@alchemy.run/fly 2.0.0-beta.84 → 2.0.0-beta.86

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alchemy.run/fly",
-  "version": "2.0.0-beta.84",
+  "version": "2.0.0-beta.86",
   "description": "Fly.io apps, machines and Postgres for Alchemy.",
   "keywords": [
     "alchemy",
@@ -57,27 +57,27 @@
     "access": "public"
   },
   "dependencies": {
-    "@alchemy.run/docker": "2.0.0-beta.84",
-    "@alchemy.run/redis": "2.0.0-beta.84",
-    "@alchemy.run/sql": "2.0.0-beta.84",
-    "@distilled.cloud/aws": "1.0.0-rc.17",
-    "@distilled.cloud/core": "1.0.0-rc.17",
-    "@distilled.cloud/fly-io": "1.0.0-rc.17",
-    "rolldown": "1.2.13"
+    "@alchemy.run/docker": "2.0.0-beta.86",
+    "@alchemy.run/redis": "2.0.0-beta.86",
+    "@alchemy.run/sql": "2.0.0-beta.86",
+    "@distilled.cloud/aws": "1.0.0-rc.19",
+    "@distilled.cloud/core": "1.0.0-rc.19",
+    "@distilled.cloud/fly-io": "1.0.0-rc.19",
+    "rolldown": "1.2.16"
   },
   "devDependencies": {
-    "@effect/platform-node": "^4.0.5",
+    "@effect/platform-node": "^4.1.4",
     "@types/bun": "1.4.3",
     "@types/pg": "^8.20.0",
-    "alchemy": "2.0.0-beta.84",
-    "effect": "^4.0.5",
+    "alchemy": "2.0.0-beta.86",
+    "effect": "^4.1.4",
     "pg": "^8.22.0",
-    "typescript": "^7.0.2"
+    "typescript": "^7.1.0-dev.20261105.1"
   },
   "peerDependencies": {
-    "@effect/platform-node": "^4.0.5",
-    "alchemy": "2.0.0-beta.84",
-    "effect": "^4.0.5",
+    "@effect/platform-node": "^4.1.4",
+    "alchemy": "2.0.0-beta.86",
+    "effect": "^4.1.4",
     "pg": "^8.22.0"
   },
   "peerDependenciesMeta": {

package/src/App.ts

@@ -82,9 +82,19 @@ export type App = Resource<
     url: string;
   },
   AppBinding,
-  Providers
+  Providers,
+  AppLookup
 >;
 
+/**
+ * Props for {@link App.lookup}: find an App this stack doesn't manage by
+ * its name.
+ */
+export interface AppLookup {
+  /** Fly App name. */
+  name: string;
+}
+
 /**
  * Binding contract accepted by {@link App}. Each {@link Service} placed in
  * the App (`app` prop) reports the ports it publishes, so the App can
@@ -196,18 +206,32 @@ export interface AppBinding {
  * export const Site = Fly.App("Site");
  * ```
  *
+ * ### Looking up an existing App
+ * `App.lookup` references an App Alchemy doesn't manage (created with
+ * `fly launch` or by another stack). It is read during plan/deploy, never
+ * created, updated or deleted, and works anywhere a declared App does.
+ *
+ * **Example:** Reference an existing App
+ * ```typescript
+ * const site = Fly.App.lookup({ name: "my-site" });
+ * const db = yield* Fly.Secret("DatabaseUrl", {
+ *   app: site,
+ *   value: Redacted.make("postgres://…"),
+ * });
+ * ```
+ *
  * @resource
  * @product App
  */
 export const App = Resource<App>("Fly.App");
 
 export class AppNotCreated extends Data.TaggedError("Fly.AppNotCreated")<{
-  name: string;
+  resourceName: string;
   /** Fly's rejection of the create request, when there was one. */
   reason?: string;
 }> {
   get message() {
-    return `Fly App ${this.name} was not created${this.reason ? `: ${this.reason}` : ""}`;
+    return `Fly App ${this.resourceName} was not created${this.reason ? `: ${this.reason}` : ""}`;
   }
 }
 
@@ -234,9 +258,7 @@ const resolveAppName = (id: string, name: string | undefined, existing?: string)
   });
 
 const getByName = (appName: string) =>
-  machines
-    .getApp({ app_name: appName })
-    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+  machines.getApp({ app_name: appName }).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
 
 const hasAlchemyMachines = (appName: string) =>
   machines.listMachines({ app_name: appName }).pipe(
@@ -348,11 +370,11 @@ export const ensureApp = Effect.fn(function* (input: {
       current = yield* observe;
     }
     if (current === undefined) {
-      return yield* new AppNotCreated({ name: input.name, reason: rejection });
+      return yield* new AppNotCreated({ resourceName: input.name, reason: rejection });
     }
   }
   if (current === undefined) {
-    return yield* new AppNotCreated({ name: input.name });
+    return yield* new AppNotCreated({ resourceName: input.name });
   }
   return current;
 });
@@ -387,7 +409,7 @@ export const deleteApp = Effect.fn(function* (appName: string) {
   );
   const http = yield* HttpClient.HttpClient;
   const fetchOptions = yield* Effect.serviceOption(FetchHttpClient.RequestInit);
-  yield* machines.deleteApp({ app_name: appName }).pipe(
+  const accepted = yield* machines.deleteApp({ app_name: appName }).pipe(
     Retry.none,
     // Bun can replay DELETE on a reused socket below the SDK retry policy.
     Effect.provideService(
@@ -400,7 +422,10 @@ export const deleteApp = Effect.fn(function* (appName: string) {
       redirect: "error",
     }),
     Effect.timeout("30 seconds"),
-    Effect.catchTag("NotFound", () => Effect.void),
+    Effect.as(true),
+    // Fly's DELETE is authoritative for absence: its GET can keep serving a
+    // deleted App as `pending` long after DELETE answers 404.
+    Effect.catchTag("NotFound", () => Effect.succeed(false)),
     Effect.catchTag(
       [
         "HttpClientError",
@@ -413,6 +438,7 @@ export const deleteApp = Effect.fn(function* (appName: string) {
       (error) => Effect.fail(new AppDeletionAmbiguous({ appName, evidence: error._tag })),
     ),
   );
+  if (!accepted) return;
   const gone = yield* getByName(appName).pipe(
     Effect.map((app) => app === undefined),
     Effect.repeat({ schedule: Schedule.spaced("1 second"), until: (gone) => gone, times: 8 }),
@@ -481,6 +507,11 @@ export const AppProvider = () =>
       return undefined;
     }),
 
+    lookup: Effect.fn(function* ({ name }) {
+      const found = yield* getByName(name);
+      return found === undefined ? undefined : toAttrs(found, name);
+    }),
+
     read: Effect.fn(function* ({ id, olds, output }) {
       const name = yield* resolveAppName(id, olds?.name, output?.appName);
       const found =

package/src/BindService.ts

@@ -1,6 +1,6 @@
 import * as Binding from "alchemy/Binding";
 import type { Resource } from "alchemy/Resource";
-import { makeFetchRpcStub, RPC_PATH_PREFIX, type Rpc } from "alchemy/Rpc";
+import { makeFetchRpcStub, type Rpc } from "alchemy/Rpc";
 import { CurrentRuntimeContext, type RuntimeContext, sanitizeKey } from "alchemy/RuntimeContext";
 import { isYieldableEffectLike } from "alchemy/Util/effect";
 import * as Data from "effect/Data";
@@ -9,9 +9,7 @@ import * as HttpClient from "effect/http/HttpClient";
 import type * as HttpClientError from "effect/http/HttpClientError";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import type * as HttpClientResponse from "effect/http/HttpClientResponse";
-import * as Redacted from "effect/Redacted";
 import type { BoundTarget, ServiceBinding } from "./MountVolume.ts";
-import { RPC_TOKEN_HEADER } from "./rpc.ts";
 import type { Service } from "./Service.ts";
 
 /** The deployed caller has no address for the bound Service. */
@@ -75,12 +73,13 @@ const logicalIdOf = (target: unknown): string => {
 export const boundTargetEnvKeys = (id: string) => ({
   appName: sanitizeKey(`FLY_BIND_${id}_APP`),
   url: sanitizeKey(`FLY_BIND_${id}_URL`),
-  token: sanitizeKey(`FLY_BIND_${id}_TOKEN`),
 });
 
 /**
  * Record the binding on the caller and transport the target's private
- * address and caller token as Outputs. Returns runtime accessors for them.
+ * address as Outputs. For {@link bindService}, also record the caller's
+ * App on the target, which serves its methods only to the Apps recorded
+ * there. Returns runtime accessors for the address.
  */
 const bindTarget = Effect.fn(function* <Shape, Req>(
   target: Target<Shape> | Effect.Effect<Target<Shape>, never, Req>,
@@ -105,17 +104,27 @@ const bindTarget = Effect.fn(function* <Shape, Req>(
           appName: service.appName,
           network: service.network,
           privateUrl: service.privateUrl,
-          rpcToken: service.rpcToken,
           port,
           endpoints: service.endpoints,
         } as unknown as BoundTarget,
       });
+      if (port === undefined) {
+        // Fly signs each request's calling App (`Fly-Src`), so the target
+        // authorizes callers by App: no key to hand out.
+        yield* (
+          service as unknown as {
+            bind: (
+              label: TemplateStringsArray,
+              ...args: unknown[]
+            ) => (data: ServiceBinding) => Effect.Effect<void>;
+          }
+        ).bind`Caller(${host})`({ caller: { appName: host.appName as unknown as string } });
+      }
     }
   }
   // Captured at bind time: the host's runtime context reads the values
   // transported onto the Machine.
-  const read = (key: string) =>
-    ctx === undefined ? Effect.succeed(undefined) : ctx.get<unknown>(key);
+  const read = (key: string) => (ctx === undefined ? Effect.undefined : ctx.get<unknown>(key));
   const required = (key: string) =>
     read(key).pipe(
       Effect.flatMap((value) =>
@@ -127,15 +136,6 @@ const bindTarget = Effect.fn(function* <Shape, Req>(
   return {
     appName: required(keys.appName),
     url: required(keys.url),
-    token: read(keys.token).pipe(
-      Effect.map((value) =>
-        Redacted.isRedacted(value)
-          ? String(Redacted.value(value))
-          : typeof value === "string"
-            ? value
-            : "",
-      ),
-    ),
   };
 });
 
@@ -151,12 +151,13 @@ const withBase = (base: string, url: string) => {
  * `fetch` and `run`) and forwards `fetch` requests, over Fly's private
  * network.
  *
- * Binding makes the caller deploy after the Service and hands it the
- * Service's private address and caller token. Only callers that bind a
- * Service receive its token, so other Services on the same network cannot
- * call its methods. Every call must also carry Fly's signed `Fly-Src`
- * header from the same organization, so the public internet cannot call
- * them. Calls are plain HTTP inside Fly's WireGuard-encrypted network.
+ * Binding makes the caller deploy after the Service, hands it the
+ * Service's private address, and records the caller's App on the Service.
+ * Fly's proxy signs every call with the calling App (`Fly-Src`), and the
+ * Service answers methods only for the Apps recorded on it, so neither
+ * other Services on the network nor the public internet can call them,
+ * and no key is involved. Calls are plain HTTP inside Fly's
+ * WireGuard-encrypted network.
  *
  * ### Call a private Service
  * **Example:** Methods on the target
@@ -251,24 +252,15 @@ export const bindService = <Shape, Req = never>(
   Effect.gen(function* () {
     const http = yield* HttpClient.HttpClient;
     const bound = yield* bindTarget(target, undefined);
-    const send = (request: HttpClientRequest.HttpClientRequest, isRpc: boolean) =>
+    const send = (request: HttpClientRequest.HttpClientRequest) =>
       Effect.gen(function* () {
         const base = yield* bound.url;
-        let next = HttpClientRequest.setUrl(request, withBase(base, request.url));
-        if (isRpc) {
-          next = HttpClientRequest.setHeader(next, RPC_TOKEN_HEADER, yield* bound.token);
-        }
-        return yield* http.execute(next);
+        return yield* http.execute(HttpClientRequest.setUrl(request, withBase(base, request.url)));
       });
     return makeFetchRpcStub<ServiceClient<Shape>>({
       fetch: (request) =>
-        send(request, request.url.includes(RPC_PATH_PREFIX)) as Effect.Effect<
-          HttpClientResponse.HttpClientResponse,
-          unknown
-        >,
-      base: {
-        fetch: (request: HttpClientRequest.HttpClientRequest) => send(request, false),
-      },
+        send(request) as Effect.Effect<HttpClientResponse.HttpClientResponse, unknown>,
+      base: { fetch: send },
     });
   });
 

package/src/Bootstrap.ts

@@ -14,6 +14,7 @@ import {
 } from "alchemy/Runtime/Bootstrap";
 import { ManagedHttpShutdown } from "alchemy/Runtime/ManagedHttpShutdown";
 import * as ConfigProvider from "effect/ConfigProvider";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as Effect from "effect/Effect";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
@@ -31,6 +32,7 @@ export const bootstrap = (entrypoint: unknown): Promise<void> => {
   const platform = Layer.mergeAll(
     NodeServices.layer,
     FetchHttpClient.layer,
+    SecureRandom.layerWebCrypto,
     Logger.layer([Logger.consolePretty()]),
   );