@anvil-works/anvil-cli 0.7.0-canary.6 → 0.7.0-canary.7

package/dist/cli.js

@@ -7389,6 +7389,7 @@ var __webpack_exports__ = {};
     const external_node_fs_namespaceObject = require("node:fs");
     const external_node_path_namespaceObject = require("node:path");
     const external_node_crypto_namespaceObject = require("node:crypto");
+    var external_node_crypto_default = /*#__PURE__*/ __webpack_require__.n(external_node_crypto_namespaceObject);
     const external_node_assert_namespaceObject = require("node:assert");
     const isObject = (value)=>{
         const type = typeof value;
@@ -14246,6 +14247,47 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getAuthFilePath(gitDir) {
         return external_path_default().join(gitDir, "anvil-auth.json");
     }
+    const KEY_ENV = "ANVIL_AUTH_FILE_ENCRYPTION_KEY";
+    function getEncryptionKey() {
+        const keyBase64 = process.env[KEY_ENV];
+        if (!keyBase64) return null;
+        const key = Buffer.from(keyBase64, "base64");
+        if (32 !== key.length) throw new Error(`${KEY_ENV} must be a base64-encoded 32-byte key`);
+        return key;
+    }
+    function maybeEncrypt(plainText) {
+        const key = getEncryptionKey();
+        if (!key) return plainText;
+        const iv = external_node_crypto_default().randomBytes(12);
+        const cipher = external_node_crypto_default().createCipheriv("aes-256-gcm", key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(plainText, "utf8"),
+            cipher.final()
+        ]);
+        const authTag = cipher.getAuthTag();
+        return JSON.stringify({
+            version: 1,
+            algorithm: "aes-256-gcm",
+            iv: iv.toString("base64"),
+            authTag: authTag.toString("base64"),
+            ciphertext: ciphertext.toString("base64")
+        }, null, 2);
+    }
+    function maybeDecrypt(json) {
+        const key = getEncryptionKey();
+        if (!key) return json;
+        const payload = JSON.parse(json);
+        if (1 !== payload.version || "aes-256-gcm" !== payload.algorithm) throw new Error("Unsupported encrypted file format");
+        const iv = Buffer.from(payload.iv, "base64");
+        const authTag = Buffer.from(payload.authTag, "base64");
+        const ciphertext = Buffer.from(payload.ciphertext, "base64");
+        const decipher = external_node_crypto_default().createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final()
+        ]).toString("utf8");
+    }
     async function writeAuthToFile(repoPath, auth) {
         const git = esm_default(repoPath);
         const gitDir = await getRepositoryGitDir(repoPath, git);
@@ -14254,8 +14296,8 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             recursive: true
         });
         const authJson = JSON.stringify(auth, null, 2);
-        await external_fs_.promises.writeFile(authFilePath, authJson, {
-            mode: 448
+        await external_fs_.promises.writeFile(authFilePath, maybeEncrypt(authJson), {
+            mode: 384
         });
         await external_fs_.promises.chmod(authFilePath, 448);
         await git.raw([
@@ -14272,7 +14314,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         const authFilePath = getAuthFilePath(gitDir);
         if (!external_fs_default().existsSync(authFilePath)) return;
         const authJson = await external_fs_.promises.readFile(authFilePath, "utf8");
-        return JSON.parse(authJson);
+        return JSON.parse(maybeDecrypt(authJson));
     };
     function getDefaultAnvilUrl() {
         return resolveAnvilUrl();

package/dist/index.js

@@ -11617,6 +11617,7 @@ var __webpack_exports__ = {};
     const external_node_process_namespaceObject = require("node:process");
     const external_node_fs_namespaceObject = require("node:fs");
     const external_node_crypto_namespaceObject = require("node:crypto");
+    var external_node_crypto_default = /*#__PURE__*/ __webpack_require__.n(external_node_crypto_namespaceObject);
     const external_node_assert_namespaceObject = require("node:assert");
     const isObject = (value)=>{
         const type = typeof value;
@@ -14217,6 +14218,47 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getAuthFilePath(gitDir) {
         return external_path_default().join(gitDir, "anvil-auth.json");
     }
+    const KEY_ENV = "ANVIL_AUTH_FILE_ENCRYPTION_KEY";
+    function getEncryptionKey() {
+        const keyBase64 = process.env[KEY_ENV];
+        if (!keyBase64) return null;
+        const key = Buffer.from(keyBase64, "base64");
+        if (32 !== key.length) throw new Error(`${KEY_ENV} must be a base64-encoded 32-byte key`);
+        return key;
+    }
+    function maybeEncrypt(plainText) {
+        const key = getEncryptionKey();
+        if (!key) return plainText;
+        const iv = external_node_crypto_default().randomBytes(12);
+        const cipher = external_node_crypto_default().createCipheriv("aes-256-gcm", key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(plainText, "utf8"),
+            cipher.final()
+        ]);
+        const authTag = cipher.getAuthTag();
+        return JSON.stringify({
+            version: 1,
+            algorithm: "aes-256-gcm",
+            iv: iv.toString("base64"),
+            authTag: authTag.toString("base64"),
+            ciphertext: ciphertext.toString("base64")
+        }, null, 2);
+    }
+    function maybeDecrypt(json) {
+        const key = getEncryptionKey();
+        if (!key) return json;
+        const payload = JSON.parse(json);
+        if (1 !== payload.version || "aes-256-gcm" !== payload.algorithm) throw new Error("Unsupported encrypted file format");
+        const iv = Buffer.from(payload.iv, "base64");
+        const authTag = Buffer.from(payload.authTag, "base64");
+        const ciphertext = Buffer.from(payload.ciphertext, "base64");
+        const decipher = external_node_crypto_default().createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final()
+        ]).toString("utf8");
+    }
     async function writeAuthToFile(repoPath, auth) {
         const git = esm_default(repoPath);
         const gitDir = await getRepositoryGitDir(repoPath, git);
@@ -14225,8 +14267,8 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             recursive: true
         });
         const authJson = JSON.stringify(auth, null, 2);
-        await external_fs_.promises.writeFile(authFilePath, authJson, {
-            mode: 448
+        await external_fs_.promises.writeFile(authFilePath, maybeEncrypt(authJson), {
+            mode: 384
         });
         await external_fs_.promises.chmod(authFilePath, 448);
         await git.raw([
@@ -14243,7 +14285,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         const authFilePath = getAuthFilePath(gitDir);
         if (!external_fs_default().existsSync(authFilePath)) return;
         const authJson = await external_fs_.promises.readFile(authFilePath, "utf8");
-        return JSON.parse(authJson);
+        return JSON.parse(maybeDecrypt(authJson));
     };
     function getDefaultAnvilUrl() {
         return resolveAnvilUrl();

package/dist/services/git-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-auth.d.ts","sourceRoot":"","sources":["../../src/services/git-auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIvC,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GAAG,MAAM,CAcT;AAWD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAUhG;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/G;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI5E;AAED,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA2BpE;AAiCD,wBAAgB,6BAA6B,CAAC,OAAO,CAAC,EAAE;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC,GAAG,MAAM,CAWT;AA0BD,wBAAsB,+BAA+B,CACjD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GACF,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBtC;AAED,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5E;AAOD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,mBAgBrE;AAED,eAAO,MAAM,gBAAgB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAarF,CAAC"}
+{"version":3,"file":"git-auth.d.ts","sourceRoot":"","sources":["../../src/services/git-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,QAAQ,CAAC;AAIrC,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GAAG,MAAM,CAcT;AAWD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAUhG;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/G;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI5E;AAED,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA2BpE;AAiCD,wBAAgB,6BAA6B,CAAC,OAAO,CAAC,EAAE;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC,GAAG,MAAM,CAWT;AA0BD,wBAAsB,+BAA+B,CACjD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GACF,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBtC;AAED,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5E;AA+ED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,mBAerE;AAED,eAAO,MAAM,gBAAgB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAYrF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anvil-works/anvil-cli",
-  "version": "0.7.0-canary.6",
+  "version": "0.7.0-canary.7",
   "description": "CLI tool for developing Anvil apps locally",
   "main": "dist/index.js",
   "types": "dist/api.d.ts",