Fly.Secret Key reference

Decrypt

Source: src/Fly/Decrypt.ts

Decrypt with a Fly SecretKey. The App and key name are fixed by Decrypt(key).

Decrypt: Decrypt a payload

Provide DecryptHttp. Plaintext comes back Redacted. Unwrap with Redacted.value only where you need the raw bytes.

import * as Redacted from "effect/Redacted";

const decrypt = yield* Fly.Decrypt(Box);
const { plaintext } = yield* decrypt({ ciphertext });
const bytes = Redacted.value(plaintext);

Decrypt: Associated data

associatedData must match the bytes passed to Encrypt.

const { plaintext } = yield* decrypt({
  ciphertext,
  associatedData: nonce,
});

DecryptHttp

Source: src/Fly/DecryptHttp.ts Kind: Layer · Provides: Fly.Decrypt

HTTP implementation of Decrypt. Provide it on the Service or Action Effect.

DecryptHttp: Provide the layer

Effect.gen(function* () {
  const decrypt = yield* Fly.Decrypt(Box);
  // ...
}).pipe(Effect.provide(Fly.DecryptHttp))

Encrypt

Source: src/Fly/Encrypt.ts

Encrypt with a Fly SecretKey (nacl_box, nacl_secretbox, xaes256gcm, …). The App and key name are fixed by Encrypt(key).

Encrypt: Encrypt a payload

Provide EncryptHttp on the Action or Service Effect. Fly crypto ops need a KMS token. Org API tokens are typed Forbidden.

const encrypt = yield* Fly.Encrypt(Box);
const { ciphertext } = yield* encrypt({
  plaintext: new TextEncoder().encode("attack at dawn"),
});

Encrypt: Associated data

associatedData is optional AEAD associated data. Decrypt must pass the same bytes.

const { ciphertext } = yield* encrypt({
  plaintext: bytes,
  associatedData: nonce,
});

EncryptHttp

Source: src/Fly/EncryptHttp.ts Kind: Layer · Provides: Fly.Encrypt

HTTP implementation of Encrypt. Provide it on the Service or Action Effect.

EncryptHttp: Provide the layer

Effect.gen(function* () {
  const encrypt = yield* Fly.Encrypt(Box);
  // ...
}).pipe(Effect.provide(Fly.EncryptHttp))

SecretKey

Source: src/Fly/SecretKey.ts

A Fly.SecretKey is an App KMS key, not an env secret. Generate a random key or set raw material. Private bytes never appear in attributes.

Use it at runtime with Encrypt, Decrypt, Sign, and Verify. Generate, set, and delete stay on this resource.

SecretKey: Generate a key

Omit value and Fly generates a key via generateSecretKey. type is Fly’s key type (nacl_sign, nacl_box, nacl_secretbox, hs256, hs384, hs512, xaes256gcm, nacl_auth, es256, …).

export const Signing = Fly.SecretKey("Signing", {
  app: Site,
  type: "nacl_sign",
});

Changing app, name, or type replaces the key

The new key is created. The old one is deleted. Ciphertext from the old key will not decrypt.

SecretKey: Set raw material

Pass value as bytes. The key is created or updated with setSecretKey. Never persisted in state.

const hmac = yield* Fly.SecretKey("Hmac", {
  app: Site,
  type: "hs256",
  value: hmacBytes,
});

SecretKey: Encrypt

Bind Encrypt to a box/secretbox/AEAD key. Provide EncryptHttp. Optional associatedData is AEAD associated data.

Fly crypto ops need a KMS token. Org API tokens are typed Forbidden. Encrypt and sign from a Service, not a laptop Action.

const encrypt = yield* Fly.Encrypt(Box);
const { ciphertext } = yield* encrypt({
  plaintext: new TextEncoder().encode("attack at dawn"),
});

SecretKey: Decrypt

Bind Decrypt to the same key. Plaintext comes back Redacted. Unwrap with Redacted.value. associatedData must match encryption. Provide DecryptHttp.

const decrypt = yield* Fly.Decrypt(Box);
const { plaintext } = yield* decrypt({ ciphertext });
const bytes = Redacted.value(plaintext);

SecretKey: Sign

Bind Sign to a signing key (nacl_sign, hs256, es256, …). The private key never leaves Fly KMS. Provide SignHttp.

const sign = yield* Fly.Sign(Signing);
const { signature } = yield* sign({
  plaintext: new TextEncoder().encode("release-manifest-v1"),
});

SecretKey: Verify

Bind Verify to the same key. A bad signature is a typed error from the Machines API. Provide VerifyHttp.

const verify = yield* Fly.Verify(Signing);
const { valid } = yield* verify({ plaintext, signature });

Sign

Source: src/Fly/Sign.ts

Sign with a Fly SecretKey (nacl_sign, hs256, es256, …). The private key never leaves Fly KMS.

Sign: Sign a payload

The App and key name are fixed by Sign(key). Provide SignHttp on the Action or Service Effect.

const sign = yield* Fly.Sign(Signing);
const { signature } = yield* sign({
  plaintext: new TextEncoder().encode("release-manifest-v1"),
});

SignHttp

Source: src/Fly/SignHttp.ts Kind: Layer · Provides: Fly.Sign

HTTP implementation of Sign. Provide it on the Service or Action Effect.

SignHttp: Provide the layer

Effect.gen(function* () {
  const sign = yield* Fly.Sign(Signing);
  // ...
}).pipe(Effect.provide(Fly.SignHttp))

Verify

Source: src/Fly/Verify.ts

Verify a signature with a Fly SecretKey. The App and key name are fixed by Verify(key).

Verify: Verify a signature

Provide VerifyHttp. A bad signature is a typed error from the Machines API, not valid: false.

const verify = yield* Fly.Verify(Signing);
const { valid } = yield* verify({ plaintext, signature });

VerifyHttp

Source: src/Fly/VerifyHttp.ts Kind: Layer · Provides: Fly.Verify

HTTP implementation of Verify. Provide it on the Service or Action Effect.

VerifyHttp: Provide the layer

Effect.gen(function* () {
  const verify = yield* Fly.Verify(Signing);
  // ...
}).pipe(Effect.provide(Fly.VerifyHttp))