@alchemy.run/fly 2.0.0-beta.84 → 2.0.0-beta.86

package/src/Service.ts

@@ -14,11 +14,11 @@ import { deepEqual, isResolved } from "alchemy/Diff";
 import type { Input } from "alchemy/Input";
 import { Platform, type Main, type MainRpc, type PlatformProps } from "alchemy/Platform";
 import * as Provider from "alchemy/Provider";
-import { makeRandom } from "alchemy/Random";
-import type { Resource } from "alchemy/Resource";
+import type { LookupMethod, Resource } from "alchemy/Resource";
 import type { ServerHost } from "alchemy/Runtime/Process";
 import { packEnvValue } from "alchemy/RuntimeContext";
 import { Stack } from "alchemy/Stack";
+import { sha256 } from "alchemy/Util/sha256";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -52,6 +52,7 @@ import {
   createFlyAppName,
   createFlyResourceName,
   diffMachineMetadata,
+  matchesAlchemyPhysicalName,
   sanitizeFlyAppName,
 } from "./Metadata.ts";
 import type { BoundTarget, MountedDisk, ServiceBinding } from "./MountVolume.ts";
@@ -64,6 +65,7 @@ import {
   deleteReplicaSet,
   hasPublishedService,
   listReplicaSets,
+  lookupReplicaSet,
   observeReplicaSet,
   reconcileReplicas,
   resolveCount,
@@ -73,7 +75,7 @@ import {
   type Replica,
   type ReplicaSet,
 } from "./replicas.ts";
-import { BINDING_PORT_ENV, DEFAULT_BINDING_PORT, RPC_ORG_ENV, RPC_TOKEN_ENV } from "./rpc.ts";
+import { BINDING_PORT_ENV, DEFAULT_BINDING_PORT, RPC_CALLERS_ENV, RPC_ORG_ENV } from "./rpc.ts";
 
 /**
  * A resource-valued prop: the resource itself, or an Effect that produces
@@ -139,18 +141,21 @@ export interface ServiceProps extends PlatformProps {
    * @default 7780
    */
   bindingPort?: number;
-  /**
-   * Caller token for bound callers. Set automatically from an
-   * `Alchemy.Random` child resource; do not pass it.
-   * @internal
-   */
-  rpcToken?: Redacted.Redacted<string>;
   /**
    * Module entrypoint bundled with rolldown and baked into a Docker
    * image pushed to `registry.fly.io`. Typically `import.meta.url`.
    * A content-hash change updates the workload using the selected deployment strategy.
+   * Set this or {@link context}.
+   */
+  main?: string;
+  /**
+   * A Docker build context whose `Dockerfile` builds the Service's image
+   * as it is, on a Fly remote builder (or locally with
+   * `build: { remote: false }`), for `linux/amd64`. The image's own
+   * `CMD` runs. A change to any file in it updates the workload. Set this
+   * or {@link main}.
    */
-  main: string;
+  context?: string;
   /**
    * Region or regions to run in (`"iad"`, `["iad", "lhr"]`). The
    * Service runs `count` Machines in each region behind one hostname;
@@ -271,6 +276,19 @@ export interface ServiceEndpoint {
   url: string | undefined;
 }
 
+/** An App secret a {@link Service} wrote. Never the plaintext. */
+export interface BoundSecret {
+  /**
+   * Name of the App secret, scoped to the Service
+   * (`ALCHEMY_<hash>_<ENV_VAR>`). The Machine maps it back to its env var.
+   */
+  name: string;
+  /** Fly's digest of the value after the write. */
+  digest: string;
+  /** sha256 of `<name>:<value>` for the value written. Never the plaintext. */
+  sha256: string;
+}
+
 export type Service = Resource<
   "Fly.Service",
   ServiceProps,
@@ -286,8 +304,19 @@ export type Service = Resource<
      * shared App's network. `undefined` for the organization's default.
      */
     network?: string;
-    /** Token bound callers send with RPC calls. */
-    rpcToken?: Redacted.Redacted<string>;
+    /**
+     * App secrets the Service wrote from bound `Config` and Redacted
+     * values, by the env var they set: the scoped secret name, Fly's
+     * digest after the write and a sha256 of the value.
+     */
+    secrets?: Record<string, BoundSecret>;
+    /** App-secrets version that holds {@link secrets}. */
+    secretsVersion?: number;
+    /**
+     * Slug of the organization the App is in. Its Machines' OIDC tokens are
+     * issued by `https://oidc.fly.io/{orgSlug}`.
+     */
+    orgSlug?: string;
     /** Fly Machine id of replica 0. */
     machineId: string;
     /** Fly Machine ids of every replica. */
@@ -338,9 +367,24 @@ export type Service = Resource<
     code: { hash: string };
   },
   ServiceBinding,
-  Providers
+  Providers,
+  ServiceLookup
 >;
 
+/**
+ * Props for {@link Service.lookup}: find a Service this stack doesn't
+ * manage by its App, and its name when the App holds several.
+ */
+export interface ServiceLookup {
+  /** Fly App name the Service's Machines run in. */
+  appName: string;
+  /**
+   * Machine name of the Service, for an App that runs several. Omit it to
+   * take every Machine in the App.
+   */
+  name?: string;
+}
+
 export const isService = (value: unknown): value is Service =>
   typeof value === "object" &&
   value !== null &&
@@ -538,9 +582,9 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * ### Call another Service
  * A Service can return methods next to `fetch`. Another Service calls
  * them by binding it with {@link bindService}, which returns a typed
- * client. Binding makes the caller deploy after the Service, and only
- * callers that bind a Service receive its caller token, so only they
- * can call its methods.
+ * client. Binding makes the caller deploy after the Service and records
+ * the caller's App on it, so only callers that bind a Service can call
+ * its methods.
  *
  * **Example:** A private Service with methods
  * ```typescript
@@ -574,9 +618,10 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * ```
  *
  * Calls use plain HTTP to `privateUrl` inside Fly's WireGuard-encrypted
- * private network. The Service accepts a method call only with its
- * caller token and a `Fly-Src` signature from Fly's proxy for the same
- * organization, so the public internet can never call it. A public
+ * private network. The Service accepts a method call only with a
+ * `Fly-Src` signature from Fly's proxy naming the App of a Service that
+ * binds it, so neither the public internet nor any other App can call
+ * it, and no caller holds a key. A public
  * Service publishes an extra plain-HTTP port for bound callers,
  * `bindingPort` (default 7780), since its own ports are an HTTPS
  * redirect and HTTPS. `client.fetch` sends a request to the Service's
@@ -727,8 +772,18 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  *
  * ### Config
  * Yield `Config` in init. Alchemy reads the value from the env of
- * whoever deploys and writes it onto the Machine, so there is no need
- * to copy it into `env`.
+ * whoever deploys and stores it as a secret on the Service's App, so
+ * there is no need to copy it into `env` and it never appears in the
+ * Machine config. Redacted outputs of bound resources are stored the
+ * same way. The secret's name is scoped to the Service
+ * (`ALCHEMY_<hash>_API_KEY`) and the Machine maps it back to `API_KEY`,
+ * so it never collides with `Fly.Secret`, `fly secrets set` or an
+ * attachment. The bound value wins over an App secret already named
+ * `API_KEY`, which stays in the App untouched. The Machine sees the
+ * App's other secrets as they were at deploy; one set later with
+ * `fly secrets set` reaches it on the next deploy. A Service in a shared
+ * App (`app`) writes the values into the Machine env instead, because
+ * Fly gives every App secret to every Machine in the App.
  *
  * `Config.Redacted("API_KEY")` is `Redacted<string>`. Unwrap with
  * `Redacted.value` only where you need the raw string.
@@ -866,6 +921,20 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * ) {}
  * ```
  *
+ * ### Run your own image
+ * `context` builds a directory's `Dockerfile` as it is, on a Fly remote
+ * builder, and runs the image's own `CMD`. A change to any file in the
+ * directory updates the Machines.
+ *
+ * **Example:** A Dockerfile build
+ * ```typescript
+ * const worker = yield* Fly.Service("Worker", {
+ *   context: "./worker",
+ *   public: false,
+ *   services: [],
+ * });
+ * ```
+ *
  * ### Custom proxy services
  * `services` defaults to HTTP 80 (redirecting to HTTPS) + HTTPS 443
  * toward `port`, or plain HTTP 80 for a private Service. Pass a custom
@@ -928,28 +997,23 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * ) {}
  * ```
  *
- * **Example:** Install `pg` unbundled
- * `pg` is CommonJS. Rolldown's interop turns `Client` into a namespace.
- * Install it into the image so `@effect/sql-pg` / `Drizzle.Postgres` load
- * it with Node's CJS semantics — same `build.install` as Lambda.
+ * **Example:** Install a native package unbundled
+ * `build.install` runs `npm install` in the image for packages that
+ * cannot be bundled, such as native addons — same `build.install` as
+ * Lambda.
  * ```typescript
  * export default class Api extends Fly.Service<Api>()(
  *   "Api",
  *   {
  *     main: import.meta.url,
  *     port: 3000,
- *     build: { install: ["pg"] },
+ *     build: { install: ["sharp"] },
  *   },
  *   Effect.gen(function* () {
- *     const conn = yield* Fly.ConnectPostgres(Db);
- *     const db = yield* Drizzle.Postgres(conn.connectionString);
  *     return {
- *       fetch: Effect.gen(function* () {
- *         const rows = yield* db.execute("select 1 as ok");
- *         return HttpServerResponse.json({ rows });
- *       }),
+ *       fetch: Effect.succeed(HttpServerResponse.text("hello")),
  *     };
- *   }).pipe(Effect.provide(Fly.ConnectPostgresHttp)),
+ *   }),
  * ) {}
  * ```
  *
@@ -1033,38 +1097,48 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * See the [deployment guide](/fly/compute/deployments) for recovery,
  * idle capacity, application responsibilities, and verification limits.
  *
+ * ### Looking up an existing Service
+ * `Service.lookup` references a Service Alchemy doesn't manage (deployed
+ * with `fly deploy` or by another stack). It is read during plan/deploy,
+ * never created, updated or deleted, and `url`, `endpoints` and
+ * `privateUrl` come from the Machines and addresses Fly reports.
+ *
+ * **Example:** Call a Service another stack deployed
+ * ```typescript
+ * const api = Fly.Service.lookup({ appName: "my-api" });
+ * const url = api.privateUrl;
+ * ```
+ *
  * @resource
  * @product Service
  */
-export const Service: Platform<Service, ServiceServices, ServiceShape, ServiceRuntimeContext> =
-  Platform("Fly.Service", {
-    createRuntimeContext: createFlyHostRuntimeContext("Fly.Service"),
-    // `{ app: Site }` at module scope is an Effect. Yield it here so the
-    // App is registered and `news.app` is resolved attributes at
-    // reconcile (same DX as `yield* App(...)` inside Effect.gen).
-    transformProps: (id, props) =>
-      Effect.gen(function* () {
-        if (globalThis.__ALCHEMY_RUNTIME__) return props;
-        const app = Effect.isEffect(props.app)
-          ? yield* props.app as Effect.Effect<App, never, Providers>
-          : props.app;
-        // Only callers that bind this Service receive the token.
-        const rpcToken = yield* makeRandom(`${id}RpcToken`);
-        if (app !== undefined) {
-          // Report the ports this Service publishes so the App can reject
-          // two Services on the same port before either one is deployed.
-          yield* app.bind(id, {
-            service: id,
-            services: props.services,
-            bindingPort: props.bindingPort,
-          });
-        }
-        return { ...props, app, rpcToken } as typeof props;
-      }),
-  });
+export const Service: Platform<Service, ServiceServices, ServiceShape, ServiceRuntimeContext> &
+  LookupMethod<Service> = Platform("Fly.Service", {
+  createRuntimeContext: createFlyHostRuntimeContext("Fly.Service"),
+  // `{ app: Site }` at module scope is an Effect. Yield it here so the
+  // App is registered and `news.app` is resolved attributes at
+  // reconcile (same DX as `yield* App(...)` inside Effect.gen).
+  transformProps: (id, props) =>
+    Effect.gen(function* () {
+      if (globalThis.__ALCHEMY_RUNTIME__) return props;
+      const app = Effect.isEffect(props.app)
+        ? yield* props.app as Effect.Effect<App, never, Providers>
+        : props.app;
+      if (app !== undefined) {
+        // Report the ports this Service publishes so the App can reject
+        // two Services on the same port before either one is deployed.
+        yield* app.bind(id, {
+          service: id,
+          services: props.services,
+          bindingPort: props.bindingPort,
+        });
+      }
+      return { ...props, app } as typeof props;
+    }),
+});
 
 export class ServiceNotCreated extends Data.TaggedError("Fly.ServiceNotCreated")<{
-  name: string;
+  resourceName: string;
   appName: string;
 }> {}
 
@@ -1111,6 +1185,147 @@ const toFlyGuest = (guest: MachineGuest | undefined): FlyMachineGuest => {
   return fly;
 };
 
+/**
+ * Prefix of the App secrets a Service writes. Scoped to its FQN so they
+ * never share a name with `Fly.Secret`, `fly secrets set`, the
+ * Redis/Postgres/Bucket attachments, or another Service.
+ */
+const boundSecretPrefix = Effect.fn(function* (fqn: string) {
+  const hash = yield* sha256(fqn);
+  return `ALCHEMY_${hash.slice(0, 8).toUpperCase()}_`;
+});
+
+/** A secret some Service wrote under its {@link boundSecretPrefix}. */
+const SCOPED_SECRET = /^ALCHEMY_[0-9A-F]{8}_/;
+
+/**
+ * Store bound `Config` and Redacted values as App secrets under names
+ * scoped to the Service; the Machine config maps each back to its env var
+ * (see {@link secretMappings}). Fly's digest is not a hash Alchemy can
+ * compute, so a value is unchanged only when its sha256 matches the last
+ * write and Fly still reports that write's digest. Deletes secrets under
+ * the Service's prefix that are no longer bound, including ones a crash
+ * left out of state; never touches any other secret. Returns what it now
+ * owns, the App's other secrets the Machine should still see, and the
+ * App-secrets version Machines must reach.
+ */
+const syncBoundSecrets = Effect.fn(function* (
+  appName: string,
+  fqn: string,
+  desired: Record<string, Redacted.Redacted<string>>,
+  previous: { secrets: Record<string, BoundSecret>; version: number | undefined },
+) {
+  if (Object.keys(desired).length === 0 && Object.keys(previous.secrets).length === 0) {
+    return { secrets: {}, others: [], version: previous.version };
+  }
+  const prefix = yield* boundSecretPrefix(fqn);
+  const listDigests = machines
+    .listSecrets({ app_name: appName, show_secrets: false })
+    .pipe(
+      Effect.map(
+        (listed) =>
+          new Map(
+            (listed.secrets ?? []).flatMap((secret) =>
+              secret.name === undefined ? [] : [[secret.name, secret.digest ?? ""] as const],
+            ),
+          ),
+      ),
+    );
+  const observed = yield* listDigests;
+  const planned = yield* Effect.forEach(
+    Object.entries(desired),
+    ([envVar, value]) =>
+      // Salted with the scoped name, so equal values on different Services
+      // or Apps never share a hash in state.
+      sha256(`${prefix}${envVar}:${Redacted.value(value)}`).pipe(
+        Effect.map((hash) => ({ envVar, name: `${prefix}${envVar}`, value, hash })),
+      ),
+    { concurrency: "unbounded" },
+  );
+  const isUnchanged = ({ envVar, name, hash }: (typeof planned)[number]) => {
+    const last = previous.secrets[envVar];
+    return (
+      last !== undefined &&
+      last.name === name &&
+      last.sha256 === hash &&
+      observed.get(name) === last.digest
+    );
+  };
+  const kept = planned.filter(isUnchanged);
+  const changed = planned.filter((entry) => !isUnchanged(entry));
+  const unbound = [...observed.keys()].filter(
+    (name) => name.startsWith(prefix) && !(name.slice(prefix.length) in desired),
+  );
+  const write =
+    changed.length === 0
+      ? Effect.succeed({ version: undefined, written: [] as [string, BoundSecret][] })
+      : Effect.gen(function* () {
+          const response = yield* machines.updateSecrets({
+            app_name: appName,
+            values: Object.fromEntries(changed.map(({ name, value }) => [name, value])),
+          });
+          const digests = yield* listDigests;
+          return {
+            version: response.version ?? response.Version,
+            written: changed.map(({ envVar, name, hash }): [string, BoundSecret] => [
+              envVar,
+              { name, digest: digests.get(name) ?? "", sha256: hash },
+            ]),
+          };
+        });
+  const remove = Effect.forEach(
+    unbound,
+    (name) =>
+      machines.deleteSecret({ app_name: appName, secret_name: name }).pipe(
+        Effect.map((response) => response.version ?? response.Version),
+        Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+      ),
+    { concurrency: "unbounded" },
+  );
+  const [{ version: writeVersion, written }, deleteVersions] = yield* Effect.all([write, remove], {
+    concurrency: "unbounded",
+  });
+  const secrets: Record<string, BoundSecret> = Object.fromEntries([
+    ...kept.map(({ envVar }): [string, BoundSecret] => [envVar, previous.secrets[envVar]!]),
+    ...written,
+  ]);
+  const versions = [writeVersion, ...deleteVersions].filter(
+    (version): version is number => version !== undefined && Number.isSafeInteger(version),
+  );
+  // A bound value wins over an App secret with the same env var name, as
+  // a Machine env var did; that secret stays in the App untouched.
+  const others = [...observed.keys()]
+    .filter((name) => !SCOPED_SECRET.test(name) && !(name in desired))
+    .sort();
+  return {
+    secrets,
+    others,
+    version: versions.length > 0 ? Math.max(...versions) : previous.version,
+  };
+});
+
+/**
+ * Fly maps a process's `secrets` entries from a scoped App secret to the
+ * env var the program reads, but only with `ignore_app_secrets`, which
+ * hides every App secret the process does not list. So the App's other
+ * secrets (attachments, `fly secrets set`) are listed under their own
+ * names, as they were at deploy.
+ */
+const secretMappings = (bound: {
+  secrets: Record<string, BoundSecret>;
+  others: string[];
+}): FlyMachineConfig["processes"] => {
+  const mapped = Object.entries(bound.secrets).map(([envVar, secret]) => ({
+    env_var: envVar,
+    name: secret.name,
+  }));
+  if (mapped.length === 0) return undefined;
+  const entries = [...mapped, ...bound.others.map((name) => ({ env_var: name, name }))].sort(
+    (left, right) => left.env_var.localeCompare(right.env_var),
+  );
+  return [{ secrets: entries, ignore_app_secrets: true }];
+};
+
 const desiredEnv = (
   props: ServiceProps,
   bindingEnv: Record<string, any>,
@@ -1150,6 +1365,7 @@ const buildConfig = (input: {
   mounts: FlyMachineMount[];
   metadata: Record<string, string>;
   statics?: FlyStatic[];
+  processes?: FlyMachineConfig["processes"];
 }): FlyMachineConfig => ({
   image: input.image,
   guest: input.guest,
@@ -1158,6 +1374,7 @@ const buildConfig = (input: {
   mounts: input.mounts.length > 0 ? input.mounts : undefined,
   metadata: input.metadata,
   statics: input.statics !== undefined && input.statics.length > 0 ? input.statics : undefined,
+  processes: input.processes,
 });
 
 const sameImage = (machine: FlyMachine, image: string) => {
@@ -1211,6 +1428,22 @@ const sameStatics = (observed: FlyStatic[] | undefined, desired: FlyStatic[] | u
   return deepEqual(normalize(observed), normalize(desired), { stripNullish: true });
 };
 
+/** Fly fills an omitted secret `name` with its `env_var`. */
+const sameProcesses = (
+  observed: FlyMachineConfig["processes"],
+  desired: FlyMachineConfig["processes"],
+) => {
+  const normalize = (processes: FlyMachineConfig["processes"]) =>
+    (processes ?? []).map((process) => ({
+      ...process,
+      secrets: process.secrets?.map((secret) => ({
+        env_var: secret.env_var,
+        name: secret.name || secret.env_var,
+      })),
+    }));
+  return deepEqual(normalize(observed), normalize(desired), { stripNullish: true });
+};
+
 const configDrifted = (
   machine: FlyMachine,
   desired: {
@@ -1221,6 +1454,7 @@ const configDrifted = (
     mounts: FlyMachineMount[];
     metadata: Record<string, string>;
     statics?: FlyStatic[];
+    processes?: FlyMachineConfig["processes"];
   },
 ) => {
   const config = machine.config;
@@ -1231,13 +1465,11 @@ const configDrifted = (
     !sameServices(config?.services, desired.services) ||
     !sameMounts(config?.mounts, desired.mounts) ||
     metadataChanged(config?.metadata, desired.metadata) ||
-    !sameStatics(config?.statics, desired.statics)
+    !sameStatics(config?.statics, desired.statics) ||
+    !sameProcesses(config?.processes, desired.processes)
   );
 };
 
-const portsOf = (services: FlyMachineService[] | undefined) =>
-  (services ?? []).flatMap((service) => service.ports ?? []);
-
 const withPort = (base: string, port: number, standard: number) =>
   port === standard ? base : `${base}:${port}`;
 
@@ -1317,7 +1549,9 @@ interface Access {
   isPublic: boolean;
   network: string | undefined;
   bindingPort: number;
-  rpcToken: Redacted.Redacted<string> | undefined;
+  secrets?: Record<string, BoundSecret>;
+  secretsVersion?: number;
+  orgSlug: string | undefined;
 }
 
 /** Drop the port Alchemy added for bindings from a services list. */
@@ -1500,7 +1734,9 @@ const toAttrs = (set: ReplicaSet, codeHash: string, access: Access): Service["At
   appName: set.appName,
   ownsApp: access.ownsApp,
   network: normalizeNetwork(access.network),
-  rpcToken: access.rpcToken,
+  secrets: access.secrets,
+  secretsVersion: access.secretsVersion,
+  orgSlug: access.orgSlug,
   ...endpointsOf(set, access),
   rolloutPending: set.rolloutPending,
   machineId: set.machineId,
@@ -1517,6 +1753,26 @@ const toAttrs = (set: ReplicaSet, codeHash: string, access: Access): Service["At
   code: { hash: codeHash },
 });
 
+/** The replica set of a Service whose App exists but runs no Machines yet. */
+const emptyReplicaSet = (appName: string, name: string): ReplicaSet => ({
+  appName,
+  machineId: "",
+  machineIds: [],
+  name,
+  baseName: name,
+  region: "",
+  regions: [],
+  state: "created",
+  instanceId: undefined,
+  privateIp: undefined,
+  imageRef: undefined,
+  guest: undefined,
+  services: undefined,
+  count: 0,
+  mounts: [],
+  replicas: [],
+});
+
 const machineIdsOf = (output: Service["Attributes"] | undefined) =>
   output?.machineIds ??
   (output?.machineId !== undefined && output.machineId.length > 0 ? [output.machineId] : []);
@@ -1587,7 +1843,7 @@ export const ServiceProvider = () =>
         stables: ["appName"],
         nuke: { dependsOn: ["Fly.App"] },
 
-        diff: Effect.fn(function* ({ id, news, output }) {
+        diff: Effect.fn(function* ({ news, output }) {
           if (news === undefined) return;
           const shape = news as Partial<Pick<ServiceProps, "app" | "public" | "network">>;
           const ownsApp = shape.app === undefined;
@@ -1674,8 +1930,15 @@ export const ServiceProvider = () =>
           // effect-config form has been evaluated, so the object view is
           // safe to read.
           const statics = news as Partial<
-            Pick<ServiceProps, "main" | "build" | "image" | "port" | "extraFiles" | "isExternal">
+            Pick<
+              ServiceProps,
+              "main" | "context" | "build" | "image" | "port" | "extraFiles" | "isExternal"
+            >
           >;
+          if (typeof statics.context === "string") {
+            const hash = yield* hosted.contextHash(statics.context);
+            if (hash !== output.code.hash) return { action: "update" as const };
+          }
           if (
             isResolved({
               main: statics.main,
@@ -1695,6 +1958,24 @@ export const ServiceProvider = () =>
           return output.rolloutPending ? { action: "update" as const } : undefined;
         }),
 
+        lookup: Effect.fn(function* ({ appName, name }) {
+          const found = yield* lookupReplicaSet({ appName, name });
+          if (found === undefined) return undefined;
+          const app = yield* machines
+            .getApp({ app_name: appName })
+            .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+          const attrs = toAttrs(found, "", {
+            // Reported as Alchemy-owned only so the endpoints follow the App's
+            // observed addresses, as a declared Service's own App's do.
+            ownsApp: true,
+            isPublic: yield* hasPublicAddress(appName),
+            network: app?.network,
+            bindingPort: DEFAULT_BINDING_PORT,
+            orgSlug: app?.organization?.slug,
+          });
+          return { ...attrs, ownsApp: false };
+        }),
+
         read: Effect.fn(function* ({ id, fqn, instanceId, olds, output }) {
           const ownsApp = output?.ownsApp ?? (olds !== undefined && olds.app === undefined);
           const appName = ownsApp
@@ -1717,13 +1998,34 @@ export const ServiceProvider = () =>
             machineIds: machineIdsOf(output),
             baseName: name,
           });
-          if (found === undefined) return undefined;
+          if (found === undefined) {
+            // A create interrupted between creating the Service's own App and
+            // starting its Machines (an image build in between can take
+            // minutes) leaves the App with nothing in it. Report it, so the
+            // engine's recovery of the interrupted create deletes it instead
+            // of leaking it. The App's name is derived from this resource's
+            // instance, so an App with that name is this resource's.
+            if (!ownsApp || appName === undefined) return undefined;
+            const app = yield* machines
+              .getApp({ app_name: appName })
+              .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+            if (app === undefined || !matchesAlchemyPhysicalName(app.name)) return undefined;
+            return toAttrs(emptyReplicaSet(appName, name), output?.code.hash ?? "", {
+              ownsApp,
+              isPublic: false,
+              network: output?.network ?? olds?.network,
+              bindingPort: olds?.bindingPort ?? DEFAULT_BINDING_PORT,
+              orgSlug: output?.orgSlug ?? (yield* resolveOrgSlug()),
+            });
+          }
           return toAttrs(found, output?.code.hash ?? "", {
             ownsApp,
             isPublic: ownsApp && (yield* hasPublicAddress(found.appName)),
             network: output?.network ?? (ownsApp ? olds?.network : undefined),
             bindingPort: olds?.bindingPort ?? DEFAULT_BINDING_PORT,
-            rpcToken: output?.rpcToken,
+            secrets: output?.secrets,
+            secretsVersion: output?.secretsVersion,
+            orgSlug: output?.orgSlug ?? (yield* resolveOrgSlug()),
           });
         }),
 
@@ -1736,7 +2038,7 @@ export const ServiceProvider = () =>
               isPublic: true,
               network: undefined,
               bindingPort: DEFAULT_BINDING_PORT,
-              rpcToken: undefined,
+              orgSlug: undefined,
             }),
           );
         }),
@@ -1774,9 +2076,35 @@ export const ServiceProvider = () =>
             const version = yield* attachPostgresSecrets(appName, pg.clusterId, pg.variableName);
             if (version !== undefined) secretVersions.push(version);
           }
+          const env = desiredEnv(props, bound.env, hosted.alchemyEnv, port);
+          // Redacted values (every bound `Config`) become App secrets, but
+          // only in an App the Service owns: Fly gives every App secret to
+          // every Machine in the App. A plain `env` entry wins over a binding.
+          const redacted = Object.keys(env).filter((key) =>
+            props.env?.[key] !== undefined
+              ? Redacted.isRedacted(props.env[key])
+              : bound.secretNames.includes(key),
+          );
+          // Move them out of the plain env record before anything else reads it.
+          const desiredSecrets: Record<string, Redacted.Redacted<string>> = {};
+          if (ownsApp) {
+            for (const key of redacted) {
+              desiredSecrets[key] = Redacted.make(env[key]!);
+              delete env[key];
+            }
+          }
+          const boundSecrets = yield* syncBoundSecrets(
+            appName,
+            fqn,
+            desiredSecrets,
+            output?.appName === appName
+              ? { secrets: output.secrets ?? {}, version: output.secretsVersion }
+              : { secrets: {}, version: undefined },
+          );
+          if (boundSecrets.version !== undefined) secretVersions.push(boundSecrets.version);
           const minSecretsVersion =
             secretVersions.length > 0 ? Math.max(...secretVersions) : undefined;
-          const env = desiredEnv(props, bound.env, hosted.alchemyEnv, port);
+          const processes = secretMappings(boundSecrets);
           if (policy.shutdown && !props.isExternal) {
             env.ALCHEMY_FLY_SHUTDOWN_TIMEOUT_MS = String(policy.shutdown.timeoutMs);
           }
@@ -1790,24 +2118,35 @@ export const ServiceProvider = () =>
           );
           const services = published.services;
           if (!ownsApp) yield* validateObservedPorts(appName, fqn, id, services);
-          if (props.rpcToken !== undefined) env[RPC_TOKEN_ENV] = Redacted.value(props.rpcToken);
+          // The Apps of the Services that bind this one; only they may call
+          // its methods (see `serveFlyRpc`).
+          if (bound.callers.length > 0) env[RPC_CALLERS_ENV] = bound.callers.join(",");
           for (const target of bound.targets) {
             const keys = boundTargetEnvKeys(target.service);
             env[keys.appName] = packEnvValue(target.appName);
             if (target.privateUrl !== undefined) env[keys.url] = packEnvValue(target.privateUrl);
-            if (target.rpcToken !== undefined) env[keys.token] = packEnvValue(target.rpcToken);
           }
           env[RPC_ORG_ENV] = yield* resolveOrgSlug();
           if (published.added) env[BINDING_PORT_ENV] = String(bindingPort);
           const statics = toFlyStatics(props.statics);
 
-          const { imageRef, codeHash } = yield* hosted.resolveImage({
-            id,
-            appName,
-            props,
-            previousHash: output?.code.hash,
-            session,
-          });
+          const { imageRef, codeHash } =
+            props.context !== undefined
+              ? yield* hosted.resolveContextImage({
+                  id,
+                  appName,
+                  context: props.context,
+                  remote: props.build?.remote,
+                  previousHash: output?.code.hash,
+                  session,
+                })
+              : yield* hosted.resolveImage({
+                  id,
+                  appName,
+                  props: props as HostedProgramProps,
+                  previousHash: output?.code.hash,
+                  session,
+                });
 
           const set = yield* reconcileReplicas({
             id,
@@ -1836,12 +2175,24 @@ export const ServiceProvider = () =>
                 mounts: desired.mounts,
                 metadata: desired.metadata,
                 statics,
+                processes,
               }),
             buildConfig: ({ mounts, metadata }) =>
-              buildConfig({ image: imageRef, guest, env, services, mounts, metadata, statics }),
+              buildConfig({
+                image: imageRef,
+                guest,
+                env,
+                services,
+                mounts,
+                metadata,
+                statics,
+                processes,
+              }),
           }).pipe(
             Effect.catchTag("Fly.ReplicaNotCreated", (error) =>
-              Effect.fail(new ServiceNotCreated({ name: error.name, appName: error.appName })),
+              Effect.fail(
+                new ServiceNotCreated({ resourceName: error.resourceName, appName: error.appName }),
+              ),
             ),
           );
           return toAttrs(set, codeHash, {
@@ -1849,13 +2200,15 @@ export const ServiceProvider = () =>
             isPublic,
             network,
             bindingPort,
-            rpcToken: props.rpcToken,
+            secrets: boundSecrets.secrets,
+            secretsVersion: boundSecrets.version,
+            orgSlug: yield* resolveOrgSlug(),
           });
         }),
 
-        // Create the App, its addresses, and the caller token before any
-        // Machine, so two Services that bind each other can both resolve
-        // the other's private address and token.
+        // Create the App and its addresses before any Machine, so two
+        // Services that bind each other can both resolve the other's App
+        // and private address.
         precreate: Effect.fn(function* ({ id, news }) {
           const props = news;
           // Precreate runs before dependencies resolve. A Service placed in
@@ -1909,7 +2262,7 @@ export const ServiceProvider = () =>
             isPublic,
             network,
             bindingPort,
-            rpcToken: isResolved(props.rpcToken) ? props.rpcToken : undefined,
+            orgSlug: yield* resolveOrgSlug(),
           });
         }),