alchemy 0.1.17 → 0.1.18

package/src/encrypt.ts

@@ -0,0 +1,79 @@
+import sodium from "libsodium-wrappers";
+
+/**
+ * Encrypt a value with a symmetric key using libsodium
+ *
+ * @param value - The value to encrypt
+ * @param key - The encryption key
+ * @returns The base64-encoded encrypted value with nonce
+ */
+export async function encryptWithKey(
+  value: string,
+  key: string,
+): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Derive a key from the passphrase
+  const cryptoKey = sodium.crypto_generichash(
+    sodium.crypto_secretbox_KEYBYTES,
+    sodium.from_string(key),
+  );
+
+  // Generate a random nonce
+  const nonce = sodium.randombytes_buf(sodium.crypto_secretbox_NONCEBYTES);
+
+  // Encrypt the message
+  const encryptedBin = sodium.crypto_secretbox_easy(
+    sodium.from_string(value),
+    nonce,
+    cryptoKey,
+  );
+
+  // Combine nonce and ciphertext, then encode to base64
+  const combined = new Uint8Array(nonce.length + encryptedBin.length);
+  combined.set(nonce);
+  combined.set(encryptedBin, nonce.length);
+
+  return sodium.to_base64(combined, sodium.base64_variants.ORIGINAL);
+}
+
+/**
+ * Decrypt a value encrypted with a symmetric key
+ *
+ * @param encryptedValue - The base64-encoded encrypted value with nonce
+ * @param key - The decryption key
+ * @returns The decrypted string
+ */
+export async function decryptWithKey(
+  encryptedValue: string,
+  key: string,
+): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Derive a key from the passphrase
+  const cryptoKey = sodium.crypto_generichash(
+    sodium.crypto_secretbox_KEYBYTES,
+    sodium.from_string(key),
+  );
+
+  // Decode the base64 combined value
+  const combined = sodium.from_base64(
+    encryptedValue,
+    sodium.base64_variants.ORIGINAL,
+  );
+
+  // Extract nonce and ciphertext
+  const nonce = combined.slice(0, sodium.crypto_secretbox_NONCEBYTES);
+  const ciphertext = combined.slice(sodium.crypto_secretbox_NONCEBYTES);
+
+  // Decrypt the message
+  const decryptedBin = sodium.crypto_secretbox_open_easy(
+    ciphertext,
+    nonce,
+    cryptoKey,
+  );
+
+  return sodium.to_string(decryptedBin);
+}

package/src/github/secret.ts

@@ -1,7 +1,7 @@
 import sodium from "libsodium-wrappers";
 import { type Context, Resource } from "../resource";
+import type { Secret } from "../secret";
 import { createGitHubClient, verifyGitHubAuth } from "./client";
-
 /**
  * Properties for creating or updating a GitHub Secret
  */
@@ -24,7 +24,7 @@ export interface GitHubSecretProps {
   /**
    * Secret value (will be stored securely on GitHub)
    */
-  value: string;
+  value: Secret;
 
   /**
    * Optional GitHub API token (overrides environment variable)
@@ -47,31 +47,6 @@ export interface GitHubSecretOutput extends Omit<GitHubSecretProps, "value"> {
   updatedAt: string;
 }
 
-/**
- * Encrypt a value for GitHub using libsodium
- * Based on GitHub's documentation for encrypting secrets
- *
- * @param value - The secret value to encrypt
- * @param publicKey - The base64-encoded public key from GitHub
- * @returns The base64-encoded encrypted value
- */
-async function encryptValue(value: string, publicKey: string): Promise<string> {
-  // Initialize libsodium
-  await sodium.ready;
-
-  // Convert the public key from base64 to binary
-  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
-
-  // Convert the message to a Uint8Array
-  const binMessage = sodium.from_string(value);
-
-  // Encrypt the message with the public key using libsodium's sealed box
-  const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
-
-  // Convert the encrypted message to base64
-  return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
-}
-
 /**
  * Resource for managing GitHub repository secrets
  */
@@ -121,7 +96,10 @@ export class GitHubSecret extends Resource(
         );
 
         // Encrypt the secret value using libsodium
-        const encryptedValue = await encryptValue(props.value, publicKey.key);
+        const encryptedValue = await encryptString(
+          props.value.unencrypted,
+          publicKey.key,
+        );
 
         // Create or update the secret with the encrypted value and key_id
         const response = await octokit.rest.actions.createOrUpdateRepoSecret({
@@ -132,11 +110,6 @@ export class GitHubSecret extends Resource(
           key_id: publicKey.key_id,
         });
 
-        // Log success
-        if (!ctx.quiet) {
-          console.log(`Successfully created/updated secret: ${props.name}`);
-        }
-
         // GitHub doesn't return the secret details on create/update, so we need to construct it
         const output: GitHubSecretOutput = {
           id: `${props.owner}/${props.repository}/${props.name}`,
@@ -170,3 +143,31 @@ export class GitHubSecret extends Resource(
     }
   },
 ) {}
+
+/**
+ * Encrypt a value for GitHub using libsodium
+ * Based on GitHub's documentation for encrypting secrets
+ *
+ * @param value - The secret value to encrypt
+ * @param publicKey - The base64-encoded public key from GitHub
+ * @returns The base64-encoded encrypted value
+ */
+async function encryptString(
+  value: string,
+  publicKey: string,
+): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Convert the public key from base64 to binary
+  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+
+  // Convert the message to a Uint8Array
+  const binMessage = sodium.from_string(value);
+
+  // Encrypt the message with the public key using libsodium's sealed box
+  const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
+
+  // Convert the encrypted message to base64
+  return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
+}

package/src/index.ts

@@ -12,4 +12,5 @@ export {
   type DeleteContext,
   type UpdateContext,
 } from "./resource";
+export * from "./secret";
 export type { FileSystemStateStore as StateStore } from "./state";

package/src/input.ts

@@ -1,16 +1,19 @@
 import type { Output } from "./output";
+import type { Secret } from "./secret";
 
 export type Inputs<P extends any[]> = P extends [infer First, ...infer Rest]
   ? [Input<First>, ...Inputs<Rest>]
   : [];
 
-export type Input<T = any> =
-  | T
-  | Output<T>
-  | (T extends any[] ? Inputs<T> : never)
-  | (T extends string | number | boolean ? Output<T> : never)
-  | (T extends object
-      ? {
-          [k in keyof T]: Input<T[k]>;
-        }
-      : never);
+export type Input<T = any> = T extends Secret
+  ? T | Output<T>
+  :
+      | T
+      | Output<T>
+      | (T extends any[] ? Inputs<T> : never)
+      | (T extends string | number | boolean ? Output<T> : never)
+      | (T extends object
+          ? {
+              [k in keyof T]: Input<T[k]>;
+            }
+          : never);

package/src/output.ts

@@ -1,3 +1,5 @@
+import type { Secret } from "./secret";
+
 export function isOutput<T>(value: any): value is Output<T> {
   return (
     value && typeof value === "object" && typeof value.apply === "function"
@@ -45,15 +47,17 @@ export class OutputChain<T, U> {
 
 export type Resolved<O> = O extends Output<infer U>
   ? U
-  : O extends null
-    ? O
-    : O extends any[]
-      ? ResolveN<O>
-      : O extends object
-        ? {
-            [k in keyof O]: Resolved<O[k]>;
-          }
-        : O;
+  : O extends Secret
+    ? Secret
+    : O extends null
+      ? O
+      : O extends any[]
+        ? ResolveN<O>
+        : O extends object
+          ? {
+              [k in keyof O]: Resolved<O[k]>;
+            }
+          : O;
 
 type ResolveN<O extends any[]> = O extends [infer First, ...infer Rest]
   ? [Resolved<First>, ...ResolveN<Rest>]

package/src/secret.ts

@@ -0,0 +1,41 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { Input } from "./input";
+import { type Output, isOutput } from "./output";
+
+const passphraseContext = new AsyncLocalStorage<string>();
+
+export function secret<S extends Input<string> | undefined>(
+  unencrypted: S,
+): S extends undefined
+  ? never
+  : S extends Output<string>
+    ? Output<Secret>
+    : Secret {
+  if (unencrypted === undefined) {
+    throw new Error("Secret cannot be undefined");
+  }
+  return (
+    isOutput(unencrypted) ? unencrypted.apply(secret) : new Secret(unencrypted)
+  ) as any;
+}
+
+export class Secret {
+  public readonly type = "secret";
+  constructor(readonly unencrypted: string) {}
+}
+
+export function setSecretPassphrase(passphrase: string) {
+  passphraseContext.enterWith(passphrase);
+}
+
+export function getSecretPassphrase(): string {
+  const passphrase = passphraseContext.getStore();
+  if (!passphrase) {
+    throw new Error("No passphrase set");
+  }
+  return passphrase;
+}
+
+export function tryGetSecretPassphrase(): string | undefined {
+  return passphraseContext.getStore();
+}

package/src/serde.ts

@@ -0,0 +1,46 @@
+import { decryptWithKey, encryptWithKey } from "./encrypt";
+import { Secret, getSecretPassphrase } from "./secret";
+
+export async function serialize(value: any): Promise<any> {
+  if (Array.isArray(value)) {
+    return Promise.all(value.map(serialize));
+  } else if (value instanceof Secret) {
+    return {
+      "@secret": await encryptWithKey(value.unencrypted, getSecretPassphrase()),
+    };
+  } else if (value && typeof value === "object") {
+    return Object.fromEntries(
+      await Promise.all(
+        Object.entries(value).map(async ([key, value]) => [
+          key,
+          await serialize(value),
+        ]),
+      ),
+    );
+  }
+  return value;
+}
+
+export async function deserialize(value: any): Promise<any> {
+  if (Array.isArray(value)) {
+    return await Promise.all(
+      value.map(async (item) => await deserialize(item)),
+    );
+  } else if (value && typeof value === "object") {
+    if (typeof value["@secret"] === "string") {
+      return new Secret(
+        await decryptWithKey(value["@secret"], getSecretPassphrase()),
+      );
+    } else {
+      return Object.fromEntries(
+        await Promise.all(
+          Object.entries(value).map(async ([key, value]) => [
+            key,
+            await deserialize(value),
+          ]),
+        ),
+      );
+    }
+  }
+  return value;
+}

package/src/state.ts

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { ignore } from "./error";
+import { deserialize, serialize } from "./serde";
 
 export interface State {
   status:
@@ -79,7 +80,7 @@ export class FileSystemStateStore implements StateStore {
         await this.getPath(key),
         "utf8",
       );
-      return JSON.parse(content) as State;
+      return (await deserialize(JSON.parse(content))) as State;
     } catch (error: any) {
       if (error.code === "ENOENT") {
         return undefined;
@@ -91,7 +92,7 @@ export class FileSystemStateStore implements StateStore {
   async set(key: string, value: State): Promise<void> {
     return fs.promises.writeFile(
       await this.getPath(key),
-      JSON.stringify(value, null, 2),
+      JSON.stringify(await serialize(value), null, 2),
     );
   }