CAAC,CAAC,CACH,CACF,CAAC"}

package/lib/Contributions.d.ts

@@ -0,0 +1,7 @@
+import * as Contributions from "alchemy/Contributions";
+declare const _default: {
+    readonly name: "fly";
+    readonly auth: Contributions.Lazy<import("effect/Layer").Layer<never, never, import("alchemy/Auth/AuthProvider").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path>>;
+};
+export default _default;
+//# sourceMappingURL=Contributions.d.ts.map

package/lib/Contributions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Contributions.d.ts","sourceRoot":"","sources":["../src/Contributions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,uBAAuB,CAAC;;;;;AAEvD,wBAMG"}

package/lib/Contributions.js

@@ -0,0 +1,6 @@
+import * as Contributions from "alchemy/Contributions";
+export default Contributions.make({
+    name: "fly",
+    auth: Contributions.lazy(() => import("./AuthProvider.js"), (module) => module.FlyAuth),
+});
+//# sourceMappingURL=Contributions.js.map

package/lib/Contributions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Contributions.js","sourceRoot":"","sources":["../src/Contributions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,uBAAuB,CAAC;AAEvD,eAAe,aAAa,CAAC,IAAI,CAAC;IAChC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,aAAa,CAAC,IAAI,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAC3B;CACF,CAAC,CAAC"}

package/lib/Credentials.d.ts

@@ -0,0 +1,33 @@
+import { Credentials } from "@distilled.cloud/fly-io";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+export { Credentials, CredentialsFromEnv, credentials, DEFAULT_API_BASE_URL, normalizeApiBaseUrl, type Config as CredentialsConfig, } from "@distilled.cloud/fly-io";
+/**
+ * Capture the deployment's org token as a named runtime Output.
+ * Resolve it during binding initialization so plan/diff retains
+ * profile-backed credentials rather than falling back to process env.
+ */
+export declare const bindFlyApiToken: () => Effect.Effect<void, never, Credentials>;
+/**
+ * `Credentials` for the HTTP binding layers (`GetSecretHttp`, `ExecHttp`, …).
+ *
+ * Those layers are built in two places. Inside a stack (plan/deploy, or an
+ * Action) `providers()` has already resolved the profile-backed
+ * `Credentials`, and the binding must use them — a laptop deploy has no
+ * `FLY_API_TOKEN` in its env once the token lives in the Alchemy profile.
+ * Inside a deployed Machine there is no profile; `bindFlyApiToken`
+ * has already `RuntimeContext.set` the org token, which Platform copies
+ * into Machine env as `FLY_API_TOKEN`. So: reuse the ambient
+ * `Credentials` when present, otherwise read the env.
+ */
+export declare const CredentialsFromAmbientOrEnv: Layer.Layer<Credentials>;
+/**
+ * Build a `Credentials` layer that resolves Fly credentials via the current
+ * Alchemy profile, or directly from environment variables in CI.
+ *
+ * Maps onto `@distilled.cloud/fly-io`'s `{ apiKey, apiBaseUrl }` shape.
+ * Distilled's own `CredentialsFromEnv` also accepts `FLY_IO_API_KEY` as a
+ * fallback — Alchemy itself only reads `FLY_API_TOKEN`.
+ */
+export declare const fromAuthProvider: () => Layer.Layer<Credentials, never, import("alchemy/Auth/AuthProvider").AuthProviders | import("alchemy/Auth/Profile").ProfileStore>;
+//# sourceMappingURL=Credentials.d.ts.map

package/lib/Credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../src/Credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAO1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAStC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,MAAM,IAAI,iBAAiB,GACjC,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CASrE,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAOhE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wIA6B1B,CAAC"}

package/lib/Credentials.js

@@ -0,0 +1,59 @@
+import { ConfigError } from "@distilled.cloud/core/errors";
+import { Credentials, CredentialsFromEnv } from "@distilled.cloud/fly-io";
+import { deferUntilFirstUse, orDieCredentialsUnavailable, resolveProviderConfig, } from "alchemy/Auth/Resolve";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import { FLY_AUTH_PROVIDER_NAME, } from "./AuthProvider.js";
+export { Credentials, CredentialsFromEnv, credentials, DEFAULT_API_BASE_URL, normalizeApiBaseUrl, } from "@distilled.cloud/fly-io";
+/**
+ * Capture the deployment's org token as a named runtime Output.
+ * Resolve it during binding initialization so plan/diff retains
+ * profile-backed credentials rather than falling back to process env.
+ */
+export const bindFlyApiToken = () => Effect.gen(function* () {
+    const token = globalThis.__ALCHEMY_RUNTIME__
+        ? ""
+        : yield* Credentials.pipe(Effect.flatMap((resolve) => resolve), Effect.map((cfg) => Redacted.value(cfg.apiKey)));
+    yield* Output.named(Output.asOutput(token), "FLY_API_TOKEN").asEffect().pipe(Effect.asVoid);
+});
+/**
+ * `Credentials` for the HTTP binding layers (`GetSecretHttp`, `ExecHttp`, …).
+ *
+ * Those layers are built in two places. Inside a stack (plan/deploy, or an
+ * Action) `providers()` has already resolved the profile-backed
+ * `Credentials`, and the binding must use them — a laptop deploy has no
+ * `FLY_API_TOKEN` in its env once the token lives in the Alchemy profile.
+ * Inside a deployed Machine there is no profile; `bindFlyApiToken`
+ * has already `RuntimeContext.set` the org token, which Platform copies
+ * into Machine env as `FLY_API_TOKEN`. So: reuse the ambient
+ * `Credentials` when present, otherwise read the env.
+ */
+export const CredentialsFromAmbientOrEnv = Layer.effect(Credentials, Effect.gen(function* () {
+    const ambient = yield* Effect.serviceOption(Credentials);
+    if (Option.isSome(ambient))
+        return ambient.value;
+    return yield* Credentials.pipe(Effect.provide(CredentialsFromEnv));
+}));
+/**
+ * Build a `Credentials` layer that resolves Fly credentials via the current
+ * Alchemy profile, or directly from environment variables in CI.
+ *
+ * Maps onto `@distilled.cloud/fly-io`'s `{ apiKey, apiBaseUrl }` shape.
+ * Distilled's own `CredentialsFromEnv` also accepts `FLY_IO_API_KEY` as a
+ * fallback — Alchemy itself only reads `FLY_API_TOKEN`.
+ */
+export const fromAuthProvider = () => Layer.effect(Credentials, Effect.gen(function* () {
+    // Defer profile lookup and credential resolution until first use, so
+    // building the provider layers never requires a configured profile.
+    const resolve = yield* resolveProviderConfig(FLY_AUTH_PROVIDER_NAME).pipe(Effect.flatMap(({ profileName, resolve }) => resolve.pipe(Effect.map((creds) => ({
+        apiKey: creds.apiKey,
+        apiBaseUrl: creds.apiBaseUrl,
+    })), Effect.mapError((e) => ConfigError.make({
+        message: `Failed to resolve Fly credentials from ${profileName === undefined ? "the CI environment" : `profile '${profileName}'`}: ${e.message ?? String(e)}`,
+    })))), deferUntilFirstUse);
+    return yield* resolve.pipe(orDieCredentialsUnavailable(FLY_AUTH_PROVIDER_NAME), Effect.cached);
+}));
+//# sourceMappingURL=Credentials.js.map

package/lib/Credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../src/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,sBAAsB,GAGvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAA4C,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,UAAU,CAAC,mBAAmB;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CACrB,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EACpC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAChD,CAAC;IACN,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA6B,KAAK,CAAC,MAAM,CAC/E,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACjD,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACrE,CAAC,CAAC,CACH,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAC1C,sBAAsB,CACvB,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC,EACH,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,WAAW,CAAC,IAAI,CAAC;QACf,OAAO,EAAE,0CAA0C,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,WAAW,GAAG,KAAM,CAA0B,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE;KACxL,CAAC,CACH,CACF,CACF,EACD,kBAAkB,CACnB,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACxB,2BAA2B,CAAC,sBAAsB,CAAC,EACnD,MAAM,CAAC,MAAM,CACd,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Decrypt.d.ts

@@ -0,0 +1,52 @@
+import type { DecryptSecretKeyError } from "@distilled.cloud/fly-io/machines";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import type { SecretKey } from "./SecretKey.ts";
+export interface DecryptRequest {
+    /** Ciphertext produced by {@link Encrypt}. */
+    ciphertext: Uint8Array | ArrayLike<number>;
+    /** Optional AEAD associated data. Must match encryption. */
+    associatedData?: Uint8Array | ArrayLike<number>;
+}
+export interface DecryptResult {
+    /** Plaintext, wrapped so it never logs. Unwrap with `Redacted.value`. */
+    plaintext: Redacted.Redacted<Uint8Array>;
+}
+/**
+ * Decrypt with a Fly {@link SecretKey}. The App and key name are fixed
+ * by `Decrypt(key)`.
+ *
+ *
+ * ### Decrypt a payload
+ * Provide {@link DecryptHttp}. Plaintext comes back `Redacted`. Unwrap
+ * with `Redacted.value` only where you need the raw bytes.
+ *
+ * **Example:** Decrypt
+ * ```typescript
+ * import * as Redacted from "effect/Redacted";
+ *
+ * const decrypt = yield* Fly.Decrypt(Box);
+ * const { plaintext } = yield* decrypt({ ciphertext });
+ * const bytes = Redacted.value(plaintext);
+ * ```
+ *
+ * ### Associated data
+ * `associatedData` must match the bytes passed to {@link Encrypt}.
+ *
+ * **Example:** AEAD
+ * ```typescript
+ * const { plaintext } = yield* decrypt({
+ *   ciphertext,
+ *   associatedData: nonce,
+ * });
+ * ```
+ *
+ * @binding
+ * @product Secret Key
+ */
+export interface Decrypt extends Binding.Service<Decrypt, "Fly.Decrypt", (key: SecretKey) => Effect.Effect<(request: DecryptRequest) => Effect.Effect<DecryptResult, DecryptSecretKeyError, RuntimeContext>>> {
+}
+export declare const Decrypt: Decrypt;
+//# sourceMappingURL=Decrypt.d.ts.map

package/lib/Decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decrypt.d.ts","sourceRoot":"","sources":["../src/Decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,4DAA4D;IAC5D,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,OAAQ,SAAQ,OAAO,CAAC,OAAO,CAC9C,OAAO,EACP,aAAa,EACb,CACE,GAAG,EAAE,SAAS,KACX,MAAM,CAAC,MAAM,CAChB,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,qBAAqB,EAAE,cAAc,CAAC,CACjG,CACF;CAAG;AAEJ,eAAO,MAAM,OAAO,SAA0C,CAAC"}

package/lib/Decrypt.js

@@ -0,0 +1,3 @@
+import * as Binding from "alchemy/Binding";
+export const Decrypt = Binding.Service("Fly.Decrypt");
+//# sourceMappingURL=Decrypt.js.map

package/lib/Decrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decrypt.js","sourceRoot":"","sources":["../src/Decrypt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AA4D3C,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAU,aAAa,CAAC,CAAC"}

package/lib/DecryptHttp.d.ts

@@ -0,0 +1,22 @@
+import * as Layer from "effect/Layer";
+import { Decrypt } from "./Decrypt.ts";
+/**
+ * HTTP implementation of {@link Decrypt}. Provide it on the
+ * {@link Service} or Action Effect.
+ *
+ *
+ * ### Provide the layer
+ * **Example:** On a Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const decrypt = yield* Fly.Decrypt(Box);
+ *   // ...
+ * }).pipe(Effect.provide(Fly.DecryptHttp))
+ * ```
+ *
+ * @layer
+ * @product Secret Key
+ * @provides Fly.Decrypt
+ */
+export declare const DecryptHttp: Layer.Layer<Decrypt, never, never>;
+//# sourceMappingURL=DecryptHttp.d.ts.map

package/lib/DecryptHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DecryptHttp.d.ts","sourceRoot":"","sources":["../src/DecryptHttp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAE,OAAO,EAAuB,MAAM,cAAc,CAAC;AAI5D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,oCAuBgE,CAAC"}

package/lib/DecryptHttp.js

@@ -0,0 +1,43 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { CredentialsFromAmbientOrEnv } from "./Credentials.js";
+import { Decrypt } from "./Decrypt.js";
+import { unwrapSecretValue } from "./SecretHttp.js";
+import { base64ToBytes, bytesToBase64, makeHttpSecretKeyBinding } from "./SecretKeyHttp.js";
+/**
+ * HTTP implementation of {@link Decrypt}. Provide it on the
+ * {@link Service} or Action Effect.
+ *
+ *
+ * ### Provide the layer
+ * **Example:** On a Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const decrypt = yield* Fly.Decrypt(Box);
+ *   // ...
+ * }).pipe(Effect.provide(Fly.DecryptHttp))
+ * ```
+ *
+ * @layer
+ * @product Secret Key
+ * @provides Fly.Decrypt
+ */
+export const DecryptHttp = Layer.effect(Decrypt, Effect.suspend(() => makeHttpSecretKeyBinding({
+    makeClient: (auth, appName, secretName) => Effect.fn("Fly.Decrypt")(function* (request) {
+        const res = yield* auth.authorize(machines.decryptSecretKey({
+            app_name: yield* appName,
+            secret_name: yield* secretName,
+            ciphertext: bytesToBase64(request.ciphertext),
+            associated_data: request.associatedData === undefined
+                ? undefined
+                : bytesToBase64(request.associatedData),
+        }));
+        return {
+            plaintext: Redacted.make(base64ToBytes(unwrapSecretValue(res.plaintext ?? ""))),
+        };
+    }),
+}))).pipe(Layer.provide(FetchHttpClient.layer), Layer.provide(CredentialsFromAmbientOrEnv));
+//# sourceMappingURL=DecryptHttp.js.map

package/lib/DecryptHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DecryptHttp.js","sourceRoot":"","sources":["../src/DecryptHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kCAAkC,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAuB,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE5F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CACrC,OAAO,EACP,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,wBAAwB,CAAC;IACvB,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CACxC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAuB;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAC/B,QAAQ,CAAC,gBAAgB,CAAC;YACxB,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO;YACxB,WAAW,EAAE,KAAK,CAAC,CAAC,UAAU;YAC9B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,eAAe,EACb,OAAO,CAAC,cAAc,KAAK,SAAS;gBAClC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC,CACH,CAAC;QACF,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;SAChF,CAAC;IACJ,CAAC,CAAC;CACL,CAAC,CACH,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC"}

package/lib/DeleteObject.d.ts

@@ -0,0 +1,29 @@
+import type * as S3 from "@distilled.cloud/aws/s3";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { Bucket } from "./Bucket.ts";
+import type { TigrisCredentialsMissing } from "./Errors.ts";
+export interface DeleteObjectRequest extends Omit<S3.DeleteObjectRequest, "Bucket"> {
+}
+/**
+ * Runtime binding for Tigris `DeleteObject` over the S3 API.
+ *
+ * Bind this operation to a {@link Bucket} in Service init. Provide
+ * {@link DeleteObjectHttp}.
+ *
+ *
+ * ### Deleting Objects
+ * **Example:** Delete an Object
+ * ```typescript
+ * const deleteObject = yield* Fly.DeleteObject(Data);
+ * yield* deleteObject({ Key: "hello.txt" });
+ * ```
+ *
+ * @binding
+ * @product Bucket
+ */
+export interface DeleteObject extends Binding.Service<DeleteObject, "Fly.DeleteObject", (bucket: Bucket) => Effect.Effect<(request: DeleteObjectRequest) => Effect.Effect<S3.DeleteObjectOutput, S3.DeleteObjectError | TigrisCredentialsMissing, RuntimeContext>>> {
+}
+export declare const DeleteObject: DeleteObject;
+//# sourceMappingURL=DeleteObject.d.ts.map

package/lib/DeleteObject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteObject.d.ts","sourceRoot":"","sources":["../src/DeleteObject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,QAAQ,CAAC;CAAG;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO,CAAC,OAAO,CACnD,YAAY,EACZ,kBAAkB,EAClB,CACE,MAAM,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAChB,CACE,OAAO,EAAE,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAChB,EAAE,CAAC,kBAAkB,EACrB,EAAE,CAAC,iBAAiB,GAAG,wBAAwB,EAC/C,cAAc,CACf,CACF,CACF;CAAG;AAEJ,eAAO,MAAM,YAAY,cAAoD,CAAC"}

package/lib/DeleteObject.js

@@ -0,0 +1,3 @@
+import * as Binding from "alchemy/Binding";
+export const DeleteObject = Binding.Service("Fly.DeleteObject");
+//# sourceMappingURL=DeleteObject.js.map

package/lib/DeleteObject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteObject.js","sourceRoot":"","sources":["../src/DeleteObject.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAyC3C,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAe,kBAAkB,CAAC,CAAC"}

package/lib/DeleteObjectHttp.d.ts

@@ -0,0 +1,12 @@
+import * as Layer from "effect/Layer";
+import { DeleteObject } from "./DeleteObject.ts";
+/**
+ * HTTP implementation of {@link DeleteObject}. Calls distilled S3
+ * `deleteObject` against the Tigris endpoint with the bucket's credentials.
+ *
+ * @layer
+ * @product Bucket
+ * @provides Fly.DeleteObject
+ */
+export declare const DeleteObjectHttp: Layer.Layer<DeleteObject, never, never>;
+//# sourceMappingURL=DeleteObjectHttp.d.ts.map

package/lib/DeleteObjectHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteObjectHttp.d.ts","sourceRoot":"","sources":["../src/DeleteObjectHttp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,yCAM5B,CAAC"}

package/lib/DeleteObjectHttp.js

@@ -0,0 +1,17 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Layer from "effect/Layer";
+import { makeTigrisS3Binding } from "./BucketBinding.js";
+import { DeleteObject } from "./DeleteObject.js";
+/**
+ * HTTP implementation of {@link DeleteObject}. Calls distilled S3
+ * `deleteObject` against the Tigris endpoint with the bucket's credentials.
+ *
+ * @layer
+ * @product Bucket
+ * @provides Fly.DeleteObject
+ */
+export const DeleteObjectHttp = Layer.effect(DeleteObject, makeTigrisS3Binding({
+    tag: "Fly.DeleteObject",
+    operation: S3.deleteObject,
+}));
+//# sourceMappingURL=DeleteObjectHttp.js.map

package/lib/DeleteObjectHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteObjectHttp.js","sourceRoot":"","sources":["../src/DeleteObjectHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAC1C,YAAY,EACZ,mBAAmB,CAAC;IAClB,GAAG,EAAE,kBAAkB;IACvB,SAAS,EAAE,EAAE,CAAC,YAAY;CAC3B,CAAC,CACH,CAAC"}

package/lib/Deployment.d.ts

@@ -0,0 +1,51 @@
+import type { FlyMachineConfig, FlyStopConfigSignal } from "@distilled.cloud/fly-io/machines";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import type { MachineServiceCheck } from "./Machine.ts";
+/** Replacement/readiness policy shared by Machines, Services, and websites; not an App-wide deployment lock. */
+export interface MachineDeploy {
+    /** Sequential in-place updates, or a checked replacement set. @default "rolling" */
+    strategy: "rolling" | "bluegreen";
+    /** Readiness deadline after startup, positive and at most 300 seconds. A deadline-only change does not replace Machines. @default "60 seconds" */
+    healthTimeout?: Duration.Input;
+}
+/** Process shutdown policy. Retirement uses the predecessor's own policy; raw images and external website servers own signal handling and drain. */
+export interface MachineShutdown {
+    /** Signal sent before termination. Managed Services support SIGTERM and SIGINT. @default "SIGTERM" */
+    signal?: Exclude<FlyStopConfigSignal, "SIGKILL">;
+    /** Grace period, greater than zero and at most 300 seconds. @default "30 seconds" */
+    timeout?: Duration.Input;
+}
+/** Named readiness check for a worker without public proxy ports. */
+export interface MachineCheck extends MachineServiceCheck {
+    /** Port inside the Machine to check. */
+    port: number;
+}
+declare const InvalidDeployment_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Fly.InvalidDeployment";
+} & Readonly<A>;
+export declare class InvalidDeployment extends InvalidDeployment_base<{
+    message: string;
+}> {
+}
+export interface DeploymentPolicy {
+    bluegreen: boolean;
+    healthTimeoutMs: number;
+    shutdown: {
+        signal: Exclude<FlyStopConfigSignal, "SIGKILL">;
+        timeout: string;
+        timeoutMs: number;
+    } | undefined;
+}
+export declare const deploymentPolicy: (deploy: MachineDeploy | undefined, shutdown: MachineShutdown | undefined, managed?: any) => Effect.Effect<{
+    bluegreen: boolean;
+    healthTimeoutMs: number;
+    shutdown: {
+        signal: "SIGHUP" | "SIGINT" | "SIGQUIT" | "SIGTERM" | "SIGUSR1" | "SIGUSR2";
+        timeout: string;
+        timeoutMs: number;
+    } | undefined;
+}, InvalidDeployment, never>;
+export declare const validateDeployment: (policy: DeploymentPolicy, config: FlyMachineConfig, mounted: boolean, skipLaunch?: boolean) => Effect.Effect<void, never, never> | Effect.Effect<never, InvalidDeployment, never>;
+export {};
+//# sourceMappingURL=Deployment.d.ts.map

package/lib/Deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Deployment.d.ts","sourceRoot":"","sources":["../src/Deployment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE9F,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,gHAAgH;AAChH,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,QAAQ,EAAE,SAAS,GAAG,WAAW,CAAC;IAClC,kJAAkJ;IAClJ,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;CAChC;AAED,oJAAoJ;AACpJ,MAAM,WAAW,eAAe;IAC9B,sGAAsG;IACtG,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACjD,qFAAqF;IACrF,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAa,SAAQ,mBAAmB;IACvD,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;;;;AAED,qBAAa,iBAAkB,SAAQ,uBAA0C;IAC/E,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;AAEL,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EACJ;QAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACvF,SAAS,CAAC;CACf;AAiBD,eAAO,MAAM,gBAAgB;;;;;;;;4BAmC3B,CAAC;AAEH,eAAO,MAAM,kBAAkB,WACrB,gBAAgB,UAChB,gBAAgB,WACf,OAAO,6GAwBjB,CAAC"}

package/lib/Deployment.js

@@ -0,0 +1,62 @@
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { pinsFromConfig } from "./DeploymentImages.js";
+export class InvalidDeployment extends Data.TaggedError("Fly.InvalidDeployment") {
+}
+const duration = (value, name, maximum) => Effect.try({
+    try: () => {
+        const milliseconds = Duration.toMillis(value);
+        if (!Number.isSafeInteger(milliseconds) || milliseconds <= 0 || milliseconds > maximum) {
+            throw new Error("invalid duration");
+        }
+        return milliseconds;
+    },
+    catch: () => new InvalidDeployment({
+        message: `${name} must be a finite positive duration no greater than ${maximum / 1000} seconds.`,
+    }),
+});
+export const deploymentPolicy = Effect.fn(function* (deploy, shutdown, managed = false) {
+    const bluegreen = deploy?.strategy === "bluegreen";
+    const healthTimeoutMs = yield* duration(deploy?.healthTimeout ?? "60 seconds", "deploy.healthTimeout", 300_000);
+    const enabled = bluegreen || shutdown !== undefined;
+    const signal = shutdown?.signal ?? "SIGTERM";
+    if (enabled &&
+        !["SIGHUP", "SIGINT", "SIGQUIT", "SIGUSR1", "SIGUSR2", "SIGTERM"].includes(signal)) {
+        return yield* new InvalidDeployment({
+            message: "shutdown.signal must be a supported graceful Fly signal, not SIGKILL.",
+        });
+    }
+    if (managed && enabled && signal !== "SIGTERM" && signal !== "SIGINT") {
+        return yield* new InvalidDeployment({
+            message: "Managed Fly Services support SIGTERM and SIGINT shutdown signals.",
+        });
+    }
+    const timeoutMs = enabled
+        ? yield* duration(shutdown?.timeout ?? "30 seconds", "shutdown.timeout", 300_000)
+        : undefined;
+    return {
+        bluegreen,
+        healthTimeoutMs,
+        shutdown: timeoutMs === undefined ? undefined : { signal, timeout: `${timeoutMs}ms`, timeoutMs },
+    };
+});
+export const validateDeployment = (policy, config, mounted, skipLaunch = false) => {
+    if (!policy.bluegreen)
+        return Effect.void;
+    let message;
+    if (mounted)
+        message = "Blue/green deployments cannot attach volumes, including MountVolume bindings.";
+    else if (config.containers !== undefined && pinsFromConfig(config) === undefined)
+        message =
+            "Blue/green multi-container Machines require unique names and immutable repository@sha256 image references for every container.";
+    else if (skipLaunch || config.auto_destroy || config.restart?.policy === "no")
+        message = "Blue/green deployments require a persistent, launched Machine.";
+    else if ((config.services ?? []).some((service) => (service.ports?.length ?? 0) > 0 && !service.checks?.length))
+        message = "Every published service needs a service health check for blue/green deployment.";
+    else if (!(config.services ?? []).some((service) => service.checks?.length) &&
+        !Object.keys(config.checks ?? {}).length)
+        message = "Blue/green deployments require readiness checks.";
+    return message ? Effect.fail(new InvalidDeployment({ message })) : Effect.void;
+};
+//# sourceMappingURL=Deployment.js.map

package/lib/Deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Deployment.js","sourceRoot":"","sources":["../src/Deployment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAyBvD,MAAM,OAAO,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAE7E;CAAG;AAUL,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,YAAY,GAAG,OAAO,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,iBAAiB,CAAC;QACpB,OAAO,EAAE,GAAG,IAAI,uDAAuD,OAAO,GAAG,IAAI,WAAW;KACjG,CAAC;CACL,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACjD,MAAiC,EACjC,QAAqC,EACrC,OAAO,GAAG,KAAK;IAEf,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,KAAK,WAAW,CAAC;IACnD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,QAAQ,CACrC,MAAM,EAAE,aAAa,IAAI,YAAY,EACrC,sBAAsB,EACtB,OAAO,CACR,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,SAAS,CAAC;IAC7C,IACE,OAAO;QACP,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAClF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAClC,OAAO,EAAE,uEAAuE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAClC,OAAO,EAAE,mEAAmE;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,OAAO;QACvB,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,IAAI,YAAY,EAAE,kBAAkB,EAAE,OAAO,CAAC;QACjF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,SAAS;QACT,eAAe;QACf,QAAQ,EACN,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,IAAI,EAAE,SAAS,EAAE;KAC9D,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAwB,EACxB,MAAwB,EACxB,OAAgB,EAChB,UAAU,GAAG,KAAK,EAClB,EAAE;IACF,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAC1C,IAAI,OAA2B,CAAC;IAChC,IAAI,OAAO;QACT,OAAO,GAAG,+EAA+E,CAAC;SACvF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,SAAS;QAC9E,OAAO;YACL,gIAAgI,CAAC;SAChI,IAAI,UAAU,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI;QAC3E,OAAO,GAAG,gEAAgE,CAAC;SACxE,IACH,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CACzE;QAED,OAAO,GAAG,iFAAiF,CAAC;SACzF,IACH,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;QAClE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM;QAExC,OAAO,GAAG,kDAAkD,CAAC;IAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACjF,CAAC,CAAC"}

package/lib/DeploymentImages.d.ts

@@ -0,0 +1,18 @@
+import type { FlyMachineConfig } from "@distilled.cloud/fly-io/machines";
+export type ContainerImagePin = {
+    name: string;
+    image: string;
+};
+/** Blue/green needs immutable image references that survive a crash. */
+export declare const isImmutableImage: (image: string) => boolean;
+export declare const pinsFromConfig: (config: FlyMachineConfig | undefined) => ContainerImagePin[] | undefined;
+export declare const encodeImageSet: (pins: readonly ContainerImagePin[]) => string | undefined;
+export declare const decodeImageSet: (raw: string | undefined) => ContainerImagePin[] | undefined;
+export declare const sameImageSet: (left: readonly ContainerImagePin[] | undefined, right: readonly ContainerImagePin[] | undefined) => boolean;
+/** Protocol-2 metadata and the authoritative readback config must describe exactly the same set. */
+export declare const validObservedImageSet: (machine: {
+    config?: FlyMachineConfig;
+}) => boolean;
+/** Keep all named pins when changing service or idle policy on a candidate. */
+export declare const applyImageSet: (config: FlyMachineConfig, pins: readonly ContainerImagePin[]) => FlyMachineConfig | undefined;
+//# sourceMappingURL=DeploymentImages.d.ts.map

package/lib/DeploymentImages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeploymentImages.d.ts","sourceRoot":"","sources":["../src/DeploymentImages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAMzE,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,OACoB,CAAC;AAUtE,eAAO,MAAM,cAAc,WACjB,gBAAgB,GAAG,SAAS,KACnC,iBAAiB,EAAE,GAAG,SAQxB,CAAC;AAEF,eAAO,MAAM,cAAc,SAAU,SAAS,iBAAiB,EAAE,KAAG,MAAM,GAAG,SAClB,CAAC;AAE5D,eAAO,MAAM,cAAc,QAAS,MAAM,GAAG,SAAS,KAAG,iBAAiB,EAAE,GAAG,SAM9E,CAAC;AAEF,eAAO,MAAM,YAAY,SACjB,SAAS,iBAAiB,EAAE,GAAG,SAAS,SACvC,SAAS,iBAAiB,EAAE,GAAG,SAAS,KAC9C,OAIF,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,qBAAqB,YAAa;IAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,KAAG,OAO9E,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,aAAa,WAChB,gBAAgB,QAClB,SAAS,iBAAiB,EAAE,KACjC,gBAAgB,GAAG,SAiBrB,CAAC"}