@lumiblue/secrets 0.1.15

package/README.md

@@ -0,0 +1,50 @@
+# `@lumiblue/secrets`
+
+Typed client for the Lumiblue Secrets HTTP API. Built around `createSdkClient` + `Sdk`. Uses the runtime `fetch` API.
+
+## Install
+
+```bash
+pnpm add @lumiblue/secrets
+```
+
+## Usage
+
+Always pass a client into `Sdk` so credentials stay encapsulated on that instance:
+
+```ts
+import { createSdkClient, Sdk } from "@lumiblue/secrets";
+
+const sdk = new Sdk({
+  client: createSdkClient({
+    apiKey: process.env.LUMIBLUE_API_KEY!,
+    // servers: ["https://secrets.lumiblue.nl"], // optional failover list
+    // aud: ["secrets"],                          // optional; default ["secrets"]
+  }),
+});
+
+const health = await sdk.getApiHealth();
+if (health.error) {
+  console.error(health.error);
+} else {
+  console.log(health.data);
+}
+
+await sdk.getApiHealthMe();
+```
+
+Methods map 1:1 to Secrets routes. Each call returns `data` / `error` / `response` unless you pass `throwOnError: true`.
+
+### `createSdkClient` options
+
+- `apiKey` — M2M secret; sent as `x-api-key` when minting JWTs
+- `servers` — API base URLs for failover (defaults to package OpenAPI servers)
+- `aud` — audience list on `POST /api/lumiblue-token` (defaults to `["secrets"]`)
+
+### Auth flow (M2M)
+
+1. On 401, `POST /api/lumiblue-token` with header `x-api-key` and body `{ aud }`.
+2. The returned JWT is kept in that client’s memory and sent as `Authorization: Bearer`.
+3. `logout()` on the client clears its in-memory API key and JWT.
+
+Machine keys are created in the Secrets UI (Machines). The full secret is returned only once on create — list/get do not expose it again.