feat(fly-io,hetzner,railway): MachineIdentity, tagged createServer errors, slim GraphQL

[sam-goodwin]

Add Fly MachineIdentity so Machines PetSem encrypt/sign/decrypt/verify can talk to /.fly/api as the machine. Org-token GetSecret on the same fiber is unchanged.

Slim Railway GraphQL list/get selections so nuke list()s don't pull workspace/team/members/baseEnvironment/canvasGroupRefs/subscriptionType — those fields fail decode on live rows and blow the rate budget. Stop paginateRelay when endCursor does not advance. Type GraphQL INTERNAL_SERVER_ERROR "not found" / "creating too quickly" as RailwayNotFound / RailwayRateLimited, and parse retry-after from "per N seconds" or "every N s" (default 31s when the gateway sends none). Identify GraphQL as source=alchemy so Cloudflare's anonymous 10 RPS cap does not apply.

Type Hetzner createServer quota/placement failures as ServerLimitExceeded / ServerPlacementError instead of Forbidden / PreconditionFailed plus message text. convert.ts applies /shapes/ patches after OpenAPI conversion.

Fly MachineIdentity

FlyIoProtocol still sends Authorization: Bearer by default. A per-call MachineIdentity service drops that header and sets Connection: close. The protocol does not sniff an empty API key.

export class MachineIdentity extends Context.Service<
  MachineIdentity,
  true
>()("FlyIoMachineIdentity") {}

Generated machines ops are unchanged. Callers provide MachineIdentity plus an HttpClient with socketPath: "/.fly/api".

Hetzner createServer errors

// 403 resource_limit_exceeded, message includes "server limit"
ServerLimitExceeded
// 412 resource_unavailable, message includes "placement"
ServerPlacementError

Railway GraphQL

# projects list — identity scalars
project { id name workspaceId baseEnvironmentId primaryEnvironmentId }

# project({id}) — identity plus services / buckets / groups
services { id name groupId templateId }
buckets  { id name groupId }
groups   { id name groupId }

# environments list — identity plus volumeInstances (no environment({id}))
# volumeInstance GET — no nested environment
# volumeCreate — returns volumeInstances

# Boolean! mutations — no subfields
mutation deploymentCancel($id: String!) { deploymentCancel(id: $id) }

environment({id}) still selects canvasGroupRefs / meta. List paths must not call it.

const retryAfterForRateLimit = (message, headers) => {
  const fromHeader = parseRetryAfterForStatus(429, headers);
  if (fromHeader !== undefined) return fromHeader;
  const match =
    /per (\d+) seconds/.exec(message) ?? /every (\d+)\s*s/.exec(message);
  if (match !== null) return Duration.seconds(Number(match[1]) + 1);
  return Duration.seconds(31);
};

[alchemy-version-bot]

Install the packages built from this commit:

Distilled

@distilled.cloud/core

bun add https://pkg.ing/@distilled.cloud/core/88b462a

@distilled.cloud/aws

bun add https://pkg.ing/@distilled.cloud/aws/88b462a

@distilled.cloud/axiom

bun add https://pkg.ing/@distilled.cloud/axiom/88b462a

@distilled.cloud/azure

bun add https://pkg.ing/@distilled.cloud/azure/88b462a

@distilled.cloud/cloudflare

bun add https://pkg.ing/@distilled.cloud/cloudflare/88b462a

@distilled.cloud/coinbase

bun add https://pkg.ing/@distilled.cloud/coinbase/88b462a

@distilled.cloud/discord

bun add https://pkg.ing/@distilled.cloud/discord/88b462a

@distilled.cloud/expo-eas

bun add https://pkg.ing/@distilled.cloud/expo-eas/88b462a

@distilled.cloud/fly-io

bun add https://pkg.ing/@distilled.cloud/fly-io/88b462a

@distilled.cloud/gcp

bun add https://pkg.ing/@distilled.cloud/gcp/88b462a

@distilled.cloud/github

bun add https://pkg.ing/@distilled.cloud/github/88b462a

@distilled.cloud/hetzner

bun add https://pkg.ing/@distilled.cloud/hetzner/88b462a

@distilled.cloud/kubernetes

bun add https://pkg.ing/@distilled.cloud/kubernetes/88b462a

@distilled.cloud/mongodb-atlas

bun add https://pkg.ing/@distilled.cloud/mongodb-atlas/88b462a

@distilled.cloud/neon

bun add https://pkg.ing/@distilled.cloud/neon/88b462a

@distilled.cloud/planetscale

bun add https://pkg.ing/@distilled.cloud/planetscale/88b462a

@distilled.cloud/posthog

bun add https://pkg.ing/@distilled.cloud/posthog/88b462a

@distilled.cloud/prisma-postgres

bun add https://pkg.ing/@distilled.cloud/prisma-postgres/88b462a

@distilled.cloud/railway

bun add https://pkg.ing/@distilled.cloud/railway/88b462a

@distilled.cloud/stripe

bun add https://pkg.ing/@distilled.cloud/stripe/88b462a

@distilled.cloud/supabase

bun add https://pkg.ing/@distilled.cloud/supabase/88b462a

@distilled.cloud/turso

bun add https://pkg.ing/@distilled.cloud/turso/88b462a

@distilled.cloud/typesense

bun add https://pkg.ing/@distilled.cloud/typesense/88b462a

@distilled.cloud/vercel

bun add https://pkg.ing/@distilled.cloud/vercel/88b462a

@distilled.cloud/workos

bun add https://pkg.ing/@distilled.cloud/workos/88b462a