@alchemy.run/fly 0.0.0 → 2.0.0-beta.85

package/lib/SecretHttp.d.ts

@@ -0,0 +1,54 @@
+import { Credentials } from "@distilled.cloud/fly-io";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Redacted from "effect/Redacted";
+import type { App } from "./App.ts";
+import type { Secret } from "./Secret.ts";
+import type { SecretKey } from "./SecretKey.ts";
+/**
+ * Shared scaffolding for the HTTP-backed Fly Secret bindings.
+ *
+ * Fly has no native Worker-style binding. This layer captures the ambient
+ * org token during stack-eval (so Actions work in-process) and `yield*`s
+ * it plus `appName` / secret `name` so RuntimeContext.set runs. Platform
+ * copies those Outputs into host env; runtime `yield*` gets them back.
+ * {@link CredentialsFromEnv} still reads `FLY_API_TOKEN` after that copy.
+ *
+ * NOT exported from `index.ts`.
+ */
+export type AppNamed = Secret | SecretKey;
+export declare const makeHttpSecretBinding: <Target extends AppNamed, Client>(options: {
+    makeClient: (auth: SecretAuth, appName: Effect.Effect<string>, secretName: Effect.Effect<string>) => Client;
+    /**
+     * PetSem encrypt/sign/decrypt/verify only work from a Machine over
+     * `/.fly/api` (implicit machine identity). Org tokens return Forbidden.
+     */
+    kms?: boolean;
+}) => Effect.Effect<(resource: Target) => Effect.Effect<Client, never, never>, never, Credentials | HttpClient.HttpClient>;
+/**
+ * Same scaffolding as {@link makeHttpSecretBinding}, but the target is
+ * an {@link App} (no secret name). Used by ListSecrets.
+ */
+export declare const makeHttpAppBinding: <Client>(options: {
+    makeClient: (auth: SecretAuth, appName: Effect.Effect<string>) => Client;
+}) => Effect.Effect<(app: App) => Effect.Effect<Client, never, never>, never, Credentials | HttpClient.HttpClient>;
+/**
+ * Injectable auth for the Secret HTTP client builders. Supplies an
+ * `authorize` that provides `Credentials` + `HttpClient` to a raw SDK op.
+ */
+export interface SecretAuth {
+    authorize: <A, E>(eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>) => Effect.Effect<A, E, RuntimeContext>;
+}
+/** Build auth that uses ambient stack creds, or env creds inside a host. */
+export declare const makeSecretAuth: (ambient: Context.Context<Credentials | HttpClient.HttpClient>) => SecretAuth;
+/**
+ * PetSem encrypt/sign/decrypt/verify from a Machine. Org API tokens are
+ * Forbidden; the machine identity is the unix socket at `/.fly/api`.
+ * {@link MachineIdentity} is the protocol signal (no Authorization,
+ * Connection: close). GetSecret in the same process keeps Bearer.
+ */
+export declare const makeKmsAuth: (ambient: Context.Context<Credentials | HttpClient.HttpClient>) => SecretAuth;
+export declare const unwrapSecretValue: (value: Redacted.Redacted<string> | string) => string;
+//# sourceMappingURL=SecretHttp.d.ts.map

package/lib/SecretHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretHttp.d.ts","sourceRoot":"","sources":["../src/SecretHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAIZ,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAErD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1C,eAAO,MAAM,qBAAqB,GAAI,MAAM,SAAS,QAAQ,EAAE,MAAM,WAAW;IAC9E,UAAU,EAAE,CACV,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAC9B,MAAM,CAAC;IACZ;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,yHAWG,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,WAAW;IAClD,UAAU,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC;CAC1E,iHASG,CAAC;AAEL;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,KAC1D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,4EAA4E;AAC5E,eAAO,MAAM,cAAc,YAChB,OAAO,CAAC,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,KAC5D,UAaD,CAAC;AAeH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,YACb,OAAO,CAAC,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,KAC5D,UAuBD,CAAC;AAEH,eAAO,MAAM,iBAAiB,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,KAAG,MAClB,CAAC"}

package/lib/SecretHttp.js

@@ -0,0 +1,66 @@
+import { Credentials, CredentialsFromEnv, credentials, MachineIdentity, } from "@distilled.cloud/fly-io";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { bindFlyApiToken } from "./Credentials.js";
+export const makeHttpSecretBinding = (options) => Effect.gen(function* () {
+    const context = yield* Effect.context();
+    const auth = options.kms === true ? makeKmsAuth(context) : makeSecretAuth(context);
+    return Effect.fn(function* (resource) {
+        yield* bindFlyApiToken().pipe(Effect.provideContext(context));
+        const appName = yield* resource.appName;
+        const secretName = yield* resource.name;
+        return options.makeClient(auth, appName, secretName);
+    });
+});
+/**
+ * Same scaffolding as {@link makeHttpSecretBinding}, but the target is
+ * an {@link App} (no secret name). Used by ListSecrets.
+ */
+export const makeHttpAppBinding = (options) => Effect.gen(function* () {
+    const context = yield* Effect.context();
+    return Effect.fn(function* (app) {
+        yield* bindFlyApiToken().pipe(Effect.provideContext(context));
+        const appName = yield* app.appName;
+        return options.makeClient(makeSecretAuth(context), appName);
+    });
+});
+/** Build auth that uses ambient stack creds, or env creds inside a host. */
+export const makeSecretAuth = (ambient) => ({
+    authorize: (eff) => {
+        if (globalThis.__ALCHEMY_RUNTIME__) {
+            // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- TimeoutError/env-credential errors surface untyped; widening SecretAuth would ripple through every Fly secret client
+            return eff.pipe(Effect.provide(Layer.mergeAll(CredentialsFromEnv, FetchHttpClient.layer)), Effect.timeout("8 seconds"));
+        }
+        return eff.pipe(Effect.provideContext(ambient));
+    },
+});
+const FLY_MACHINE_API_SOCKET = "/.fly/api";
+/** Distilled machines client over `/.fly/api`. URL host is unused. */
+const flyMachineApiHttp = NodeHttpClient.layerNodeHttpNoAgent.pipe(Layer.provide(NodeHttpClient.layerAgentOptions({
+    socketPath: FLY_MACHINE_API_SOCKET,
+    keepAlive: false,
+})));
+/**
+ * PetSem encrypt/sign/decrypt/verify from a Machine. Org API tokens are
+ * Forbidden; the machine identity is the unix socket at `/.fly/api`.
+ * {@link MachineIdentity} is the protocol signal (no Authorization,
+ * Connection: close). GetSecret in the same process keeps Bearer.
+ */
+export const makeKmsAuth = (ambient) => ({
+    authorize: (eff) => {
+        if (globalThis.__ALCHEMY_RUNTIME__) {
+            // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- TimeoutError surfaces untyped; widening SecretAuth would ripple through every Fly secret client
+            return Effect.scoped(eff.pipe(Effect.provide(Layer.mergeAll(Layer.succeed(MachineIdentity, true), flyMachineApiHttp, credentials({
+                apiKey: Redacted.make("unused"),
+                apiBaseUrl: "http://localhost/v1",
+            }))))).pipe(Effect.timeout("8 seconds"));
+        }
+        return eff.pipe(Effect.provideContext(ambient));
+    },
+});
+export const unwrapSecretValue = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
+//# sourceMappingURL=SecretHttp.js.map

package/lib/SecretHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretHttp.js","sourceRoot":"","sources":["../src/SecretHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,cAAc,MAAM,sCAAsC,CAAC;AAGvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAiBnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAkC,OAWtE,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAuC,CAAC;IAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAEnF,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAgB;QAC1C,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAS,OAE1C,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAuC,CAAC;IAE7E,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAQ;QAClC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,OAAO,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAYL,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA6D,EACjD,EAAE,CAAC,CAAC;IAChB,SAAS,EAAE,CACT,GAA6D,EACxB,EAAE;QACvC,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;YACnC,2LAA2L;YAC3L,OAAO,GAAG,CAAC,IAAI,CACb,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EACzE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CACW,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAwC,CAAC;IACzF,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C,sEAAsE;AACtE,MAAM,iBAAiB,GACrB,cAAc,CAAC,oBAAoB,CAAC,IAAI,CACtC,KAAK,CAAC,OAAO,CACX,cAAc,CAAC,iBAAiB,CAAC;IAC/B,UAAU,EAAE,sBAAsB;IAClC,SAAS,EAAE,KAAK;CACjB,CAAC,CACH,CACF,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,OAA6D,EACjD,EAAE,CAAC,CAAC;IAChB,SAAS,EAAE,CACT,GAA6D,EACxB,EAAE;QACvC,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;YACnC,sKAAsK;YACtK,OAAO,MAAM,CAAC,MAAM,CAClB,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,QAAQ,CACZ,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,EACpC,iBAAiB,EACjB,WAAW,CAAC;gBACV,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,UAAU,EAAE,qBAAqB;aAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAwC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAwC,CAAC;IACzF,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAyC,EAAU,EAAE,CACrF,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC"}

package/lib/SecretKey.d.ts

@@ -0,0 +1,164 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import { App } from "./App.ts";
+import type { Providers } from "./Providers.ts";
+/**
+ * A resource-valued prop: the resource itself, or an Effect that produces
+ * it (so `yield* App(...)` and `App(...)` both type-check).
+ */
+type Ref<T> = T | Effect.Effect<T, never, Providers>;
+export interface SecretKeyProps {
+    /**
+     * Parent Fly App. Changing it replaces the secret key.
+     */
+    app: Ref<App>;
+    /**
+     * Secret key name, unique per App. If omitted, a unique name is generated
+     * from the stack, stage and logical ID (the ownership stamp). Changing it
+     * replaces the key.
+     */
+    name?: string;
+    /**
+     * Fly key type (`nacl_sign`, `nacl_box`, `hs256`, `hs384`, `hs512`,
+     * `xaes256gcm`, `nacl_auth`, `nacl_secretbox`, `es256`). Changing it
+     * replaces the key.
+     */
+    type?: string;
+    /**
+     * Raw key material. If omitted, Fly generates a key via
+     * `generateSecretKey`. If set, the key is created or updated with
+     * `setSecretKey`. Never persisted in state.
+     */
+    value?: ReadonlyArray<number>;
+}
+export type SecretKey = Resource<"Fly.SecretKey", SecretKeyProps, {
+    /** Parent Fly App name. */
+    appName: string;
+    /** Secret key name (unique per App). */
+    name: string;
+    /** Observed Fly key type. */
+    type: string | undefined;
+    /** Public key (base64), when the type has one. Never private material. */
+    publicKey: string | undefined;
+    /** RFC3339 creation timestamp. */
+    createdAt: string | undefined;
+    /** RFC3339 last-update timestamp. */
+    updatedAt: string | undefined;
+}, never, Providers>;
+declare const SecretKeyResource: import("alchemy/Resource").ResourceClass<SecretKey>;
+/**
+ * A Fly.SecretKey is an App KMS key, not an env secret. Generate a
+ * random key or set raw material. Private bytes never appear in
+ * attributes.
+ *
+ * Use it at runtime with {@link Encrypt}, {@link Decrypt}, {@link Sign},
+ * and {@link Verify}. Generate, set, and delete stay on this resource.
+ *
+ * @see https://docs.machines.dev/secrets/Secretkeys_list
+ *
+ * ### Generate a key
+ * Omit `value` and Fly generates a key via `generateSecretKey`. `type`
+ * is Fly's key type (`nacl_sign`, `nacl_box`, `nacl_secretbox`,
+ * `hs256`, `hs384`, `hs512`, `xaes256gcm`, `nacl_auth`, `es256`, …).
+ *
+ * **Example:** Signing key
+ * ```typescript
+ * export const Signing = Fly.SecretKey("Signing", {
+ *   app: Site,
+ *   type: "nacl_sign",
+ * });
+ * ```
+ *
+ * :::caution[Changing `app`, `name`, or `type` replaces the key]
+ * The new key is created. The old one is deleted. Ciphertext from the
+ * old key will not decrypt.
+ * :::
+ *
+ * ### Set raw material
+ * Pass `value` as bytes. The key is created or updated with
+ * `setSecretKey`. Never persisted in state.
+ *
+ * **Example:** HS256
+ * ```typescript
+ * const hmac = yield* Fly.SecretKey("Hmac", {
+ *   app: Site,
+ *   type: "hs256",
+ *   value: hmacBytes,
+ * });
+ * ```
+ *
+ * ### Encrypt
+ * Bind {@link Encrypt} to a box/secretbox/AEAD key. Provide
+ * {@link EncryptHttp}. Optional `associatedData` is AEAD associated
+ * data.
+ *
+ * Fly crypto ops need a KMS token. Org API tokens are typed
+ * `Forbidden`. Encrypt and sign from a {@link Service}, not a laptop
+ * Action.
+ *
+ * **Example:** Encrypt a payload
+ * ```typescript
+ * const encrypt = yield* Fly.Encrypt(Box);
+ * const { ciphertext } = yield* encrypt({
+ *   plaintext: new TextEncoder().encode("attack at dawn"),
+ * });
+ * ```
+ *
+ * ### Decrypt
+ * Bind {@link Decrypt} to the same key. Plaintext comes back
+ * `Redacted`. Unwrap with `Redacted.value`. `associatedData` must
+ * match encryption. Provide {@link DecryptHttp}.
+ *
+ * **Example:** Decrypt a payload
+ * ```typescript
+ * const decrypt = yield* Fly.Decrypt(Box);
+ * const { plaintext } = yield* decrypt({ ciphertext });
+ * const bytes = Redacted.value(plaintext);
+ * ```
+ *
+ * ### Sign
+ * Bind {@link Sign} to a signing key (`nacl_sign`, `hs256`, `es256`,
+ * …). The private key never leaves Fly KMS. Provide {@link SignHttp}.
+ *
+ * **Example:** Sign a payload
+ * ```typescript
+ * const sign = yield* Fly.Sign(Signing);
+ * const { signature } = yield* sign({
+ *   plaintext: new TextEncoder().encode("release-manifest-v1"),
+ * });
+ * ```
+ *
+ * ### Verify
+ * Bind {@link Verify} to the same key. A bad signature is a typed
+ * error from the Machines API. Provide {@link VerifyHttp}.
+ *
+ * **Example:** Verify a signature
+ * ```typescript
+ * const verify = yield* Fly.Verify(Signing);
+ * const { valid } = yield* verify({ plaintext, signature });
+ * ```
+ *
+ * @resource
+ * @product Secret Key
+ */
+export declare const SecretKey: typeof SecretKeyResource;
+declare const SecretKeyNotCreated_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Fly.SecretKeyNotCreated";
+} & Readonly<A>;
+export declare class SecretKeyNotCreated extends SecretKeyNotCreated_base<{
+    appName: string;
+    secretName: string;
+}> {
+}
+declare const SecretKeyAppRequired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Fly.SecretKeyAppRequired";
+} & Readonly<A>;
+export declare class SecretKeyAppRequired extends SecretKeyAppRequired_base<{
+    message: string;
+}> {
+}
+export declare const SecretKeyProvider: () => import("effect/Layer").Layer<Provider.Provider<SecretKey>, never, import("alchemy/Stack").Stack | import("alchemy/Stage").Stage | machines.FlyIoOpContext>;
+export {};
+//# sourceMappingURL=SecretKey.d.ts.map

package/lib/SecretKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKey.d.ts","sourceRoot":"","sources":["../src/SecretKey.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kCAAkC,CAAC;AAG7D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,GAAG,EAAiB,MAAM,UAAU,CAAC;AAM9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,CAC9B,eAAe,EACf,cAAc,EACd;IACE,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kCAAkC;IAClC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,EACD,KAAK,EACL,SAAS,CACV,CAAC;AAcF,QAAA,MAAM,iBAAiB,qDAAuC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AACH,eAAO,MAAM,SAAS,EAAE,OAAO,iBAI9B,CAAC;;;;AAEF,qBAAa,mBAAoB,SAAQ,yBAA4C;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAA6C;IACrF,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;AAwEL,eAAO,MAAM,iBAAiB,kKA6H1B,CAAC"}

package/lib/SecretKey.js

@@ -0,0 +1,277 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { App, listOwnedApps } from "./App.js";
+import { createFlyVolumeName, matchesAlchemyPhysicalName, sanitizeFlyVolumeName, } from "./Metadata.js";
+const resolveSecretKeyProps = (props) => Effect.gen(function* () {
+    const resolved = Effect.isEffect(props) ? yield* props : props;
+    if (globalThis.__ALCHEMY_RUNTIME__)
+        return resolved;
+    const app = Effect.isEffect(resolved.app)
+        ? yield* resolved.app
+        : resolved.app;
+    return { ...resolved, app };
+});
+const SecretKeyResource = Resource("Fly.SecretKey");
+/**
+ * A Fly.SecretKey is an App KMS key, not an env secret. Generate a
+ * random key or set raw material. Private bytes never appear in
+ * attributes.
+ *
+ * Use it at runtime with {@link Encrypt}, {@link Decrypt}, {@link Sign},
+ * and {@link Verify}. Generate, set, and delete stay on this resource.
+ *
+ * @see https://docs.machines.dev/secrets/Secretkeys_list
+ *
+ * ### Generate a key
+ * Omit `value` and Fly generates a key via `generateSecretKey`. `type`
+ * is Fly's key type (`nacl_sign`, `nacl_box`, `nacl_secretbox`,
+ * `hs256`, `hs384`, `hs512`, `xaes256gcm`, `nacl_auth`, `es256`, …).
+ *
+ * **Example:** Signing key
+ * ```typescript
+ * export const Signing = Fly.SecretKey("Signing", {
+ *   app: Site,
+ *   type: "nacl_sign",
+ * });
+ * ```
+ *
+ * :::caution[Changing `app`, `name`, or `type` replaces the key]
+ * The new key is created. The old one is deleted. Ciphertext from the
+ * old key will not decrypt.
+ * :::
+ *
+ * ### Set raw material
+ * Pass `value` as bytes. The key is created or updated with
+ * `setSecretKey`. Never persisted in state.
+ *
+ * **Example:** HS256
+ * ```typescript
+ * const hmac = yield* Fly.SecretKey("Hmac", {
+ *   app: Site,
+ *   type: "hs256",
+ *   value: hmacBytes,
+ * });
+ * ```
+ *
+ * ### Encrypt
+ * Bind {@link Encrypt} to a box/secretbox/AEAD key. Provide
+ * {@link EncryptHttp}. Optional `associatedData` is AEAD associated
+ * data.
+ *
+ * Fly crypto ops need a KMS token. Org API tokens are typed
+ * `Forbidden`. Encrypt and sign from a {@link Service}, not a laptop
+ * Action.
+ *
+ * **Example:** Encrypt a payload
+ * ```typescript
+ * const encrypt = yield* Fly.Encrypt(Box);
+ * const { ciphertext } = yield* encrypt({
+ *   plaintext: new TextEncoder().encode("attack at dawn"),
+ * });
+ * ```
+ *
+ * ### Decrypt
+ * Bind {@link Decrypt} to the same key. Plaintext comes back
+ * `Redacted`. Unwrap with `Redacted.value`. `associatedData` must
+ * match encryption. Provide {@link DecryptHttp}.
+ *
+ * **Example:** Decrypt a payload
+ * ```typescript
+ * const decrypt = yield* Fly.Decrypt(Box);
+ * const { plaintext } = yield* decrypt({ ciphertext });
+ * const bytes = Redacted.value(plaintext);
+ * ```
+ *
+ * ### Sign
+ * Bind {@link Sign} to a signing key (`nacl_sign`, `hs256`, `es256`,
+ * …). The private key never leaves Fly KMS. Provide {@link SignHttp}.
+ *
+ * **Example:** Sign a payload
+ * ```typescript
+ * const sign = yield* Fly.Sign(Signing);
+ * const { signature } = yield* sign({
+ *   plaintext: new TextEncoder().encode("release-manifest-v1"),
+ * });
+ * ```
+ *
+ * ### Verify
+ * Bind {@link Verify} to the same key. A bad signature is a typed
+ * error from the Machines API. Provide {@link VerifyHttp}.
+ *
+ * **Example:** Verify a signature
+ * ```typescript
+ * const verify = yield* Fly.Verify(Signing);
+ * const { valid } = yield* verify({ plaintext, signature });
+ * ```
+ *
+ * @resource
+ * @product Secret Key
+ */
+export const SecretKey = Object.assign((id, props) => SecretKeyResource(id, resolveSecretKeyProps(props)), SecretKeyResource);
+export class SecretKeyNotCreated extends Data.TaggedError("Fly.SecretKeyNotCreated") {
+}
+export class SecretKeyAppRequired extends Data.TaggedError("Fly.SecretKeyAppRequired") {
+}
+const appNameOf = (value) => {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const rec = value;
+    return typeof rec.appName === "string" && rec.appName.length > 0 ? rec.appName : undefined;
+};
+const resolveName = (id, name, existing) => Effect.gen(function* () {
+    if (name !== undefined)
+        return sanitizeFlyVolumeName(name);
+    if (existing !== undefined)
+        return existing;
+    return yield* createFlyVolumeName(id);
+});
+const toAttrs = (appName, key, fallbackName) => ({
+    appName,
+    name: key.name ?? fallbackName,
+    type: key.type,
+    publicKey: key.public_key,
+    createdAt: key.created_at,
+    updatedAt: key.updated_at,
+});
+const getByName = (appName, secretName) => machines
+    .getSecretKey({
+    app_name: appName,
+    secret_name: secretName,
+})
+    .pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+const listKeys = (appName) => machines.listSecretKeys({ app_name: appName }).pipe(Effect.map((res) => res.secret_keys ?? []), Effect.catchTag(["NotFound", "Forbidden"], () => Effect.succeed([])));
+const putKey = (input) => {
+    if (input.value !== undefined) {
+        return machines.setSecretKey({
+            app_name: input.appName,
+            secret_name: input.secretName,
+            type: input.type,
+            value: [...input.value],
+        });
+    }
+    return machines.generateSecretKey({
+        app_name: input.appName,
+        secret_name: input.secretName,
+        type: input.type,
+    });
+};
+const valuesEqual = (left, right) => {
+    if (left === undefined && right === undefined)
+        return true;
+    if (left === undefined || right === undefined)
+        return false;
+    return deepEqual(left, right);
+};
+export const SecretKeyProvider = () => Provider.succeed(SecretKey, {
+    stables: ["appName", "name", "type", "publicKey", "createdAt"],
+    nuke: { dependsOn: ["Fly.App"] },
+    diff: Effect.fn(function* ({ news, output }) {
+        if (news === undefined || !isResolved(news))
+            return undefined;
+        if (output === undefined)
+            return undefined;
+        const desiredName = news.name !== undefined ? sanitizeFlyVolumeName(news.name) : output.name;
+        const nameChanged = desiredName !== output.name;
+        const nextApp = appNameOf(news.app);
+        const appChanged = nextApp !== undefined && nextApp !== output.appName;
+        const typeChanged = news.type !== undefined && output.type !== undefined && news.type !== output.type;
+        if (nameChanged || appChanged || typeChanged) {
+            return {
+                action: "replace",
+                // Same (app, name) cannot hold two types — delete first.
+                deleteFirst: !nameChanged && !appChanged,
+            };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+        const appName = output?.appName ?? (olds !== undefined ? appNameOf(olds.app) : undefined);
+        if (appName === undefined)
+            return undefined;
+        const name = yield* resolveName(id, olds?.name, output?.name);
+        const found = yield* getByName(appName, name);
+        if (found === undefined)
+            return undefined;
+        const attrs = toAttrs(appName, found, name);
+        if (output !== undefined)
+            return attrs;
+        return matchesAlchemyPhysicalName(name) ? attrs : Unowned(attrs);
+    }),
+    list: Effect.fn(function* () {
+        const apps = yield* listOwnedApps();
+        const rows = yield* Effect.forEach(apps, (app) => listKeys(app.appName).pipe(Effect.map((keys) => keys.flatMap((key) => {
+            const name = key.name;
+            if (!matchesAlchemyPhysicalName(name))
+                return [];
+            return [toAttrs(app.appName, key, name ?? "")];
+        }))), { concurrency: 8 });
+        return rows.flat();
+    }),
+    reconcile: Effect.fn(function* ({ id, news, olds, output }) {
+        const props = news ?? {};
+        const appName = appNameOf(props.app) ?? output?.appName;
+        if (appName === undefined) {
+            return yield* new SecretKeyAppRequired({
+                message: "SecretKey requires a resolved Fly.App",
+            });
+        }
+        const name = yield* resolveName(id, props.name, output?.name);
+        // Observe by cached identity, then the desired (app, name).
+        let current = output !== undefined ? yield* getByName(output.appName, output.name) : undefined;
+        if (current === undefined &&
+            (output === undefined || output.appName !== appName || output.name !== name)) {
+            current = yield* getByName(appName, name);
+        }
+        if (current === undefined) {
+            yield* putKey({
+                appName,
+                secretName: name,
+                type: props.type,
+                value: props.value,
+            }).pipe(Effect.catchTag("Conflict", () => Effect.void));
+            current = yield* getByName(appName, name);
+        }
+        if (current === undefined) {
+            return yield* new SecretKeyNotCreated({ appName, secretName: name });
+        }
+        // Sync — re-set when the caller supplied new material. Observed
+        // cloud never returns private bytes; `olds.value` is only a hint.
+        const desiredValue = props.value;
+        if (desiredValue !== undefined) {
+            const previousValue = olds?.value;
+            const shouldSet = previousValue === undefined || !valuesEqual(previousValue, desiredValue);
+            if (shouldSet) {
+                yield* putKey({
+                    appName,
+                    secretName: name,
+                    type: props.type ?? current.type,
+                    value: desiredValue,
+                }).pipe(Effect.catchTag("Conflict", () => Effect.void));
+                current = (yield* getByName(appName, name)) ?? current;
+            }
+        }
+        return toAttrs(appName, current, name);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        if (output.appName.length === 0 || output.name.length === 0)
+            return;
+        yield* machines
+            .deleteSecretKey({
+            app_name: output.appName,
+            secret_name: output.name,
+        })
+            .pipe(Effect.catchTag("NotFound", () => Effect.void));
+        yield* getByName(output.appName, output.name).pipe(Effect.map((key) => key === undefined), Effect.repeat({
+            schedule: Schedule.spaced("1 second"),
+            until: (gone) => gone,
+            times: 8,
+        }));
+    }),
+});
+//# sourceMappingURL=SecretKey.js.map

package/lib/SecretKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKey.js","sourceRoot":"","sources":["../src/SecretKey.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAuDvB,MAAM,qBAAqB,GAAG,CAC5B,KAAuE,EACtB,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,IAAI,UAAU,CAAC,mBAAmB;QAAE,OAAO,QAAQ,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAA2C;QAC7D,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IACjB,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,QAAQ,CAAY,eAAe,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B,MAAM,CAAC,MAAM,CAC9D,CAAC,EAAU,EAAE,KAAuE,EAAE,EAAE,CACtF,iBAAiB,CAAC,EAAE,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,EACrD,iBAAiB,CAClB,CAAC;AAEF,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAGjF;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAEnF;CAAG;AAEL,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,KAA8B,CAAC;IAC3C,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,QAAiB,EAAE,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,CACd,OAAe,EACf,GAAiB,EACjB,YAAoB,EACK,EAAE,CAAC,CAAC;IAC7B,OAAO;IACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,YAAY;IAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,UAAU;CAC1B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAE,EAAE,CACxD,QAAQ;KACL,YAAY,CAAC;IACZ,QAAQ,EAAE,OAAO;IACjB,WAAW,EAAE,UAAU;CACxB,CAAC;KACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAE/D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,KAKf,EAAE,EAAE;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,YAAY,CAAC;YAC3B,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;QAChC,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,IAAuC,EACvC,KAAwC,EAC/B,EAAE;IACX,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CACpC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE;IAC1B,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC;IAC9D,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE;IAEhC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7F,MAAM,WAAW,GAAG,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QACvE,MAAM,WAAW,GACf,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;QACpF,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;YAC7C,OAAO;gBACL,MAAM,EAAE,SAAkB;gBAC1B,yDAAyD;gBACzD,WAAW,EAAE,CAAC,WAAW,IAAI,CAAC,UAAU;aACzC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1F,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CACN,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CACxB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CACH,CACF,EACH,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACxD,MAAM,KAAK,GAAG,IAAI,IAAK,EAAqB,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC;QACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;gBACrC,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9D,4DAA4D;QAC5D,IAAI,OAAO,GACT,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IACE,OAAO,KAAK,SAAS;YACrB,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,EAC5E,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,CAAC,MAAM,CAAC;gBACZ,OAAO;gBACP,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,gEAAgE;QAChE,kEAAkE;QAClE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;QACjC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,aAAa,GAAG,IAAI,EAAE,KAAK,CAAC;YAClC,MAAM,SAAS,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAC3F,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,CAAC,CAAC,MAAM,CAAC;oBACZ,OAAO;oBACP,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;oBAChC,KAAK,EAAE,YAAY;iBACpB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpE,KAAK,CAAC,CAAC,QAAQ;aACZ,eAAe,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,EACtC,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/SecretKeyHttp.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared scaffolding for Fly SecretKey HTTP bindings.
+ *
+ * NOT exported from `index.ts`.
+ */
+import type * as Effect from "effect/Effect";
+import type { SecretAuth } from "./SecretHttp.ts";
+import type { SecretKey } from "./SecretKey.ts";
+export declare const bytesToBase64: (bytes: Uint8Array | ArrayLike<number>) => string;
+export declare const base64ToBytes: (value: string | undefined) => Uint8Array;
+export declare const makeHttpSecretKeyBinding: <Client>(options: {
+    makeClient: (auth: SecretAuth, appName: Effect.Effect<string>, secretName: Effect.Effect<string>) => Client;
+}) => Effect.Effect<(resource: SecretKey) => Effect.Effect<Client, never, never>, never, import("@distilled.cloud/fly-io").Credentials | import("effect/http/HttpClient").HttpClient>;
+//# sourceMappingURL=SecretKeyHttp.d.ts.map

package/lib/SecretKeyHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKeyHttp.d.ts","sourceRoot":"","sources":["../src/SecretKeyHttp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,eAAO,MAAM,aAAa,UAAW,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,KAAG,MACwB,CAAC;AAE/F,eAAO,MAAM,aAAa,UAAW,MAAM,GAAG,SAAS,KAAG,UACL,CAAC;AAEtD,eAAO,MAAM,wBAAwB,GAAI,MAAM,WAAW;IACxD,UAAU,EAAE,CACV,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAC9B,MAAM,CAAC;CACb,oLAAwE,CAAC"}

package/lib/SecretKeyHttp.js

@@ -0,0 +1,5 @@
+import { makeHttpSecretBinding } from "./SecretHttp.js";
+export const bytesToBase64 = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes)).toString("base64");
+export const base64ToBytes = (value) => Uint8Array.from(Buffer.from(value ?? "", "base64"));
+export const makeHttpSecretKeyBinding = (options) => makeHttpSecretBinding({ ...options, kms: true });
+//# sourceMappingURL=SecretKeyHttp.js.map

package/lib/SecretKeyHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKeyHttp.js","sourceRoot":"","sources":["../src/SecretKeyHttp.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAqC,EAAU,EAAE,CAC7E,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAE/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAc,EAAE,CACrE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAS,OAMhD,EAAE,EAAE,CAAC,qBAAqB,CAAoB,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC"}