alchemy 2.0.0-beta.73 → 2.0.0-beta.75

package/src/Fly/hosted.ts

@@ -17,14 +17,25 @@ import {
   getStableContextDir,
   resolveMainPath,
 } from "../Bundle/TempRoot.ts";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
 import type { Docker } from "../Docker/Docker.ts";
 import type { ResourceBinding } from "../Resource.ts";
-import { Self } from "../Self.ts";
 import {
   createContainerRuntimeContext,
   type HostRuntimeContext,
 } from "../Server/Process.ts";
-import { sha256Object } from "../Util/sha256.ts";
+import {
+  copyExtraFiles,
+  contextRootOf,
+  extraFileDestination,
+  hashExtraFiles,
+  isContextRootDest,
+  posixRelUnder,
+  resolveExtraSource,
+  type ExtraFile,
+} from "../Util/extraFiles.ts";
+import { sha256, sha256Object } from "../Util/sha256.ts";
 import type { DiskSpec, ServiceBinding } from "./MountVolume.ts";
 
 export type FlyHostRuntimeContext = HostRuntimeContext;
@@ -32,14 +43,14 @@ export type FlyHostRuntimeContext = HostRuntimeContext;
 export const createFlyHostRuntimeContext = createContainerRuntimeContext;
 
 export const FLY_REGISTRY = "registry.fly.io";
-export const DEFAULT_BASE_IMAGE = "oven/bun:1";
+export const DEFAULT_BASE_IMAGE = "node:26-slim";
 export const DEFAULT_PORT = 3000;
 export const MACHINE_PLATFORM = "linux/amd64";
 
 export interface FlyBuildOptions extends Bundle.BundleConfig {
   /**
    * Native or Node-only packages to install into the Machine image with
-   * `bun install` instead of bundling them. `pg` is CommonJS: Rolldown's
+   * `npm install` instead of bundling them. `pg` is CommonJS: Rolldown's
    * interop turns `Client` into a namespace (`The superclass is not a
    * constructor`). Same `build.install` shape as Lambda.
    *
@@ -51,6 +62,8 @@ export interface FlyBuildOptions extends Bundle.BundleConfig {
   readonly install?: PackageInstall;
 }
 
+export type { ExtraFile };
+
 export interface HostedProgramProps {
   main: string;
   handler?: string;
@@ -59,8 +72,16 @@ export interface HostedProgramProps {
   env?: Record<string, any>;
   isExternal?: boolean;
   build?: FlyBuildOptions;
+  /**
+   * Extra host directories baked into the image (framework client
+   * assets, Next.js `.next`, …). Hashed into `code.hash` so asset
+   * changes rebuild the image.
+   */
+  extraFiles?: ReadonlyArray<ExtraFile>;
 }
 
+export { extraFileDestination };
+
 const matchesConfiguredExternal = (
   external: rolldown.InputOptions["external"],
   moduleId: string,
@@ -83,73 +104,23 @@ export class DeployTokenMissing extends Data.TaggedError(
   appName: string;
 }> {}
 
+/**
+ * The generated entry for `Fly.Service` / `Fly.Sprite` machines: a shim
+ * importing only `alchemy/Runtime/Bootstrap/Fly` plus the user's `main` —
+ * see that module for why the entry never imports alchemy's own
+ * dependencies. The runtime flag is raised BEFORE the user's module is
+ * evaluated (hence the dynamic import) so its module-scope code sees it.
+ */
 const makeBunBootstrap =
   (handler: string) =>
   (importPath: string): string =>
     `
-import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy/Http";
-import { Stack } from "alchemy/Stack";
-import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
+import { bootstrap } from "alchemy/Runtime/Bootstrap/Fly";
 
 globalThis.__ALCHEMY_RUNTIME__ = true;
 const { ${handler}: entrypoint } = await import(${JSON.stringify(importPath)});
 
-const tag = Context.Service(${JSON.stringify(Self.key)});
-const layer = makeEntrypointLayer(tag, entrypoint);
-
-const platform = Layer.mergeAll(
-  BunServices.layer,
-  FetchHttpClient.layer,
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.effect(
-  Stack,
-  Effect.all([
-    Config.string("ALCHEMY_STACK_NAME"),
-    Config.string("ALCHEMY_STAGE")
-  ]).pipe(
-    Effect.map(([name, stage]) => ({
-      name,
-      stage,
-      bindings: {},
-      resources: {}
-    }))
-  )
-);
-
-const program = tag.pipe(
-  Effect.flatMap((service) => service.RuntimeContext.exports),
-  Effect.flatMap((exports) => exports.program),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      Layer.provideMerge(BunHttpServer({ hostname: "0.0.0.0" })),
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-console.log("Fly service bootstrap starting...");
-await Effect.runPromise(program).catch((err) => {
-  console.error("Fly service bootstrap failed:", err);
-  process.exit(1);
-});
+await bootstrap(entrypoint);
 `;
 
 /** Flatten a binding/env leaf into a machine env string. Unwraps Redacted. */
@@ -300,6 +271,17 @@ export const defaultHttpServices = (
       { port: 80, handlers: ["http"], force_https: true },
       { port: 443, handlers: ["tls", "http"] },
     ],
+    // Wait until the process is listening before the proxy sends traffic.
+    // Without this, fly.dev hangs (status 0) while Node is still booting.
+    checks: [
+      {
+        type: "tcp",
+        port,
+        interval: "10s",
+        timeout: "2s",
+        grace_period: "30s",
+      },
+    ],
   },
 ];
 
@@ -315,23 +297,46 @@ const generateDockerfile = (
   props: HostedProgramProps,
   hasChunks: boolean,
   install?: Record<string, string>,
+  entryRel?: string,
 ) => {
   const port = props.port ?? DEFAULT_PORT;
   const lines = [`FROM ${props.image ?? DEFAULT_BASE_IMAGE}`, `WORKDIR /app`];
   if (install !== undefined && Object.keys(install).length > 0) {
     lines.push(
       `COPY package.json /app/package.json`,
-      `RUN bun install --production`,
+      `RUN npm install --omit=dev --no-fund --no-audit`,
     );
   }
+  if (props.isExternal === true) {
+    lines.push(`COPY . /app`);
+    const entry =
+      entryRel !== undefined && entryRel.length > 0
+        ? entryRel
+        : "serve-node.mjs";
+    lines.push(
+      `ENV PORT=${String(port)}`,
+      `ENV HOST=0.0.0.0`,
+      `EXPOSE ${String(port)}`,
+      `ENTRYPOINT ["node", ${JSON.stringify(`/app/${entry}`)}]`,
+    );
+    return `${lines.join("\n")}\n`;
+  }
   lines.push(`COPY index.mjs /app/index.mjs`);
   if (hasChunks) {
     lines.push(`COPY *.js /app/`);
   }
+  const seen = new Set<string>();
+  for (const extra of props.extraFiles ?? []) {
+    const dest = extraFileDestination(extra.dest);
+    if (isContextRootDest(dest) || seen.has(dest)) continue;
+    seen.add(dest);
+    lines.push(`COPY ${dest} /app/${dest}`);
+  }
   lines.push(
     `ENV PORT=${String(port)}`,
+    `ENV HOST=0.0.0.0`,
     `EXPOSE ${String(port)}`,
-    `ENTRYPOINT ["bun", "/app/index.mjs"]`,
+    `ENTRYPOINT ["node", "/app/index.mjs"]`,
   );
   return `${lines.join("\n")}\n`;
 };
@@ -362,6 +367,7 @@ export const createFlyHostedSupport = ({
     ALCHEMY_STACK_NAME: stackName,
     ALCHEMY_STAGE: stage,
     ALCHEMY_PHASE: "runtime",
+    HOST: "0.0.0.0",
   };
 
   const bundleProgram = Effect.fn(function* (props: HostedProgramProps) {
@@ -396,7 +402,7 @@ export const createFlyHostedSupport = ({
             );
           },
           resolve: {
-            conditionNames: ["bun", "import", "module", "default"],
+            conditionNames: [...Bundle.NODE_CONDITION_NAMES],
             ...props.build?.input?.resolve,
           },
           plugins: [props.build?.input?.plugins, plugins],
@@ -413,9 +419,21 @@ export const createFlyHostedSupport = ({
       );
     });
 
-    const bundleOutput = props.isExternal
-      ? yield* buildBundle(realMain)
-      : yield* buildBundle(realMain, virtualEntryPlugin(bootstrap));
+    if (props.isExternal === true) {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const bytes = yield* fs.readFile(realMain);
+      const hash = yield* sha256(bytes);
+      return {
+        files: [{ path: path.basename(realMain), content: bytes }],
+        hash,
+      };
+    }
+
+    const bundleOutput = yield* buildBundle(
+      realMain,
+      virtualEntryPlugin(bootstrap),
+    );
 
     const files = bundleOutput.files.map((file) => ({
       path: file.path,
@@ -432,6 +450,7 @@ export const createFlyHostedSupport = ({
     const bundled = yield* bundleProgram(props);
     const realMain = yield* resolveMainPath(props.main);
     const cwd = yield* findCwdForBundle(realMain);
+    const path = yield* Path.Path;
     const requested = yield* normalizeInstallTargets(props.build?.install);
     const identity =
       Object.keys(requested).length > 0
@@ -443,17 +462,32 @@ export const createFlyHostedSupport = ({
         : undefined;
     const packageJson =
       install === undefined ? undefined : installManifest(install);
+    const extras = (props.extraFiles ?? []).map((file) => ({
+      source: file.source,
+      dest: file.dest,
+    }));
+    const root = contextRootOf(realMain, extras, path, (source) =>
+      resolveExtraSource(source, path),
+    );
+    const entryRel =
+      props.isExternal === true
+        ? (posixRelUnder(root, realMain, path) ?? path.basename(realMain))
+        : undefined;
     const dockerfile = generateDockerfile(
       props,
       bundled.files.length > 1,
       install,
+      entryRel,
     );
+    const extraFiles = yield* hashExtraFiles(props.extraFiles);
     const codeHash = (yield* sha256Object({
       bundleHash: bundled.hash,
       dockerfile,
       packageJson,
+      extraFiles,
+      extraFilesIncludesNodeModules: true,
     })).slice(0, 16);
-    return { bundled, dockerfile, codeHash, packageJson };
+    return { bundled, dockerfile, codeHash, packageJson, entryRel };
   });
 
   const imageExists = (imageRef: string) =>
@@ -485,6 +519,7 @@ export const createFlyHostedSupport = ({
     yield* note(`Bundling ${input.id} program...`);
     const { bundled, dockerfile, codeHash, packageJson } =
       yield* computeCodeHash(input.props);
+    yield* note(`Hashed ${input.id} (${codeHash})`);
     const repo = sanitizeImageRepo(input.id);
     const imageRef = `${FLY_REGISTRY}/${input.appName}:${repo}-${codeHash}`;
 
@@ -499,21 +534,54 @@ export const createFlyHostedSupport = ({
         dotAlchemy,
         `${input.id}-image`,
       );
-      const files = bundled.files.map((file, index) => ({
-        path: index === 0 ? "index.mjs" : file.path,
-        content: file.content,
-      }));
-      if (packageJson !== undefined) {
-        files.push({
-          path: "package.json",
-          content: new TextEncoder().encode(packageJson),
-        });
-      }
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const files =
+        input.props.isExternal === true
+          ? packageJson !== undefined
+            ? [
+                {
+                  path: "package.json",
+                  content: new TextEncoder().encode(packageJson),
+                },
+              ]
+            : []
+          : [
+              ...bundled.files.map((file, index) => ({
+                path: index === 0 ? "index.mjs" : file.path,
+                content: file.content,
+              })),
+              ...(packageJson !== undefined
+                ? [
+                    {
+                      path: "package.json",
+                      content: new TextEncoder().encode(packageJson),
+                    },
+                  ]
+                : []),
+            ];
       yield* docker.materialize({
         context: contextDir,
         dockerfile,
         files,
       });
+      yield* copyExtraFiles(contextDir, input.props.extraFiles);
+      if (input.props.isExternal === true) {
+        const extras = (input.props.extraFiles ?? []).map((file) => ({
+          source: file.source,
+          dest: file.dest,
+        }));
+        const root = contextRootOf(realMain, extras, path, (source) =>
+          resolveExtraSource(source, path),
+        );
+        const entryRel =
+          posixRelUnder(root, realMain, path) ?? path.basename(realMain);
+        const dest = path.join(contextDir, entryRel);
+        if (!(yield* fs.exists(dest).pipe(Effect.orElseSucceed(() => false)))) {
+          yield* fs.makeDirectory(path.dirname(dest), { recursive: true });
+          yield* fs.copy(realMain, dest, { overwrite: true });
+        }
+      }
       yield* note(`Building container image ${imageRef}...`);
       yield* docker.image.build({
         context: contextDir,
@@ -564,7 +632,7 @@ export const createFlyHostedSupport = ({
 
 /**
  * Bundle a Sprite program the same way {@link createFlyHostedSupport}
- * bundles a Service — rolldown + bun bootstrap — without building a
+ * bundles a Service — rolldown + Node bootstrap — without building a
  * Docker image. The provider writes the files onto the Sprite.
  */
 export const createSpriteHostedSupport = ({
@@ -582,6 +650,7 @@ export const createSpriteHostedSupport = ({
     ALCHEMY_STACK_NAME: stackName,
     ALCHEMY_STAGE: stage,
     ALCHEMY_PHASE: "runtime",
+    HOST: "0.0.0.0",
   };
 
   const bundleProgram = Effect.fn(function* (props: HostedProgramProps) {
@@ -606,7 +675,7 @@ export const createSpriteHostedSupport = ({
             ...((props.build?.input?.external as string[] | undefined) ?? []),
           ],
           resolve: {
-            conditionNames: ["bun", "import", "module", "default"],
+            conditionNames: [...Bundle.NODE_CONDITION_NAMES],
             ...props.build?.input?.resolve,
           },
           plugins: [props.build?.input?.plugins, plugins],

package/src/Fly/index.ts

@@ -52,5 +52,6 @@ export * from "./Sprite.ts";
 export * from "./Verify.ts";
 export * from "./VerifyHttp.ts";
 export * from "./VolumeSnapshot.ts";
+export * as Website from "./Website/index.ts";
 export * from "./WriteSecret.ts";
 export * from "./WriteSecretHttp.ts";

package/src/Hetzner/MountVolume.ts

@@ -53,7 +53,7 @@ export interface ServiceBinding {
  *
  * `yield* Hetzner.MountVolume(volume, { path: "/data" })` inside a
  * Service impl registers `{ env, volumes: [{ volumeId, path }] }` on the
- * host. Service reconcile attaches the Volume (automount ok) and SSHs
+ * host. Service reconcile attaches the Volume (no automount) and SSHs
  * `mkdir` + `mount` + fstab at `path`. The same `(volume, server, path)`
  * from two Services is one attach and one mount.
  *

package/src/Hetzner/Providers.ts

@@ -2,6 +2,7 @@ import * as Layer from "effect/Layer";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
 import { ProfileLive } from "../Auth/Profile.ts";
+import * as Command from "../Command/index.ts";
 import * as Provider from "../Provider.ts";
 import { HetznerAuth } from "./AuthProvider.ts";
 import { Certificate, CertificateProvider } from "./Certificate.ts";
@@ -33,6 +34,10 @@ import {
   VolumeAttachmentProvider,
 } from "./VolumeAttachment.ts";
 import { Zone, ZoneProvider } from "./Zone.ts";
+import {
+  Server as WebsiteServer,
+  ServerProvider as WebsiteServerProvider,
+} from "../Website/Server.ts";
 
 export class Providers extends Provider.ProviderCollection<Providers>()(
   "Hetzner",
@@ -85,6 +90,7 @@ export const providers = () =>
       SshKey,
       Volume,
       VolumeAttachment,
+      WebsiteServer,
       Zone,
     ]),
   ).pipe(
@@ -105,6 +111,7 @@ export const providers = () =>
         SshKeyProvider(),
         VolumeProvider(),
         VolumeAttachmentProvider(),
+        WebsiteServerProvider(),
         ZoneProvider(),
       ),
     ),
@@ -119,5 +126,6 @@ export const providers = () =>
     Layer.provideMerge(ProfileLive),
     Layer.provideMerge(CredentialsStoreLive),
     Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(Command.providers()),
     Layer.orDie,
   );

package/src/Hetzner/Server.ts

@@ -146,7 +146,7 @@ export interface ServerProps {
    * Accepts a shell script (`#!/bin/bash …`), a `#cloud-config` document,
    * or a bare shell snippet (a `#!/bin/bash` shebang is added for you).
    * Alchemy combines it with its own bootstrap script (which preinstalls
-   * `bun` for `Hetzner.Service`) into a multipart cloud-init document, so
+   * Node 26 for `Hetzner.Service`) into a multipart cloud-init document, so
    * both run — the bootstrap first. A document that already starts with a
    * `Content-Type:` / `MIME-Version:` header is passed through untouched,
    * taking over the whole payload including the bootstrap.
@@ -429,6 +429,22 @@ const backoff = Schedule.min([
   Schedule.spaced(Duration.seconds(5)),
 ]);
 
+/** Companion deploy keys are not stack resources — delete must be idempotent. */
+const deleteDeployKey = (id: number | undefined) =>
+  id === undefined
+    ? Effect.void
+    : Services.sshKeys.deleteSshKey({ id }).pipe(
+        Effect.retry({
+          while: (e) =>
+            retryable(e) ||
+            e._tag === "UnprocessableEntity" ||
+            e._tag === "Conflict",
+          times: 8,
+          schedule: backoff,
+        }),
+        Effect.catchTag("NotFound", () => Effect.void),
+      );
+
 const createServerName = (
   id: string,
   name: string | undefined,
@@ -447,23 +463,20 @@ const createServerName = (
   });
 
 /**
- * Preinstall Bun so `Hetzner.Service`'s first deploy does not have to.
- * Mirrors the SSH-side install in `./hosted.ts` — Ubuntu images ship curl
- * but not unzip, and bun's installer needs both. Never fails the boot:
- * `hosted.ts` installs Bun over SSH if this did not manage to.
+ * Preinstall Node 26 so `Hetzner.Service`'s first deploy does not have to.
+ * Mirrors the SSH-side install in `./hosted.ts`. Never fails the boot:
+ * `hosted.ts` installs Node over SSH if this did not manage to.
  */
 const ALCHEMY_BOOTSTRAP = `#!/bin/bash
 set -uo pipefail
 export HOME=/root
-export BUN_INSTALL=/root/.bun
-export PATH="/root/.bun/bin:$PATH"
 if ! command -v curl >/dev/null 2>&1 || ! command -v unzip >/dev/null 2>&1; then
   apt-get update || true
   DEBIAN_FRONTEND=noninteractive apt-get install -y curl unzip ca-certificates || true
 fi
-if [ ! -x /root/.bun/bin/bun ]; then
+if ! command -v node >/dev/null 2>&1; then
   for attempt in 1 2 3; do
-    curl -fsSL https://bun.sh/install | bash && break
+    curl -fsSL https://deb.nodesource.com/setup_26.x | bash - && DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs && break
     sleep 5
   done
 fi
@@ -1025,7 +1038,22 @@ export const ServerProvider = () =>
                   }
                 : undefined,
           })
-          .pipe(Effect.catchTag("Conflict", () => Effect.succeed(undefined)));
+          .pipe(
+            Effect.retry({
+              while: (e) =>
+                e._tag === "ServerLimitExceeded" ||
+                e._tag === "ServerPlacementError",
+              schedule: Schedule.spaced("5 seconds"),
+              times: 8,
+            }),
+            Effect.catchTag("Conflict", () => Effect.succeed(undefined)),
+            // The deploy key is a side-effect, not a stack resource. If
+            // createServer fails after minting it (quota skip, timeout),
+            // nothing is persisted for Server.delete to clean up.
+            Effect.tapError(() =>
+              deleteDeployKey(deployKey.deploySshKeyId).pipe(Effect.ignore),
+            ),
+          );
         if (created !== undefined) {
           if (created.action) {
             yield* waitForActions([created.action, ...created.next_actions]);
@@ -1156,10 +1184,6 @@ export const ServerProvider = () =>
         yield* waitUntilGone(current.id);
       }
 
-      if (output.deploySshKeyId !== undefined) {
-        yield* Services.sshKeys
-          .deleteSshKey({ id: output.deploySshKeyId })
-          .pipe(Effect.catchTag("NotFound", () => Effect.void));
-      }
+      yield* deleteDeployKey(output.deploySshKeyId);
     }),
   });

package/src/Hetzner/Service.ts

@@ -18,6 +18,7 @@ import {
   collectBindingState,
   createHetznerHostedSupport,
   createHetznerHostRuntimeContext,
+  type HetznerBuildOptions,
   type HetznerHostRuntimeContext,
 } from "./hosted.ts";
 
@@ -58,9 +59,20 @@ export interface ServiceProps extends PlatformProps {
   env?: Record<string, any>;
   /**
    * Bundler configuration for `main`: rolldown `input`/`output` overrides
-   * plus pure-annotation options (`pure`).
+   * plus pure-annotation options (`pure`) and `install` for packages that
+   * must ship as real `node_modules` (see {@link HetznerBuildOptions}).
    */
-  build?: Bundle.BundleConfig;
+  build?: HetznerBuildOptions;
+  /**
+   * Extra host directories packed into the unit archive next to the
+   * bundled entry (e.g. a website `clientDirectory` at `dist/`). Hashed
+   * into `code.hash` so asset changes update the unit. Destination is
+   * relative to the unit root (`/opt/<unit>/`).
+   */
+  extraFiles?: ReadonlyArray<{
+    source: string;
+    destination: string;
+  }>;
 }
 
 export type Service = Resource<
@@ -288,13 +300,16 @@ export const ServiceProvider = () =>
             ...news.env,
           };
 
-          const { archive, hash } = yield* hosted.bundleProgram(id, news);
+          const { archive, hash, entryRel } = yield* hosted.bundleProgram(
+            id,
+            news,
+          );
 
           const ssh = yield* openSession(news);
           yield* Effect.ensuring(
             Effect.gen(function* () {
               yield* hosted.waitForSsh(ssh);
-              // Attach (automount ok) then mkdir+mount+fstab. The same
+              // Attach (no automount) then mkdir+mount+fstab. The same
               // (volume, server, path) from two Services is one attach
               // and one mount — both steps are independently idempotent.
               yield* hosted.attachAndMount({
@@ -307,6 +322,7 @@ export const ServiceProvider = () =>
                 unitName,
                 archive,
                 env,
+                entryRel,
               });
             }),
             ssh.close,