1import type * as secretmanager from "@distilled.cloud/gcp/secretmanager_v1";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { RuntimeContext } from "../../RuntimeContext.ts";
5import type { SecretBindingTarget } from "./BindingHttp.ts";
6
7/** Read-only client for one Secret Manager secret. */
8export interface ReadSecretClient {
9 /**
10 * UTF-8 payload of `version` (a version id, `latest`, or a full version
11 * name), or `undefined` when that version does not exist — including
12 * `latest` on a secret with no versions. `version` defaults to `latest`.
13 * A missing, disabled, or destroyed version reads as `undefined`.
14 */
15 access(
16 version?: string,
17 ): Effect.Effect<
18 string | undefined,
19 secretmanager.AccessProjectsSecretsVersionsError,
20 RuntimeContext
21 >;
22 /** Raw payload bytes of `version`; `undefined` like {@link access}. */
23 accessBytes(
24 version?: string,
25 ): Effect.Effect<
26 Uint8Array | undefined,
27 secretmanager.AccessProjectsSecretsVersionsError,
28 RuntimeContext
29 >;
30}
31
32/**
33 * Read access to a Secret Manager {@link Secret} (or regional
34 * `LocationsSecret`): `access`, `accessBytes`. Grants
35 * `roles/secretmanager.secretAccessor` on the secret only.
36 *
37 * ### Reading a secret
38 * **Example:** Read the latest version
39 * ```typescript
40 * const apiKey = yield* GCP.SecretManager.ReadSecret(secret);
41 * const value = yield* apiKey.access();
42 * // …provided with Effect.provide(GCP.SecretManager.ReadSecretHttp)
43 * ```
44 *
45 * **Example:** Pin a version
46 * ```typescript
47 * const previous = yield* apiKey.access("3");
48 * ```
49 *
50 * @binding
51 * @category SecretManager
52 */
53export interface ReadSecret extends Binding.Service<
54 ReadSecret,
55 "GCP.SecretManager.ReadSecret",
56 (secret: SecretBindingTarget) => Effect.Effect<ReadSecretClient>
57> {}
58
59export const ReadSecret = Binding.Service<ReadSecret>(
60 "GCP.SecretManager.ReadSecret",
61);