@alchemy.run/fly 0.0.0 → 2.0.0-beta.84

package/src/RedisBinding.ts

@@ -0,0 +1,64 @@
+import type { Url } from "@alchemy.run/redis";
+import * as Binding from "alchemy/Binding";
+import type { Resource } from "alchemy/Resource";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { ServiceBinding } from "./MountVolume.ts";
+import { REDIS_URL_ENV, RedisUrlMissing, type Redis } from "./Redis.ts";
+
+/**
+ * Shared scaffolding for Upstash Redis bindings.
+ *
+ * Each `{Op}Http.ts` is a thin `Layer.effect` over {@link makeRedisBinding}.
+ * Deploy-time registers the Redis add-on on the host so Service reconcile
+ * can attach it. The URL travels as `yield* redis.url` (RuntimeContext
+ * set/get). `REDIS_URL` written as an App secret is a fallback, not the
+ * primary path.
+ *
+ * The RESP client lives in `@alchemy.run/redis`. This file only wires the
+ * Fly host binding.
+ *
+ * NOT exported from `index.ts`.
+ */
+
+const isFlyHost = (value: unknown): value is Resource<string, any, any, ServiceBinding> =>
+  typeof value === "object" &&
+  value !== null &&
+  ((value as { Type?: string }).Type === "Fly.Service" ||
+    (value as { Type?: string }).Type === "Fly.Machine");
+
+const asPlain = (value: unknown): string | undefined => {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (Redacted.isRedacted(value)) return value.pipe(Redacted.value, asPlain);
+  return undefined;
+};
+
+const redisUrlFromEnv = Config.Redacted(REDIS_URL_ENV).pipe(
+  Effect.map((value) => Redacted.value(value)),
+);
+
+export const makeRedisBinding = <Client>(options: { makeClient: (url: Url) => Client }) =>
+  Effect.succeed(
+    Effect.fn(function* (redis: Redis) {
+      if (!globalThis.__ALCHEMY_RUNTIME__) {
+        const host = yield* Binding.Host;
+        if (isFlyHost(host)) {
+          yield* host.bind`${redis}`({
+            redis: { name: redis.name, id: redis.redisId },
+          });
+        }
+      }
+
+      const urlFromResource = yield* redis.url;
+      const missing = new RedisUrlMissing({
+        name: asPlain(redis.name) ?? redis.LogicalId,
+      });
+      const url: Url = Effect.gen(function* () {
+        const fromOutput = asPlain(yield* urlFromResource);
+        if (fromOutput !== undefined) return fromOutput;
+        return yield* redisUrlFromEnv.pipe(Effect.mapError(() => missing));
+      });
+      return options.makeClient(url);
+    }),
+  );

package/src/RedisHttp.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared Redis command-client builders. NOT exported from `index.ts`.
+ *
+ * The RESP client lives in `@alchemy.run/redis`. These aliases keep the
+ * `{Op}Http.ts` layers stable.
+ */
+export {
+  makeRead as makeReadRedisClient,
+  makeReadWrite as makeReadWriteRedisClient,
+  makeWrite as makeWriteRedisClient,
+} from "@alchemy.run/redis";

package/src/Region.ts

@@ -0,0 +1,44 @@
+/**
+ * A Fly.io region code. The literal codes are the regions Fly listed in
+ * September 2026 and give editor completion; any other string is accepted
+ * so new regions work without an Alchemy release. `bom` is deprecated by
+ * Fly. See [Regions](/fly/compute/regions).
+ */
+export type Region =
+  | "ams"
+  | "arn"
+  | "bom"
+  | "cdg"
+  | "dfw"
+  | "ewr"
+  | "fra"
+  | "gru"
+  | "iad"
+  | "jnb"
+  | "lax"
+  | "lhr"
+  | "nrt"
+  | "ord"
+  | "sin"
+  | "sjc"
+  | "syd"
+  | "yyz"
+  | (string & {});
+
+/** Normalize a `Region | Region[]` prop into a de-duplicated list. */
+export const regionList = (
+  region: Region | readonly Region[] | undefined,
+  fallback: string,
+): string[] => {
+  const list = region === undefined ? [fallback] : [region].flat();
+  const unique = [...new Set(list)];
+  return unique.length === 0 ? [fallback] : unique;
+};
+
+/**
+ * Region of replica `index` when `count` replicas run in each of
+ * `regions`. Replicas are spread round-robin, so growing `count` keeps
+ * every existing replica in its region.
+ */
+export const regionOfReplica = (regions: readonly string[], index: number) =>
+  regions[index % regions.length]!;

package/src/Secret.ts

@@ -0,0 +1,405 @@
+import { createHash } from "node:crypto";
+import type { AppSecret } from "@distilled.cloud/fly-io/machines";
+import * as machines from "@distilled.cloud/fly-io/machines";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { App, listOwnedApps } from "./App.ts";
+import { createFlyVolumeName, matchesAlchemyPhysicalName } from "./Metadata.ts";
+import type { Providers } from "./Providers.ts";
+
+/**
+ * A resource-valued prop: the resource itself, or an Effect that produces
+ * it (so `yield* App(...)` and `App(...)` both type-check).
+ */
+type Ref<T> = T | Effect.Effect<T, never, Providers>;
+
+export interface SecretProps {
+  /**
+   * Parent Fly App. Changing it replaces the secret.
+   */
+  app: Ref<App>;
+  /**
+   * Secret name. Used as the Machine env-var name when set by the user
+   * (case-sensitive, stored as-is). If omitted, a unique name is generated
+   * from the stack, stage and logical ID (the ownership stamp). Changing
+   * it replaces the secret.
+   */
+  name?: string;
+  /**
+   * Secret value. Wrap with `Redacted.make(...)` so it is never logged.
+   * Updated in place via `updateSecrets`. Never persisted in attributes.
+   */
+  value: Redacted.Redacted<string> | string;
+}
+
+export type Secret = Resource<
+  "Fly.Secret",
+  SecretProps,
+  {
+    /** Parent Fly App name. */
+    appName: string;
+    /** Secret name (unique per App). */
+    name: string;
+    /** Fly digest of the current value. Not the plaintext. */
+    digest: string | undefined;
+    /** RFC3339 creation timestamp. */
+    createdAt: string | undefined;
+    /** RFC3339 last-update timestamp. */
+    updatedAt: string | undefined;
+  },
+  never,
+  Providers
+>;
+
+const resolveSecretProps = (
+  props: SecretProps | Effect.Effect<SecretProps, never, Providers>,
+): Effect.Effect<SecretProps, never, Providers> =>
+  Effect.gen(function* () {
+    const resolved = Effect.isEffect(props) ? yield* props : props;
+    if (globalThis.__ALCHEMY_RUNTIME__) return resolved;
+    const app = Effect.isEffect(resolved.app)
+      ? yield* resolved.app as Effect.Effect<App, never, Providers>
+      : resolved.app;
+    return { ...resolved, app };
+  });
+
+const SecretResource = Resource<Secret>("Fly.Secret");
+
+/**
+ * A Fly.Secret is an App vault entry. Fly injects it as an environment
+ * variable on every Machine. Use it when the value is shared and
+ * managed in one place by Fly.
+ *
+ * For a secret only this {@link Service} reads from `.env` at deploy
+ * time, yield `Config.Redacted` instead. Do not pass `env: { ... }` on
+ * a Service.
+ *
+ * @see https://fly.io/docs/apps/secrets/
+ *
+ * ### Config.Redacted on a Service
+ * Most secrets in a Service come from your `.env`. Yield
+ * `Config.Redacted` in init. Alchemy binds the value onto the Machine.
+ *
+ * **Example:** Bind from .env
+ * ```typescript
+ * import * as Config from "effect/Config";
+ * import * as Redacted from "effect/Redacted";
+ *
+ * export default class Api extends Fly.Service<Api>()(
+ *   "Api",
+ *   { app: Site, main: import.meta.url, port: 3000 },
+ *   Effect.gen(function* () {
+ *     const apiKey = yield* Config.Redacted("API_KEY");
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const token = Redacted.value(apiKey);
+ *         return HttpServerResponse.text("ok");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * ### Create a Secret
+ * Wrap the value with `Redacted.make` so it is never logged. The
+ * plaintext is never stored in attributes. Omit `name` and Alchemy
+ * generates an ownership-stamped name.
+ *
+ * **Example:** Generated name
+ * ```typescript
+ * const dbUrl = yield* Fly.Secret("DatabaseUrl", {
+ *   app: Site,
+ *   value: Redacted.make("postgres://…"),
+ * });
+ * ```
+ *
+ * :::caution[Changing `app` replaces the Secret]
+ * The value is created on the new App. The old name is deleted.
+ * :::
+ *
+ * ### Env-var name
+ * `name` is the env-var Machines see. It is stored as-is
+ * (case-sensitive).
+ *
+ * **Example:** Explicit name
+ * ```typescript
+ * export const ApiToken = Fly.Secret("ApiToken", {
+ *   app: Site,
+ *   name: "API_TOKEN",
+ *   value: Redacted.make("sk_live_…"),
+ * });
+ * ```
+ *
+ * :::caution[Changing `name` replaces the Secret]
+ * Fly cannot rename a secret. Alchemy creates the new name, then
+ * deletes the old one.
+ * :::
+ *
+ * ### Rotate the value
+ * Updating `value` is in place via `updateSecrets`.
+ *
+ * **Example:** New value
+ * ```typescript
+ * export const ApiToken = Fly.Secret("ApiToken", {
+ *   app: Site,
+ *   name: "API_TOKEN",
+ *   value: Redacted.make("sk_live_rotated"),
+ * });
+ * ```
+ *
+ * ### Get a secret at runtime
+ * {@link GetSecret} is bound to one Secret. Provide
+ * {@link GetSecretHttp}. Fly only returns plaintext from a Machine in
+ * the same App. From a deploy-time Action you get metadata (name,
+ * digest, timestamps).
+ *
+ * **Example:** GetSecret
+ * ```typescript
+ * const get = yield* Fly.GetSecret(ApiToken);
+ * const got = yield* get();
+ * ```
+ *
+ * ### List secrets
+ * {@link ListSecrets} is bound to an {@link App}. From an Action, the
+ * org token can list any App in the org. From a Machine, deploy tokens
+ * are per-App. Mixing Apps on one Machine shares one `FLY_API_TOKEN`
+ * and is not supported.
+ *
+ * **Example:** ListSecrets
+ * ```typescript
+ * const list = yield* Fly.ListSecrets(Site);
+ * const { secrets } = yield* list();
+ * ```
+ *
+ * ### Write secrets
+ * {@link WriteSecret} creates, updates, and deletes by name. Provide
+ * {@link WriteSecretHttp} on the Action or Service Effect.
+ *
+ * **Example:** Rotate from an Action
+ * ```typescript
+ * const Seed = Alchemy.Action(
+ *   "Seed",
+ *   Effect.gen(function* () {
+ *     const secrets = yield* Fly.WriteSecret(ApiToken);
+ *
+ *     return Effect.fn(function* () {
+ *       yield* secrets.update("API_TOKEN", Redacted.make("sk_live_rotated"));
+ *     });
+ *   }).pipe(Effect.provide(Fly.WriteSecretHttp)),
+ * );
+ * ```
+ *
+ * @resource
+ * @product Secret
+ */
+export const Secret: typeof SecretResource = Object.assign(
+  (id: string, props: SecretProps | Effect.Effect<SecretProps, never, Providers>) =>
+    SecretResource(id, resolveSecretProps(props)),
+  SecretResource,
+);
+
+export class SecretNotCreated extends Data.TaggedError("Fly.SecretNotCreated")<{
+  appName: string;
+  name: string;
+}> {}
+
+export class SecretAppRequired extends Data.TaggedError("Fly.SecretAppRequired")<{
+  message: string;
+}> {}
+
+const appNameOf = (value: unknown): string | undefined => {
+  if (value === null || typeof value !== "object") return undefined;
+  const rec = value as { appName?: unknown };
+  return typeof rec.appName === "string" && rec.appName.length > 0 ? rec.appName : undefined;
+};
+
+const unwrapSecret = (value: Redacted.Redacted<string> | string): string =>
+  Redacted.isRedacted(value) ? Redacted.value(value) : value;
+
+const resolveName = (id: string, name: string | undefined, existing?: string) =>
+  Effect.gen(function* () {
+    // User env-var names are stored as-is (case-sensitive). Generated
+    // names use the Volume underscore shape — Fly rejects hyphens.
+    if (name !== undefined) return name;
+    if (existing !== undefined) return existing;
+    return yield* createFlyVolumeName(id);
+  });
+
+const toAttrs = (
+  appName: string,
+  secret: AppSecret,
+  fallbackName: string,
+): Secret["Attributes"] => ({
+  appName,
+  name: secret.name ?? fallbackName,
+  digest: secret.digest,
+  createdAt: secret.created_at,
+  updatedAt: secret.updated_at,
+});
+
+const getByName = (appName: string, secretName: string) =>
+  machines
+    .getSecret({
+      app_name: appName,
+      secret_name: secretName,
+      show_secrets: false,
+    })
+    .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+const listSecrets = (appName: string) =>
+  machines
+    .listSecrets({
+      app_name: appName,
+      show_secrets: false,
+    })
+    .pipe(
+      Effect.map((res) => res.secrets ?? []),
+      Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed([])),
+    );
+
+const flyDigestCandidates = (plain: string) =>
+  Effect.sync(() => {
+    const utf8 = Buffer.from(plain, "utf8");
+    return [
+      createHash("md5").update(utf8).digest("hex"),
+      createHash("sha256").update(utf8).digest("hex"),
+    ];
+  });
+
+export const SecretProvider = () =>
+  Provider.succeed(Secret, {
+    stables: ["appName", "name", "createdAt"],
+    nuke: { dependsOn: ["Fly.App"] },
+
+    diff: Effect.fn(function* ({ news, output }) {
+      if (news === undefined || !isResolved(news)) return undefined;
+      if (output === undefined) return undefined;
+      const desiredName = news.name !== undefined ? news.name : output.name;
+      const nameChanged = desiredName !== output.name;
+      const nextApp = appNameOf(news.app);
+      const appChanged = nextApp !== undefined && nextApp !== output.appName;
+      if (nameChanged || appChanged) {
+        return {
+          action: "replace" as const,
+          // Same (app, name) cannot exist twice — delete the old secret first.
+          deleteFirst: nameChanged && !appChanged,
+        };
+      }
+      return undefined;
+    }),
+
+    read: Effect.fn(function* ({ id, olds, output }) {
+      const appName = output?.appName ?? (olds !== undefined ? appNameOf(olds.app) : undefined);
+      if (appName === undefined) return undefined;
+      const name = yield* resolveName(id, olds?.name, output?.name);
+      const found = yield* getByName(appName, name);
+      if (found === undefined) return undefined;
+      const attrs = toAttrs(appName, found, name);
+      if (output !== undefined) return attrs;
+      return matchesAlchemyPhysicalName(name) ? attrs : Unowned(attrs);
+    }),
+
+    list: Effect.fn(function* () {
+      const apps = yield* listOwnedApps();
+      const rows = yield* Effect.forEach(
+        apps,
+        (app) =>
+          listSecrets(app.appName).pipe(
+            Effect.map((secrets) =>
+              secrets.flatMap((secret) => {
+                const name = secret.name;
+                if (!matchesAlchemyPhysicalName(name)) return [];
+                return [toAttrs(app.appName, secret, name ?? "")];
+              }),
+            ),
+          ),
+        { concurrency: 8 },
+      );
+      return rows.flat();
+    }),
+
+    reconcile: Effect.fn(function* ({ id, news, olds, output }) {
+      const props = news ?? ({} as SecretProps);
+      const appName = appNameOf(props.app) ?? output?.appName;
+      if (appName === undefined) {
+        return yield* new SecretAppRequired({
+          message: "Secret requires a resolved Fly.App",
+        });
+      }
+      const name = yield* resolveName(id, props.name, output?.name);
+      const desiredPlain = unwrapSecret(props.value);
+
+      // Observe by cached identity, then the desired (app, name).
+      let current =
+        output !== undefined ? yield* getByName(output.appName, output.name) : undefined;
+      if (
+        current === undefined &&
+        (output === undefined || output.appName !== appName || output.name !== name)
+      ) {
+        current = yield* getByName(appName, name);
+      }
+
+      let createdThisRun = false;
+      if (current === undefined) {
+        yield* machines
+          .createSecret({
+            app_name: appName,
+            secret_name: name,
+            value: desiredPlain,
+          })
+          .pipe(Effect.catchTag("Conflict", () => Effect.void));
+        current = yield* getByName(appName, name);
+        createdThisRun = true;
+      }
+
+      if (current === undefined) {
+        return yield* new SecretNotCreated({ appName, name });
+      }
+
+      // Sync — skip if we just created. Prefer observed digest vs hash of
+      // desired; otherwise re-put when olds is absent (adoption) or the
+      // previous value differs. Never log the plaintext.
+      if (!createdThisRun) {
+        const candidates = yield* flyDigestCandidates(desiredPlain);
+        const digestMatches = current.digest !== undefined && candidates.includes(current.digest);
+        const previousPlain = olds?.value !== undefined ? unwrapSecret(olds.value) : undefined;
+        const valueChanged = previousPlain === undefined || previousPlain !== desiredPlain;
+        if (!digestMatches && valueChanged) {
+          yield* machines
+            .updateSecrets({
+              app_name: appName,
+              values: { [name]: desiredPlain },
+            })
+            .pipe(Effect.catchTag("Conflict", () => Effect.void));
+          current = (yield* getByName(appName, name)) ?? current;
+        }
+      }
+
+      return toAttrs(appName, current, name);
+    }),
+
+    delete: Effect.fn(function* ({ output }) {
+      if (output.appName.length === 0 || output.name.length === 0) return;
+      yield* machines
+        .deleteSecret({
+          app_name: output.appName,
+          secret_name: output.name,
+        })
+        .pipe(Effect.catchTag("NotFound", () => Effect.void));
+      yield* getByName(output.appName, output.name).pipe(
+        Effect.map((secret) => secret === undefined),
+        Effect.repeat({
+          schedule: Schedule.spaced("1 second"),
+          until: (gone) => gone,
+          times: 8,
+        }),
+      );
+    }),
+  });

package/src/SecretHttp.ts

@@ -0,0 +1,149 @@
+import {
+  Credentials,
+  CredentialsFromEnv,
+  credentials,
+  MachineIdentity,
+} from "@distilled.cloud/fly-io";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import type { App } from "./App.ts";
+import { bindFlyApiToken } from "./Credentials.ts";
+import type { Secret } from "./Secret.ts";
+import type { SecretKey } from "./SecretKey.ts";
+
+/**
+ * Shared scaffolding for the HTTP-backed Fly Secret bindings.
+ *
+ * Fly has no native Worker-style binding. This layer captures the ambient
+ * org token during stack-eval (so Actions work in-process) and `yield*`s
+ * it plus `appName` / secret `name` so RuntimeContext.set runs. Platform
+ * copies those Outputs into host env; runtime `yield*` gets them back.
+ * {@link CredentialsFromEnv} still reads `FLY_API_TOKEN` after that copy.
+ *
+ * NOT exported from `index.ts`.
+ */
+export type AppNamed = Secret | SecretKey;
+
+export const makeHttpSecretBinding = <Target extends AppNamed, Client>(options: {
+  makeClient: (
+    auth: SecretAuth,
+    appName: Effect.Effect<string>,
+    secretName: Effect.Effect<string>,
+  ) => Client;
+  /**
+   * PetSem encrypt/sign/decrypt/verify only work from a Machine over
+   * `/.fly/api` (implicit machine identity). Org tokens return Forbidden.
+   */
+  kms?: boolean;
+}) =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context<Credentials | HttpClient.HttpClient>();
+    const auth = options.kms === true ? makeKmsAuth(context) : makeSecretAuth(context);
+
+    return Effect.fn(function* (resource: Target) {
+      yield* bindFlyApiToken().pipe(Effect.provideContext(context));
+      const appName = yield* resource.appName;
+      const secretName = yield* resource.name;
+      return options.makeClient(auth, appName, secretName);
+    });
+  });
+
+/**
+ * Same scaffolding as {@link makeHttpSecretBinding}, but the target is
+ * an {@link App} (no secret name). Used by ListSecrets.
+ */
+export const makeHttpAppBinding = <Client>(options: {
+  makeClient: (auth: SecretAuth, appName: Effect.Effect<string>) => Client;
+}) =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context<Credentials | HttpClient.HttpClient>();
+
+    return Effect.fn(function* (app: App) {
+      yield* bindFlyApiToken().pipe(Effect.provideContext(context));
+      const appName = yield* app.appName;
+      return options.makeClient(makeSecretAuth(context), appName);
+    });
+  });
+
+/**
+ * Injectable auth for the Secret HTTP client builders. Supplies an
+ * `authorize` that provides `Credentials` + `HttpClient` to a raw SDK op.
+ */
+export interface SecretAuth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+}
+
+/** Build auth that uses ambient stack creds, or env creds inside a host. */
+export const makeSecretAuth = (
+  ambient: Context.Context<Credentials | HttpClient.HttpClient>,
+): SecretAuth => ({
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ): Effect.Effect<A, E, RuntimeContext> => {
+    if (globalThis.__ALCHEMY_RUNTIME__) {
+      // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- TimeoutError/env-credential errors surface untyped; widening SecretAuth would ripple through every Fly secret client
+      return eff.pipe(
+        Effect.provide(Layer.mergeAll(CredentialsFromEnv, FetchHttpClient.layer)),
+        Effect.timeout("8 seconds"),
+      ) as Effect.Effect<A, E, RuntimeContext>;
+    }
+    return eff.pipe(Effect.provideContext(ambient)) as Effect.Effect<A, E, RuntimeContext>;
+  },
+});
+
+const FLY_MACHINE_API_SOCKET = "/.fly/api";
+
+/** Distilled machines client over `/.fly/api`. URL host is unused. */
+const flyMachineApiHttp: Layer.Layer<HttpClient.HttpClient> =
+  NodeHttpClient.layerNodeHttpNoAgent.pipe(
+    Layer.provide(
+      NodeHttpClient.layerAgentOptions({
+        socketPath: FLY_MACHINE_API_SOCKET,
+        keepAlive: false,
+      }),
+    ),
+  );
+
+/**
+ * PetSem encrypt/sign/decrypt/verify from a Machine. Org API tokens are
+ * Forbidden; the machine identity is the unix socket at `/.fly/api`.
+ * {@link MachineIdentity} is the protocol signal (no Authorization,
+ * Connection: close). GetSecret in the same process keeps Bearer.
+ */
+export const makeKmsAuth = (
+  ambient: Context.Context<Credentials | HttpClient.HttpClient>,
+): SecretAuth => ({
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ): Effect.Effect<A, E, RuntimeContext> => {
+    if (globalThis.__ALCHEMY_RUNTIME__) {
+      // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- TimeoutError surfaces untyped; widening SecretAuth would ripple through every Fly secret client
+      return Effect.scoped(
+        eff.pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              Layer.succeed(MachineIdentity, true),
+              flyMachineApiHttp,
+              credentials({
+                apiKey: Redacted.make("unused"),
+                apiBaseUrl: "http://localhost/v1",
+              }),
+            ),
+          ),
+        ),
+      ).pipe(Effect.timeout("8 seconds")) as Effect.Effect<A, E, RuntimeContext>;
+    }
+    return eff.pipe(Effect.provideContext(ambient)) as Effect.Effect<A, E, RuntimeContext>;
+  },
+});
+
+export const unwrapSecretValue = (value: Redacted.Redacted<string> | string): string =>
+  Redacted.isRedacted(value) ? Redacted.value(value) : value;