1import type * as ecr from "@distilled.cloud/aws/ecr";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4
5/**
6 * Runtime binding for `ecr:GetAuthorizationToken`.
7 *
8 * Mints the temporary registry credential (`AWS:<password>` base64 token,
9 * valid 12 hours) a Docker client presents to the account's private ECR
10 * registry — a registry-level operation, so the binding takes no resource
11 * and the grant is on `Resource: ["*"]` (the action supports no
12 * resource-level permissions). Provide the implementation with
13 * `Effect.provide(AWS.ECR.GetAuthorizationTokenHttp)`.
14 *
15 * The returned `authorizationToken` is wrapped in `Redacted` so it never
16 * leaks into logs — unwrap with `Redacted.value(...)` at the point of use.
17 *
18 * ### Registry Authentication
19 * **Example:** Decode Docker Login Credentials
20 * ```typescript
21 * import * as Redacted from "effect/Redacted";
22 *
23 * // init — registry-level binding takes no resource
24 * const getAuthorizationToken = yield* AWS.ECR.GetAuthorizationToken();
25 *
26 * // runtime
27 * const res = yield* getAuthorizationToken();
28 * const data = res.authorizationData?.[0];
29 * const token = data?.authorizationToken;
30 * const decoded = Buffer.from(
31 * Redacted.isRedacted(token) ? Redacted.value(token) : (token ?? ""),
32 * "base64",
33 * ).toString("utf8"); // "AWS:<password>" for `docker login`
34 * ```
35 *
36 * @binding
37 */
38export interface GetAuthorizationToken extends Binding.Service<
39 GetAuthorizationToken,
40 "AWS.ECR.GetAuthorizationToken",
41 () => Effect.Effect<
42 () => Effect.Effect<
43 ecr.GetAuthorizationTokenResponse,
44 ecr.GetAuthorizationTokenError
45 >
46 >
47> {}
48
49export const GetAuthorizationToken = Binding.Service<GetAuthorizationToken>(
50 "AWS.ECR.GetAuthorizationToken",
51);