alchemy 2.0.0-beta.73 → 2.0.0-beta.75

package/src/Docker/ServiceImage.ts

@@ -7,7 +7,6 @@ import {
   getStableContextDir,
   resolveMainPath,
 } from "../Bundle/TempRoot.ts";
-import { Self } from "../Self.ts";
 import { sha256Object } from "../Util/sha256.ts";
 import { Docker } from "./Docker.ts";
 
@@ -50,85 +49,18 @@ export interface ResolvedServiceImage {
 }
 
 /**
- * The standard bun bootstrap wrapped around a `Docker.Service` `main` entry:
- * resolves the bundled program's registered runners (`host.run` loops and the
- * served `fetch` handler) and runs them with a Bun HTTP server bound to
- * `PORT`. Mirrors the ECS bootstrap minus the AWS credential/region layers —
- * a Swarm task has no ambient cloud identity.
+ * The generated entry for `Docker.Service` containers: a shim importing only
+ * `alchemy/Runtime/Bootstrap/Docker` plus the user's `main` — see that
+ * module for why the entry never imports alchemy's own dependencies.
  */
 export const makeServiceBunBootstrap =
   (handler: string) =>
   (importPath: string): string =>
     `
-import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-
+import { bootstrap } from "alchemy/Runtime/Bootstrap/Docker";
 import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
 
-// Normalize the entrypoint export: an inline-effect class default export is
-// an Effect resolving the platform instance, while the tagged form
-// (X.make(props, impl)) exports a Layer providing the Self tag. Both fold
-// into a Layer via makeEntrypointLayer (same pattern as the ECS bridge).
-const tag = Context.Service("${Self.key}");
-const layer = makeEntrypointLayer(tag, entrypoint);
-
-const platform = Layer.mergeAll(
-  BunServices.layer,
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.effect(
-  Stack,
-  Effect.all([
-    Config.string("ALCHEMY_STACK_NAME"),
-    Config.string("ALCHEMY_STAGE")
-  ]).pipe(
-    Effect.map(([name, stage]) => ({
-      name,
-      stage,
-      bindings: {},
-      resources: {}
-    }))
-  )
-);
-
-// Resolve the bundled program (the runners registered via host.run / serve)
-// and run it with a Bun HTTP server bound to PORT, so the returned { fetch }
-// handler is actually served and host.run loops stay alive.
-const program = tag.pipe(
-  Effect.flatMap((service) => service.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      Layer.provideMerge(BunHttpServer()),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("Docker service bootstrap starting...");
-await Effect.runPromise(program).catch((err) => {
-  console.error("Docker service bootstrap failed:", err);
-  process.exit(1);
-});
+await bootstrap(entrypoint);
 `;
 
 /**
@@ -172,7 +104,7 @@ export const makeServiceImage = Effect.gen(function* () {
             ...((source.build?.input?.external as string[] | undefined) ?? []),
           ],
           resolve: {
-            conditionNames: ["bun", "import", "module", "default"],
+            conditionNames: [...Bundle.BUN_CONDITION_NAMES],
             ...source.build?.input?.resolve,
           },
           plugins: [source.build?.input?.plugins, plugins],

package/src/Fly/Bucket.ts

@@ -526,17 +526,30 @@ const waitUntilReady = (name: string, addOnId: string) =>
   );
 
 const waitUntilGone = (addOnId: string, name: string) =>
-  findById(addOnId).pipe(
-    Effect.map((addOn) => addOn === undefined),
-    Effect.flatMap((goneById) =>
-      goneById
-        ? Effect.succeed(true)
-        : findByName(name).pipe(Effect.map((addOn) => addOn === undefined)),
-    ),
-    Effect.repeat({
+  Effect.gen(function* () {
+    // Best-effort: Tigris often answers "The specified bucket does not
+    // exist" (untyped UnknownFlyIoError) for a delete that already
+    // succeeded. Never fail the wait on that — only on the add-on still
+    // showing up in list.
+    yield* Effect.result(
+      addons.deleteAddOn({
+        input: addOnId.length > 0 ? { addOnId } : { name, provider: TIGRIS },
+      }),
+    );
+    const still =
+      (yield* findById(addOnId)) ??
+      (name.length > 0 ? yield* findByName(name) : undefined);
+    if (still !== undefined) {
+      return yield* new BucketPending({
+        name,
+        status: still.status ?? "deleting",
+      });
+    }
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "Fly.BucketPending",
       schedule: Schedule.spaced("2 seconds"),
-      until: (gone) => gone,
-      times: 10,
+      times: 20,
     }),
   );
 
@@ -755,22 +768,11 @@ export const BucketProvider = () =>
       const addOnId = output.addOnId;
       const name = output.name;
       if (addOnId.length === 0 && name.length === 0) return;
-      const deleted = yield* Effect.result(
-        addons.deleteAddOn({
-          input: addOnId.length > 0 ? { addOnId } : { name, provider: TIGRIS },
-        }),
-      );
-      if (Result.isFailure(deleted)) {
-        const still = yield* findById(addOnId);
-        const stillNamed =
-          still === undefined && name.length > 0
-            ? yield* findByName(name)
-            : still;
-        if (stillNamed !== undefined) {
-          return yield* Effect.fail(deleted.failure);
-        }
-        return;
-      }
+      // Always wait for the add-on to leave the list. A failed
+      // deleteAddOn plus a single list miss is not gone — Tigris
+      // list lags, and a bucket still attached to an App is a
+      // transient error. waitUntilGone retries delete and only
+      // succeeds once list (id and name) is empty.
       yield* waitUntilGone(addOnId, name);
     }),
   });

package/src/Fly/BucketBinding.ts

@@ -3,6 +3,7 @@ import * as AwsEndpoint from "@distilled.cloud/aws/Endpoint";
 import type { RegionName } from "@distilled.cloud/aws/Region";
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import type * as HttpClient from "effect/unstable/http/HttpClient";
@@ -108,16 +109,18 @@ const authorizeS3 = <A, E>(
 ): Effect.Effect<A, E, RuntimeContext> =>
   operation.pipe(
     Effect.provide(
-      fromCredentials(
-        {
-          accessKeyId: scope.accessKeyId,
-          secretAccessKey: scope.secretAccessKey,
-        },
-        scope.region,
+      Layer.mergeAll(
+        fromCredentials(
+          {
+            accessKeyId: scope.accessKeyId,
+            secretAccessKey: scope.secretAccessKey,
+          },
+          scope.region,
+        ),
+        AwsEndpoint.of(scope.endpoint),
+        FetchHttpClient.layer,
       ),
     ),
-    Effect.provide(AwsEndpoint.of(scope.endpoint)),
-    Effect.provide(FetchHttpClient.layer),
   ) as Effect.Effect<A, E, RuntimeContext>;
 
 export const makeTigrisS3Binding = <

package/src/Fly/ConnectPostgres.ts

@@ -26,8 +26,6 @@ import type { Postgres } from "./Postgres.ts";
  * ```
  *
  * @binding
- * @product Fly
- * @category Storage & Databases
  */
 export interface ConnectPostgres extends Binding.Service<
   ConnectPostgres,

package/src/Fly/Decrypt.ts

@@ -1,5 +1,4 @@
 import type { DecryptSecretKeyError } from "@distilled.cloud/fly-io/machines";
-import type { FlyKmsError } from "./Errors.ts";
 import type * as Effect from "effect/Effect";
 import type * as Redacted from "effect/Redacted";
 import * as Binding from "../Binding.ts";
@@ -57,11 +56,7 @@ export interface Decrypt extends Binding.Service<
   ) => Effect.Effect<
     (
       request: DecryptRequest,
-    ) => Effect.Effect<
-      DecryptResult,
-      DecryptSecretKeyError | FlyKmsError,
-      RuntimeContext
-    >
+    ) => Effect.Effect<DecryptResult, DecryptSecretKeyError, RuntimeContext>
   >
 > {}
 

package/src/Fly/DecryptHttp.ts

@@ -5,10 +5,10 @@ import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import { Decrypt, type DecryptRequest } from "./Decrypt.ts";
+import { unwrapSecretValue } from "./SecretHttp.ts";
 import {
   base64ToBytes,
   bytesToBase64,
-  flyKmsPost,
   makeHttpSecretKeyBinding,
 } from "./SecretKeyHttp.ts";
 
@@ -35,27 +35,6 @@ export const DecryptHttp = Layer.effect(
     makeHttpSecretKeyBinding({
       makeClient: (auth, appName, secretName) =>
         Effect.fn("Fly.Decrypt")(function* (request: DecryptRequest) {
-          if (globalThis.__ALCHEMY_RUNTIME__) {
-            const res = yield* flyKmsPost(
-              yield* appName,
-              yield* secretName,
-              "decrypt",
-              {
-                ciphertext: bytesToBase64(request.ciphertext),
-                associated_data:
-                  request.associatedData === undefined
-                    ? undefined
-                    : bytesToBase64(request.associatedData),
-              },
-            );
-            return {
-              plaintext: Redacted.make(
-                base64ToBytes(
-                  typeof res.plaintext === "string" ? res.plaintext : undefined,
-                ),
-              ),
-            };
-          }
           const res = yield* auth.authorize(
             machines.decryptSecretKey({
               app_name: yield* appName,
@@ -68,7 +47,9 @@ export const DecryptHttp = Layer.effect(
             }),
           );
           return {
-            plaintext: Redacted.make(base64ToBytes(res.plaintext)),
+            plaintext: Redacted.make(
+              base64ToBytes(unwrapSecretValue(res.plaintext ?? "")),
+            ),
           };
         }),
     }),

package/src/Fly/Encrypt.ts

@@ -1,5 +1,4 @@
 import type { EncryptSecretKeyError } from "@distilled.cloud/fly-io/machines";
-import type { FlyKmsError } from "./Errors.ts";
 import type * as Effect from "effect/Effect";
 import * as Binding from "../Binding.ts";
 import type { RuntimeContext } from "../RuntimeContext.ts";
@@ -55,11 +54,7 @@ export interface Encrypt extends Binding.Service<
   ) => Effect.Effect<
     (
       request: EncryptRequest,
-    ) => Effect.Effect<
-      EncryptResult,
-      EncryptSecretKeyError | FlyKmsError,
-      RuntimeContext
-    >
+    ) => Effect.Effect<EncryptResult, EncryptSecretKeyError, RuntimeContext>
   >
 > {}
 

package/src/Fly/EncryptHttp.ts

@@ -7,7 +7,6 @@ import { Encrypt, type EncryptRequest } from "./Encrypt.ts";
 import {
   base64ToBytes,
   bytesToBase64,
-  flyKmsPost,
   makeHttpSecretKeyBinding,
 } from "./SecretKeyHttp.ts";
 
@@ -34,25 +33,6 @@ export const EncryptHttp = Layer.effect(
     makeHttpSecretKeyBinding({
       makeClient: (auth, appName, secretName) =>
         Effect.fn("Fly.Encrypt")(function* (request: EncryptRequest) {
-          if (globalThis.__ALCHEMY_RUNTIME__) {
-            const res = yield* flyKmsPost(
-              yield* appName,
-              yield* secretName,
-              "encrypt",
-              {
-                plaintext: bytesToBase64(request.plaintext),
-                associated_data:
-                  request.associatedData === undefined
-                    ? undefined
-                    : bytesToBase64(request.associatedData),
-              },
-            );
-            return {
-              ciphertext: base64ToBytes(
-                typeof res.ciphertext === "string" ? res.ciphertext : undefined,
-              ),
-            };
-          }
           const res = yield* auth.authorize(
             machines.encryptSecretKey({
               app_name: yield* appName,

package/src/Fly/Environment.ts

@@ -62,8 +62,12 @@ export const fromCredentials = () =>
       return yield* creds.pipe(
         Effect.flatMap((resolved) =>
           resolveOrgSlug().pipe(
-            Effect.provideService(Credentials, creds),
-            Effect.provideService(HttpClient.HttpClient, http),
+            Effect.provide(
+              Layer.mergeAll(
+                Layer.succeed(Credentials, creds),
+                Layer.succeed(HttpClient.HttpClient, http),
+              ),
+            ),
             Effect.map((orgSlug) => ({
               ...resolved,
               orgSlug,

package/src/Fly/Errors.ts

@@ -14,22 +14,3 @@ export class TigrisCredentialsMissing extends Data.TaggedError(
 )<{
   name: string;
 }> {}
-
-/**
- * Failure of a Fly PetSem (KMS) call made from inside a Machine over the
- * `/.fly/api` unix socket.
- *
- * The distilled Machines SDK cannot reach that socket, so
- * {@link Encrypt}, {@link Decrypt}, {@link Sign}, and {@link Verify} post
- * directly when running inside a deployed host. This is the typed error
- * for that path — a non-2xx response, or a socket/transport failure.
- */
-export class FlyKmsError extends Data.TaggedError("Fly.KmsError")<{
-  /** The PetSem operation that failed. */
-  readonly op: "encrypt" | "decrypt" | "sign" | "verify";
-  /** HTTP status, when Fly answered at all. */
-  readonly status?: number;
-  /** Response body, or the transport failure message. */
-  readonly message: string;
-  readonly cause?: unknown;
-}> {}

package/src/Fly/Postgres.ts

@@ -501,26 +501,25 @@ export const credentialsUri = (
 ): string | undefined => unwrapSensitive(credentials?.pgbouncer_uri);
 
 export const directUri = (
-  cluster: ManagedCluster | undefined,
+  _cluster: ManagedCluster | undefined,
   credentials: ClusterCredentials | undefined,
 ): string | undefined => {
-  const user = credentials?.user;
-  const password = unwrapSensitive(credentials?.password);
-  const dbname = credentials?.dbname;
-  const hash = cluster?.mpgd_cluster_id;
-  if (
-    user === undefined ||
-    user.length === 0 ||
-    password === undefined ||
-    password.length === 0 ||
-    dbname === undefined ||
-    dbname.length === 0 ||
-    hash === undefined ||
-    hash.length === 0
-  ) {
+  // Derive the direct host from the server-provided PgBouncer URI:
+  // `pgbouncer.<hash>.flympg.net` → `direct.<hash>.flympg.net`. The `<hash>`
+  // is the cluster's DNS hash, which is NOT any id the cluster API returns —
+  // `mpgd_cluster_id` is the `fly-mpg-…` cluster id, and a host synthesized
+  // from it does not resolve. Rewriting the observed pooled host is the only
+  // reliable derivation.
+  const pooled = unwrapSensitive(credentials?.pgbouncer_uri);
+  if (pooled === undefined || pooled.length === 0) return undefined;
+  try {
+    const url = new URL(pooled);
+    if (!url.hostname.startsWith("pgbouncer.")) return undefined;
+    url.hostname = url.hostname.replace(/^pgbouncer\./, "direct.");
+    return url.toString();
+  } catch {
     return undefined;
   }
-  return `postgres://${encodeURIComponent(user)}:${encodeURIComponent(password)}@direct.${hash}.flympg.net/${dbname}`;
 };
 
 const secretVersion = (

package/src/Fly/PostgresMigrations.ts

@@ -1,6 +1,7 @@
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
 import type { Client } from "pg";
 import {
   makePgMigrationExecutor,
@@ -40,6 +41,27 @@ const toMigrationError = (cause: unknown) =>
     cause,
   });
 
+/**
+ * A freshly-provisioned Fly Managed Postgres cluster reports `ready` on the
+ * API before its hostname is resolvable and its endpoint accepts
+ * connections — reconcile's first migration connect can fail with
+ * `ENOTFOUND` (DNS still propagating) or a refused/reset socket. These are
+ * eventual consistency, not failures: retry the connect on a bounded
+ * schedule (~45s) before surfacing the error.
+ */
+const TRANSIENT_CONNECT_CODES = new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+]);
+
+const isTransientConnectError = (error: PostgresMigrationError): boolean => {
+  const code = (error.cause as { code?: unknown } | null | undefined)?.code;
+  return typeof code === "string" && TRANSIENT_CONNECT_CODES.has(code);
+};
+
 /** Open a pg client for the scope of `use`, closing it afterwards. */
 export const withPgClient = <A, E, R>(
   connectionUri: Redacted.Redacted<string>,
@@ -57,7 +79,28 @@ export const withPgClient = <A, E, R>(
         return client;
       },
       catch: toMigrationError,
-    }),
+    }).pipe(
+      Effect.retry({
+        while: isTransientConnectError,
+        schedule: Schedule.spaced("3 seconds"),
+        times: 15,
+      }),
+      // Still unreachable after the bounded retry: almost always a missing
+      // route rather than propagation — MPG hostnames only exist on the org
+      // private network. Say so instead of a bare `getaddrinfo ENOTFOUND`.
+      Effect.mapError((error) =>
+        isTransientConnectError(error)
+          ? new PostgresMigrationError({
+              message:
+                `${error.message} — Fly Managed Postgres is only reachable ` +
+                "on the org's private network. Run the deploy behind a " +
+                "WireGuard peer or `fly mpg proxy`, or from a machine on " +
+                "6PN. See https://fly.io/docs/mpg/create-and-connect/",
+              cause: error.cause,
+            })
+          : error,
+      ),
+    ),
     use,
     (client) => Effect.promise(() => client.end().catch(() => {})),
   );

package/src/Fly/Providers.ts

@@ -2,6 +2,7 @@ import * as Layer from "effect/Layer";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
 import { ProfileLive } from "../Auth/Profile.ts";
+import * as Command from "../Command/index.ts";
 import * as Provider from "../Provider.ts";
 import { App, AppProvider } from "./App.ts";
 import { FlyAuth } from "./AuthProvider.ts";
@@ -32,6 +33,14 @@ import { MountVolumeLive } from "./MountVolume.ts";
 import { Secret, SecretProvider } from "./Secret.ts";
 import { SecretKey, SecretKeyProvider } from "./SecretKey.ts";
 import { Service, ServiceProvider } from "./Service.ts";
+import {
+  AssetDeployment,
+  AssetDeploymentProvider,
+} from "./Website/AssetDeployment.ts";
+import {
+  Server as WebsiteServer,
+  ServerProvider as WebsiteServerProvider,
+} from "../Website/Server.ts";
 import { SignHttp } from "./SignHttp.ts";
 import { Sprite, SpriteProvider } from "./Sprite.ts";
 import { VerifyHttp } from "./VerifyHttp.ts";
@@ -76,6 +85,7 @@ export const providers = () =>
     Providers,
     Provider.collection([
       App,
+      AssetDeployment,
       Bucket,
       Certificate,
       IpAssignment,
@@ -87,11 +97,13 @@ export const providers = () =>
       Service,
       Sprite,
       VolumeSnapshot,
+      WebsiteServer,
     ]),
   ).pipe(
     Layer.provide(
       Layer.mergeAll(
         AppProvider(),
+        AssetDeploymentProvider(),
         BucketProvider(),
         CertificateProvider(),
         IpAssignmentProvider(),
@@ -103,6 +115,7 @@ export const providers = () =>
         ServiceProvider(),
         SpriteProvider(),
         VolumeSnapshotProvider(),
+        WebsiteServerProvider(),
       ),
     ),
     // The binding layers are mutually independent — they all draw on the
@@ -137,5 +150,6 @@ export const providers = () =>
     Layer.provideMerge(ProfileLive),
     Layer.provideMerge(CredentialsStoreLive),
     Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(Command.providers()),
     Layer.orDie,
   );

package/src/Fly/ReadRedis.ts

@@ -1,7 +1,7 @@
 import type * as Effect from "effect/Effect";
 import * as Binding from "../Binding.ts";
-import type { RuntimeContext } from "../RuntimeContext.ts";
-import type { Redis, RedisCommandError, RedisUrlMissing } from "./Redis.ts";
+import type { ReadClient } from "../Redis/index.ts";
+import type { Redis } from "./Redis.ts";
 
 /**
  * Bind a {@link Redis} database with read access (`get`, `ping`).
@@ -27,17 +27,4 @@ export interface ReadRedis extends Binding.Service<
 
 export const ReadRedis = Binding.Service<ReadRedis>("Fly.ReadRedis");
 
-export interface ReadRedisClient {
-  get(
-    key: string,
-  ): Effect.Effect<
-    string | null,
-    RedisCommandError | RedisUrlMissing,
-    RuntimeContext
-  >;
-  ping(): Effect.Effect<
-    string,
-    RedisCommandError | RedisUrlMissing,
-    RuntimeContext
-  >;
-}
+export type ReadRedisClient = ReadClient;

package/src/Fly/Redis.ts

@@ -28,16 +28,10 @@ export const REDIS_ADDON_TYPE = "upstash_redis";
 export const REDIS_PROVIDER = "upstash_redis";
 export const REDIS_URL_ENV = "REDIS_URL";
 
-export class RedisUrlMissing extends Data.TaggedError("Fly.RedisUrlMissing")<{
-  name: string;
-}> {}
-
-export class RedisCommandError extends Data.TaggedError(
-  "Fly.RedisCommandError",
-)<{
-  command: string;
-  cause: unknown;
-}> {}
+export {
+  CommandError as RedisCommandError,
+  UrlMissing as RedisUrlMissing,
+} from "../Redis/index.ts";
 
 export interface RedisProps {
   /**