@alchemy.run/infisical 0.0.0 → 2.0.0-beta.84

package/lib/SecretsProvider.d.ts

@@ -0,0 +1,81 @@
+import { type SecretsLayer, type SecretsOption } from "alchemy/Secrets/Provider";
+import { UserFacingError } from "alchemy/UserFacingError";
+import { type InfisicalResolvedCredentials } from "./AuthProvider.ts";
+export interface InfisicalOptions {
+    /**
+     * Project slug, or the project's UUID. Infisical only resolves slugs for
+     * machine identities, so a user token must pass the UUID.
+     */
+    project: string;
+    /** Environment slug, e.g. `dev` or `prod`. */
+    environment: string;
+    /**
+     * Folder to read from.
+     * @default "/"
+     */
+    path?: string;
+    /**
+     * Also read every sub-folder of `path`.
+     * @default false
+     */
+    recursive?: boolean;
+    /**
+     * Include secrets imported into the folder from elsewhere. Directly
+     * defined secrets win over imported ones.
+     * @default true
+     */
+    includeImports?: boolean;
+}
+interface InfisicalCredentials extends InfisicalResolvedCredentials {
+    /** Set when the credentials came from a stored Alchemy profile. */
+    readonly profileName?: string;
+}
+declare const InfisicalSecretsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "InfisicalSecretsError";
+} & Readonly<A>;
+/**
+ * Infisical could not serve the requested secrets. The message says
+ * "Infisical" up front and names the selection, so a stack trace never has
+ * to be read to know which secrets source broke.
+ */
+export declare class InfisicalSecretsError extends InfisicalSecretsError_base<{
+    readonly selection: InfisicalOptions;
+    readonly credentials: InfisicalCredentials;
+    /** What the Infisical SDK failed with. */
+    readonly cause: {
+        readonly _tag: string;
+        readonly message: string;
+    };
+}> {
+    readonly [UserFacingError] = true;
+    get message(): string;
+}
+declare const InfisicalSecretsProvider_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "alchemy/SecretProvider::Infisical";
+} & import("effect/Pipeable").Pipeable;
+/** A `secrets` entry that loads an Infisical environment. */
+export declare class InfisicalSecretsProvider extends InfisicalSecretsProvider_base<{
+    readonly layer: SecretsLayer;
+}> {
+}
+/**
+ * Load Infisical secrets into Effect Config without touching `process.env`.
+ *
+ * Authenticate locally with `alchemy profile edit --add Infisical` and
+ * paste a machine identity's universal-auth client id and secret; Alchemy
+ * mints a fresh access token on every run. The client secret must remain valid. In
+ * CI, set `INFISICAL_TOKEN`, or `INFISICAL_IDENTITY_ID` to log in with the
+ * platform's OIDC token.
+ *
+ * ```ts
+ * secrets: [
+ *   Infisical.Secrets(({ stage }) => ({
+ *     project: "my-app",
+ *     environment: stage === "prod" ? "prod" : "dev",
+ *   })),
+ * ]
+ * ```
+ */
+export declare const Secrets: (options: SecretsOption<InfisicalOptions>) => InfisicalSecretsProvider;
+export {};
+//# sourceMappingURL=SecretsProvider.d.ts.map

package/lib/SecretsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsProvider.d.ts","sourceRoot":"","sources":["../src/SecretsProvider.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM1D,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,oBAAqB,SAAQ,4BAA4B;IACjE,mEAAmE;IACnE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;;;;AAQD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE,CAAC;IACA,QAAQ,CAAC,CAAC,eAAe,CAAC,QAAQ;IAElC,IAAa,OAAO,WAanB;CACF;;;;AAwED,6DAA6D;AAC7D,qBAAa,wBAAyB,SAAQ,8BAE5C;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC;CAAG;AAEtC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,OAAO,YAAa,aAAa,CAAC,gBAAgB,CAAC,6BAkB5D,CAAC"}

package/lib/SecretsProvider.js

@@ -0,0 +1,128 @@
+import { fromApiKey, getProjectBySlug, listSecretsV4 } from "@distilled.cloud/infisical";
+import * as Retry from "@distilled.cloud/infisical/Retry";
+import { refreshHint } from "alchemy/Auth/AuthProvider";
+import { SuppressMissingProviderConfig } from "alchemy/Auth/Profile";
+import { resolveProviderConfig } from "alchemy/Auth/Resolve";
+import { logLoadedKeys } from "alchemy/Secrets/Log";
+import { CredentialsConfig, resolveSecretsOption, } from "alchemy/Secrets/Provider";
+import { UserFacingError } from "alchemy/UserFacingError";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import { InfisicalAuth, } from "./AuthProvider.js";
+/** Human description of which secrets were asked for, for error messages. */
+const describeSelection = (options) => {
+    const folder = options.path === undefined ? "" : ` path '${options.path}'`;
+    return `project '${options.project}' environment '${options.environment}'${folder}`;
+};
+/**
+ * Infisical could not serve the requested secrets. The message says
+ * "Infisical" up front and names the selection, so a stack trace never has
+ * to be read to know which secrets source broke.
+ */
+export class InfisicalSecretsError extends Data.TaggedError("InfisicalSecretsError") {
+    [UserFacingError] = true;
+    get message() {
+        const selection = describeSelection(this.selection);
+        switch (this.cause._tag) {
+            case "Unauthorized":
+                return this.credentials.profileName === undefined
+                    ? "Infisical rejected the token. Check INFISICAL_TOKEN; to set up a machine identity locally run `alchemy profile edit --add Infisical`."
+                    : `Infisical credentials were rejected. ${refreshHint("Infisical", this.credentials.profileName)}`;
+            case "NotFound":
+            case "Forbidden":
+                return `Infisical could not read ${selection}: ${this.cause.message}. Check Infisical.Secrets({ project, environment }) and that the identity has read access to it.`;
+            default:
+                return `Infisical could not download secrets for ${selection}: ${this.cause.message}`;
+        }
+    }
+}
+/**
+ * Resolve credentials through the Infisical auth provider: `INFISICAL_TOKEN`
+ * when present, otherwise the selected profile (which mints a token from
+ * the stored machine identity).
+ */
+const resolveCredentials = Effect.gen(function* () {
+    const resolved = yield* resolveProviderConfig("Infisical").pipe(Effect.provide(InfisicalAuth));
+    const { token, apiBaseUrl } = yield* resolved.resolve;
+    const credentials = {
+        token,
+        apiBaseUrl,
+        profileName: resolved.profileName,
+    };
+    return credentials;
+}).pipe(Effect.provide(CredentialsConfig));
+const isUUID = Schema.is(Schema.String.check(Schema.isUUID()));
+const text = (value) => Redacted.isRedacted(value) ? Redacted.value(value) : value;
+/** Download the selected secrets (plus imports) as a flat env map. */
+const downloadSecrets = Effect.fn("downloadInfisicalSecrets")(function* (options, credentials) {
+    const includeImports = options.includeImports ?? true;
+    const response = yield* Effect.gen(function* () {
+        // The v4 secrets API only accepts project ids, so resolve slugs first.
+        const projectId = isUUID(options.project)
+            ? options.project
+            : (yield* getProjectBySlug({ slug: options.project })).id;
+        return yield* listSecretsV4({
+            projectId,
+            environment: options.environment,
+            secretPath: options.path,
+            recursive: options.recursive,
+            includeImports,
+            viewSecretValue: true,
+            expandSecretReferences: true,
+        });
+    }).pipe(Retry.none, Effect.provide(fromApiKey({
+        apiKey: credentials.token,
+        apiBaseUrl: credentials.apiBaseUrl,
+    })), Effect.timeout("30 seconds"), Effect.mapError((cause) => new InfisicalSecretsError({ selection: options, credentials, cause })));
+    // Imports first so a directly defined secret overwrites an imported one.
+    const env = {};
+    for (const imported of response.imports ?? []) {
+        for (const secret of imported.secrets) {
+            env[text(secret.secretKey)] = secret.secretValue;
+        }
+    }
+    for (const secret of response.secrets) {
+        env[text(secret.secretKey)] = secret.secretValue;
+    }
+    return env;
+});
+/** A `secrets` entry that loads an Infisical environment. */
+export class InfisicalSecretsProvider extends Data.TaggedClass("alchemy/SecretProvider::Infisical") {
+}
+/**
+ * Load Infisical secrets into Effect Config without touching `process.env`.
+ *
+ * Authenticate locally with `alchemy profile edit --add Infisical` and
+ * paste a machine identity's universal-auth client id and secret; Alchemy
+ * mints a fresh access token on every run. The client secret must remain valid. In
+ * CI, set `INFISICAL_TOKEN`, or `INFISICAL_IDENTITY_ID` to log in with the
+ * platform's OIDC token.
+ *
+ * ```ts
+ * secrets: [
+ *   Infisical.Secrets(({ stage }) => ({
+ *     project: "my-app",
+ *     environment: stage === "prod" ? "prod" : "dev",
+ *   })),
+ * ]
+ * ```
+ */
+export const Secrets = (options) => new InfisicalSecretsProvider({
+    layer: ConfigProvider.layerAdd(Effect.gen(function* () {
+        // Auth-provider discovery builds stack layers just to find out which
+        // providers are used. It must work offline and with broken
+        // credentials, so the user can configure the very identity this
+        // layer needs.
+        if (yield* SuppressMissingProviderConfig)
+            return ConfigProvider.fromEnv({ env: {} });
+        const resolved = yield* resolveSecretsOption(options);
+        const credentials = yield* resolveCredentials;
+        const env = yield* downloadSecrets(resolved, credentials);
+        yield* logLoadedKeys(`Infisical (${describeSelection(resolved)})`, Object.keys(env));
+        return ConfigProvider.fromEnv({ env, preserveEmptyStrings: true });
+    }), { asPrimary: true }),
+});
+//# sourceMappingURL=SecretsProvider.js.map

package/lib/SecretsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsProvider.js","sourceRoot":"","sources":["../src/SecretsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,KAAK,KAAK,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,aAAa,GAGd,MAAM,mBAAmB,CAAC;AAiC3B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,CAAC,OAAyB,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,IAAI,GAAG,CAAC;IAC3E,OAAO,YAAY,OAAO,CAAC,OAAO,kBAAkB,OAAO,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC;AACtF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAKjF;IACS,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAElC,IAAa,OAAO;QAClB,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,KAAK,SAAS;oBAC/C,CAAC,CAAC,uIAAuI;oBACzI,CAAC,CAAC,wCAAwC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACvG,KAAK,UAAU,CAAC;YAChB,KAAK,WAAW;gBACd,OAAO,4BAA4B,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,kGAAkG,CAAC;YACxK;gBACE,OAAO,4CAA4C,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAC3C,WAAW,CACZ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IACtD,MAAM,WAAW,GAAyB;QACxC,KAAK;QACL,UAAU;QACV,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE3C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAE/D,MAAM,IAAI,GAAG,CAAC,KAAyC,EAAE,EAAE,CACzD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7D,sEAAsE;AACtE,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EACrE,OAAyB,EACzB,WAAiC;IAEjC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1C,uEAAuE;QACvE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC;YAC1B,SAAS;YACT,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,eAAe,EAAE,IAAI;YACrB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CACL,KAAK,CAAC,IAAI,EACV,MAAM,CAAC,OAAO,CACZ,UAAU,CAAC;QACT,MAAM,EAAE,WAAW,CAAC,KAAK;QACzB,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC,CACH,EACD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAC5B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CACjF,CACF,CAAC;IAEF,yEAAyE;IACzE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,OAAO,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAC5D,mCAAmC,CACF;CAAG;AAEtC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAwC,EAAE,EAAE,CAClE,IAAI,wBAAwB,CAAC;IAC3B,KAAK,EAAE,cAAc,CAAC,QAAQ,CAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,qEAAqE;QACrE,2DAA2D;QAC3D,gEAAgE;QAChE,eAAe;QACf,IAAI,KAAK,CAAC,CAAC,6BAA6B;YAAE,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAErF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1D,KAAK,CAAC,CAAC,aAAa,CAAC,cAAc,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrF,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,EACF,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB;CACF,CAAC,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,3 @@
+export { InfisicalAuth, InfisicalAuthConfigSchema, INFISICAL_API_URL_ENV, INFISICAL_IDENTITY_ID_ENV, INFISICAL_OIDC_AUDIENCE_ENV, INFISICAL_OIDC_TOKEN_ENV, INFISICAL_TOKEN_ENV, mintAccessToken, mintAccessTokenFromOidc, type InfisicalAuthConfig, type InfisicalResolvedCredentials, } from "./AuthProvider.ts";
+export { Secrets, InfisicalSecretsError, InfisicalSecretsProvider, type InfisicalOptions, } from "./SecretsProvider.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,OAAO,EACP,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC"}

package/lib/index.js

@@ -0,0 +1,3 @@
+export { InfisicalAuth, InfisicalAuthConfigSchema, INFISICAL_API_URL_ENV, INFISICAL_IDENTITY_ID_ENV, INFISICAL_OIDC_AUDIENCE_ENV, INFISICAL_OIDC_TOKEN_ENV, INFISICAL_TOKEN_ENV, mintAccessToken, mintAccessTokenFromOidc, } from "./AuthProvider.js";
+export { Secrets, InfisicalSecretsError, InfisicalSecretsProvider, } from "./SecretsProvider.js";
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,OAAO,EACP,qBAAqB,EACrB,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alchemy.run/infisical",
-  "version": "0.0.0",
+  "version": "2.0.0-beta.84",
   "description": "Infisical secrets and auth for Alchemy.",
   "keywords": [
     "alchemy",
@@ -9,12 +9,61 @@
     "infrastructure-as-code",
     "secrets"
   ],
+  "homepage": "https://alchemy.run",
+  "bugs": {
+    "url": "https://github.com/alchemy-run/alchemy/issues"
+  },
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
-  "homepage": "https://alchemy.run",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alchemy-run/alchemy.git",
     "directory": "packages/infisical"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "default": "./lib/index.js"
+    },
+    "./*": {
+      "types": "./lib/*.d.ts",
+      "bun": "./src/*.ts",
+      "worker": "./src/*.ts",
+      "default": "./lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@distilled.cloud/infisical": "1.0.0-rc.17"
+  },
+  "devDependencies": {
+    "@types/bun": "1.4.3",
+    "alchemy": "2.0.0-beta.84",
+    "effect": "^4.0.5",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "alchemy": "2.0.0-beta.84",
+    "effect": "^4.0.5"
+  },
+  "alchemy": {
+    "contributes": [
+      "@alchemy.run/infisical/Contributions"
+    ]
+  },
+  "scripts": {
+    "build": "pnpm -r --filter \"{.}...\" run build:package",
+    "build:package": "node scripts/build.ts"
   }
-}
+}

package/src/AuthProvider.ts

@@ -0,0 +1,334 @@
+import {
+  anonymous,
+  DEFAULT_API_BASE_URL,
+  loginWithOidcAuth,
+  loginWithUniversalAuth,
+} from "@distilled.cloud/infisical";
+import * as Retry from "@distilled.cloud/infisical/Retry";
+import { AuthError, AuthProviderLayer, type ConfigureField } from "alchemy/Auth/AuthProvider";
+import { displayRedacted } from "alchemy/Auth/Credentials";
+import { getEnv, getEnvRedacted, mapPromptCancellation } from "alchemy/Auth/Env";
+import { detectOidcToken, SUPPORTED_OIDC_PLATFORMS } from "alchemy/Auth/OidcToken";
+import {
+  collectFieldValues,
+  storedValueText,
+  validateFieldValues,
+  type StoredValues,
+} from "alchemy/Auth/StoredAuthProvider";
+import * as Interaction from "alchemy/Interaction";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+
+export const INFISICAL_TOKEN_ENV = "INFISICAL_TOKEN";
+/** The machine identity to log into with a platform OIDC token. */
+export const INFISICAL_IDENTITY_ID_ENV = "INFISICAL_IDENTITY_ID";
+/** Same name the Infisical CLI uses for self-hosted instances. */
+export const INFISICAL_API_URL_ENV = "INFISICAL_API_URL";
+/** Explicit OIDC token for platforms that are not auto-detected. */
+export const INFISICAL_OIDC_TOKEN_ENV = "INFISICAL_OIDC_TOKEN";
+/** Optional audience to request in the platform's OIDC token. */
+export const INFISICAL_OIDC_AUDIENCE_ENV = "INFISICAL_OIDC_AUDIENCE";
+
+const PROVIDER_NAME = "Infisical";
+const API_TIMEOUT = Duration.seconds(30);
+
+/**
+ * A machine identity's client id + secret. The secret never expires unless
+ * given a TTL in Infisical, and Alchemy exchanges it for a short-lived
+ * access token on every read, so this is the method for local development.
+ */
+const UniversalAuthConfig = Schema.Struct({
+  method: Schema.Literal("universal-auth"),
+  clientId: Schema.NonEmptyString,
+  clientSecret: Schema.NonEmptyString,
+  apiBaseUrl: Schema.optional(Schema.String),
+});
+
+/** A user token from the dashboard's "Copy Token" menu item. Valid for 10 days. */
+const AccessTokenConfig = Schema.Struct({
+  method: Schema.Literal("access-token"),
+  token: Schema.NonEmptyString,
+  apiBaseUrl: Schema.optional(Schema.String),
+});
+
+export const InfisicalAuthConfigSchema = Schema.Union([UniversalAuthConfig, AccessTokenConfig]);
+export type InfisicalAuthConfig = typeof InfisicalAuthConfigSchema.Type;
+
+export interface InfisicalResolvedCredentials {
+  readonly token: Redacted.Redacted<string>;
+  readonly apiBaseUrl: string;
+}
+
+const apiBaseUrlField: ConfigureField = {
+  name: "apiBaseUrl",
+  label: "Infisical API URL",
+  description: "For the EU cloud (https://eu.infisical.com) or a self-hosted instance.",
+  placeholder: DEFAULT_API_BASE_URL,
+  optional: true,
+};
+
+const universalAuthFields: ReadonlyArray<ConfigureField> = [
+  {
+    name: "clientId",
+    label: "Machine identity client ID",
+    description:
+      "From the machine identity's Universal Auth settings in Infisical. See https://infisical.com/docs/documentation/platform/identities/universal-auth",
+  },
+  {
+    name: "clientSecret",
+    label: "Machine identity client secret",
+    secret: true,
+  },
+  apiBaseUrlField,
+];
+
+const accessTokenFields: ReadonlyArray<ConfigureField> = [
+  {
+    name: "token",
+    label: "Infisical user token",
+    description:
+      'From the account menu in the Infisical dashboard ("Copy Token"). Valid for 10 days.',
+    secret: true,
+  },
+  apiBaseUrlField,
+];
+
+const toCredentials = (
+  response: { readonly accessToken: string | Redacted.Redacted<string> },
+  apiBaseUrl: string | undefined,
+): InfisicalResolvedCredentials => ({
+  token: Redacted.isRedacted(response.accessToken)
+    ? response.accessToken
+    : Redacted.make(response.accessToken),
+  apiBaseUrl: apiBaseUrl ?? DEFAULT_API_BASE_URL,
+});
+
+/**
+ * Exchange a machine identity's client credentials for an access token.
+ * Infisical answers 401 when either half is wrong or the secret is spent.
+ */
+export const mintAccessToken = (config: {
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly apiBaseUrl?: string;
+}) =>
+  loginWithUniversalAuth({
+    clientId: config.clientId,
+    clientSecret: Redacted.make(config.clientSecret),
+  }).pipe(
+    Retry.none,
+    Effect.provide(anonymous({ apiBaseUrl: config.apiBaseUrl })),
+    Effect.timeout(API_TIMEOUT),
+    Effect.map((response) => toCredentials(response, config.apiBaseUrl)),
+    Effect.mapError((cause) =>
+      AuthError.make({
+        message:
+          "Infisical rejected the machine identity credentials. Check the client ID and secret, and that the secret has not expired or hit its use limit.",
+        cause,
+      }),
+    ),
+  );
+
+/**
+ * Exchange a platform-issued OIDC token for an access token of the machine
+ * identity whose OIDC auth trusts that platform's issuer.
+ */
+export const mintAccessTokenFromOidc = (config: {
+  readonly identityId: string;
+  readonly jwt: Redacted.Redacted<string>;
+  readonly apiBaseUrl?: string;
+}) =>
+  loginWithOidcAuth({
+    identityId: config.identityId,
+    jwt: Redacted.value(config.jwt),
+  }).pipe(
+    Retry.none,
+    Effect.provide(anonymous({ apiBaseUrl: config.apiBaseUrl })),
+    Effect.timeout(API_TIMEOUT),
+    Effect.map((response) => toCredentials(response, config.apiBaseUrl)),
+    Effect.mapError((cause) =>
+      AuthError.make({
+        message: `Infisical rejected the OIDC login for identity '${config.identityId}': ${cause.message}. Check that the identity's OIDC auth trusts this platform's issuer, subject, and audience.`,
+        cause,
+      }),
+    ),
+  );
+
+/**
+ * Resolve the token a stored configuration grants. Annotated because the two
+ * branches are differently shaped Effects and a union of Effects does not
+ * flow through `flatMap`.
+ */
+const resolve = (
+  config: InfisicalAuthConfig,
+): Effect.Effect<InfisicalResolvedCredentials, AuthError, HttpClient.HttpClient> =>
+  config.method === "universal-auth"
+    ? mintAccessToken(config)
+    : Effect.succeed({
+        token: Redacted.make(config.token),
+        apiBaseUrl: config.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+      });
+
+/** Turn collected field values into a stored configuration. */
+const toConfig = (
+  method: InfisicalAuthConfig["method"],
+  values: StoredValues,
+): InfisicalAuthConfig => {
+  const apiBaseUrl = storedValueText(values.apiBaseUrl);
+  return method === "access-token"
+    ? { method, token: storedValueText(values.token)!, apiBaseUrl }
+    : {
+        method,
+        clientId: storedValueText(values.clientId)!,
+        clientSecret: storedValueText(values.clientSecret)!,
+        apiBaseUrl,
+      };
+};
+
+/**
+ * Verify Universal Auth with a login before storing it. Pasted access
+ * tokens are used as supplied and checked when secrets are requested.
+ */
+const verify = (config: InfisicalAuthConfig) => resolve(config).pipe(Effect.as(config));
+
+const fieldsFor = (method: InfisicalAuthConfig["method"]) =>
+  method === "universal-auth" ? universalAuthFields : accessTokenFields;
+
+const chooseMethod = Interaction.accessors.prompt
+  .select({
+    message: "Infisical authentication method",
+    options: [
+      {
+        value: "universal-auth" as const,
+        label: "Machine identity",
+        description: "Client ID and secret; mints a fresh access token on each run",
+      },
+      {
+        value: "access-token" as const,
+        label: "User token",
+        description: "Copied from the dashboard; valid for 10 days",
+      },
+    ],
+  })
+  .pipe(mapPromptCancellation);
+
+/**
+ * How CI authenticates, decided from the environment: a ready token, or a
+ * machine identity to log into with the platform's OIDC token. Environment
+ * credentials take precedence over stored profiles, including outside CI.
+ */
+const readEnvironment = Effect.gen(function* () {
+  const apiBaseUrl = yield* getEnv(INFISICAL_API_URL_ENV);
+  const token = yield* getEnvRedacted(INFISICAL_TOKEN_ENV);
+  if (token !== undefined && Redacted.value(token).length > 0) {
+    return { token, apiBaseUrl: apiBaseUrl ?? DEFAULT_API_BASE_URL };
+  }
+  const identityId = yield* getEnv(INFISICAL_IDENTITY_ID_ENV);
+  if (!identityId) {
+    return yield* AuthError.make({
+      message: `Infisical credentials are missing. In CI set ${INFISICAL_TOKEN_ENV}, or set ${INFISICAL_IDENTITY_ID_ENV} to log in with the platform's OIDC token; locally run \`alchemy profile edit --add Infisical\`.`,
+    });
+  }
+  const oidc = yield* detectOidcToken({
+    token: INFISICAL_OIDC_TOKEN_ENV,
+    audience: INFISICAL_OIDC_AUDIENCE_ENV,
+  });
+  if (oidc === undefined) {
+    return yield* AuthError.make({
+      message: `${INFISICAL_IDENTITY_ID_ENV} is set but no platform OIDC token was found. Supported: ${SUPPORTED_OIDC_PLATFORMS}; elsewhere pass the token in ${INFISICAL_OIDC_TOKEN_ENV}.`,
+    });
+  }
+  return yield* mintAccessTokenFromOidc({
+    identityId,
+    jwt: oidc.token,
+    apiBaseUrl,
+  });
+});
+
+/**
+ * Infisical profile authentication: a machine identity's universal-auth
+ * credentials (recommended) or a pasted access token.
+ */
+export const InfisicalAuth = AuthProviderLayer<InfisicalAuthConfig, InfisicalResolvedCredentials>()(
+  PROVIDER_NAME,
+  {
+    configSchema: InfisicalAuthConfigSchema,
+    configure: () =>
+      chooseMethod.pipe(
+        Effect.flatMap((method) =>
+          collectFieldValues(fieldsFor(method)).pipe(
+            Effect.map((values) => toConfig(method, values)),
+          ),
+        ),
+        Effect.flatMap(verify),
+      ),
+    configureMethods: [
+      { method: "universal-auth", fields: universalAuthFields },
+      { method: "access-token", fields: accessTokenFields },
+    ],
+    configureWith: (_, input) => {
+      if (input.method !== "universal-auth" && input.method !== "access-token") {
+        return Effect.fail(
+          AuthError.make({
+            message: `Infisical: unknown method '${input.method}'. Valid methods: universal-auth, access-token.`,
+          }),
+        );
+      }
+      const method = input.method;
+      return validateFieldValues(PROVIDER_NAME, fieldsFor(method), input.values).pipe(
+        Effect.map((values) => toConfig(method, values)),
+        Effect.flatMap(verify),
+      );
+    },
+    // Nothing to re-authenticate: stored credentials are long-lived (or, for
+    // access tokens, replaced by reconfiguring). Verifying them is enough.
+    login: (_, config) => verify(config),
+    // Client secrets are revoked from the Infisical dashboard by an admin;
+    // there is nothing session-like to tear down.
+    logout: () => Effect.void,
+    read: (_, config) => resolve(config),
+    details: (_, config) =>
+      Effect.succeed({
+        lines: [
+          { key: "method", value: config.method },
+          config.method === "universal-auth"
+            ? { key: "clientId", value: config.clientId }
+            : {
+                key: "token",
+                value: displayRedacted(Redacted.make(config.token)),
+              },
+          { key: "apiBaseUrl", value: config.apiBaseUrl ?? DEFAULT_API_BASE_URL },
+        ],
+      }),
+    readEnvironment,
+    environment: [
+      {
+        name: INFISICAL_TOKEN_ENV,
+        required: true,
+        secret: true,
+        alternatives: [INFISICAL_IDENTITY_ID_ENV],
+        description:
+          "A machine identity access token; or set INFISICAL_IDENTITY_ID instead to log in with the platform's OIDC token (Vercel, GitHub Actions, GitLab CI, GCP)",
+      },
+      {
+        name: INFISICAL_OIDC_TOKEN_ENV,
+        required: false,
+        secret: true,
+        description: "Explicit OIDC token for platforms that are not auto-detected",
+      },
+      {
+        name: INFISICAL_OIDC_AUDIENCE_ENV,
+        required: false,
+        description: "Audience to request in the platform's OIDC token",
+      },
+      {
+        name: INFISICAL_API_URL_ENV,
+        required: false,
+        description: "Base URL of a self-hosted Infisical instance",
+      },
+    ],
+  },
+);

package/src/Contributions.ts

@@ -0,0 +1,9 @@
+import * as Contributions from "alchemy/Contributions";
+
+export default Contributions.make({
+  name: "infisical",
+  auth: Contributions.lazy(
+    () => import("./AuthProvider.ts"),
+    (module) => module.InfisicalAuth,
+  ),
+});