@vizamodo/runtime-primitives 1.1.9 → 1.1.11

package/dist/aws/console-login.d.ts

@@ -7,8 +7,7 @@ export interface AwsConsoleLoginConfig {
     certBase64: string;
     privateKeyBase64: string;
 }
-export declare function issueAwsSessionCredentials(config: AwsConsoleLoginConfig): Promise<import("@vizamodo/aws-runtime-core").AwsCredentialResult>;
-export declare function createAwsFederatedLogin(params: AwsConsoleLoginConfig & {
+export declare function createAwsFederatedLoginWithRetry(params: AwsConsoleLoginConfig & {
     intent?: "console" | "billing" | "dynamodb" | "ssm";
 }): Promise<{
     loginUrl: string;

package/dist/aws/console-login.js

@@ -1,21 +1,9 @@
-import { issueAwsCredentials, buildFederationLoginUrl, } from "@vizamodo/aws-runtime-core";
+import { buildFederationLoginUrl, } from "@vizamodo/aws-runtime-core";
 import { retryOnce } from "../runtime/retry-once";
-export async function issueAwsSessionCredentials(config) {
-    const { profile, region, trustAnchorArn, roleArn, profileArn, certBase64, privateKeyBase64, } = config;
-    return await retryOnce((ctx) => issueAwsCredentials({
-        trustAnchorArn,
-        roleArn,
-        profileArn,
-        region,
-        certBase64,
-        privateKeyPkcs8Base64: privateKeyBase64,
-        profile,
-        ...ctx,
-    }));
-}
-export async function createAwsFederatedLogin(params) {
+import { issueAwsCredentialsWithRetry } from "./credentials";
+export async function createAwsFederatedLoginWithRetry(params) {
     const { intent, ...config } = params;
-    const creds = await issueAwsSessionCredentials(config);
+    const creds = await issueAwsCredentialsWithRetry(config);
     const { loginUrl, shortUrl } = await retryOnce((ctx) => buildFederationLoginUrl({
         accessKeyId: creds.accessKeyId,
         secretAccessKey: creds.secretAccessKey,

package/dist/aws/credentials.d.ts

@@ -0,0 +1,16 @@
+export interface AwsCredentialConfig {
+    profile: string;
+    region: string;
+    trustAnchorArn: string;
+    roleArn: string;
+    profileArn: string;
+    certBase64: string;
+    privateKeyBase64: string;
+}
+/**
+ * Primitive: Issue AWS credentials with a single retry.
+ * - No console-specific logic
+ * - No side effects beyond AWS call
+ * - Deterministic input/output
+ */
+export declare function issueAwsCredentialsWithRetry(config: AwsCredentialConfig): Promise<import("@vizamodo/aws-runtime-core").AwsCredentialResult>;

package/dist/aws/credentials.js

@@ -0,0 +1,24 @@
+import { issueAwsCredentials } from "@vizamodo/aws-runtime-core";
+import { retryOnce } from "../runtime/retry-once";
+/**
+ * Primitive: Issue AWS credentials with a single retry.
+ * - No console-specific logic
+ * - No side effects beyond AWS call
+ * - Deterministic input/output
+ */
+export async function issueAwsCredentialsWithRetry(config) {
+    const { profile, region, trustAnchorArn, roleArn, profileArn, certBase64, privateKeyBase64, } = config;
+    if (!profile || !region || !trustAnchorArn || !roleArn || !profileArn) {
+        throw new Error("Missing required AWS credential parameters");
+    }
+    return await retryOnce((ctx) => issueAwsCredentials({
+        trustAnchorArn,
+        roleArn,
+        profileArn,
+        region,
+        certBase64,
+        privateKeyPkcs8Base64: privateKeyBase64,
+        profile,
+        ...ctx,
+    }));
+}

package/dist/github/github-owner-token.d.ts

@@ -1,4 +1,9 @@
-export declare function getInstallationTokenCached(params: {
+/**
+ * Use-case helper: get installation token with built-in retry.
+ * - wraps getInstallationTokenCached
+ * - avoids forcing consumers to compose retry manually
+ */
+export declare function getInstallationTokenWithRetry(params: {
     installationId: number;
     appPrivateKey: string;
     clientId: string;

package/dist/github/github-owner-token.js

@@ -1,6 +1,7 @@
+import { retryOnce } from "../runtime/retry-once";
 import { getGithubInstallationToken } from "./github-app-token";
 import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
-export async function getInstallationTokenCached(params) {
+async function getInstallationTokenCached(params) {
     const { installationId, appPrivateKey, clientId, forceRefresh } = params;
     const key = `gh-token:${clientId}:${installationId}`;
     const token = await getCachedOrFetch(key, async () => {
@@ -14,3 +15,14 @@ export async function getInstallationTokenCached(params) {
     );
     return token;
 }
+/**
+ * Use-case helper: get installation token with built-in retry.
+ * - wraps getInstallationTokenCached
+ * - avoids forcing consumers to compose retry manually
+ */
+export async function getInstallationTokenWithRetry(params) {
+    return await retryOnce((ctx) => getInstallationTokenCached({
+        ...params,
+        ...(ctx ?? {})
+    }));
+}

package/dist/github/put-secret.d.ts

@@ -1,6 +1,6 @@
 export declare function base64ToBytes(b64: string): Uint8Array;
 export declare function bytesToBase64(bytes: Uint8Array): string;
-export declare function encryptSecret(recipientPub: Uint8Array, secret: string): string;
+export declare function encryptSecret(recipientPub: string | Uint8Array, secret: string): Promise<string>;
 export declare function getPublicKey(repo: string, environment: string, headers: Record<string, string>): Promise<{
     key_id: string;
     key: string;

package/dist/github/put-secret.js

@@ -1,4 +1,4 @@
-import sealedbox from "tweetnacl-sealedbox-js";
+import sodium from "libsodium-wrappers";
 import { repoUrl } from "./github-env";
 // ─────────────────────────────────────────────
 // Crypto
@@ -18,9 +18,13 @@ export function bytesToBase64(bytes) {
     }
     return btoa(parts.join(""));
 }
-export function encryptSecret(recipientPub, secret) {
+export async function encryptSecret(recipientPub, secret) {
+    await sodium.ready;
+    // Chuyển đổi public key từ string (base64) sang Uint8Array nếu cần
+    const bkey = typeof recipientPub === "string" ? base64ToBytes(recipientPub) : recipientPub;
     const messageBytes = new TextEncoder().encode(secret);
-    const sealed = sealedbox.seal(messageBytes, recipientPub);
+    // Thực hiện mã hóa
+    const sealed = sodium.crypto_box_seal(messageBytes, bkey);
     return bytesToBase64(sealed);
 }
 // ─────────────────────────────────────────────

package/dist/github/put-secrets.js

@@ -17,7 +17,7 @@ export async function putGithubSecretsParallel(repo, environment, secrets, heade
     for (let i = 0; i < entries.length; i += concurrency) {
         const batch = entries.slice(i, i + concurrency);
         await Promise.all(batch.map(async ([name, plaintext]) => {
-            const encryptedValue = encryptSecret(recipientPub, plaintext);
+            const encryptedValue = await encryptSecret(recipientPub, plaintext);
             await putSecret(repo, environment, name, encryptedValue, key_id, headers);
         }));
     }

package/dist/index.d.ts

@@ -3,11 +3,11 @@
  * Organized by domain to keep imports explicit and tree-shake friendly
  */
 export * from "./aws/console-login";
+export * from "./aws/credentials";
 export * from "./aws/load-backup-from-ssm";
 export * from "./aws/resolve-config";
 export { buildSignedAwsRequest } from "@vizamodo/aws-runtime-core";
 export * from "./crypto/age";
-export * from "./github/github-app-token";
 export * from "./github/github-owner-token";
 export * from "./github/list-workflow-runs";
 export * from "./github/put-secret";

package/dist/index.js

@@ -4,13 +4,13 @@
  */
 // AWS
 export * from "./aws/console-login";
+export * from "./aws/credentials";
 export * from "./aws/load-backup-from-ssm";
 export * from "./aws/resolve-config";
 export { buildSignedAwsRequest } from "@vizamodo/aws-runtime-core";
 // Crypto
 export * from "./crypto/age";
 // GitHub
-export * from "./github/github-app-token";
 export * from "./github/github-owner-token";
 export * from "./github/list-workflow-runs";
 export * from "./github/put-secret";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/runtime-primitives",
-  "version": "1.1.9",
+  "version": "1.1.11",
   "description": "Edge-compatible runtime primitives for AWS, GitHub, crypto, and caching used across Viza services",
   "type": "module",
   "main": "dist/index.js",
@@ -25,7 +25,7 @@
   "dependencies": {
     "@vizamodo/aws-runtime-core": "^0.4.38",
     "age-encryption": "^0.3.0",
-    "tweetnacl-sealedbox-js": "^1.2.0"
+    "libsodium-wrappers": "^0.8.3"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",