1import type { SignSecretKeyError } from "@distilled.cloud/fly-io/machines";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../Binding.ts";
4import type { RuntimeContext } from "../RuntimeContext.ts";
5import type { SecretKey } from "./SecretKey.ts";
6
7export interface SignRequest {
8 /** Bytes to sign. */
9 plaintext: Uint8Array | ArrayLike<number>;
10}
11
12export interface SignResult {
13 signature: Uint8Array;
14}
15
16/**
17 * Sign with a Fly {@link SecretKey} (`nacl_sign`, `hs256`, `es256`,
18 * …). The private key never leaves Fly KMS.
19 *
20 *
21 * ### Sign a payload
22 * The App and key name are fixed by `Sign(key)`. Provide
23 * {@link SignHttp} on the Action or Service Effect.
24 *
25 * **Example:** Sign
26 * ```typescript
27 * const sign = yield* Fly.Sign(Signing);
28 * const { signature } = yield* sign({
29 * plaintext: new TextEncoder().encode("release-manifest-v1"),
30 * });
31 * ```
32 *
33 * @binding
34 * @product Secret Key
35 */
36export interface Sign extends Binding.Service<
37 Sign,
38 "Fly.Sign",
39 (
40 key: SecretKey,
41 ) => Effect.Effect<
42 (
43 request: SignRequest,
44 ) => Effect.Effect<SignResult, SignSecretKeyError, RuntimeContext>
45 >
46> {}
47
48export const Sign = Binding.Service<Sign>("Fly.Sign");