alchemy 2.0.0-beta.74 → 2.0.0-beta.76

package/src/Fly/RedisHttp.ts

@@ -1,51 +1,11 @@
-import * as Effect from "effect/Effect";
-import type { RuntimeContext } from "../RuntimeContext.ts";
-import type { ReadRedisClient } from "./ReadRedis.ts";
-import type { ReadWriteRedisClient } from "./ReadWriteRedis.ts";
-import type { RedisUrlMissing } from "./Redis.ts";
-import { redisCommand } from "./RedisBinding.ts";
-import type { WriteRedisClient } from "./WriteRedis.ts";
-
 /**
  * Shared Redis command-client builders. NOT exported from `index.ts`.
+ *
+ * The RESP client lives in `alchemy/Redis`. These aliases keep the
+ * `{Op}Http.ts` layers stable.
  */
-
-const asString = (value: unknown): string => {
-  if (typeof value === "string") return value;
-  if (value == null) return "";
-  return String(value);
-};
-
-const asNullableString = (value: unknown): string | null => {
-  if (value == null) return null;
-  return asString(value);
-};
-
-const asNumber = (value: unknown): number => {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  const parsed = Number(asString(value));
-  return Number.isFinite(parsed) ? parsed : 0;
-};
-
-export const makeReadRedisClient = (
-  url: Effect.Effect<string, RedisUrlMissing, RuntimeContext>,
-): ReadRedisClient => ({
-  get: (key) =>
-    redisCommand(url, "GET", [key]).pipe(Effect.map(asNullableString)),
-  ping: () => redisCommand(url, "PING").pipe(Effect.map(asString)),
-});
-
-export const makeWriteRedisClient = (
-  url: Effect.Effect<string, RedisUrlMissing, RuntimeContext>,
-): WriteRedisClient => ({
-  set: (key, value) =>
-    redisCommand(url, "SET", [key, value]).pipe(Effect.asVoid),
-  del: (key) => redisCommand(url, "DEL", [key]).pipe(Effect.map(asNumber)),
-});
-
-export const makeReadWriteRedisClient = (
-  url: Effect.Effect<string, RedisUrlMissing, RuntimeContext>,
-): ReadWriteRedisClient => ({
-  ...makeReadRedisClient(url),
-  ...makeWriteRedisClient(url),
-});
+export {
+  makeRead as makeReadRedisClient,
+  makeReadWrite as makeReadWriteRedisClient,
+  makeWrite as makeWriteRedisClient,
+} from "../Redis/index.ts";

package/src/Fly/SecretHttp.ts

@@ -2,13 +2,16 @@ import {
   Credentials,
   CredentialsFromEnv,
   credentials,
+  MachineIdentity,
 } from "@distilled.cloud/fly-io";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
 import type * as Context from "effect/Context";
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import type * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as Binding from "../Binding.ts";
 import type { Resource } from "../Resource.ts";
 import type { RuntimeContext } from "../RuntimeContext.ts";
@@ -147,8 +150,9 @@ export const makeSecretAuth = (
   ): Effect.Effect<A, E, RuntimeContext> => {
     if (globalThis.__ALCHEMY_RUNTIME__) {
       return eff.pipe(
-        Effect.provide(CredentialsFromEnv),
-        Effect.provide(FetchHttpClient.layer),
+        Effect.provide(
+          Layer.mergeAll(CredentialsFromEnv, FetchHttpClient.layer),
+        ),
         Effect.timeout("8 seconds"),
       ) as Effect.Effect<A, E, RuntimeContext>;
     }
@@ -162,30 +166,23 @@ export const makeSecretAuth = (
 
 const FLY_MACHINE_API_SOCKET = "/.fly/api";
 
-const flyMachineFetch = ((input: RequestInfo | URL, init?: RequestInit) => {
-  const raw =
-    typeof input === "string"
-      ? input
-      : input instanceof URL
-        ? input.href
-        : input.url;
-  const url = raw.replace(
-    /^https:\/\/api\.machines\.dev\/v1/,
-    "http://localhost/v1",
+/** Distilled machines client over `/.fly/api`. URL host is unused. */
+const flyMachineApiHttp: Layer.Layer<HttpClient.HttpClient> =
+  NodeHttpClient.layerNodeHttpNoAgent.pipe(
+    Layer.provide(
+      NodeHttpClient.layerAgentOptions({
+        // @ts-expect-error Node Agent accepts unix socketPath; Https.AgentOptions omits it
+        socketPath: FLY_MACHINE_API_SOCKET,
+        keepAlive: false,
+      }),
+    ),
   );
-  const headers = new Headers(init?.headers);
-  headers.delete("authorization");
-  headers.delete("Authorization");
-  return fetch(url, {
-    ...init,
-    headers,
-    unix: FLY_MACHINE_API_SOCKET,
-  } as RequestInit);
-}) as typeof fetch;
 
 /**
  * PetSem encrypt/sign/decrypt/verify from a Machine. Org API tokens are
  * Forbidden; the machine identity is the unix socket at `/.fly/api`.
+ * {@link MachineIdentity} is the protocol signal (no Authorization,
+ * Connection: close). GetSecret in the same process keeps Bearer.
  */
 export const makeKmsAuth = (
   ambient: Context.Context<Credentials | HttpClient.HttpClient>,
@@ -194,17 +191,24 @@ export const makeKmsAuth = (
     eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
   ): Effect.Effect<A, E, RuntimeContext> => {
     if (globalThis.__ALCHEMY_RUNTIME__) {
-      return eff.pipe(
-        Effect.provide(FetchHttpClient.layer),
-        Effect.provideService(FetchHttpClient.Fetch, flyMachineFetch),
-        Effect.provide(
-          credentials({
-            apiKey: "machine",
-            apiBaseUrl: "http://localhost/v1",
-          }),
+      return Effect.scoped(
+        eff.pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              Layer.succeed(MachineIdentity, true),
+              flyMachineApiHttp,
+              credentials({
+                apiKey: "unused",
+                apiBaseUrl: "http://localhost/v1",
+              }),
+            ),
+          ),
         ),
-        Effect.timeout("8 seconds"),
-      ) as Effect.Effect<A, E, RuntimeContext>;
+      ).pipe(Effect.timeout("8 seconds")) as Effect.Effect<
+        A,
+        E,
+        RuntimeContext
+      >;
     }
     return eff.pipe(Effect.provideContext(ambient)) as Effect.Effect<
       A,

package/src/Fly/SecretKeyHttp.ts

@@ -3,8 +3,7 @@
  *
  * NOT exported from `index.ts`.
  */
-import * as Effect from "effect/Effect";
-import { FlyKmsError } from "./Errors.ts";
+import type * as Effect from "effect/Effect";
 import type { SecretAuth } from "./SecretHttp.ts";
 import { makeHttpSecretBinding } from "./SecretHttp.ts";
 import type { SecretKey } from "./SecretKey.ts";
@@ -17,43 +16,6 @@ export const bytesToBase64 = (bytes: Uint8Array | ArrayLike<number>): string =>
 export const base64ToBytes = (value: string | undefined): Uint8Array =>
   Uint8Array.from(Buffer.from(value ?? "", "base64"));
 
-const FLY_MACHINE_API_SOCKET = "/.fly/api";
-
-/**
- * PetSem crypto over the Machine unix socket. Fly expects base64 strings,
- * not integer arrays. Org tokens are Forbidden; `/.fly/api` is the
- * machine identity.
- */
-export const flyKmsPost = (
-  appName: string,
-  secretName: string,
-  op: "encrypt" | "decrypt" | "sign" | "verify",
-  body: Record<string, unknown>,
-): Effect.Effect<Record<string, unknown>, FlyKmsError> =>
-  Effect.tryPromise({
-    try: async () => {
-      const res = await fetch(
-        `http://localhost/v1/apps/${encodeURIComponent(appName)}/secretkeys/${encodeURIComponent(secretName)}/${op}`,
-        {
-          method: "POST",
-          unix: FLY_MACHINE_API_SOCKET,
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(body),
-        } as RequestInit,
-      );
-      const text = await res.text();
-      if (!res.ok) {
-        throw new FlyKmsError({ op, status: res.status, message: text });
-      }
-      if (text.length === 0) return {};
-      return JSON.parse(text) as Record<string, unknown>;
-    },
-    catch: (cause) =>
-      cause instanceof FlyKmsError
-        ? cause
-        : new FlyKmsError({ op, message: String(cause), cause }),
-  });
-
 export const makeHttpSecretKeyBinding = <Client>(options: {
   makeClient: (
     auth: SecretAuth,

package/src/Fly/Service.ts

@@ -3,6 +3,7 @@ import type {
   FlyMachineGuest,
   FlyMachineMount,
   FlyMachineService,
+  FlyStatic,
   Machine as FlyMachine,
 } from "@distilled.cloud/fly-io/machines";
 import * as Data from "effect/Data";
@@ -39,6 +40,7 @@ import {
   toEnvRecord,
   type FlyBuildOptions,
   type FlyHostRuntimeContext,
+  type HostedProgramProps,
 } from "./hosted.ts";
 import { attachBucketSecrets } from "./Bucket.ts";
 import { attachPostgresSecrets } from "./Postgres.ts";
@@ -123,9 +125,10 @@ export interface ServiceProps extends PlatformProps {
   build?: FlyBuildOptions;
   /**
    * Environment image used as the generated Dockerfile's `FROM`. Must
-   * be able to run the bun runtime.
+   * be able to run Node (websites and Effect-native Services use Node
+   * in production).
    *
-   * @default "oven/bun:1"
+   * @default "node:26-slim"
    */
   image?: string;
   /**
@@ -137,6 +140,32 @@ export interface ServiceProps extends PlatformProps {
    * from the stack, stage and logical ID. Changing it replaces the Service.
    */
   name?: string;
+  /**
+   * Extra host directories copied into the Machine image next to the
+   * bundled entry (e.g. a website `clientDirectory` at `/app/dist`).
+   * Hashed into `code.hash` so asset changes update the image.
+   * Destination is relative to `/app`.
+   */
+  extraFiles?: ReadonlyArray<{
+    source: string;
+    dest: string;
+  }>;
+  /**
+   * Fly proxy static-file maps. Matching GET paths skip the process and
+   * are served from the image (`guestPath`) or a Tigris bucket
+   * (`tigrisBucket`). Website composites publish hashed client assets
+   * this way.
+   */
+  statics?: ReadonlyArray<{
+    /** Path inside the image, or key prefix in {@link tigrisBucket}. */
+    guestPath: string;
+    /** URL prefix, e.g. `"/"`. */
+    urlPrefix: string;
+    /** Tigris bucket name. When set, files come from the bucket. */
+    tigrisBucket?: string;
+    /** Directory index file (`index.html`) for Tigris statics. */
+    indexDocument?: string;
+  }>;
 }
 
 export type Service = Resource<
@@ -201,7 +230,7 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  * `app` is the parent {@link App}. Pass the declaration directly,
  * yielded or module-scope. `main: import.meta.url` is the bundle
  * entrypoint. Alchemy bundles this file with Rolldown, builds a
- * Docker image (default `oven/bun:1`), and pushes it to
+ * Docker image (default `node:26-slim`), and pushes it to
  * `registry.fly.io/{app}:{id}-{hash}`.
  *
  * **Example:** Class + App + main
@@ -491,8 +520,8 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  *
  * ### Base image
  * `image` is the generated Dockerfile's `FROM`. Default is
- * `oven/bun:1`. It must still run bun. A content-hash change of
- * `main` updates the Machine in place.
+ * `node:26-slim`. A content-hash change of `main` updates the
+ * Machine in place.
  *
  * **Example:** Override FROM
  * ```typescript
@@ -501,7 +530,7 @@ export type ServiceRuntimeContext = FlyHostRuntimeContext;
  *   {
  *     app: Site,
  *     main: import.meta.url,
- *     image: "oven/bun:1.2",
+ *     image: "node:26",
  *     port: 3000,
  *   },
  *   Effect.gen(function* () {
@@ -731,6 +760,29 @@ const desiredEnv = (
   ...toEnv(props.env),
 });
 
+const toFlyStatics = (
+  statics:
+    | ReadonlyArray<{
+        guestPath: string;
+        urlPrefix: string;
+        tigrisBucket?: string;
+        indexDocument?: string;
+      }>
+    | undefined,
+): FlyStatic[] | undefined => {
+  if (statics === undefined || statics.length === 0) return undefined;
+  return statics.map((entry) => ({
+    guest_path: entry.guestPath,
+    url_prefix: entry.urlPrefix,
+    ...(entry.tigrisBucket !== undefined
+      ? { tigris_bucket: entry.tigrisBucket }
+      : {}),
+    ...(entry.indexDocument !== undefined
+      ? { index_document: entry.indexDocument }
+      : {}),
+  }));
+};
+
 const buildConfig = (input: {
   image: string;
   guest: FlyMachineGuest;
@@ -738,6 +790,7 @@ const buildConfig = (input: {
   services: FlyMachineService[];
   mounts: FlyMachineMount[];
   metadata: Record<string, string>;
+  statics?: FlyStatic[];
 }): FlyMachineConfig => ({
   image: input.image,
   guest: input.guest,
@@ -745,6 +798,10 @@ const buildConfig = (input: {
   services: input.services.length > 0 ? input.services : undefined,
   mounts: input.mounts.length > 0 ? input.mounts : undefined,
   metadata: input.metadata,
+  statics:
+    input.statics !== undefined && input.statics.length > 0
+      ? input.statics
+      : undefined,
 });
 
 const sameImage = (machine: FlyMachine, image: string) => {
@@ -807,6 +864,11 @@ const metadataChanged = (
   );
 };
 
+const sameStatics = (
+  observed: FlyStatic[] | undefined,
+  desired: FlyStatic[] | undefined,
+) => deepEqual(observed ?? [], desired ?? [], { stripNullish: true });
+
 const configDrifted = (
   machine: FlyMachine,
   desired: {
@@ -816,6 +878,7 @@ const configDrifted = (
     services: FlyMachineService[];
     mounts: FlyMachineMount[];
     metadata: Record<string, string>;
+    statics?: FlyStatic[];
   },
 ) => {
   const config = machine.config;
@@ -825,7 +888,8 @@ const configDrifted = (
     !sameEnv(config?.env, desired.env) ||
     !sameServices(config?.services, desired.services) ||
     !sameMounts(config?.mounts, desired.mounts) ||
-    metadataChanged(config?.metadata, desired.metadata)
+    metadataChanged(config?.metadata, desired.metadata) ||
+    !sameStatics(config?.statics, desired.statics)
   );
 };
 
@@ -871,27 +935,53 @@ export const ServiceProvider = () =>
         nuke: { dependsOn: ["Fly.App"] },
 
         diff: Effect.fn(function* ({ id, news, output }) {
-          if (news === undefined || !isResolved(news)) return undefined;
-          if (output === undefined) return undefined;
-          const desiredAppName = appNameOf(news.app);
-          const appChanged =
-            desiredAppName !== undefined && desiredAppName !== output.appName;
-          const desiredName =
-            news.name !== undefined
-              ? sanitizeFlyAppName(news.name)
-              : output.name;
-          const nameChanged = desiredName !== output.name;
-          const desiredRegion = news.region ?? DEFAULT_REGION;
-          const regionChanged = desiredRegion !== output.region;
-          if (appChanged || nameChanged || regionChanged) {
-            return {
-              action: "replace" as const,
-              deleteFirst: nameChanged === false && appChanged === false,
-            };
+          if (news === undefined || output === undefined) return undefined;
+          if (isResolved(news)) {
+            const desiredAppName = appNameOf(news.app);
+            const appChanged =
+              desiredAppName !== undefined && desiredAppName !== output.appName;
+            const desiredName =
+              news.name !== undefined
+                ? sanitizeFlyAppName(news.name)
+                : output.name;
+            const nameChanged = desiredName !== output.name;
+            const desiredRegion = news.region ?? DEFAULT_REGION;
+            const regionChanged = desiredRegion !== output.region;
+            if (appChanged || nameChanged || regionChanged) {
+              return {
+                action: "replace" as const,
+                deleteFirst: nameChanged === false && appChanged === false,
+              };
+            }
           }
-          const hash = yield* hosted.hash(news);
-          if (hash !== output.code.hash) {
-            return { action: "update" as const };
+          // The code hash depends only on statically-known props (`main`,
+          // `build`, `image`, `port`, `extraFiles`, `isExternal`). Never
+          // gate it on the WHOLE props being resolved: `app` is a resource
+          // reference that stays unresolved at diff time, so a whole-props
+          // guard makes code-only changes silently noop. By diff time the
+          // effect-config form has been evaluated, so the object view is
+          // safe to read.
+          const statics = news as Partial<
+            Pick<
+              ServiceProps,
+              "main" | "build" | "image" | "port" | "extraFiles" | "isExternal"
+            >
+          >;
+          if (
+            isResolved({
+              main: statics.main,
+              build: statics.build,
+              image: statics.image,
+              port: statics.port,
+              extraFiles: statics.extraFiles,
+              isExternal: statics.isExternal,
+            }) &&
+            statics.main !== undefined
+          ) {
+            const hash = yield* hosted.hash(statics as HostedProgramProps);
+            if (hash !== output.code.hash) {
+              return { action: "update" as const };
+            }
           }
           return undefined;
         }),
@@ -956,6 +1046,7 @@ export const ServiceProvider = () =>
             props.services !== undefined
               ? props.services.map(toFlyService)
               : defaultHttpServices(port, count);
+          const statics = toFlyStatics(props.statics);
 
           const { imageRef, codeHash } = yield* hosted.resolveImage({
             id,
@@ -986,6 +1077,7 @@ export const ServiceProvider = () =>
                 services,
                 mounts: desired.mounts,
                 metadata: desired.metadata,
+                statics,
               }),
             buildConfig: ({ mounts, metadata }) =>
               buildConfig({
@@ -995,6 +1087,7 @@ export const ServiceProvider = () =>
                 services,
                 mounts,
                 metadata,
+                statics,
               }),
           }).pipe(
             Effect.catchTag("Fly.ReplicaNotCreated", (error) =>

package/src/Fly/Sign.ts

@@ -1,5 +1,4 @@
 import type { SignSecretKeyError } from "@distilled.cloud/fly-io/machines";
-import type { FlyKmsError } from "./Errors.ts";
 import type * as Effect from "effect/Effect";
 import * as Binding from "../Binding.ts";
 import type { RuntimeContext } from "../RuntimeContext.ts";
@@ -41,11 +40,7 @@ export interface Sign extends Binding.Service<
   ) => Effect.Effect<
     (
       request: SignRequest,
-    ) => Effect.Effect<
-      SignResult,
-      SignSecretKeyError | FlyKmsError,
-      RuntimeContext
-    >
+    ) => Effect.Effect<SignResult, SignSecretKeyError, RuntimeContext>
   >
 > {}
 

package/src/Fly/SignHttp.ts

@@ -6,7 +6,6 @@ import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import {
   base64ToBytes,
   bytesToBase64,
-  flyKmsPost,
   makeHttpSecretKeyBinding,
 } from "./SecretKeyHttp.ts";
 import { Sign, type SignRequest } from "./Sign.ts";
@@ -34,19 +33,6 @@ export const SignHttp = Layer.effect(
     makeHttpSecretKeyBinding({
       makeClient: (auth, appName, secretName) =>
         Effect.fn("Fly.Sign")(function* (request: SignRequest) {
-          if (globalThis.__ALCHEMY_RUNTIME__) {
-            const res = yield* flyKmsPost(
-              yield* appName,
-              yield* secretName,
-              "sign",
-              { plaintext: bytesToBase64(request.plaintext) },
-            );
-            return {
-              signature: base64ToBytes(
-                typeof res.signature === "string" ? res.signature : undefined,
-              ),
-            };
-          }
           const res = yield* auth.authorize(
             machines.signSecretKey({
               app_name: yield* appName,

package/src/Fly/Sprite.ts

@@ -576,22 +576,32 @@ export const SpriteProvider = () =>
         stables: ["spriteId", "name"],
 
         diff: Effect.fn(function* ({ news, output }) {
-          if (news === undefined || !isResolved(news)) return undefined;
-          if (output === undefined) return undefined;
-          const desiredName =
-            news.name !== undefined
-              ? sanitizeFlyAppName(news.name)
-              : output.name;
-          if (desiredName !== output.name) {
-            return { action: "replace" as const };
+          if (news === undefined || output === undefined) return undefined;
+          if (isResolved(news)) {
+            const desiredName =
+              news.name !== undefined
+                ? sanitizeFlyAppName(news.name)
+                : output.name;
+            if (desiredName !== output.name) {
+              return { action: "replace" as const };
+            }
+            const desiredAuth = news.urlAuth ?? DEFAULT_URL_AUTH;
+            if (desiredAuth !== output.urlAuth) {
+              return { action: "update" as const };
+            }
           }
-          const desiredAuth = news.urlAuth ?? DEFAULT_URL_AUTH;
-          if (desiredAuth !== output.urlAuth) {
-            return { action: "update" as const };
-          }
-          const hash = yield* hosted.hash(news as HostedProgramProps);
-          if (hash !== output.code.hash) {
-            return { action: "update" as const };
+          // The code hash depends only on statically-known props — never
+          // gate it on the WHOLE props being resolved: an unresolved
+          // reference elsewhere in props would make code-only changes
+          // silently noop (see the same pattern in Service.ts). By diff
+          // time the effect-config form has been evaluated, so the object
+          // view is safe to read.
+          const statics = news as Partial<Pick<SpriteProps, "main" | "port">>;
+          if (isResolved({ main: statics.main, port: statics.port })) {
+            const hash = yield* hosted.hash(news as HostedProgramProps);
+            if (hash !== output.code.hash) {
+              return { action: "update" as const };
+            }
           }
           return undefined;
         }),

package/src/Fly/SpriteHttp.ts

@@ -1,6 +1,7 @@
 import { Credentials, CredentialsFromEnv } from "@distilled.cloud/fly-io";
 import type * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import type * as HttpClient from "effect/unstable/http/HttpClient";
@@ -58,8 +59,9 @@ export const makeSpriteAuth = (
   authorize: (eff) => {
     if (globalThis.__ALCHEMY_RUNTIME__) {
       return eff.pipe(
-        Effect.provide(CredentialsFromEnv),
-        Effect.provide(FetchHttpClient.layer),
+        Effect.provide(
+          Layer.mergeAll(CredentialsFromEnv, FetchHttpClient.layer),
+        ),
       );
     }
     return eff.pipe(Effect.provideContext(ambient));

package/src/Fly/Verify.ts

@@ -1,5 +1,4 @@
 import type { VerifySecretKeyError } from "@distilled.cloud/fly-io/machines";
-import type { FlyKmsError } from "./Errors.ts";
 import type * as Effect from "effect/Effect";
 import * as Binding from "../Binding.ts";
 import type { RuntimeContext } from "../RuntimeContext.ts";
@@ -42,11 +41,7 @@ export interface Verify extends Binding.Service<
   ) => Effect.Effect<
     (
       request: VerifyRequest,
-    ) => Effect.Effect<
-      VerifyResult,
-      VerifySecretKeyError | FlyKmsError,
-      RuntimeContext
-    >
+    ) => Effect.Effect<VerifyResult, VerifySecretKeyError, RuntimeContext>
   >
 > {}
 

package/src/Fly/VerifyHttp.ts

@@ -3,11 +3,7 @@ import * as machines from "@distilled.cloud/fly-io/machines";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import {
-  bytesToBase64,
-  flyKmsPost,
-  makeHttpSecretKeyBinding,
-} from "./SecretKeyHttp.ts";
+import { bytesToBase64, makeHttpSecretKeyBinding } from "./SecretKeyHttp.ts";
 import { Verify, type VerifyRequest } from "./Verify.ts";
 
 /**
@@ -33,15 +29,7 @@ export const VerifyHttp = Layer.effect(
     makeHttpSecretKeyBinding({
       makeClient: (auth, appName, secretName) =>
         Effect.fn("Fly.Verify")(function* (request: VerifyRequest) {
-          if (globalThis.__ALCHEMY_RUNTIME__) {
-            yield* flyKmsPost(yield* appName, yield* secretName, "verify", {
-              plaintext: bytesToBase64(request.plaintext),
-              signature: bytesToBase64(request.signature),
-            });
-            // Fly answers 200 only when the signature checks out;
-            // `flyKmsPost` already failed on any non-2xx status.
-            return { valid: true as const };
-          }
+          // Fly answers 200 only when the signature checks out.
           yield* auth.authorize(
             machines.verifySecretKey({
               app_name: yield* appName,