morpheus-cli 0.6.4 → 0.6.6

package/dist/runtime/trinity-crypto.js

@@ -50,3 +50,54 @@ export function decrypt(ciphertext) {
 export function canEncrypt() {
     return !!process.env.MORPHEUS_SECRET;
 }
+/**
+ * Checks if a string appears to be an encrypted value.
+ * Format: base64(iv):base64(authTag):base64(ciphertext)
+ */
+export function looksLikeEncrypted(value) {
+    const parts = value.split(':');
+    if (parts.length !== 3)
+        return false;
+    // Each part should be valid base64
+    return parts.every(part => {
+        try {
+            const decoded = Buffer.from(part, 'base64');
+            return decoded.toString('base64') === part;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Safely decrypts a value, returning null if decryption fails.
+ * Use this for fail-open scenarios where MORPHEUS_SECRET may not be set.
+ */
+export function safeDecrypt(ciphertext) {
+    if (!ciphertext)
+        return null;
+    try {
+        return decrypt(ciphertext);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Gets the usable API key from a potentially encrypted value.
+ * If the value looks encrypted, attempts to decrypt it.
+ * If decryption fails or MORPHEUS_SECRET is not set, returns the original value.
+ * Use this when you need the actual plaintext key for API calls.
+ */
+export function getUsableApiKey(encryptedOrPlain) {
+    if (!encryptedOrPlain)
+        return undefined;
+    // If it looks encrypted, try to decrypt
+    if (looksLikeEncrypted(encryptedOrPlain)) {
+        const decrypted = safeDecrypt(encryptedOrPlain);
+        // If decryption succeeded, return it; otherwise return original
+        return decrypted ?? encryptedOrPlain;
+    }
+    // Not encrypted, return as-is
+    return encryptedOrPlain;
+}