@alchemy.run/fly 2.0.0-beta.84 → 2.0.0-beta.86

package/src/Bucket.ts

@@ -1,3 +1,7 @@
+import { fromCredentials, type Credentials } from "@distilled.cloud/aws/Credentials";
+import * as AwsEndpoint from "@distilled.cloud/aws/Endpoint";
+import type { RegionName } from "@distilled.cloud/aws/Region";
+import * as S3 from "@distilled.cloud/aws/s3";
 import type { AddOnsResponseEdgesItemNode } from "@distilled.cloud/fly-io/addons";
 import * as addons from "@distilled.cloud/fly-io/addons";
 import * as machines from "@distilled.cloud/fly-io/machines";
@@ -9,6 +13,9 @@ import { createInternalTags } from "alchemy/Tags";
 import * as Data from "effect/Data";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as Result from "effect/Result";
 import * as Schedule from "effect/Schedule";
@@ -133,9 +140,19 @@ export type Bucket = Resource<
     bucketName: Redacted.Redacted<string> | undefined;
   },
   never,
-  Providers
+  Providers,
+  BucketLookup
 >;
 
+/**
+ * Props for {@link Bucket.lookup}: find a Tigris bucket this stack
+ * doesn't manage by its name.
+ */
+export interface BucketLookup {
+  /** Tigris bucket / add-on name. */
+  name: string;
+}
+
 /**
  * A Fly.Bucket is Tigris S3-compatible object storage, billed through
  * Fly. It is an org-scoped GraphQL add-on (`AddOnType` `tigris`).
@@ -245,13 +262,25 @@ export type Bucket = Resource<
  * });
  * ```
  *
+ * ### Looking up an existing bucket
+ * `Bucket.lookup` references a bucket Alchemy doesn't manage (created with
+ * `fly storage create` or by another stack). It is read during plan/deploy,
+ * never created, updated or deleted. Tigris returns a bucket's access keys
+ * only when it is created, so a looked-up bucket's credential attributes
+ * are `undefined` unless Fly still reports them.
+ *
+ * **Example:** Reference an existing bucket
+ * ```typescript
+ * const assets = Fly.Bucket.lookup({ name: "my-assets" });
+ * ```
+ *
  * @resource
  * @product Bucket
  */
 export const Bucket = Resource<Bucket>("Fly.Bucket");
 
 export class BucketNotCreated extends Data.TaggedError("Fly.BucketNotCreated")<{
-  name: string;
+  resourceName: string;
 }> {}
 
 export class BucketOrgMissing extends Data.TaggedError("Fly.BucketOrgMissing")<{
@@ -259,18 +288,37 @@ export class BucketOrgMissing extends Data.TaggedError("Fly.BucketOrgMissing")<{
 }> {}
 
 export class BucketProvisionFailed extends Data.TaggedError("Fly.BucketProvisionFailed")<{
-  name: string;
+  resourceName: string;
   status: string | undefined;
   errorMessage: string | undefined;
 }> {}
 
 class BucketPending extends Data.TaggedError("Fly.BucketPending")<{
-  name: string;
+  resourceName: string;
   status: string;
-}> {}
+}> {
+  override get message() {
+    return `Tigris bucket ${this.resourceName} is still ${this.status}`;
+  }
+}
+
+/**
+ * Fly lists an add-on whose Tigris bucket is gone, and Fly's delete
+ * fails on the missing bucket.
+ */
+export class BucketRecordStale extends Data.TaggedError("Fly.BucketRecordStale")<{
+  resourceName: string;
+  reason: string;
+}> {
+  override get message() {
+    return `Fly keeps a stale add-on record for Tigris bucket ${this.resourceName}: ${this.reason}`;
+  }
+}
 
 const TIGRIS = "tigris" as const;
 
+const TIGRIS_ENDPOINT = "https://fly.storage.tigris.dev";
+
 const backoff = Schedule.min([
   Schedule.exponential(Duration.millis(500), 1.5),
   Schedule.spaced(Duration.seconds(5)),
@@ -465,20 +513,22 @@ const waitUntilReady = (name: string, addOnId: string) =>
         addOn,
       ): Effect.Effect<AddOnsResponseEdgesItemNode, BucketPending | BucketProvisionFailed> => {
         if (addOn === undefined) {
-          return Effect.fail(new BucketPending({ name, status: "missing" }));
+          return Effect.fail(new BucketPending({ resourceName: name, status: "missing" }));
         }
         const status = addOn.status ?? undefined;
         if (failedStatus(status)) {
           return Effect.fail(
             new BucketProvisionFailed({
-              name,
+              resourceName: name,
               status,
               errorMessage: addOn.errorMessage ?? undefined,
             }),
           );
         }
         if (pendingStatus(status)) {
-          return Effect.fail(new BucketPending({ name, status: status ?? "creating" }));
+          return Effect.fail(
+            new BucketPending({ resourceName: name, status: status ?? "creating" }),
+          );
         }
         return Effect.succeed(addOn);
       },
@@ -491,37 +541,218 @@ const waitUntilReady = (name: string, addOnId: string) =>
     Effect.catchTag("Fly.BucketPending", () => findById(addOnId)),
   );
 
-const waitUntilGone = (addOnId: string, name: string) =>
-  Effect.gen(function* () {
-    // Best-effort: Tigris often answers "The specified bucket does not
-    // exist" (untyped UnknownFlyIoError) for a delete that already
-    // succeeded. Never fail the wait on that — only on the add-on still
-    // showing up in list.
-    yield* Effect.result(
-      addons.deleteAddOn({
-        input: addOnId.length > 0 ? { addOnId } : { name, provider: TIGRIS },
+interface TigrisKeys {
+  accessKeyId: Redacted.Redacted<string>;
+  secretAccessKey: Redacted.Redacted<string>;
+  endpoint: string;
+}
+
+/** The bucket's own S3 keys. Fly returns them only from createAddOn. */
+const tigrisKeysOf = (
+  attrs: Pick<Bucket["Attributes"], "accessKeyId" | "secretAccessKey" | "endpoint">,
+): TigrisKeys | undefined =>
+  attrs.accessKeyId !== undefined && attrs.secretAccessKey !== undefined
+    ? {
+        accessKeyId: attrs.accessKeyId,
+        secretAccessKey: attrs.secretAccessKey,
+        endpoint: asString(attrs.endpoint) ?? TIGRIS_ENDPOINT,
+      }
+    : undefined;
+
+const withTigrisKeys = <A, E>(
+  keys: TigrisKeys,
+  operation: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+) =>
+  operation.pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        fromCredentials(
+          { accessKeyId: keys.accessKeyId, secretAccessKey: keys.secretAccessKey },
+          "auto" as RegionName,
+        ),
+        AwsEndpoint.of(keys.endpoint),
+        FetchHttpClient.layer,
+      ),
+    ),
+  );
+
+/**
+ * Signed HeadBucket. Tigris answers 404 for a name it has no bucket
+ * under and 403 for a bucket the keys don't own. After a delete it can
+ * keep answering 200 to the deleted bucket's own keys for minutes.
+ */
+const tigrisHasBucket = (keys: TigrisKeys, bucketName: string) =>
+  withTigrisKeys(keys, S3.headBucket({ Bucket: bucketName })).pipe(
+    Effect.as(true),
+    Effect.catchTag(["NotFound", "NoSuchBucket"], () => Effect.succeed(false)),
+  );
+
+const requestDelete = (addOnId: string, name: string) =>
+  addons
+    .deleteAddOn({
+      input: addOnId.length > 0 ? { addOnId } : { name, provider: TIGRIS },
+    })
+    .pipe(
+      Effect.as("deleted" as const),
+      Effect.catchTag("TigrisBucketNotFound", () => Effect.succeed("missing" as const)),
+    );
+
+interface DeleteTarget {
+  addOnId: string;
+  /** Fly add-on name. */
+  name: string;
+  /** Tigris bucket name (the add-on name unless Fly said otherwise). */
+  bucketName: string;
+  keys: TigrisKeys | undefined;
+}
+
+const deleteTargetOf = (attrs: Bucket["Attributes"]): DeleteTarget => ({
+  addOnId: attrs.addOnId,
+  name: attrs.name,
+  bucketName: asString(attrs.bucketName) ?? attrs.name,
+  keys: tigrisKeysOf(attrs),
+});
+
+/**
+ * Delete through Fly (which also empties the bucket), then confirm.
+ * With the bucket's keys, Tigris decides (its missing-bucket answer to
+ * the delete, else HeadBucket): Fly's list lags it and can keep a stale
+ * record. Without keys, the add-on must leave Fly's list.
+ * Fails with BucketPending once the confirm runs out; `missing` reports
+ * whether Fly's last delete said Tigris has no such bucket while the
+ * record stayed listed (only without keys).
+ */
+const deleteVerified = (target: DeleteTarget) =>
+  Effect.suspend(() => {
+    const state = { missing: false };
+    return Effect.gen(function* () {
+      // Other delete failures (a bucket still attached to an App, a Fly
+      // 5xx) are transient; the confirm below decides.
+      const requested = yield* Effect.result(requestDelete(target.addOnId, target.name));
+      state.missing = Result.isSuccess(requested) && requested.success === "missing";
+      if (target.keys !== undefined) {
+        // Fly forwards Tigris's own "bucket does not exist" for the delete:
+        // the bucket is gone. HeadBucket can keep answering 200 to the
+        // deleted bucket's keys for minutes after that.
+        if (state.missing) return;
+        if (!(yield* tigrisHasBucket(target.keys, target.bucketName))) return;
+        return yield* new BucketPending({ resourceName: target.name, status: "deleting" });
+      }
+      const still =
+        (target.addOnId.length > 0 ? yield* findById(target.addOnId) : undefined) ??
+        (target.name.length > 0 ? yield* findByName(target.name) : undefined);
+      if (still !== undefined) {
+        return yield* new BucketPending({
+          resourceName: target.name,
+          status: still.status ?? "deleting",
+        });
+      }
+    }).pipe(
+      Effect.retry({
+        while: (e) => e._tag === "Fly.BucketPending",
+        schedule: Schedule.spaced("2 seconds"),
+        times: 20,
       }),
+      Effect.as({ missing: false }),
+      Effect.catchTag("Fly.BucketPending", (pending) =>
+        state.missing && target.keys === undefined
+          ? Effect.succeed({ missing: true })
+          : Effect.fail(pending),
+      ),
     );
-    const still =
-      (yield* findById(addOnId)) ?? (name.length > 0 ? yield* findByName(name) : undefined);
-    if (still !== undefined) {
-      return yield* new BucketPending({
-        name,
-        status: still.status ?? "deleting",
-      });
-    }
-  }).pipe(
-    Effect.retry({
-      while: (e) => e._tag === "Fly.BucketPending",
-      schedule: Schedule.spaced("2 seconds"),
-      times: 20,
+  });
+
+const randomBase32 = (length: number) =>
+  Effect.sync(() => {
+    const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
+    return Array.from(crypto.getRandomValues(new Uint8Array(length)), (b) => alphabet[b % 32]).join(
+      "",
+    );
+  });
+
+/**
+ * A throwaway bucket, only for its keys. Its name matches the physical
+ * name shape, so a leaked one is listed and nuked like any other.
+ */
+const helperBucket = Effect.fn(function* (orgSlug: string) {
+  const org = yield* resolveOrganization(orgSlug);
+  if (org === undefined) {
+    return yield* new BucketOrgMissing({ orgSlug });
+  }
+  yield* ensureTos(orgSlug, org.id);
+  const name = `alchemy-fix-${yield* randomBase32(16)}`;
+  const created = yield* addons.createAddOn({
+    input: {
+      type: TIGRIS,
+      name,
+      organizationId: org.id,
+      options: desiredOptions({}),
+    },
+  });
+  return toAttrs(created.addOn, undefined, { name, orgSlug });
+});
+
+/**
+ * Fly keeps an add-on record whose Tigris bucket is gone, and its
+ * delete fails on the missing bucket. Recreate the name in Tigris with a
+ * throwaway bucket's keys so Fly's delete has a bucket to remove.
+ * CreateBucket fails on a name Tigris still holds, so this never touches
+ * a live bucket. A name deleted in the last several minutes stays
+ * blocked (`BucketInaccessible`); the delete fails and a later one
+ * repairs it.
+ */
+const repairStaleRecord = Effect.fn(function* (target: DeleteTarget, orgSlug: string) {
+  yield* Effect.logWarning(
+    `Fly still lists Tigris bucket ${target.name} after Tigris reported it gone; repairing the stale record`,
+  );
+  yield* Effect.scoped(
+    Effect.gen(function* () {
+      const helper = yield* Effect.acquireRelease(helperBucket(orgSlug), (attrs) =>
+        deleteVerified(deleteTargetOf(attrs)).pipe(Effect.ignore),
+      );
+      const keys = tigrisKeysOf(helper);
+      if (keys === undefined) {
+        return yield* new BucketRecordStale({
+          resourceName: target.name,
+          reason: "Fly returned no keys for the temporary repair bucket",
+        });
+      }
+      const recreated = yield* Effect.result(
+        withTigrisKeys(keys, S3.createBucket({ Bucket: target.bucketName })),
+      );
+      if (Result.isFailure(recreated)) {
+        return yield* new BucketRecordStale({
+          resourceName: target.name,
+          reason: `Tigris would not recreate the name (${recreated.failure._tag}); a recently deleted name stays blocked for several minutes, so retry the delete later`,
+        });
+      }
+      const result = yield* deleteVerified({ ...target, keys: undefined });
+      if (result.missing) {
+        return yield* new BucketRecordStale({
+          resourceName: target.name,
+          reason: "Fly's delete still reported a missing bucket after the name was recreated",
+        });
+      }
     }),
   );
+});
+
+/**
+ * Delete and confirm. A stale Fly record is repaired only when there are
+ * no keys to ask Tigris with (nuke, adopted buckets): with keys, Tigris's
+ * 404 already proves the bucket is gone.
+ */
+const waitUntilGone = Effect.fn(function* (attrs: Bucket["Attributes"]) {
+  const target = deleteTargetOf(attrs);
+  const result = yield* deleteVerified(target);
+  if (!result.missing) return;
+  yield* repairStaleRecord(target, attrs.orgSlug ?? (yield* resolveOrgSlug()));
+});
 
 const resolveOrganization = (orgSlug: string) =>
   addons
     .organization({ slug: orgSlug })
-    .pipe(Effect.catchTag("FlyIoParseError", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("FlyIoParseError", () => Effect.undefined));
 
 const ensureTos = (orgSlug: string, organizationId: string) =>
   Effect.gen(function* () {
@@ -580,6 +811,15 @@ export const BucketProvider = () =>
       return undefined;
     }),
 
+    lookup: Effect.fn(function* ({ name }) {
+      const found = yield* findByName(name);
+      if (found === undefined) return undefined;
+      const detail = yield* addons
+        .addOn({ id: found.id, name: found.name ?? name, provider: TIGRIS })
+        .pipe(Effect.catchTag("FlyIoParseError", () => Effect.undefined));
+      return toAttrs(detail ?? found, undefined, { name });
+    }),
+
     read: Effect.fn(function* ({ id, olds, output }) {
       const name = yield* resolveBucketName(id, olds?.name, output?.name);
       const found =
@@ -650,13 +890,13 @@ export const BucketProvider = () =>
       }
 
       if (current === undefined || current.id.length === 0) {
-        return yield* new BucketNotCreated({ name });
+        return yield* new BucketNotCreated({ resourceName: name });
       }
 
       const status = current.status ?? undefined;
       if (failedStatus(status)) {
         return yield* new BucketProvisionFailed({
-          name,
+          resourceName: name,
           status,
           errorMessage: current.errorMessage ?? undefined,
         });
@@ -714,15 +954,8 @@ export const BucketProvider = () =>
     }),
 
     delete: Effect.fn(function* ({ output }) {
-      const addOnId = output.addOnId;
-      const name = output.name;
-      if (addOnId.length === 0 && name.length === 0) return;
-      // Always wait for the add-on to leave the list. A failed
-      // deleteAddOn plus a single list miss is not gone — Tigris
-      // list lags, and a bucket still attached to an App is a
-      // transient error. waitUntilGone retries delete and only
-      // succeeds once list (id and name) is empty.
-      yield* waitUntilGone(addOnId, name);
+      if (output.addOnId.length === 0 && output.name.length === 0) return;
+      yield* waitUntilGone(output);
     }),
   });
 
@@ -749,7 +982,7 @@ const requireBucketSecrets = Effect.fn(function* (appName: string, values: Recor
   ];
   if (required.some((key) => !values[key]?.trim())) {
     return yield* new TigrisCredentialsMissing({
-      name: values.BUCKET_NAME || appName,
+      resourceName: values.BUCKET_NAME || appName,
     });
   }
 });
@@ -820,7 +1053,7 @@ const findAttachedBucket = (input: { id?: string; name: string }) =>
           : undefined;
     if (listed === undefined) {
       return yield* new BucketPending({
-        name: input.name || input.id || "",
+        resourceName: input.name || input.id || "",
         status: "missing",
       });
     }
@@ -830,7 +1063,7 @@ const findAttachedBucket = (input: { id?: string; name: string }) =>
         name: listed.name ?? input.name,
         provider: TIGRIS,
       })
-      .pipe(Effect.catchTag("FlyIoParseError", () => Effect.succeed(undefined)));
+      .pipe(Effect.catchTag("FlyIoParseError", () => Effect.undefined));
     return detail ?? listed;
   });
 

package/src/BucketBinding.ts

@@ -106,7 +106,7 @@ export const makeTigrisS3Binding = <I extends { Bucket?: string }, A, E>(options
           resolvedEndpoint === undefined
         ) {
           return yield* new TigrisCredentialsMissing({
-            name: resolvedName ?? bucket.LogicalId,
+            resourceName: resolvedName ?? bucket.LogicalId,
           });
         }
         const scope = {

package/src/Certificate.ts

@@ -97,9 +97,21 @@ export type Certificate = Resource<
     source: CertificateSource;
   },
   never,
-  Providers
+  Providers,
+  CertificateLookup
 >;
 
+/**
+ * Props for {@link Certificate.lookup}: find a certificate this stack
+ * doesn't manage by its App and hostname.
+ */
+export interface CertificateLookup {
+  /** Fly App name the certificate is attached to. */
+  appName: string;
+  /** Hostname the certificate covers. */
+  hostname: string;
+}
+
 /**
  * A Fly.Certificate covers a hostname on an {@link App}. Default
  * `kind` is `"acme"` (Let's Encrypt). `"custom"` uploads a PEM.
@@ -176,6 +188,20 @@ export type Certificate = Resource<
  * });
  * ```
  *
+ * ### Looking up an existing certificate
+ * `Certificate.lookup` references a certificate Alchemy doesn't manage
+ * (added with `fly certs add` or by another stack). It is read during
+ * plan/deploy, never created, updated or deleted.
+ *
+ * **Example:** Read the DNS records Fly expects
+ * ```typescript
+ * const cert = Fly.Certificate.lookup({
+ *   appName: "my-site",
+ *   hostname: "www.example.com",
+ * });
+ * const target = cert.dnsRequirements;
+ * ```
+ *
  * @resource
  * @product Certificate
  */
@@ -314,7 +340,7 @@ const toAttrsFromSummary = (
 const getByHostname = (appName: string, hostname: string) =>
   machines
     .getAppCertificate({ app_name: appName, hostname })
-    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
 
 const listAppCertificates = (appName: string) =>
   Effect.gen(function* () {
@@ -372,7 +398,7 @@ const createAcme = (appName: string, hostname: string) =>
       app_name: appName,
       hostname,
     })
-    .pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("Conflict", () => Effect.undefined));
 
 const createCustom = (appName: string, hostname: string, fullchain: string, privateKey: string) =>
   machines
@@ -382,7 +408,7 @@ const createCustom = (appName: string, hostname: string, fullchain: string, priv
       fullchain,
       private_key: privateKey,
     })
-    .pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+    .pipe(Effect.catchTag("Conflict", () => Effect.undefined));
 
 const replaceCustom = (appName: string, hostname: string, fullchain: string, privateKey: string) =>
   Effect.gen(function* () {
@@ -423,6 +449,11 @@ export const CertificateProvider = () =>
       return undefined;
     }),
 
+    lookup: Effect.fn(function* ({ appName, hostname }) {
+      const found = yield* getByHostname(appName, hostname);
+      return found === undefined ? undefined : toAttrs(appName, found, hostname);
+    }),
+
     read: Effect.fn(function* ({ olds, output }) {
       const appName = output?.appName ?? appNameOf(olds?.app);
       const hostname = output?.hostname ?? olds?.hostname;
@@ -524,7 +555,7 @@ export const CertificateProvider = () =>
             app_name: appName,
             hostname,
           })
-          .pipe(Effect.catchTag(["NotFound", "BadRequest"], () => Effect.succeed(undefined)));
+          .pipe(Effect.catchTag(["NotFound", "BadRequest"], () => Effect.undefined));
         if (checked !== undefined) {
           current = checked;
         }

package/src/ConnectPostgres.ts

@@ -46,7 +46,7 @@ export const connectEnvKeys = (postgres: Pick<Postgres, "LogicalId">) => {
 };
 
 export class PostgresUrlMissing extends Data.TaggedError("Fly.PostgresUrlMissing")<{
-  name: string;
+  resourceName: string;
 }> {}
 
 export interface ConnectPostgresClient {

package/src/ConnectPostgresHttp.ts

@@ -26,7 +26,7 @@ const asRedactedUrl = (
   const url = typeof plain === "string" ? plain : "";
   return url.length > 0
     ? Effect.succeed(Redacted.make(url))
-    : Effect.fail(new PostgresUrlMissing({ name }));
+    : Effect.fail(new PostgresUrlMissing({ resourceName: name }));
 };
 
 /**

package/src/Credentials.ts

@@ -1,20 +1,12 @@
 import { ConfigError } from "@distilled.cloud/core/errors";
 import { Credentials, CredentialsFromEnv } from "@distilled.cloud/fly-io";
-import {
-  deferUntilFirstUse,
-  orDieCredentialsUnavailable,
-  resolveProviderConfig,
-} from "alchemy/Auth/Resolve";
+import { lazyCredentials, orDieCredentialsUnavailable } from "alchemy/Auth/Resolve";
 import * as Output from "alchemy/Output";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Redacted from "effect/Redacted";
-import {
-  FLY_AUTH_PROVIDER_NAME,
-  type FlyAuthConfig,
-  type FlyResolvedCredentials,
-} from "./AuthProvider.ts";
+import { FLY_AUTH_PROVIDER_NAME, type FlyResolvedCredentials } from "./AuthProvider.ts";
 
 export {
   Credentials,
@@ -32,11 +24,17 @@ export {
  */
 export const bindFlyApiToken = (): Effect.Effect<void, never, Credentials> =>
   Effect.gen(function* () {
+    // Bound as Redacted so a Service that owns its App stores the token
+    // as an App secret, not plain Machine env. The runtime reads it back
+    // with `CredentialsFromEnv`.
     const token = globalThis.__ALCHEMY_RUNTIME__
-      ? ""
+      ? Redacted.make("")
       : yield* Credentials.pipe(
           Effect.flatMap((resolve) => resolve),
-          Effect.map((cfg) => Redacted.value(cfg.apiKey)),
+          Effect.map((cfg) => cfg.apiKey),
+          // Binding initialization cannot fail; the engine reports this
+          // defect as `CredentialsRequired`.
+          orDieCredentialsUnavailable("Fly"),
         );
     yield* Output.named(Output.asOutput(token), "FLY_API_TOKEN").asEffect().pipe(Effect.asVoid);
   });
@@ -49,9 +47,10 @@ export const bindFlyApiToken = (): Effect.Effect<void, never, Credentials> =>
  * `Credentials`, and the binding must use them — a laptop deploy has no
  * `FLY_API_TOKEN` in its env once the token lives in the Alchemy profile.
  * Inside a deployed Machine there is no profile; `bindFlyApiToken`
- * has already `RuntimeContext.set` the org token, which Platform copies
- * into Machine env as `FLY_API_TOKEN`. So: reuse the ambient
- * `Credentials` when present, otherwise read the env.
+ * has already `RuntimeContext.set` the org token, which reaches the
+ * Machine as `FLY_API_TOKEN` (an App secret, or Machine env in a shared
+ * App). So: reuse the ambient `Credentials` when present, otherwise read
+ * it with {@link CredentialsFromEnv}.
  */
 export const CredentialsFromAmbientOrEnv: Layer.Layer<Credentials> = Layer.effect(
   Credentials,
@@ -73,30 +72,8 @@ export const CredentialsFromAmbientOrEnv: Layer.Layer<Credentials> = Layer.effec
 export const fromAuthProvider = () =>
   Layer.effect(
     Credentials,
-    Effect.gen(function* () {
-      // Defer profile lookup and credential resolution until first use, so
-      // building the provider layers never requires a configured profile.
-      const resolve = yield* resolveProviderConfig<FlyAuthConfig, FlyResolvedCredentials>(
-        FLY_AUTH_PROVIDER_NAME,
-      ).pipe(
-        Effect.flatMap(({ profileName, resolve }) =>
-          resolve.pipe(
-            Effect.map((creds) => ({
-              apiKey: creds.apiKey,
-              apiBaseUrl: creds.apiBaseUrl,
-            })),
-            Effect.mapError((e) =>
-              ConfigError.make({
-                message: `Failed to resolve Fly credentials from ${profileName === undefined ? "the CI environment" : `profile '${profileName}'`}: ${(e as { message?: string }).message ?? String(e)}`,
-              }),
-            ),
-          ),
-        ),
-        deferUntilFirstUse,
-      );
-      return yield* resolve.pipe(
-        orDieCredentialsUnavailable(FLY_AUTH_PROVIDER_NAME),
-        Effect.cached,
-      );
-    }),
+    lazyCredentials<FlyResolvedCredentials, ConfigError>()(FLY_AUTH_PROVIDER_NAME, (creds) => ({
+      apiKey: creds.apiKey,
+      apiBaseUrl: creds.apiBaseUrl,
+    })),
   );

package/src/DeploymentImages.ts

@@ -35,7 +35,7 @@ export const encodeImageSet = (pins: readonly ContainerImagePin[]): string | und
 
 export const decodeImageSet = (raw: string | undefined): ContainerImagePin[] | undefined => {
   if (raw === undefined) return undefined;
-  const decoded = Schema.decodeUnknownOption(Schema.fromJsonString(ImageSet))(raw);
+  const decoded = Schema.decodeOption(Schema.fromJsonString(ImageSet))(raw);
   if (!Option.isSome(decoded)) return undefined;
   const pins = decoded.value;
   return valid(pins) ? canonical(pins) : undefined;

package/src/Errors.ts

@@ -10,5 +10,5 @@ import * as Data from "effect/Data";
  * operation fails with this instead of signing an anonymous request.
  */
 export class TigrisCredentialsMissing extends Data.TaggedError("Fly.TigrisCredentialsMissing")<{
-  name: string;
+  resourceName: string;
 }> {}