ncrypted 0.1.2 → 0.3.0

package/dist/crypto.js

@@ -72,3 +72,64 @@ export function parseLink(link) {
         throw new Error("Not a valid ncrypted link (expected https://host/s/{id}#{key})");
     return { origin: url.origin, id: m[1], key };
 }
+// ---- Secret requests: a human seals a value to the requesting agent's X25519 public key. ----
+const REQUEST_INFO = new TextEncoder().encode("ncrypted request v1");
+/** New X25519 keypair for a secret request. publicKey goes in the request link's #fragment; keep privateKey local. */
+export async function generateRequestKeypair() {
+    const kp = (await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]));
+    const raw = new Uint8Array(await crypto.subtle.exportKey("raw", kp.publicKey));
+    return { publicKey: toB64url(raw), privateKey: await crypto.subtle.exportKey("jwk", kp.privateKey) };
+}
+async function requestKey(shared, epk, pk) {
+    const salt = new Uint8Array(epk.length + pk.length);
+    salt.set(epk);
+    salt.set(pk, epk.length);
+    const base = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt, info: REQUEST_INFO }, base, { name: "AES-GCM", length: 256 }, false, [
+        "encrypt",
+        "decrypt",
+    ]);
+}
+/** Seals plaintext so only the holder of the request's private key can open it. Used by the request page. */
+export async function sealToPublicKey(plaintext, publicKey) {
+    const data = new TextEncoder().encode(plaintext);
+    if (data.length === 0)
+        throw new Error("Secret is empty");
+    if (data.length > MAX_PLAINTEXT_BYTES)
+        throw new Error(`Secret exceeds ${MAX_PLAINTEXT_BYTES} bytes`);
+    const pk = fromB64url(publicKey);
+    if (pk.length !== 32)
+        throw new Error("Invalid request public key");
+    const recipient = await crypto.subtle.importKey("raw", pk, { name: "X25519" }, false, []);
+    const eph = (await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]));
+    const epk = new Uint8Array(await crypto.subtle.exportKey("raw", eph.publicKey));
+    const shared = await crypto.subtle.deriveBits({ name: "X25519", public: recipient }, eph.privateKey, 256);
+    const key = await requestKey(shared, epk, pk);
+    const iv = randomBytes(12);
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, data));
+    return { v: VERSION, epk: toB64url(epk), iv: toB64url(iv), ciphertext: toB64url(ct) };
+}
+/** Opens a sealed payload with the request's private key. Throws if it was tampered with or sealed to another key. */
+export async function openSealed(sealed, privateKey, publicKey) {
+    const priv = await crypto.subtle.importKey("jwk", privateKey, { name: "X25519" }, false, ["deriveBits"]);
+    const epk = fromB64url(sealed.epk);
+    const eph = await crypto.subtle.importKey("raw", epk, { name: "X25519" }, false, []);
+    const shared = await crypto.subtle.deriveBits({ name: "X25519", public: eph }, priv, 256);
+    const key = await requestKey(shared, epk, fromB64url(publicKey));
+    try {
+        const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: fromB64url(sealed.iv) }, key, fromB64url(sealed.ciphertext));
+        return new TextDecoder().decode(pt);
+    }
+    catch {
+        throw new Error("Could not open the submitted secret: it was tampered with or sealed to a different key");
+    }
+}
+/** Splits a request link: https://host/r/{id}#{publicKey} */
+export function parseRequestLink(link) {
+    const url = new URL(link);
+    const m = url.pathname.match(/^\/r\/([A-Za-z0-9_-]{16,64})\/?$/);
+    const publicKey = url.hash.slice(1);
+    if (!m || !publicKey)
+        throw new Error("Not a valid ncrypted request link (expected https://host/r/{id}#{publicKey})");
+    return { origin: url.origin, id: m[1], publicKey };
+}

package/dist/destinations.d.ts

@@ -0,0 +1,35 @@
+export type VercelTarget = "production" | "preview" | "development";
+export interface VercelEnvDestination {
+    type: "vercel_env";
+    /** Env var name, e.g. STRIPE_SECRET_KEY. */
+    key: string;
+    /** Project name or id. Defaults to the project linked in <cwd>/.vercel/project.json. */
+    project?: string;
+    /** Team id (team_...) or slug. Defaults to the linked project's org. */
+    team?: string;
+    /** Default: production and preview. */
+    targets?: VercelTarget[];
+    /** Directory containing .vercel/project.json. Default: process.cwd(). */
+    cwd?: string;
+    comment?: string;
+}
+export interface DotenvDestination {
+    type: "dotenv";
+    key: string;
+    /** Path to the .env file. Default: ./.env */
+    path?: string;
+}
+export type Destination = VercelEnvDestination | DotenvDestination;
+export interface DeliveryResult {
+    destination: string;
+    key: string;
+    details: Record<string, unknown>;
+}
+export interface PreparedDestination {
+    deliver(value: string): Promise<DeliveryResult>;
+}
+/**
+ * Validates a destination (auth, project access, names) without touching the secret.
+ * Call this before consuming a one-time secret so a bad destination doesn't destroy it.
+ */
+export declare function prepareDestination(d: Destination): Promise<PreparedDestination>;

package/dist/destinations.js

@@ -0,0 +1,146 @@
+// Node-only destinations that receive a secret's value directly, so it never passes through the model.
+import { readFile, writeFile, chmod } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { homedir, platform } from "node:os";
+import { join, resolve, dirname } from "node:path";
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function checkKey(key) {
+    if (!KEY_RE.test(key))
+        throw new Error(`Invalid variable name "${key}" (letters, digits and _, not starting with a digit)`);
+}
+// ---------------- Vercel ----------------
+function vercelAuthPath() {
+    if (process.env.VERCEL_AUTH_FILE)
+        return process.env.VERCEL_AUTH_FILE;
+    if (platform() === "darwin")
+        return join(homedir(), "Library", "Application Support", "com.vercel.cli", "auth.json");
+    if (platform() === "win32")
+        return join(process.env.APPDATA ?? homedir(), "com.vercel.cli", "auth.json");
+    return join(process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share"), "com.vercel.cli", "auth.json");
+}
+/** VERCEL_TOKEN, else the Vercel CLI's login session (`vercel login`). */
+async function vercelToken() {
+    if (process.env.VERCEL_TOKEN)
+        return process.env.VERCEL_TOKEN;
+    let auth;
+    try {
+        auth = JSON.parse(await readFile(vercelAuthPath(), "utf8"));
+    }
+    catch {
+        throw new Error("Not logged in to Vercel. Run `vercel login` (or set VERCEL_TOKEN) and try again.");
+    }
+    if (!auth.token)
+        throw new Error("Not logged in to Vercel. Run `vercel login` (or set VERCEL_TOKEN) and try again.");
+    if (auth.expiresAt && auth.expiresAt * (auth.expiresAt < 1e12 ? 1000 : 1) < Date.now() + 60_000) {
+        throw new Error("Your Vercel CLI session has expired. Run `vercel whoami` to refresh it (or set VERCEL_TOKEN) and try again.");
+    }
+    return auth.token;
+}
+async function linkedProject(cwd) {
+    try {
+        return JSON.parse(await readFile(join(cwd, ".vercel", "project.json"), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function vercelApi(r, method, path, body) {
+    const res = await fetch(`https://api.vercel.com${path}${path.includes("?") ? "&" : "?"}${r.query}`, {
+        method,
+        headers: { authorization: `Bearer ${r.token}`, "content-type": "application/json" },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw new Error(`Vercel API ${res.status}: ${data.error?.message ?? res.statusText}`);
+    return data;
+}
+async function resolveVercel(d) {
+    checkKey(d.key);
+    const token = await vercelToken();
+    const linked = await linkedProject(d.cwd ?? process.cwd());
+    const project = d.project ?? linked?.projectId;
+    if (!project)
+        throw new Error("No Vercel project given and no .vercel/project.json here. Pass `project` (name or id) or run `vercel link`.");
+    const team = d.team ?? (d.project ? undefined : linked?.orgId);
+    const query = team ? (team.startsWith("team_") ? `teamId=${encodeURIComponent(team)}` : `slug=${encodeURIComponent(team)}`) : "";
+    const targets = d.targets?.length ? [...new Set(d.targets)] : ["production", "preview"];
+    return { token, project, query, targets };
+}
+/** Checks auth and project access before a one-time secret is consumed. */
+async function preflightVercel(d) {
+    const r = await resolveVercel(d);
+    await vercelApi(r, "GET", `/v9/projects/${encodeURIComponent(r.project)}`);
+    return r;
+}
+async function deliverVercel(value, d, r) {
+    // Sensitive vars can't target development; use encrypted there.
+    const sensitiveTargets = r.targets.filter((t) => t !== "development");
+    const entries = [
+        ...(sensitiveTargets.length ? [{ key: d.key, value, type: "sensitive", target: sensitiveTargets }] : []),
+        ...(r.targets.includes("development") ? [{ key: d.key, value, type: "encrypted", target: ["development"] }] : []),
+    ].map((e) => ({ ...e, comment: d.comment ?? "Set via ncrypted (value never shown to the agent)" }));
+    await vercelApi(r, "POST", `/v10/projects/${encodeURIComponent(r.project)}/env?upsert=true`, entries.length === 1 ? entries[0] : entries);
+    return {
+        destination: "vercel_env",
+        key: d.key,
+        details: {
+            project: r.project,
+            targets: r.targets,
+            type: sensitiveTargets.length ? "sensitive" : "encrypted",
+            note: "Redeploy for the new value to take effect.",
+        },
+    };
+}
+// ---------------- .env file ----------------
+function quoteEnv(value) {
+    if (/^[A-Za-z0-9_./:@+-]*$/.test(value))
+        return value;
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`;
+}
+function gitIgnored(path) {
+    return new Promise((done) => execFile("git", ["check-ignore", "-q", path], { cwd: dirname(path) }, (err) => {
+        if (!err)
+            return done(true);
+        done(err.code === 1 ? false : undefined); // 128: not a git repo
+    }));
+}
+async function deliverDotenv(value, d) {
+    checkKey(d.key);
+    const path = resolve(d.path ?? ".env");
+    let text = "";
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch { }
+    const line = `${d.key}=${quoteEnv(value)}`;
+    const re = new RegExp(`^(export\\s+)?${d.key}=.*$`, "m");
+    text = re.test(text) ? text.replace(re, line) : `${text}${text && !text.endsWith("\n") ? "\n" : ""}${line}\n`;
+    await writeFile(path, text, { mode: 0o600 });
+    await chmod(path, 0o600);
+    const ignored = await gitIgnored(path);
+    return {
+        destination: "dotenv",
+        key: d.key,
+        details: {
+            path,
+            gitIgnored: ignored,
+            ...(ignored === false ? { warning: `${path} is NOT git-ignored. Add it to .gitignore before committing.` } : {}),
+        },
+    };
+}
+/**
+ * Validates a destination (auth, project access, names) without touching the secret.
+ * Call this before consuming a one-time secret so a bad destination doesn't destroy it.
+ */
+export async function prepareDestination(d) {
+    if (d.type === "vercel_env") {
+        const r = await preflightVercel(d);
+        return { deliver: (v) => deliverVercel(v, d, r) };
+    }
+    if (d.type === "dotenv") {
+        checkKey(d.key);
+        return { deliver: (v) => deliverDotenv(v, d) };
+    }
+    throw new Error(`Unknown destination type "${d.type}"`);
+}

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./client.js";
-export { encrypt, decrypt, parseLink, MAX_PLAINTEXT_BYTES, type EncryptedPayload } from "./crypto.js";
+export { encrypt, decrypt, parseLink, parseRequestLink, sealToPublicKey, MAX_PLAINTEXT_BYTES, type EncryptedPayload, type SealedPayload } from "./crypto.js";
+export type { Destination, VercelEnvDestination, DotenvDestination, DeliveryResult, VercelTarget } from "./destinations.js";
 export { walletPath, createWallet, usdcBalance } from "./wallet.js";

package/dist/index.js

@@ -1,3 +1,3 @@
 export * from "./client.js";
-export { encrypt, decrypt, parseLink, MAX_PLAINTEXT_BYTES } from "./crypto.js";
+export { encrypt, decrypt, parseLink, parseRequestLink, sealToPublicKey, MAX_PLAINTEXT_BYTES } from "./crypto.js";
 export { walletPath, createWallet, usdcBalance } from "./wallet.js";

package/dist/localRequests.d.ts

@@ -0,0 +1,13 @@
+export interface LocalRequest {
+    id: string;
+    origin: string;
+    publicKey: string;
+    privateKey: JsonWebKey;
+    pollToken: string;
+    label: string;
+    expiresAt: string;
+}
+export declare function requestsDir(): string;
+export declare function saveLocalRequest(r: LocalRequest): Promise<void>;
+export declare function loadLocalRequest(id: string): Promise<LocalRequest>;
+export declare const removeLocalRequest: (id: string) => Promise<void>;

package/dist/localRequests.js

@@ -0,0 +1,25 @@
+// Node-only storage for the private keys of pending secret requests (one 0600 file per request).
+import { readFile, writeFile, mkdir, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function requestsDir() {
+    return process.env.NCRYPTED_REQUESTS_DIR || join(homedir(), ".config", "ncrypted", "requests");
+}
+const fileFor = (id) => {
+    if (!/^[A-Za-z0-9_-]{16,64}$/.test(id))
+        throw new Error("Invalid request id");
+    return join(requestsDir(), `${id}.json`);
+};
+export async function saveLocalRequest(r) {
+    await mkdir(requestsDir(), { recursive: true, mode: 0o700 });
+    await writeFile(fileFor(r.id), JSON.stringify(r), { mode: 0o600 });
+}
+export async function loadLocalRequest(id) {
+    try {
+        return JSON.parse(await readFile(fileFor(id), "utf8"));
+    }
+    catch {
+        throw new Error(`No pending request ${id} on this machine (it was collected already, or created elsewhere).`);
+    }
+}
+export const removeLocalRequest = (id) => rm(fileFor(id), { force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ncrypted",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "One-time, end-to-end encrypted secrets for AI agents. Pay 0.005 USDC per secret via x402; the note self-destructs after one read.",
   "license": "MIT",
   "type": "module",
@@ -18,6 +18,10 @@
     "./wallet": {
       "types": "./dist/wallet.d.ts",
       "default": "./dist/wallet.js"
+    },
+    "./ai-sdk": {
+      "types": "./dist/ai-sdk.d.ts",
+      "default": "./dist/ai-sdk.js"
     }
   },
   "bin": {
@@ -32,13 +36,15 @@
     "node": ">=20"
   },
   "keywords": [
-    "secrets",
-    "one-time",
-    "x402",
     "agents",
-    "mcp",
+    "ai-sdk",
     "encryption",
-    "usdc"
+    "mcp",
+    "one-time",
+    "secrets",
+    "usdc",
+    "vercel",
+    "x402"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -52,7 +58,9 @@
   "devDependencies": {
     "@types/node": "^24.0.0",
     "typescript": "^5.9.0",
-    "vitest": "^5.0.5"
+    "vitest": "^5.0.5",
+    "ai": "^7.0.143",
+    "zod": "^4.6.7"
   },
   "repository": {
     "type": "git",
@@ -62,5 +70,17 @@
   "homepage": "https://github.com/Seidl-Family/ncrypted",
   "publishConfig": {
     "access": "public"
+  },
+  "peerDependencies": {
+    "ai": ">=5",
+    "zod": "^3.25.0 || ^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "ai": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
   }
 }