Encrypting Secrets

{
  "API_KEY": "sk-xxxxxxxxxxxxx",
  "ENDPOINT": "https://api.example.com"
}

import { storeEncryptedSecrets } from '@newton-xyz/sdk'

const result = await storeEncryptedSecrets(
  11155111, // chainId
  'your-api-key',
  {
    policyClient: '0xYourPolicyClientAddress',
    policyDataAddress: '0xYourPolicyDataAddress',
    plaintext: {
      API_KEY: 'sk-xxxxxxxxxxxxx',
      ENDPOINT: 'https://api.example.com',
    },
    chainId: 11155111,
    // recipientPublicKey: '...' — optional, fetched automatically if omitted
  },
)

if (!result.success) {
  throw new Error(`Upload failed: ${result.error}`)
}

// In your WASM oracle (policy.js)
import { fetch as httpFetch } from "newton:provider/http@0.2.0";
import { get as getHostSecrets } from "newton:provider/secrets@0.2.0";

let _secrets = {};

function loadHostSecrets() {
  const r = getHostSecrets();              // result<secret-response, string>
  const resp = r?.val ?? r;
  const bytes = resp?.value;               // value: list<u8> — decrypted secrets JSON
  if (!bytes || bytes.length === 0) return;
  const text = new TextDecoder().decode(new Uint8Array(bytes));
  _secrets = { ..._secrets, ...JSON.parse(text) };
}

export function run(wasm_args) {
  loadHostSecrets();

  const response = httpFetch({
    url: "https://api.example.com/data",
    method: "GET",
    headers: [["Authorization", `Bearer ${_secrets.API_KEY}`]],
    body: null,
  });

  if (response.tag === "err") {
    return JSON.stringify({ error: response.val });
  }

  const body = new TextDecoder().decode(new Uint8Array(response.val.body));
  return JSON.stringify(JSON.parse(body));
}

{
  "type": "object",
  "properties": {
    "API_KEY": { "type": "string" },
    "ENDPOINT": { "type": "string", "format": "uri" }
  },
  "required": ["API_KEY", "ENDPOINT"]
}