@alchemy.run/fly 0.0.0-stage → 2.0.0-beta.84

package/lib/RedisBinding.js

@@ -0,0 +1,53 @@
+import * as Binding from "alchemy/Binding";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { REDIS_URL_ENV, RedisUrlMissing } from "./Redis.js";
+/**
+ * Shared scaffolding for Upstash Redis bindings.
+ *
+ * Each `{Op}Http.ts` is a thin `Layer.effect` over {@link makeRedisBinding}.
+ * Deploy-time registers the Redis add-on on the host so Service reconcile
+ * can attach it. The URL travels as `yield* redis.url` (RuntimeContext
+ * set/get). `REDIS_URL` written as an App secret is a fallback, not the
+ * primary path.
+ *
+ * The RESP client lives in `@alchemy.run/redis`. This file only wires the
+ * Fly host binding.
+ *
+ * NOT exported from `index.ts`.
+ */
+const isFlyHost = (value) => typeof value === "object" &&
+    value !== null &&
+    (value.Type === "Fly.Service" ||
+        value.Type === "Fly.Machine");
+const asPlain = (value) => {
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    if (Redacted.isRedacted(value))
+        return value.pipe(Redacted.value, asPlain);
+    return undefined;
+};
+const redisUrlFromEnv = Config.Redacted(REDIS_URL_ENV).pipe(Effect.map((value) => Redacted.value(value)));
+export const makeRedisBinding = (options) => Effect.succeed(Effect.fn(function* (redis) {
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+        const host = yield* Binding.Host;
+        if (isFlyHost(host)) {
+            yield* host.bind `${redis}`({
+                redis: { name: redis.name, id: redis.redisId },
+            });
+        }
+    }
+    const urlFromResource = yield* redis.url;
+    const missing = new RedisUrlMissing({
+        name: asPlain(redis.name) ?? redis.LogicalId,
+    });
+    const url = Effect.gen(function* () {
+        const fromOutput = asPlain(yield* urlFromResource);
+        if (fromOutput !== undefined)
+            return fromOutput;
+        return yield* redisUrlFromEnv.pipe(Effect.mapError(() => missing));
+    });
+    return options.makeClient(url);
+}));
+//# sourceMappingURL=RedisBinding.js.map

package/lib/RedisBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedisBinding.js","sourceRoot":"","sources":["../src/RedisBinding.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAc,MAAM,YAAY,CAAC;AAExE;;;;;;;;;;;;;GAaG;AAEH,MAAM,SAAS,GAAG,CAAC,KAAc,EAAuD,EAAE,CACxF,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,CAAE,KAA2B,CAAC,IAAI,KAAK,aAAa;QACjD,KAA2B,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;AAEzD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAsB,EAAE;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAS,OAA6C,EAAE,EAAE,CACxF,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAY;IAC/B,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,GAAG,KAAK,EAAE,CAAC;gBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC;QAClC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS;KAC7C,CAAC,CAAC;IACH,MAAM,GAAG,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC,CAAC,CACH,CAAC"}

package/lib/RedisHttp.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Shared Redis command-client builders. NOT exported from `index.ts`.
+ *
+ * The RESP client lives in `@alchemy.run/redis`. These aliases keep the
+ * `{Op}Http.ts` layers stable.
+ */
+export { makeRead as makeReadRedisClient, makeReadWrite as makeReadWriteRedisClient, makeWrite as makeWriteRedisClient, } from "@alchemy.run/redis";
+//# sourceMappingURL=RedisHttp.d.ts.map

package/lib/RedisHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedisHttp.d.ts","sourceRoot":"","sources":["../src/RedisHttp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,IAAI,mBAAmB,EAC/B,aAAa,IAAI,wBAAwB,EACzC,SAAS,IAAI,oBAAoB,GAClC,MAAM,oBAAoB,CAAC"}

package/lib/RedisHttp.js

@@ -0,0 +1,8 @@
+/**
+ * Shared Redis command-client builders. NOT exported from `index.ts`.
+ *
+ * The RESP client lives in `@alchemy.run/redis`. These aliases keep the
+ * `{Op}Http.ts` layers stable.
+ */
+export { makeRead as makeReadRedisClient, makeReadWrite as makeReadWriteRedisClient, makeWrite as makeWriteRedisClient, } from "@alchemy.run/redis";
+//# sourceMappingURL=RedisHttp.js.map

package/lib/RedisHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedisHttp.js","sourceRoot":"","sources":["../src/RedisHttp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,IAAI,mBAAmB,EAC/B,aAAa,IAAI,wBAAwB,EACzC,SAAS,IAAI,oBAAoB,GAClC,MAAM,oBAAoB,CAAC"}

package/lib/Region.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A Fly.io region code. The literal codes are the regions Fly listed in
+ * September 2026 and give editor completion; any other string is accepted
+ * so new regions work without an Alchemy release. `bom` is deprecated by
+ * Fly. See [Regions](/fly/compute/regions).
+ */
+export type Region = "ams" | "arn" | "bom" | "cdg" | "dfw" | "ewr" | "fra" | "gru" | "iad" | "jnb" | "lax" | "lhr" | "nrt" | "ord" | "sin" | "sjc" | "syd" | "yyz" | (string & {});
+/** Normalize a `Region | Region[]` prop into a de-duplicated list. */
+export declare const regionList: (region: Region | readonly Region[] | undefined, fallback: string) => string[];
+/**
+ * Region of replica `index` when `count` replicas run in each of
+ * `regions`. Replicas are spread round-robin, so growing `count` keeps
+ * every existing replica in its region.
+ */
+export declare const regionOfReplica: (regions: readonly string[], index: number) => string;
+//# sourceMappingURL=Region.d.ts.map

package/lib/Region.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Region.d.ts","sourceRoot":"","sources":["../src/Region.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GACd,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,sEAAsE;AACtE,eAAO,MAAM,UAAU,WACb,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,YACpC,MAAM,KACf,MAAM,EAIR,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAa,SAAS,MAAM,EAAE,SAAS,MAAM,WACvC,CAAC"}

package/lib/Region.js

@@ -0,0 +1,13 @@
+/** Normalize a `Region | Region[]` prop into a de-duplicated list. */
+export const regionList = (region, fallback) => {
+    const list = region === undefined ? [fallback] : [region].flat();
+    const unique = [...new Set(list)];
+    return unique.length === 0 ? [fallback] : unique;
+};
+/**
+ * Region of replica `index` when `count` replicas run in each of
+ * `regions`. Replicas are spread round-robin, so growing `count` keeps
+ * every existing replica in its region.
+ */
+export const regionOfReplica = (regions, index) => regions[index % regions.length];
+//# sourceMappingURL=Region.js.map

package/lib/Region.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Region.js","sourceRoot":"","sources":["../src/Region.ts"],"names":[],"mappings":"AA2BA,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAA8C,EAC9C,QAAgB,EACN,EAAE;IACZ,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAE,KAAa,EAAE,EAAE,CAC3E,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAE,CAAC"}

package/lib/Secret.d.ts

@@ -0,0 +1,190 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { App } from "./App.ts";
+import type { Providers } from "./Providers.ts";
+/**
+ * A resource-valued prop: the resource itself, or an Effect that produces
+ * it (so `yield* App(...)` and `App(...)` both type-check).
+ */
+type Ref<T> = T | Effect.Effect<T, never, Providers>;
+export interface SecretProps {
+    /**
+     * Parent Fly App. Changing it replaces the secret.
+     */
+    app: Ref<App>;
+    /**
+     * Secret name. Used as the Machine env-var name when set by the user
+     * (case-sensitive, stored as-is). If omitted, a unique name is generated
+     * from the stack, stage and logical ID (the ownership stamp). Changing
+     * it replaces the secret.
+     */
+    name?: string;
+    /**
+     * Secret value. Wrap with `Redacted.make(...)` so it is never logged.
+     * Updated in place via `updateSecrets`. Never persisted in attributes.
+     */
+    value: Redacted.Redacted<string> | string;
+}
+export type Secret = Resource<"Fly.Secret", SecretProps, {
+    /** Parent Fly App name. */
+    appName: string;
+    /** Secret name (unique per App). */
+    name: string;
+    /** Fly digest of the current value. Not the plaintext. */
+    digest: string | undefined;
+    /** RFC3339 creation timestamp. */
+    createdAt: string | undefined;
+    /** RFC3339 last-update timestamp. */
+    updatedAt: string | undefined;
+}, never, Providers>;
+declare const SecretResource: import("alchemy/Resource").ResourceClass<Secret>;
+/**
+ * A Fly.Secret is an App vault entry. Fly injects it as an environment
+ * variable on every Machine. Use it when the value is shared and
+ * managed in one place by Fly.
+ *
+ * For a secret only this {@link Service} reads from `.env` at deploy
+ * time, yield `Config.Redacted` instead. Do not pass `env: { ... }` on
+ * a Service.
+ *
+ * @see https://fly.io/docs/apps/secrets/
+ *
+ * ### Config.Redacted on a Service
+ * Most secrets in a Service come from your `.env`. Yield
+ * `Config.Redacted` in init. Alchemy binds the value onto the Machine.
+ *
+ * **Example:** Bind from .env
+ * ```typescript
+ * import * as Config from "effect/Config";
+ * import * as Redacted from "effect/Redacted";
+ *
+ * export default class Api extends Fly.Service<Api>()(
+ *   "Api",
+ *   { app: Site, main: import.meta.url, port: 3000 },
+ *   Effect.gen(function* () {
+ *     const apiKey = yield* Config.Redacted("API_KEY");
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const token = Redacted.value(apiKey);
+ *         return HttpServerResponse.text("ok");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * ### Create a Secret
+ * Wrap the value with `Redacted.make` so it is never logged. The
+ * plaintext is never stored in attributes. Omit `name` and Alchemy
+ * generates an ownership-stamped name.
+ *
+ * **Example:** Generated name
+ * ```typescript
+ * const dbUrl = yield* Fly.Secret("DatabaseUrl", {
+ *   app: Site,
+ *   value: Redacted.make("postgres://…"),
+ * });
+ * ```
+ *
+ * :::caution[Changing `app` replaces the Secret]
+ * The value is created on the new App. The old name is deleted.
+ * :::
+ *
+ * ### Env-var name
+ * `name` is the env-var Machines see. It is stored as-is
+ * (case-sensitive).
+ *
+ * **Example:** Explicit name
+ * ```typescript
+ * export const ApiToken = Fly.Secret("ApiToken", {
+ *   app: Site,
+ *   name: "API_TOKEN",
+ *   value: Redacted.make("sk_live_…"),
+ * });
+ * ```
+ *
+ * :::caution[Changing `name` replaces the Secret]
+ * Fly cannot rename a secret. Alchemy creates the new name, then
+ * deletes the old one.
+ * :::
+ *
+ * ### Rotate the value
+ * Updating `value` is in place via `updateSecrets`.
+ *
+ * **Example:** New value
+ * ```typescript
+ * export const ApiToken = Fly.Secret("ApiToken", {
+ *   app: Site,
+ *   name: "API_TOKEN",
+ *   value: Redacted.make("sk_live_rotated"),
+ * });
+ * ```
+ *
+ * ### Get a secret at runtime
+ * {@link GetSecret} is bound to one Secret. Provide
+ * {@link GetSecretHttp}. Fly only returns plaintext from a Machine in
+ * the same App. From a deploy-time Action you get metadata (name,
+ * digest, timestamps).
+ *
+ * **Example:** GetSecret
+ * ```typescript
+ * const get = yield* Fly.GetSecret(ApiToken);
+ * const got = yield* get();
+ * ```
+ *
+ * ### List secrets
+ * {@link ListSecrets} is bound to an {@link App}. From an Action, the
+ * org token can list any App in the org. From a Machine, deploy tokens
+ * are per-App. Mixing Apps on one Machine shares one `FLY_API_TOKEN`
+ * and is not supported.
+ *
+ * **Example:** ListSecrets
+ * ```typescript
+ * const list = yield* Fly.ListSecrets(Site);
+ * const { secrets } = yield* list();
+ * ```
+ *
+ * ### Write secrets
+ * {@link WriteSecret} creates, updates, and deletes by name. Provide
+ * {@link WriteSecretHttp} on the Action or Service Effect.
+ *
+ * **Example:** Rotate from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const secrets = yield* Fly.WriteSecret(ApiToken);
+ *
+ *     return Effect.fn(function* () {
+ *       yield* secrets.update("API_TOKEN", Redacted.make("sk_live_rotated"));
+ *     });
+ *   }).pipe(Effect.provide(Fly.WriteSecretHttp)),
+ * );
+ * ```
+ *
+ * @resource
+ * @product Secret
+ */
+export declare const Secret: typeof SecretResource;
+declare const SecretNotCreated_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Fly.SecretNotCreated";
+} & Readonly<A>;
+export declare class SecretNotCreated extends SecretNotCreated_base<{
+    appName: string;
+    name: string;
+}> {
+}
+declare const SecretAppRequired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Fly.SecretAppRequired";
+} & Readonly<A>;
+export declare class SecretAppRequired extends SecretAppRequired_base<{
+    message: string;
+}> {
+}
+export declare const SecretProvider: () => import("effect/Layer").Layer<Provider.Provider<Secret>, never, import("alchemy/Stack").Stack | import("alchemy/Stage").Stage | machines.FlyIoOpContext>;
+export {};
+//# sourceMappingURL=Secret.d.ts.map

package/lib/Secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../src/Secret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,kCAAkC,CAAC;AAG7D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,GAAG,EAAiB,MAAM,UAAU,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,MAAM,MAAM,GAAG,QAAQ,CAC3B,YAAY,EACZ,WAAW,EACX;IACE,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,kCAAkC;IAClC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAcF,QAAA,MAAM,cAAc,kDAAiC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+HG;AACH,eAAO,MAAM,MAAM,EAAE,OAAO,cAI3B,CAAC;;;;AAEF,qBAAa,gBAAiB,SAAQ,sBAAyC;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;CAAG;;;;AAEL,qBAAa,iBAAkB,SAAQ,uBAA0C;IAC/E,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;AA6DL,eAAO,MAAM,cAAc,+JAiIvB,CAAC"}

package/lib/Secret.js

@@ -0,0 +1,310 @@
+import { createHash } from "node:crypto";
+import * as machines from "@distilled.cloud/fly-io/machines";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { App, listOwnedApps } from "./App.js";
+import { createFlyVolumeName, matchesAlchemyPhysicalName } from "./Metadata.js";
+const resolveSecretProps = (props) => Effect.gen(function* () {
+    const resolved = Effect.isEffect(props) ? yield* props : props;
+    if (globalThis.__ALCHEMY_RUNTIME__)
+        return resolved;
+    const app = Effect.isEffect(resolved.app)
+        ? yield* resolved.app
+        : resolved.app;
+    return { ...resolved, app };
+});
+const SecretResource = Resource("Fly.Secret");
+/**
+ * A Fly.Secret is an App vault entry. Fly injects it as an environment
+ * variable on every Machine. Use it when the value is shared and
+ * managed in one place by Fly.
+ *
+ * For a secret only this {@link Service} reads from `.env` at deploy
+ * time, yield `Config.Redacted` instead. Do not pass `env: { ... }` on
+ * a Service.
+ *
+ * @see https://fly.io/docs/apps/secrets/
+ *
+ * ### Config.Redacted on a Service
+ * Most secrets in a Service come from your `.env`. Yield
+ * `Config.Redacted` in init. Alchemy binds the value onto the Machine.
+ *
+ * **Example:** Bind from .env
+ * ```typescript
+ * import * as Config from "effect/Config";
+ * import * as Redacted from "effect/Redacted";
+ *
+ * export default class Api extends Fly.Service<Api>()(
+ *   "Api",
+ *   { app: Site, main: import.meta.url, port: 3000 },
+ *   Effect.gen(function* () {
+ *     const apiKey = yield* Config.Redacted("API_KEY");
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const token = Redacted.value(apiKey);
+ *         return HttpServerResponse.text("ok");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * ### Create a Secret
+ * Wrap the value with `Redacted.make` so it is never logged. The
+ * plaintext is never stored in attributes. Omit `name` and Alchemy
+ * generates an ownership-stamped name.
+ *
+ * **Example:** Generated name
+ * ```typescript
+ * const dbUrl = yield* Fly.Secret("DatabaseUrl", {
+ *   app: Site,
+ *   value: Redacted.make("postgres://…"),
+ * });
+ * ```
+ *
+ * :::caution[Changing `app` replaces the Secret]
+ * The value is created on the new App. The old name is deleted.
+ * :::
+ *
+ * ### Env-var name
+ * `name` is the env-var Machines see. It is stored as-is
+ * (case-sensitive).
+ *
+ * **Example:** Explicit name
+ * ```typescript
+ * export const ApiToken = Fly.Secret("ApiToken", {
+ *   app: Site,
+ *   name: "API_TOKEN",
+ *   value: Redacted.make("sk_live_…"),
+ * });
+ * ```
+ *
+ * :::caution[Changing `name` replaces the Secret]
+ * Fly cannot rename a secret. Alchemy creates the new name, then
+ * deletes the old one.
+ * :::
+ *
+ * ### Rotate the value
+ * Updating `value` is in place via `updateSecrets`.
+ *
+ * **Example:** New value
+ * ```typescript
+ * export const ApiToken = Fly.Secret("ApiToken", {
+ *   app: Site,
+ *   name: "API_TOKEN",
+ *   value: Redacted.make("sk_live_rotated"),
+ * });
+ * ```
+ *
+ * ### Get a secret at runtime
+ * {@link GetSecret} is bound to one Secret. Provide
+ * {@link GetSecretHttp}. Fly only returns plaintext from a Machine in
+ * the same App. From a deploy-time Action you get metadata (name,
+ * digest, timestamps).
+ *
+ * **Example:** GetSecret
+ * ```typescript
+ * const get = yield* Fly.GetSecret(ApiToken);
+ * const got = yield* get();
+ * ```
+ *
+ * ### List secrets
+ * {@link ListSecrets} is bound to an {@link App}. From an Action, the
+ * org token can list any App in the org. From a Machine, deploy tokens
+ * are per-App. Mixing Apps on one Machine shares one `FLY_API_TOKEN`
+ * and is not supported.
+ *
+ * **Example:** ListSecrets
+ * ```typescript
+ * const list = yield* Fly.ListSecrets(Site);
+ * const { secrets } = yield* list();
+ * ```
+ *
+ * ### Write secrets
+ * {@link WriteSecret} creates, updates, and deletes by name. Provide
+ * {@link WriteSecretHttp} on the Action or Service Effect.
+ *
+ * **Example:** Rotate from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const secrets = yield* Fly.WriteSecret(ApiToken);
+ *
+ *     return Effect.fn(function* () {
+ *       yield* secrets.update("API_TOKEN", Redacted.make("sk_live_rotated"));
+ *     });
+ *   }).pipe(Effect.provide(Fly.WriteSecretHttp)),
+ * );
+ * ```
+ *
+ * @resource
+ * @product Secret
+ */
+export const Secret = Object.assign((id, props) => SecretResource(id, resolveSecretProps(props)), SecretResource);
+export class SecretNotCreated extends Data.TaggedError("Fly.SecretNotCreated") {
+}
+export class SecretAppRequired extends Data.TaggedError("Fly.SecretAppRequired") {
+}
+const appNameOf = (value) => {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const rec = value;
+    return typeof rec.appName === "string" && rec.appName.length > 0 ? rec.appName : undefined;
+};
+const unwrapSecret = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
+const resolveName = (id, name, existing) => Effect.gen(function* () {
+    // User env-var names are stored as-is (case-sensitive). Generated
+    // names use the Volume underscore shape — Fly rejects hyphens.
+    if (name !== undefined)
+        return name;
+    if (existing !== undefined)
+        return existing;
+    return yield* createFlyVolumeName(id);
+});
+const toAttrs = (appName, secret, fallbackName) => ({
+    appName,
+    name: secret.name ?? fallbackName,
+    digest: secret.digest,
+    createdAt: secret.created_at,
+    updatedAt: secret.updated_at,
+});
+const getByName = (appName, secretName) => machines
+    .getSecret({
+    app_name: appName,
+    secret_name: secretName,
+    show_secrets: false,
+})
+    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+const listSecrets = (appName) => machines
+    .listSecrets({
+    app_name: appName,
+    show_secrets: false,
+})
+    .pipe(Effect.map((res) => res.secrets ?? []), Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed([])));
+const flyDigestCandidates = (plain) => Effect.sync(() => {
+    const utf8 = Buffer.from(plain, "utf8");
+    return [
+        createHash("md5").update(utf8).digest("hex"),
+        createHash("sha256").update(utf8).digest("hex"),
+    ];
+});
+export const SecretProvider = () => Provider.succeed(Secret, {
+    stables: ["appName", "name", "createdAt"],
+    nuke: { dependsOn: ["Fly.App"] },
+    diff: Effect.fn(function* ({ news, output }) {
+        if (news === undefined || !isResolved(news))
+            return undefined;
+        if (output === undefined)
+            return undefined;
+        const desiredName = news.name !== undefined ? news.name : output.name;
+        const nameChanged = desiredName !== output.name;
+        const nextApp = appNameOf(news.app);
+        const appChanged = nextApp !== undefined && nextApp !== output.appName;
+        if (nameChanged || appChanged) {
+            return {
+                action: "replace",
+                // Same (app, name) cannot exist twice — delete the old secret first.
+                deleteFirst: nameChanged && !appChanged,
+            };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+        const appName = output?.appName ?? (olds !== undefined ? appNameOf(olds.app) : undefined);
+        if (appName === undefined)
+            return undefined;
+        const name = yield* resolveName(id, olds?.name, output?.name);
+        const found = yield* getByName(appName, name);
+        if (found === undefined)
+            return undefined;
+        const attrs = toAttrs(appName, found, name);
+        if (output !== undefined)
+            return attrs;
+        return matchesAlchemyPhysicalName(name) ? attrs : Unowned(attrs);
+    }),
+    list: Effect.fn(function* () {
+        const apps = yield* listOwnedApps();
+        const rows = yield* Effect.forEach(apps, (app) => listSecrets(app.appName).pipe(Effect.map((secrets) => secrets.flatMap((secret) => {
+            const name = secret.name;
+            if (!matchesAlchemyPhysicalName(name))
+                return [];
+            return [toAttrs(app.appName, secret, name ?? "")];
+        }))), { concurrency: 8 });
+        return rows.flat();
+    }),
+    reconcile: Effect.fn(function* ({ id, news, olds, output }) {
+        const props = news ?? {};
+        const appName = appNameOf(props.app) ?? output?.appName;
+        if (appName === undefined) {
+            return yield* new SecretAppRequired({
+                message: "Secret requires a resolved Fly.App",
+            });
+        }
+        const name = yield* resolveName(id, props.name, output?.name);
+        const desiredPlain = unwrapSecret(props.value);
+        // Observe by cached identity, then the desired (app, name).
+        let current = output !== undefined ? yield* getByName(output.appName, output.name) : undefined;
+        if (current === undefined &&
+            (output === undefined || output.appName !== appName || output.name !== name)) {
+            current = yield* getByName(appName, name);
+        }
+        let createdThisRun = false;
+        if (current === undefined) {
+            yield* machines
+                .createSecret({
+                app_name: appName,
+                secret_name: name,
+                value: desiredPlain,
+            })
+                .pipe(Effect.catchTag("Conflict", () => Effect.void));
+            current = yield* getByName(appName, name);
+            createdThisRun = true;
+        }
+        if (current === undefined) {
+            return yield* new SecretNotCreated({ appName, name });
+        }
+        // Sync — skip if we just created. Prefer observed digest vs hash of
+        // desired; otherwise re-put when olds is absent (adoption) or the
+        // previous value differs. Never log the plaintext.
+        if (!createdThisRun) {
+            const candidates = yield* flyDigestCandidates(desiredPlain);
+            const digestMatches = current.digest !== undefined && candidates.includes(current.digest);
+            const previousPlain = olds?.value !== undefined ? unwrapSecret(olds.value) : undefined;
+            const valueChanged = previousPlain === undefined || previousPlain !== desiredPlain;
+            if (!digestMatches && valueChanged) {
+                yield* machines
+                    .updateSecrets({
+                    app_name: appName,
+                    values: { [name]: desiredPlain },
+                })
+                    .pipe(Effect.catchTag("Conflict", () => Effect.void));
+                current = (yield* getByName(appName, name)) ?? current;
+            }
+        }
+        return toAttrs(appName, current, name);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        if (output.appName.length === 0 || output.name.length === 0)
+            return;
+        yield* machines
+            .deleteSecret({
+            app_name: output.appName,
+            secret_name: output.name,
+        })
+            .pipe(Effect.catchTag("NotFound", () => Effect.void));
+        yield* getByName(output.appName, output.name).pipe(Effect.map((secret) => secret === undefined), Effect.repeat({
+            schedule: Schedule.spaced("1 second"),
+            until: (gone) => gone,
+            times: 8,
+        }));
+    }),
+});
+//# sourceMappingURL=Secret.js.map

package/lib/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../src/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,QAAQ,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AA+ChF,MAAM,kBAAkB,GAAG,CACzB,KAAiE,EACnB,EAAE,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,IAAI,UAAU,CAAC,mBAAmB;QAAE,OAAO,QAAQ,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAA2C;QAC7D,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IACjB,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,QAAQ,CAAS,YAAY,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+HG;AACH,MAAM,CAAC,MAAM,MAAM,GAA0B,MAAM,CAAC,MAAM,CACxD,CAAC,EAAU,EAAE,KAAiE,EAAE,EAAE,CAChF,cAAc,CAAC,EAAE,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAC/C,cAAc,CACf,CAAC;AAEF,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAG3E;CAAG;AAEL,MAAM,OAAO,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAE7E;CAAG;AAEL,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,KAA8B,CAAC;IAC3C,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAyC,EAAU,EAAE,CACzE,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7D,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,QAAiB,EAAE,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,kEAAkE;IAClE,+DAA+D;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,CACd,OAAe,EACf,MAAiB,EACjB,YAAoB,EACE,EAAE,CAAC,CAAC;IAC1B,OAAO;IACP,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC,UAAU;IAC5B,SAAS,EAAE,MAAM,CAAC,UAAU;CAC7B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAE,EAAE,CACxD,QAAQ;KACL,SAAS,CAAC;IACT,QAAQ,EAAE,OAAO;IACjB,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,KAAK;CACpB,CAAC;KACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAExE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CACtC,QAAQ;KACL,WAAW,CAAC;IACX,QAAQ,EAAE,OAAO;IACjB,YAAY,EAAE,KAAK;CACpB,CAAC;KACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EACtC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;AAEN,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAE,EAAE,CAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;IACf,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC;IACzC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE;IAEhC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACtE,MAAM,WAAW,GAAG,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,SAAkB;gBAC1B,qEAAqE;gBACrE,WAAW,EAAE,WAAW,IAAI,CAAC,UAAU;aACxC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1F,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CACN,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CACH,CACF,EACH,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACxD,MAAM,KAAK,GAAG,IAAI,IAAK,EAAkB,CAAC;QAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC;QACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;gBAClC,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/C,4DAA4D;QAC5D,IAAI,OAAO,GACT,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IACE,OAAO,KAAK,SAAS;YACrB,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,EAC5E,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,CAAC,QAAQ;iBACZ,YAAY,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,YAAY;aACpB,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1F,MAAM,aAAa,GAAG,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,MAAM,YAAY,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,YAAY,CAAC;YACnF,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;gBACnC,KAAK,CAAC,CAAC,QAAQ;qBACZ,aAAa,CAAC;oBACb,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE;iBACjC,CAAC;qBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpE,KAAK,CAAC,CAAC,QAAQ;aACZ,YAAY,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAC5C,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;CACH,CAAC,CAAC"}