@distilled.cloud/fly-io 1.0.0-rc.14 → 1.0.0-rc.16

package/lib/traits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traits.d.ts","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;CACrC;AAED,eAAO,MAAM,eAAe,eAAmD,CAAC;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,SAAS,OAAQ,cAAc,qDAAwC,CAAC;AAErF,eAAO,MAAM,kBAAkB,eAA8D,CAAC;AAE9F,2EAA2E;AAC3E,eAAO,MAAM,YAAY,SAAU,MAAM,qDAA6C,CAAC;AAEvF,eAAO,MAAM,wBAAwB,eAA6D,CAAC;AAEnG,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,wDAAuD,CAAC"}
+{"version":3,"file":"traits.d.ts","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;CACrC;AAED,eAAO,MAAM,eAAe,eAAiE,CAAC;AAE9F,0FAA0F;AAC1F,eAAO,MAAM,SAAS,OAAQ,cAAc,qDAAwC,CAAC;AAErF,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,YAAY,SAAU,MAAM,qDAA6C,CAAC;AAEvF,eAAO,MAAM,wBAAwB,eAEpC,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,wDAAuD,CAAC"}

package/lib/traits.js

@@ -1,21 +1,21 @@
-/**
- * Fly.io SDK trait surface — hand-written.
- *
- * Re-exports the generic protocol traits from core so generated operations
- * import everything from one place. REST services use the bare-payload and
- * sensitive-value traits; GraphQL add-ons add the operation/response-path
- * envelope traits.
- */
+
+
+
+
+
+
+
+
 import { makeAnnotation } from "@distilled.cloud/core/trait";
 export { Body, Header, Query, Label, Http, ResponseCode, HttpBody, FormDataFile, KeyDictionary, UnionCases, applyErrorMatchers, getErrorMatchers, bodySymbol, headerSymbol, querySymbol, labelSymbol, httpSymbol, responseCodeSymbol, httpBodySymbol, formDataFileSymbol, keyDictionarySymbol, unionCasesSymbol, errorMatchersSymbol, } from "@distilled.cloud/core/trait";
 export { RawResponse, RawResponseRoot, SensitiveValue, rawResponseSymbol, rawResponseRootSymbol, sensitiveValueSymbol, } from "@distilled.cloud/core/protocol-rest";
-export const graphqlOpSymbol = Symbol.for("@distilled.cloud/fly-io/graphql-op");
-/** Marks an operation input with its GraphQL document (`com.flyio.graphql#operation`). */
+export const graphqlOpSymbol = /*@__PURE__*/ Symbol.for("@distilled.cloud/fly-io/graphql-op");
+
 export const GraphQLOp = (op) => makeAnnotation(graphqlOpSymbol, op);
-export const responsePathSymbol = Symbol.for("@distilled.cloud/fly-io/graphql-response-path");
-/** Dotted path under GraphQL `data` (`com.flyio.graphql#responsePath`). */
+export const responsePathSymbol = /*@__PURE__*/ Symbol.for("@distilled.cloud/fly-io/graphql-response-path");
+
 export const ResponsePath = (path) => makeAnnotation(responsePathSymbol, path);
-export const graphqlPayloadRootSymbol = Symbol.for("@distilled.cloud/fly-io/graphql-payload-root");
-/** Marks a response whose entire value is `data.<responsePath>`. */
+export const graphqlPayloadRootSymbol = /*@__PURE__*/ Symbol.for("@distilled.cloud/fly-io/graphql-payload-root");
+
 export const GraphQLPayloadRoot = () => makeAnnotation(graphqlPayloadRootSymbol, true);
 //# sourceMappingURL=traits.js.map

package/lib/traits.js.map

@@ -1 +1 @@
-{"version":3,"file":"traits.js","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAGhB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAY7C,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;AAE9F,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,cAAc,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAEnG,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"traits.js","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAGhB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAY7C,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAE9F,0FAA0F;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CACxD,+CAA+C,CAChD,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,cAAc,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAC9D,8CAA8C,CAC/C,CAAC;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@distilled.cloud/fly-io",
-  "version": "1.0.0-rc.14",
+  "version": "1.0.0-rc.16",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -19,7 +19,9 @@
       "types": "./lib/index.d.ts",
       "bun": "./src/index.ts",
       "worker": "./src/index.ts",
-      "default": "./lib/index.js"
+      "module": "./lib/index.full.js",
+      "module-sync": "./lib/index.js",
+      "default": "./lib/index.full.js"
     },
     "./Credentials": {
       "types": "./lib/credentials.d.ts",
@@ -85,27 +87,29 @@
       "types": "./lib/services/*.d.ts",
       "bun": "./src/services/*.ts",
       "worker": "./src/services/*.ts",
-      "default": "./lib/services/*.js"
+      "module": "./lib/services.full/*.js",
+      "module-sync": "./lib/services/*.js",
+      "default": "./lib/services.full/*.js"
     }
   },
   "dependencies": {
-    "@distilled.cloud/core": "1.0.0-rc.14"
+    "@distilled.cloud/core": "1.0.0-rc.16"
   },
   "devDependencies": {
-    "@types/node": "26.2.0"
+    "@types/node": "26.6.5"
   },
   "peerDependencies": {
-    "effect": "^4.0.0"
+    "effect": "^4.0.5"
   },
   "distilled": {
-    "generatedAt": "2026-10-09",
+    "generatedAt": "2026-10-21",
     "specUpdatedAt": "2026-10-08"
   },
   "scripts": {
     "convert": "node --conditions=bun scripts/convert.ts",
     "generate": "node --conditions=bun scripts/generate.ts",
-    "typecheck": "tsc -p tsconfig.json",
-    "build": "tsc -b",
+    "typecheck": "tsrs -p tsconfig.json",
+    "build": "tsrs -b",
     "specs:fetch": "git submodule update --force --init --depth=1 specs/spec-mirror-fly-io",
     "specs:update": "git submodule update --remote --force --depth=1 specs/spec-mirror-fly-io"
   }

package/src/credentials.ts

@@ -1,5 +1,6 @@
+import * as EffectConfig from "@distilled.cloud/core/config";
 /**
- * Fly.io credentials — hand-written.
+ * Fly.io credentials -- hand-written.
  *
  * The `Credentials` service holds an *effect* that resolves the current
  * credentials on every request. The protocol layer resolves it per request
@@ -14,7 +15,6 @@
  * mints a Sprites bearer from `FLY_API_TOKEN` (see `SpritesProtocol`).
  */
 import { ConfigError } from "@distilled.cloud/core/errors";
-import * as EffectConfig from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -30,13 +30,13 @@ export const DEFAULT_API_BASE_URL = "https://api.machines.dev";
 /** UI-EX REST + GraphQL host (MPG, Tigris, Redis). Not overridable via an invented env var. */
 export const DEFAULT_FLY_API_BASE_URL = "https://api.fly.io";
 
-/** Sprites REST root. Auth is a bearer minted from `FLY_API_TOKEN` — never `SPRITES_TOKEN`. */
+/** Sprites REST root. Auth is a bearer minted from `FLY_API_TOKEN` -- never `SPRITES_TOKEN`. */
 export const DEFAULT_SPRITES_API_BASE_URL = "https://api.sprites.dev/v1";
 
 /**
  * Normalize a Fly API hostname into the Machines API base URL.
  *
- * - unset / empty → `https://api.machines.dev`
+ * - unset / empty -> `https://api.machines.dev`
  * - trailing slashes stripped
  * - a trailing `/v1` is dropped: `flyctl` and older consumers set
  *   `FLY_API_HOSTNAME` to the `/v1` root, and the routes already carry it
@@ -53,27 +53,30 @@ export interface Config {
   readonly apiBaseUrl: string;
 }
 
-export class Credentials extends Context.Service<Credentials, Effect.Effect<Config>>()(
-  "Fly-ioCredentials",
-) {}
+export class Credentials
+  extends /*@__PURE__*/ Context.Service<Credentials, Effect.Effect<Config>>()(
+    "Fly-ioCredentials",
+  ) {}
 
-const envConfig = EffectConfig.all({
-  apiKey: EffectConfig.String("FLY_API_TOKEN").pipe(
-    EffectConfig.orElse(() => EffectConfig.String("FLY_IO_API_KEY")),
+const envConfig = /*@__PURE__*/ EffectConfig.all({
+  apiKey: /*@__PURE__*/ EffectConfig.String("FLY_API_TOKEN").pipe(
+    /*@__PURE__*/ EffectConfig.orElse(() => EffectConfig.String("FLY_IO_API_KEY")),
+  ),
+  apiBaseUrl: /*@__PURE__*/ EffectConfig.String("FLY_API_HOSTNAME").pipe(
+    /*@__PURE__*/ EffectConfig.withDefault(""),
   ),
-  apiBaseUrl: EffectConfig.String("FLY_API_HOSTNAME").pipe(EffectConfig.withDefault("")),
 });
 
-export const CredentialsFromEnv = Layer.succeed(
+export const CredentialsFromEnv = /*@__PURE__*/ Layer.succeed(
   Credentials,
-  envConfig.pipe(
-    Effect.mapError(
+  /*@__PURE__*/ envConfig.pipe(
+    /*@__PURE__*/ Effect.mapError(
       () =>
         new ConfigError({
           message: "FLY_API_TOKEN (or FLY_IO_API_KEY) environment variable is required",
         }),
     ),
-    Effect.map(({ apiKey, apiBaseUrl }) => ({
+    /*@__PURE__*/ Effect.map(({ apiKey, apiBaseUrl }) => ({
       apiKey: Redacted.make(apiKey),
       apiBaseUrl: normalizeApiBaseUrl(apiBaseUrl || undefined),
     })),

package/src/errors.ts

@@ -27,42 +27,39 @@ export {
 } from "@distilled.cloud/core/errors";
 import * as Category from "@distilled.cloud/core/category";
 import type { DefaultErrors as CoreDefaultErrors } from "@distilled.cloud/core/errors";
+import * as Schema from "@distilled.cloud/core/schema-lite-typed";
 import { applyErrorMatchers } from "@distilled.cloud/core/trait";
-import * as Schema from "effect/Schema";
 
 /**
- * Unknown Fly.io error — returned when a failure matches no status-mapped
+ * Unknown Fly.io error -- returned when a failure matches no status-mapped
  * error class. Carries the raw body for later cataloging.
  */
-export class UnknownFlyIoError extends Schema.TaggedError<UnknownFlyIoError>()(
-  "UnknownFlyIoError",
-  {
-    code: Schema.optional(Schema.String),
-    message: Schema.optional(Schema.String),
+export class UnknownFlyIoError
+  extends /*@__PURE__*/ Schema.TaggedError<UnknownFlyIoError>()("UnknownFlyIoError", {
+    code: /*@__PURE__*/ Schema.optional(Schema.String),
+    message: /*@__PURE__*/ Schema.optional(Schema.String),
     body: Schema.Unknown,
-  },
-).pipe(Category.withServerError) {}
+  }).pipe(Category.withServerError) {}
 
 /** Schema parse error wrapper. */
-export class FlyIoParseError extends Schema.TaggedError<FlyIoParseError>()("FlyIoParseError", {
-  body: Schema.Unknown,
-  cause: Schema.Unknown,
-}).pipe(Category.withParseError) {}
+export class FlyIoParseError
+  extends /*@__PURE__*/ Schema.TaggedError<FlyIoParseError>()("FlyIoParseError", {
+    body: Schema.Unknown,
+    cause: Schema.Unknown,
+  }).pipe(Category.withParseError) {}
 
 /**
  * Sprites is not enabled for the Fly organization that owns `FLY_API_TOKEN`.
  *
  * Returned by `POST /v1/organizations/{org}/tokens` as HTTP 401 with a
  * message matching `sprites not enabled`. Sprite CRUD never sees a
- * `SPRITES_TOKEN` — this is the mint-time entitlement signal.
+ * `SPRITES_TOKEN` -- this is the mint-time entitlement signal.
  */
-export class SpritesNotEnabled extends Schema.TaggedError<SpritesNotEnabled>()(
-  "SpritesNotEnabled",
-  {
-    code: Schema.optional(Schema.Int),
-    message: Schema.optional(Schema.String),
-  },
-).pipe(Category.withAuthError) {}
+export class SpritesNotEnabled
+  extends /*@__PURE__*/ Schema.TaggedError<SpritesNotEnabled>()("SpritesNotEnabled", {
+    code: /*@__PURE__*/ Schema.optional(Schema.Int),
+    message: /*@__PURE__*/ Schema.optional(Schema.String),
+  }).pipe(Category.withAuthError) {}
 applyErrorMatchers(SpritesNotEnabled, [
   { status: 401, message: { matches: "[Ss]prites not enabled" } },
 ]);
@@ -72,13 +69,14 @@ applyErrorMatchers(SpritesNotEnabled, [
  * (`createExtensionTosAgreement`). GraphQL returns this as a 200
  * with `Not authorized to access this createextensiontosagreement`.
  */
-export class CreateExtensionTosAgreementNotAuthorized extends Schema.TaggedError<CreateExtensionTosAgreementNotAuthorized>()(
-  "CreateExtensionTosAgreementNotAuthorized",
-  {
-    code: Schema.optional(Schema.Int),
-    message: Schema.optional(Schema.String),
-  },
-).pipe(Category.withAuthError) {}
+export class CreateExtensionTosAgreementNotAuthorized
+  extends /*@__PURE__*/ Schema.TaggedError<CreateExtensionTosAgreementNotAuthorized>()(
+    "CreateExtensionTosAgreementNotAuthorized",
+    {
+      code: /*@__PURE__*/ Schema.optional(Schema.Int),
+      message: /*@__PURE__*/ Schema.optional(Schema.String),
+    },
+  ).pipe(Category.withAuthError) {}
 applyErrorMatchers(CreateExtensionTosAgreementNotAuthorized, [
   {
     message: {

package/src/index.ts

@@ -1,8 +1,8 @@
 /**
- * @distilled.cloud/fly-io — Fly.io SDK for Effect.
+ * @distilled.cloud/fly-io -- Fly.io SDK for Effect.
  *
  * `./services` is generated by `scripts/generate.ts` from the Smithy model
- * written by `scripts/convert.ts` (OpenAPI → Smithy via the shared core
+ * written by `scripts/convert.ts` (OpenAPI -> Smithy via the shared core
  * converter). Everything else in this folder is hand-written.
  *
  * The generated barrel is re-exported at the package root, same as every

package/src/pagination.ts

@@ -1,5 +1,5 @@
 /**
- * Fly.io pagination — cursor (Sprites list) and Relay (GraphQL add-ons).
+ * Fly.io pagination -- cursor (Sprites list) and Relay (GraphQL add-ons).
  */
 export {
   paginateCursor,

package/src/protocol.ts

@@ -11,14 +11,19 @@ import {
   matchTypedError,
 } from "@distilled.cloud/core/protocol-http";
 import {
+  hasSensitiveMember,
   makeRestProtocol,
   unwrapRedactedDeep,
   wrapSensitive,
 } from "@distilled.cloud/core/protocol-rest";
-import { failIfStrict, validateResponse } from "@distilled.cloud/core/response-validation";
+import {
+  failUnlessLenient,
+  validateResponse,
+  withholdActual,
+} from "@distilled.cloud/core/response-validation";
 import { parseRetryAfterForStatus } from "@distilled.cloud/core/retry-after";
 /**
- * Fly.io protocols — Machines REST, UI-EX REST (MPG), GraphQL add-ons, and
+ * Fly.io protocols -- Machines REST, UI-EX REST (MPG), GraphQL add-ons, and
  * Sprites REST.
  *
  * Machines (`FlyIoProtocol`) is a plain bearer-token JSON API at
@@ -116,7 +121,7 @@ const spritesErrorEnvelope = (body: unknown) => {
   return { message, code };
 };
 
-const resolveFlyCreds = Effect.gen(function* () {
+const resolveFlyCreds = /*@__PURE__*/ Effect.gen(function* () {
   const resolve = yield* Credentials;
   return yield* resolve;
 });
@@ -127,11 +132,10 @@ const resolveFlyCreds = Effect.gen(function* () {
  * GetSecret in the same process; this service only changes headers:
  * omit `Authorization`, send `Connection: close`.
  */
-export class MachineIdentity extends Context.Service<MachineIdentity, true>()(
-  "FlyIoMachineIdentity",
-) {}
+export class MachineIdentity
+  extends /*@__PURE__*/ Context.Service<MachineIdentity, true>()("FlyIoMachineIdentity") {}
 
-const FlyIoProtocolRest: Layer.Layer<API.Protocol> = makeRestProtocol<Config>({
+const FlyIoProtocolRest: Layer.Layer<API.Protocol> = /*@__PURE__*/ makeRestProtocol<Config>({
   credentials: resolveFlyCreds,
   baseUrl: (creds) => creds.apiBaseUrl,
   headers: (creds) => ({
@@ -142,9 +146,9 @@ const FlyIoProtocolRest: Layer.Layer<API.Protocol> = makeRestProtocol<Config>({
   parseError: ({ body, cause }) => new FlyIoParseError({ body, cause }),
 });
 
-export const FlyIoProtocol: Layer.Layer<API.Protocol> = Layer.effect(
+export const FlyIoProtocol: Layer.Layer<API.Protocol> = /*@__PURE__*/ Layer.effect(
   API.Protocol,
-  Effect.gen(function* () {
+  /*@__PURE__*/ Effect.gen(function* () {
     const rest = yield* API.Protocol;
     return API.Protocol.of({
       encode: (args) =>
@@ -160,10 +164,10 @@ export const FlyIoProtocol: Layer.Layer<API.Protocol> = Layer.effect(
       decode: rest.decode,
     });
   }),
-).pipe(Layer.provide(FlyIoProtocolRest));
+).pipe(/*@__PURE__*/ Layer.provide(FlyIoProtocolRest));
 
 /** MPG UI-EX REST at `https://api.fly.io` with the Machines bearer token. */
-export const FlyApiProtocol: Layer.Layer<API.Protocol> = makeRestProtocol<Config>({
+export const FlyApiProtocol: Layer.Layer<API.Protocol> = /*@__PURE__*/ makeRestProtocol<Config>({
   credentials: resolveFlyCreds,
   baseUrl: () => DEFAULT_FLY_API_BASE_URL,
   headers: (creds) => ({
@@ -404,7 +408,7 @@ const mintOnce = (fly: Config) =>
     if (typeof token !== "string" || token.length === 0) {
       return yield* fail(
         new FlyIoParseError({
-          body: json ?? text,
+          body: "[REDACTED]",
           cause: "mint response missing token",
         }),
       );
@@ -413,8 +417,11 @@ const mintOnce = (fly: Config) =>
   });
 
 // Keyed by the Fly token itself: `Redacted` hashes and compares by value.
-const mintedTokens = MutableHashMap.empty<Redacted.Redacted<string>, Redacted.Redacted<string>>();
-const mintInFlight = MutableHashMap.empty<
+const mintedTokens = /*@__PURE__*/ MutableHashMap.empty<
+  Redacted.Redacted<string>,
+  Redacted.Redacted<string>
+>();
+const mintInFlight = /*@__PURE__*/ MutableHashMap.empty<
   Redacted.Redacted<string>,
   Deferred.Deferred<Redacted.Redacted<string>, Effect.Error<ReturnType<typeof mintOnce>>>
 >();
@@ -554,24 +561,32 @@ const decodeSpritesResponse = ({
     }
 
     // Strict mode checks the mapped body (or parsed exec frames) against the
-    // output schema.
+    // output schema. For an output with sensitive members, a non-JSON body
+    // fails in every mode and parse errors withhold the body.
+    const sensitive = hasSensitiveMember(outputAst);
+    const reported = sensitive ? "[REDACTED]" : (execFrames ?? (nonJson ? text : json));
+    if (nonJson && sensitive) {
+      return yield* fail(
+        new FlyIoParseError({
+          body: "[REDACTED]",
+          cause: "Invalid JSON response",
+        }),
+      );
+    }
     const body: unknown = execFrames ?? parseMaybeNdjson(nonJson ? text : (json ?? {}));
     const mapped = yield* validateResponse(
       outputAst,
       mapKeys(outputAst, body, "decode"),
       (cause) =>
-        new FlyIoParseError({
-          body: execFrames ?? (nonJson ? text : json),
-          cause,
-        }),
+        new FlyIoParseError({ body: reported, cause: sensitive ? withholdActual(cause) : cause }),
     ).pipe(Effect.catch(fail));
     return wrapSensitive(outputAst, mapped);
   });
 
 /** Sprites REST at `https://api.sprites.dev/v1`, minted from `FLY_API_TOKEN`. */
-export const SpritesProtocol: Layer.Layer<API.Protocol> = Layer.succeed(
+export const SpritesProtocol: Layer.Layer<API.Protocol> = /*@__PURE__*/ Layer.succeed(
   API.Protocol,
-  API.Protocol.of({
+  /*@__PURE__*/ API.Protocol.of({
     encode: (args) =>
       encodeSpritesRequest(args) as Effect.Effect<HttpClientRequest.HttpClientRequest>,
     decode: (args) => decodeSpritesResponse(args) as Effect.Effect<unknown>,
@@ -579,25 +594,25 @@ export const SpritesProtocol: Layer.Layer<API.Protocol> = Layer.succeed(
 );
 
 // =============================================================================
-// GraphQL add-ons (Tigris, Redis) — POST https://api.fly.io/graphql
+// GraphQL add-ons (Tigris, Redis) -- POST https://api.fly.io/graphql
 // =============================================================================
 
-const GraphQLError = Schema.Struct({
+const GraphQLError = /*@__PURE__*/ Schema.Struct({
   message: Schema.String,
-  path: Schema.optional(Schema.Array(Schema.Unknown)),
-  extensions: Schema.optional(
-    Schema.Struct({
-      code: Schema.optional(Schema.String),
+  path: /*@__PURE__*/ Schema.optional(/*@__PURE__*/ Schema.Array(Schema.Unknown)),
+  extensions: /*@__PURE__*/ Schema.optional(
+    /*@__PURE__*/ Schema.Struct({
+      code: /*@__PURE__*/ Schema.optional(Schema.String),
     }),
   ),
 });
 
-const GraphQLEnvelope = Schema.Struct({
-  data: Schema.optional(Schema.NullOr(Schema.Unknown)),
-  errors: Schema.optional(Schema.Array(GraphQLError)),
+const GraphQLEnvelope = /*@__PURE__*/ Schema.Struct({
+  data: /*@__PURE__*/ Schema.optional(/*@__PURE__*/ Schema.NullOr(Schema.Unknown)),
+  errors: /*@__PURE__*/ Schema.optional(/*@__PURE__*/ Schema.Array(GraphQLError)),
 });
 
-const decodeEnvelope = Schema.decodeUnknownOption(GraphQLEnvelope);
+const decodeEnvelope = /*@__PURE__*/ Schema.decodeUnknownOption(GraphQLEnvelope);
 
 const matchGraphqlError = (
   status: number,
@@ -715,12 +730,23 @@ const graphqlDecode = ({
       }
     }
 
+    // For an output with sensitive members, a non-JSON body fails in every
+    // mode and parse errors withhold the body.
+    const sensitive = hasSensitiveMember(outputAst);
     if (!parsed) {
       if (status >= 400) {
         return yield* matchGraphqlError(status, text, headers, errors);
       }
+      if (sensitive) {
+        return yield* fail(
+          new FlyIoParseError({
+            body: "[REDACTED]",
+            cause: "response body is not valid JSON",
+          }),
+        );
+      }
       // Lenient mode returns the body as read.
-      return yield* failIfStrict(
+      return yield* failUnlessLenient(
         new FlyIoParseError({
           body: text,
           cause: "response body is not valid JSON",
@@ -752,16 +778,21 @@ const graphqlDecode = ({
     }
     // Strict mode checks the payload at the response path against the
     // output schema.
-    return yield* validateResponse(
+    const validated = yield* validateResponse(
       outputAst,
       payload === undefined ? null : payload,
-      (cause) => new FlyIoParseError({ body: json, cause }),
+      (cause) =>
+        new FlyIoParseError({
+          body: sensitive ? "[REDACTED]" : json,
+          cause: sensitive ? withholdActual(cause) : cause,
+        }),
     ).pipe(Effect.catch(fail));
+    return wrapSensitive(outputAst, validated);
   });
 
-export const FlyGraphqlProtocol: Layer.Layer<API.Protocol> = Layer.succeed(
+export const FlyGraphqlProtocol: Layer.Layer<API.Protocol> = /*@__PURE__*/ Layer.succeed(
   API.Protocol,
-  API.Protocol.of({
+  /*@__PURE__*/ API.Protocol.of({
     encode: (args) => graphqlEncode(args) as Effect.Effect<HttpClientRequest.HttpClientRequest>,
     decode: graphqlDecode,
   }),

package/src/retry.ts

@@ -33,17 +33,19 @@ export {
 } from "@distilled.cloud/core/retry";
 
 /** Context tag for configuring retry behavior of FlyIo API calls. */
-export class Retry extends Context.Service<Retry, Policy>()("FlyIoRetry") {}
+export class Retry extends /*@__PURE__*/ Context.Service<Retry, Policy>()("FlyIoRetry") {}
 
 /** Provides a custom retry policy to every FlyIo API call below it. */
 export const policy = (optionsOrFactory: Policy) =>
   Effect.provide(Layer.succeed(Retry, optionsOrFactory));
 
 /** Disables all automatic retries. */
-export const none = Effect.provide(Layer.succeed(Retry, { while: () => false }));
+export const none = /*@__PURE__*/ Effect.provide(
+  /*@__PURE__*/ Layer.succeed(Retry, { while: () => false }),
+);
 
 /** Apply the throttling retry policy (retries throttling errors indefinitely). */
-export const throttling = policy(throttlingFactory);
+export const throttling = /*@__PURE__*/ policy(throttlingFactory);
 
 /** Apply the transient retry policy (retries all transient errors indefinitely). */
-export const transient = policy(transientFactory);
+export const transient = /*@__PURE__*/ policy(transientFactory);