@alchemy.run/fly 2.0.0-beta.84 → 2.0.0-beta.85

package/src/Secret.ts

@@ -207,7 +207,7 @@ export const Secret: typeof SecretResource = Object.assign(
 
 export class SecretNotCreated extends Data.TaggedError("Fly.SecretNotCreated")<{
   appName: string;
-  name: string;
+  secretName: string;
 }> {}
 
 export class SecretAppRequired extends Data.TaggedError("Fly.SecretAppRequired")<{
@@ -251,7 +251,7 @@ const getByName = (appName: string, secretName: string) =>
       secret_name: secretName,
       show_secrets: false,
     })
-    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
 
 const listSecrets = (appName: string) =>
   machines
@@ -360,7 +360,7 @@ export const SecretProvider = () =>
       }
 
       if (current === undefined) {
-        return yield* new SecretNotCreated({ appName, name });
+        return yield* new SecretNotCreated({ appName, secretName: name });
       }
 
       // Sync — skip if we just created. Prefer observed digest vs hash of

package/src/SecretKey.ts

@@ -184,7 +184,7 @@ export const SecretKey: typeof SecretKeyResource = Object.assign(
 
 export class SecretKeyNotCreated extends Data.TaggedError("Fly.SecretKeyNotCreated")<{
   appName: string;
-  name: string;
+  secretName: string;
 }> {}
 
 export class SecretKeyAppRequired extends Data.TaggedError("Fly.SecretKeyAppRequired")<{
@@ -223,7 +223,7 @@ const getByName = (appName: string, secretName: string) =>
       app_name: appName,
       secret_name: secretName,
     })
-    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
 
 const listKeys = (appName: string) =>
   machines.listSecretKeys({ app_name: appName }).pipe(
@@ -346,7 +346,7 @@ export const SecretKeyProvider = () =>
       }
 
       if (current === undefined) {
-        return yield* new SecretKeyNotCreated({ appName, name });
+        return yield* new SecretKeyNotCreated({ appName, secretName: name });
       }
 
       // Sync — re-set when the caller supplied new material. Observed

package/src/Service.ts

@@ -52,6 +52,7 @@ import {
   createFlyAppName,
   createFlyResourceName,
   diffMachineMetadata,
+  matchesAlchemyPhysicalName,
   sanitizeFlyAppName,
 } from "./Metadata.ts";
 import type { BoundTarget, MountedDisk, ServiceBinding } from "./MountVolume.ts";
@@ -928,28 +929,23 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * ) {}
  * ```
  *
- * **Example:** Install `pg` unbundled
- * `pg` is CommonJS. Rolldown's interop turns `Client` into a namespace.
- * Install it into the image so `@effect/sql-pg` / `Drizzle.Postgres` load
- * it with Node's CJS semantics — same `build.install` as Lambda.
+ * **Example:** Install a native package unbundled
+ * `build.install` runs `npm install` in the image for packages that
+ * cannot be bundled, such as native addons — same `build.install` as
+ * Lambda.
  * ```typescript
  * export default class Api extends Fly.Service<Api>()(
  *   "Api",
  *   {
  *     main: import.meta.url,
  *     port: 3000,
- *     build: { install: ["pg"] },
+ *     build: { install: ["sharp"] },
  *   },
  *   Effect.gen(function* () {
- *     const conn = yield* Fly.ConnectPostgres(Db);
- *     const db = yield* Drizzle.Postgres(conn.connectionString);
  *     return {
- *       fetch: Effect.gen(function* () {
- *         const rows = yield* db.execute("select 1 as ok");
- *         return HttpServerResponse.json({ rows });
- *       }),
+ *       fetch: Effect.succeed(HttpServerResponse.text("hello")),
  *     };
- *   }).pipe(Effect.provide(Fly.ConnectPostgresHttp)),
+ *   }),
  * ) {}
  * ```
  *
@@ -1064,7 +1060,7 @@ export const Service: Platform<Service, ServiceServices, ServiceShape, ServiceRu
   });
 
 export class ServiceNotCreated extends Data.TaggedError("Fly.ServiceNotCreated")<{
-  name: string;
+  resourceName: string;
   appName: string;
 }> {}
 
@@ -1235,9 +1231,6 @@ const configDrifted = (
   );
 };
 
-const portsOf = (services: FlyMachineService[] | undefined) =>
-  (services ?? []).flatMap((service) => service.ports ?? []);
-
 const withPort = (base: string, port: number, standard: number) =>
   port === standard ? base : `${base}:${port}`;
 
@@ -1517,6 +1510,26 @@ const toAttrs = (set: ReplicaSet, codeHash: string, access: Access): Service["At
   code: { hash: codeHash },
 });
 
+/** The replica set of a Service whose App exists but runs no Machines yet. */
+const emptyReplicaSet = (appName: string, name: string): ReplicaSet => ({
+  appName,
+  machineId: "",
+  machineIds: [],
+  name,
+  baseName: name,
+  region: "",
+  regions: [],
+  state: "created",
+  instanceId: undefined,
+  privateIp: undefined,
+  imageRef: undefined,
+  guest: undefined,
+  services: undefined,
+  count: 0,
+  mounts: [],
+  replicas: [],
+});
+
 const machineIdsOf = (output: Service["Attributes"] | undefined) =>
   output?.machineIds ??
   (output?.machineId !== undefined && output.machineId.length > 0 ? [output.machineId] : []);
@@ -1587,7 +1600,7 @@ export const ServiceProvider = () =>
         stables: ["appName"],
         nuke: { dependsOn: ["Fly.App"] },
 
-        diff: Effect.fn(function* ({ id, news, output }) {
+        diff: Effect.fn(function* ({ news, output }) {
           if (news === undefined) return;
           const shape = news as Partial<Pick<ServiceProps, "app" | "public" | "network">>;
           const ownsApp = shape.app === undefined;
@@ -1717,7 +1730,26 @@ export const ServiceProvider = () =>
             machineIds: machineIdsOf(output),
             baseName: name,
           });
-          if (found === undefined) return undefined;
+          if (found === undefined) {
+            // A create interrupted between creating the Service's own App and
+            // starting its Machines (an image build in between can take
+            // minutes) leaves the App with nothing in it. Report it, so the
+            // engine's recovery of the interrupted create deletes it instead
+            // of leaking it. The App's name is derived from this resource's
+            // instance, so an App with that name is this resource's.
+            if (!ownsApp || appName === undefined) return undefined;
+            const app = yield* machines
+              .getApp({ app_name: appName })
+              .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+            if (app === undefined || !matchesAlchemyPhysicalName(app.name)) return undefined;
+            return toAttrs(emptyReplicaSet(appName, name), output?.code.hash ?? "", {
+              ownsApp,
+              isPublic: false,
+              network: output?.network ?? olds?.network,
+              bindingPort: olds?.bindingPort ?? DEFAULT_BINDING_PORT,
+              rpcToken: output?.rpcToken,
+            });
+          }
           return toAttrs(found, output?.code.hash ?? "", {
             ownsApp,
             isPublic: ownsApp && (yield* hasPublicAddress(found.appName)),
@@ -1841,7 +1873,9 @@ export const ServiceProvider = () =>
               buildConfig({ image: imageRef, guest, env, services, mounts, metadata, statics }),
           }).pipe(
             Effect.catchTag("Fly.ReplicaNotCreated", (error) =>
-              Effect.fail(new ServiceNotCreated({ name: error.name, appName: error.appName })),
+              Effect.fail(
+                new ServiceNotCreated({ resourceName: error.resourceName, appName: error.appName }),
+              ),
             ),
           );
           return toAttrs(set, codeHash, {

package/src/Sprite.ts

@@ -318,18 +318,18 @@ export const Sprite: Platform<Sprite, SpriteServices, SpriteShape, SpriteRuntime
 );
 
 export class SpriteNotCreated extends Data.TaggedError("Fly.SpriteNotCreated")<{
-  name: string;
+  resourceName: string;
 }> {}
 
 export class SpriteExecFailed extends Data.TaggedError("Fly.SpriteExecFailed")<{
-  name: string;
+  resourceName: string;
   cmd: string;
   exitCode: number | undefined;
   stderr: string | undefined;
 }> {}
 
 class SpritePending extends Data.TaggedError("Fly.SpritePending")<{
-  name: string;
+  resourceName: string;
 }> {}
 
 const toStatus = (status: string | undefined): SpriteStatus =>
@@ -368,12 +368,14 @@ const ownershipLabels = (id: string) =>
   });
 
 const getByName = (name: string) =>
-  sprites.getSprite({ name }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+  sprites.getSprite({ name }).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
 
 const waitForSprite = (name: string) =>
   getByName(name).pipe(
     Effect.flatMap((found) =>
-      found !== undefined ? Effect.succeed(found) : Effect.fail(new SpritePending({ name })),
+      found !== undefined
+        ? Effect.succeed(found)
+        : Effect.fail(new SpritePending({ resourceName: name })),
     ),
     Effect.retry({
       while: (e) => e._tag === "Fly.SpritePending",
@@ -458,7 +460,7 @@ const runExec = (input: { name: string; cmd: string[]; env?: string[] }) =>
     );
     if ((result.exit_code ?? 0) !== 0) {
       return yield* new SpriteExecFailed({
-        name: input.name,
+        resourceName: input.name,
         cmd: input.cmd.join(" "),
         exitCode: result.exit_code,
         stderr: result.stderr,
@@ -576,12 +578,12 @@ export const SpriteProvider = () =>
         read: Effect.fn(function* ({ id, olds, output }) {
           const name = yield* resolveSpriteName(id, olds?.name, output?.name);
           const found = yield* (
-            output?.name !== undefined ? getByName(output.name) : Effect.succeed(undefined)
+            output?.name !== undefined ? getByName(output.name) : Effect.undefined
           ).pipe(
             Effect.flatMap((existing) =>
               existing !== undefined ? Effect.succeed(existing) : getByName(name),
             ),
-            Effect.catchTag("SpritesNotEnabled", () => Effect.succeed(undefined)),
+            Effect.catchTag("SpritesNotEnabled", () => Effect.undefined),
           );
           if (found === undefined) return undefined;
           const attrs = toAttrs(found, name, output?.code.hash ?? "");
@@ -628,7 +630,7 @@ export const SpriteProvider = () =>
           }
 
           if (current === undefined) {
-            return yield* new SpriteNotCreated({ name });
+            return yield* new SpriteNotCreated({ resourceName: name });
           }
           // Narrowed once so the `NotFound` fallbacks below keep the
           // non-optional type instead of widening back to `| undefined`.

package/src/Volume.ts

@@ -16,7 +16,7 @@ export const DEFAULT_VOLUME_REGION = "iad";
 export const MIN_SIZE_GB = 1;
 
 export class VolumeNotCreated extends Data.TaggedError("Fly.VolumeNotCreated")<{
-  name: string;
+  resourceName: string;
   appName: string;
 }> {}
 
@@ -39,7 +39,7 @@ const transientState = (state: string | undefined) =>
 export const getVolumeById = (appName: string, volumeId: string) =>
   machines.getVolumeById({ app_name: appName, volume_id: volumeId }).pipe(
     Effect.map((volume) => (destroying(volume.state) ? undefined : volume)),
-    Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+    Effect.catchTag("NotFound", () => Effect.undefined),
   );
 
 export const listVolumesByApp = (appName: string) =>
@@ -66,7 +66,7 @@ export const listVolumeGroup = (appName: string, name: string, region: string) =
 export const waitUntilVolumeReady = (appName: string, volumeId: string) =>
   getVolumeById(appName, volumeId).pipe(
     Effect.flatMap((volume) => {
-      if (volume === undefined) return Effect.succeed(undefined);
+      if (volume === undefined) return Effect.undefined;
       if (transientState(volume.state)) {
         return Effect.fail(
           new VolumePending({
@@ -130,7 +130,7 @@ export const createVolume = Effect.fn(function* (input: {
       source_volume_id: input.disk.sourceVolumeId,
       require_unique_zone: input.disk.requireUniqueZone,
     })
-    .pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("Conflict", () => Effect.undefined));
   if (created?.id !== undefined && created.id.length > 0) {
     return (yield* waitUntilVolumeReady(input.appName, created.id)) ?? created;
   }
@@ -138,7 +138,7 @@ export const createVolume = Effect.fn(function* (input: {
   const hit = group.at(-1);
   if (hit === undefined || hit.id === undefined) {
     return yield* new VolumeNotCreated({
-      name: input.name,
+      resourceName: input.name,
       appName: input.appName,
     });
   }
@@ -211,7 +211,7 @@ export const ensureVolumeGroup = Effect.fn(function* (input: {
   }
   if (group.length < input.count) {
     return yield* new VolumeNotCreated({
-      name: input.name,
+      resourceName: input.name,
       appName: input.appName,
     });
   }

package/src/VolumeSnapshot.ts

@@ -214,7 +214,7 @@ const waitForNewSnapshot = (appName: string, volumeId: string, knownIds: Readonl
       times: 8,
       schedule: backoff,
     }),
-    Effect.catchTag("Fly.VolumeSnapshotPending", () => Effect.succeed(undefined)),
+    Effect.catchTag("Fly.VolumeSnapshotPending", () => Effect.undefined),
   );
 
 export const VolumeSnapshotProvider = () =>

package/src/Website/AssetDeployment.ts

@@ -95,7 +95,7 @@ const scopeOf = (bucket: Bucket) =>
       endpoint === undefined
     ) {
       return yield* new TigrisCredentialsMissing({
-        name: bucketName ?? bucket.LogicalId,
+        resourceName: bucketName ?? bucket.LogicalId,
       });
     }
     return { bucketName, accessKeyId, secretAccessKey, endpoint, region };
@@ -131,14 +131,14 @@ const walkFiles = Effect.fn(function* (root: string) {
   const path = yield* Path.Path;
   if (!(yield* fs.exists(root))) return [] as string[];
   const names = yield* fs.readDirectory(root, { recursive: true });
-  const files = yield* Effect.all(
-    names.map((name) =>
+  const files = yield* Effect.forEach(
+    names,
+    (name) =>
       Effect.gen(function* () {
         const full = path.join(root, name);
         const stat = yield* fs.stat(full);
         return stat.type === "File" ? name.replaceAll("\\", "/") : undefined;
       }),
-    ),
     { concurrency: "unbounded" },
   );
   return files
@@ -213,8 +213,9 @@ export const AssetDeploymentProvider = () =>
           : path.resolve(initialCwd, news.sourcePath);
         const files = yield* walkFiles(root);
         const observed = yield* listObserved(scope, prefix);
-        const prepared = yield* Effect.all(
-          files.map((relative) =>
+        const prepared = yield* Effect.forEach(
+          files,
+          (relative) =>
             Effect.gen(function* () {
               const body = yield* fs.readFile(path.join(root, relative));
               const key = prefix.length > 0 ? `${prefix}/${relative}` : relative;
@@ -222,7 +223,6 @@ export const AssetDeploymentProvider = () =>
               const cacheControl = cacheControlOf(relative);
               return { relative, key, body, contentType, cacheControl };
             }),
-          ),
           { concurrency: "unbounded" },
         );
         const version = yield* Effect.sync(() => {
@@ -258,10 +258,9 @@ export const AssetDeploymentProvider = () =>
         );
 
         if (news.purge ?? true) {
-          yield* Effect.all(
-            [...observed.keys()]
-              .filter((key) => !desired.has(key))
-              .map((key) => deleteObject(scope, key)),
+          yield* Effect.forEach(
+            [...observed.keys()].filter((key) => !desired.has(key)),
+            (key) => deleteObject(scope, key),
             { concurrency: s3Concurrency },
           );
         }
@@ -283,10 +282,9 @@ export const AssetDeploymentProvider = () =>
           if (!(olds.purge ?? true)) return;
           const scope = yield* scopeOf(olds.bucket);
           const observed = yield* listObserved(scope, output.prefix);
-          yield* Effect.all(
-            [...observed.keys()].map((key) => deleteObject(scope, key)),
-            { concurrency: s3Concurrency },
-          );
+          yield* Effect.forEach([...observed.keys()], (key) => deleteObject(scope, key), {
+            concurrency: s3Concurrency,
+          });
         },
         Effect.catchTag("NoSuchBucket", () => Effect.void),
       ),

package/src/Website/Astro.ts

@@ -1,3 +1,5 @@
+import { resolveAstroOutput } from "alchemy/Website/AstroOutput";
+import * as Effect from "effect/Effect";
 import { frameworkSite, staticConfigFromAssets, type FrameworkSiteProps } from "./FrameworkSite.ts";
 
 /** The framework-integration package that drives the Astro build. */
@@ -21,8 +23,9 @@ export interface AstroProps extends FrameworkSiteProps {
      * Astro output target. `"server"` renders pages on demand; individual
      * pages opt into prerendering with `export const prerender = true`.
      * `"static"` prerenders every page at build time and deploys
-     * assets-only (no SSR server).
-     * @default "server"
+     * assets-only (no SSR server). Overrides the `output` in your
+     * `astro.config.*`; leave it unset to use the file's value.
+     * @default the config file's `output`, else `"server"`
      */
     output?: "server" | "static";
     /** Source directory, relative to `rootDir`. @default "./src" */
@@ -41,9 +44,9 @@ export interface AstroProps extends FrameworkSiteProps {
  * running the Node adapter's serve entry (static files first, then the
  * framework handler) on port 3000.
  *
- * Pages render on demand by default (`output: "server"`). With
- * `astro: { output: "static" }` every page is prerendered and the deploy
- * is assets-only.
+ * Pages render on demand by default (`output: "server"`). When your
+ * `astro.config.*` or `astro: { output: "static" }` declares a static
+ * site, every page is prerendered and the deploy is assets-only.
  *
  *
  * ### Creating Astro Sites
@@ -75,13 +78,15 @@ export interface AstroProps extends FrameworkSiteProps {
  * @resource
  * @product Website
  */
-export const Astro = (id: string, props: AstroProps = {}) => {
-  const output = props.astro?.output ?? "server";
-  return frameworkSite(id, props, {
-    name: "Astro",
-    framework: ASTRO_FRAMEWORK_SPECIFIER,
-    target: ASTRO_NODE_TARGET_SPECIFIER,
-    options: { astro: { ...props.astro, output } },
-    static: output === "static" ? staticConfigFromAssets(props.assets) : undefined,
-  });
-};
+export const Astro = (id: string, props: AstroProps = {}) =>
+  resolveAstroOutput({ rootDir: props.rootDir, output: props.astro?.output }).pipe(
+    Effect.flatMap((output) =>
+      frameworkSite(id, props, {
+        name: "Astro",
+        framework: ASTRO_FRAMEWORK_SPECIFIER,
+        target: ASTRO_NODE_TARGET_SPECIFIER,
+        options: { astro: { ...props.astro, output } },
+        static: output === "static" ? staticConfigFromAssets(props.assets) : undefined,
+      }),
+    ),
+  );

package/src/Website/FrameworkSite.ts

@@ -1,5 +1,7 @@
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import type { MemoOptions } from "alchemy/Command/Memo";
+import * as DNS from "alchemy/DNS/Adapter";
+import type { Input } from "alchemy/Input";
 import * as Namespace from "alchemy/Namespace";
 import * as Output from "alchemy/Output";
 import { ProviderModePolicy } from "alchemy/ProviderMode";
@@ -18,7 +20,7 @@ import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
 import { App } from "../App.ts";
 import { Bucket } from "../Bucket.ts";
-import { Certificate } from "../Certificate.ts";
+import { Certificate, type CertificateDnsRequirements } from "../Certificate.ts";
 import { IpAssignment } from "../IpAssignment.ts";
 import type { Providers } from "../Providers.ts";
 import { Service, type ServiceProps } from "../Service.ts";
@@ -33,6 +35,80 @@ export type Ref<T> = T | Effect.Effect<T, never, Providers>;
 export type { ServerDevProps, WebsiteAssetsProps, WebsiteNotFoundHandling };
 export { staticConfigFromAssets };
 
+/**
+ * Custom hostname of a Fly website: the hostname itself, or
+ * `{ name, dns }` to also publish its DNS records.
+ */
+export type WebsiteDomain =
+  | string
+  | {
+      /** Hostname, e.g. `www.example.com`. */
+      name: string;
+      /**
+       * DNS host that publishes the hostname's records (see
+       * [DNS Adapters](/infrastructure-as-code/dns-adapters)), e.g.
+       * `Cloudflare.DNS.Adapter()`: the ACME challenge `CNAME` Fly lists in
+       * the Certificate's `dnsRequirements`, and `A` / `AAAA` records at
+       * the site's addresses. Omitted: publish the records yourself.
+       */
+      dns?: DNS.DnsConfig;
+    };
+
+/** The hostname of a {@link WebsiteDomain}. */
+export const websiteDomainName = (domain: WebsiteDomain | undefined): string | undefined =>
+  domain === undefined || typeof domain === "string" ? domain : domain.name;
+
+const acmeChallengeRecords = (
+  hostname: string,
+  requirements: CertificateDnsRequirements | undefined,
+): DNS.DnsRecord[] => {
+  const challenge = requirements?.acmeChallenge;
+  if (challenge?.target === undefined || challenge.target.length === 0) {
+    return [];
+  }
+  const expected = `_acme-challenge.${hostname}`;
+  const name =
+    challenge.name !== undefined &&
+    DNS.normalizeDnsName(challenge.name).endsWith(DNS.normalizeDnsName(hostname))
+      ? challenge.name
+      : expected;
+  return [{ name, type: "CNAME", value: challenge.target }];
+};
+
+/**
+ * Publish a Fly website's records through `domain.dns`: the Certificate's
+ * ACME challenge `CNAME` (`CertificateValidation`) and `A` / `AAAA`
+ * records at the site's shared IPv4 plus any IPv6 Fly lists for the
+ * hostname (`Domain`). No-op for a plain hostname or an object without
+ * `dns`.
+ */
+export const publishWebsiteDomainDns = Effect.fn("Fly.Website.publishDomainDns")(function* (args: {
+  readonly domain: WebsiteDomain;
+  readonly certificate: Certificate;
+  readonly ip: IpAssignment;
+}) {
+  if (typeof args.domain === "string" || args.domain.dns === undefined) {
+    return;
+  }
+  const dns = yield* DNS.resolve(args.domain.dns);
+  const name = args.domain.name;
+  yield* dns.records("CertificateValidation", {
+    records: Output.map(args.certificate.dnsRequirements, (requirements) =>
+      acmeChallengeRecords(name, requirements),
+    ) as unknown as Input<DNS.DnsRecord[]>,
+  });
+  yield* dns.alias("Domain", {
+    name,
+    target: {
+      ipv4: Output.map(args.ip.ip, (ip) => [ip]) as unknown as Input<string[]>,
+      ipv6: Output.map(
+        args.certificate.dnsRequirements,
+        (requirements) => requirements?.aaaa ?? [],
+      ) as unknown as Input<string[]>,
+    },
+  });
+});
+
 /**
  * Props shared by every Fly framework website composite.
  */
@@ -78,9 +154,15 @@ export interface FrameworkSiteProps {
   dev?: ServerDevProps;
   /**
    * Optional custom hostname. Requests ACME (`Fly.Certificate`) on the
-   * App. `url` becomes `https://<domain>` (existing DNS only for v1).
+   * App and `url` becomes `https://<domain>`.
+   *
+   * A string (or `{ name }`) leaves DNS to you. Set `dns` (e.g.
+   * `{ name: "www.example.com", dns: Cloudflare.DNS.Adapter() }`) to
+   * publish the ACME challenge `CNAME` and the `A` / `AAAA` records
+   * through that DNS host. See
+   * [DNS Adapters](/infrastructure-as-code/dns-adapters).
    */
-  domain?: string;
+  domain?: WebsiteDomain;
   /**
    * User-defined tags. Accepted for API parity; Fly Services do not
    * surface resource tags.
@@ -327,16 +409,20 @@ const runFrameworkSite = Effect.fn("Fly.Website.FrameworkSite")(function* (
         : undefined,
   });
 
+  const domainName = websiteDomainName(props.domain);
   const certificate =
-    props.domain !== undefined
+    domainName !== undefined
       ? yield* Certificate("Certificate", {
           app,
-          hostname: props.domain,
+          hostname: domainName,
           kind: "acme",
         })
       : undefined;
+  if (props.domain !== undefined && certificate !== undefined) {
+    yield* publishWebsiteDomainDns({ domain: props.domain, certificate, ip });
+  }
 
-  const url = props.domain !== undefined ? `https://${props.domain}` : app.url;
+  const url = domainName !== undefined ? `https://${domainName}` : app.url;
 
   return { url, app, service, ip, certificate };
 });

package/src/Website/StaticSite.ts

@@ -15,9 +15,12 @@ import { IpAssignment } from "../IpAssignment.ts";
 import { Service, type ServiceProps } from "../Service.ts";
 import {
   type FrameworkSite,
+  publishWebsiteDomainDns,
   type Ref,
   type WebsiteAssetsProps,
+  type WebsiteDomain,
   staticConfigFromAssets,
+  websiteDomainName,
 } from "./FrameworkSite.ts";
 
 const DEFAULT_PORT = 3000;
@@ -69,9 +72,16 @@ export interface StaticSiteProps {
    */
   app?: Ref<App>;
   /**
-   * Optional custom hostname. Requests ACME (`Fly.Certificate`) on the App.
+   * Optional custom hostname. Requests ACME (`Fly.Certificate`) on the App
+   * and `url` becomes `https://<domain>`.
+   *
+   * A string (or `{ name }`) leaves DNS to you. Set `dns` (e.g.
+   * `{ name: "www.example.com", dns: Cloudflare.DNS.Adapter() }`) to
+   * publish the ACME challenge `CNAME` and the `A` / `AAAA` records
+   * through that DNS host. See
+   * [DNS Adapters](/infrastructure-as-code/dns-adapters).
    */
-  domain?: string;
+  domain?: WebsiteDomain;
   /**
    * User-defined tags. Accepted for API parity; Fly Services do not
    * surface resource tags.
@@ -262,14 +272,24 @@ export const StaticSite = (id: string, props: StaticSiteProps) =>
       ],
     });
 
+    const domainName = websiteDomainName(props.domain);
     const certificate =
-      props.domain !== undefined
-        ? yield* Certificate("Certificate", { app, hostname: props.domain, kind: "acme" }).pipe(
-            Namespace.push(id),
-          )
+      domainName !== undefined
+        ? yield* Certificate("Certificate", {
+            app,
+            hostname: domainName,
+            kind: "acme",
+          }).pipe(Namespace.push(id))
         : undefined;
+    if (props.domain !== undefined && certificate !== undefined) {
+      yield* publishWebsiteDomainDns({
+        domain: props.domain,
+        certificate,
+        ip,
+      }).pipe(Namespace.push(id));
+    }
 
-    const url = props.domain !== undefined ? `https://${props.domain}` : app.url;
+    const url = domainName !== undefined ? `https://${domainName}` : app.url;
 
     return { url, app, service, ip, certificate };
   }).pipe(Effect.orDie);

package/src/Website/Vite.ts

@@ -77,6 +77,15 @@ export interface ViteProps extends FrameworkSiteProps {
  * });
  * ```
  *
+ * **Example:** Publish DNS in Cloudflare
+ * ```typescript
+ * // The ACME challenge CNAME and A/AAAA records are published in the
+ * // Cloudflare zone. Requires Cloudflare.providers() in the stack.
+ * const site = yield* Fly.Website.Vite("Web", {
+ *   domain: { name: "app.example.com", dns: Cloudflare.DNS.Adapter() },
+ * });
+ * ```
+ *
  * ### Build Configuration
  * **Example:** Custom Output Directory and Base Path
  * ```typescript