@sentroy-co/client-sdk 2.6.4 → 2.9.0

package/dist/vault/index.js

@@ -0,0 +1,169 @@
+"use strict";
+/**
+ * `@sentroy-co/client-sdk/vault` — Sentroy Env Vault server-side client.
+ *
+ * Bootstrap pattern:
+ *   `SENTROY_ENV_API_KEY` (process.env) → tek dış env. Fonksiyonlar
+ *   `getEnv("KEY")` ya da `getEnvOrThrow("KEY")` çağrılırken in-memory
+ *   cache'den döner; ilk çağrıda Sentroy core'a HTTP fetch yapar ve
+ *   o token scope'undaki TÜM env'leri (public + private) çeker.
+ *
+ * Cache stratejisi:
+ *   • Default TTL 5 dk; refresh deadline aşıldığında bir sonraki
+ *     `getEnv` çağrısında re-fetch tetiklenir.
+ *   • `await refreshEnvCache()` manuel invalidation — webhook ya da
+ *     SIGHUP-style restart sinyaline bağlanabilir.
+ *   • `setEnvCacheTTL(seconds)` runtime'da TTL değiştirme.
+ *
+ * Hata politikası: bootstrap fail (token yok / network down / 401)
+ *   → `getEnv` her çağrıda undefined döner; `getEnvOrThrow` exception
+ *   atar. Process startup'ında `await preloadEnv()` çağırırsanız
+ *   eksik env'leri erkenden yakalarsınız.
+ *
+ * **NOT**: Bu modül `Sentroy` ana client'ından (mail/storage REST
+ * resource'ları) bağımsızdır. Vault token'ları (stk_env_*) ile mail/
+ * storage token'ları (stk_*) farklı namespace'tedir; tek client'ta
+ * birleştirmek ergonomiyi bozardı.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureEnvClient = configureEnvClient;
+exports.setEnvCacheTTL = setEnvCacheTTL;
+exports.refreshEnvCache = refreshEnvCache;
+exports.preloadEnv = preloadEnv;
+exports.getEnv = getEnv;
+exports.getEnvOrThrow = getEnvOrThrow;
+exports.getAllEnvs = getAllEnvs;
+exports.getPublicEnvs = getPublicEnvs;
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_BASE_URL = "https://sentroy.com";
+let resolvedBaseUrl = DEFAULT_BASE_URL;
+let resolvedApiKey;
+let cacheTtlMs = DEFAULT_TTL_MS;
+let fetchTimeoutMs = 5000;
+let cache = null;
+let pendingRefresh = null;
+function readEnv(name) {
+    if (typeof process === "undefined")
+        return undefined;
+    return process.env?.[name];
+}
+/**
+ * One-time client config — Sentroy app'lerinde modül seviyesinde çağrılır,
+ * default'lara güvenilirse hiç çağrılmasına gerek yok.
+ */
+function configureEnvClient(options = {}) {
+    if (options.baseUrl)
+        resolvedBaseUrl = options.baseUrl.replace(/\/+$/, "");
+    else
+        resolvedBaseUrl = (readEnv("NEXT_PUBLIC_SENTROY_ENV_API_URL") ||
+            readEnv("SENTROY_ENV_API_URL") ||
+            readEnv("NEXT_PUBLIC_CORE_APP_URL") ||
+            DEFAULT_BASE_URL).replace(/\/+$/, "");
+    resolvedApiKey = options.apiKey ?? readEnv("SENTROY_ENV_API_KEY");
+    if (options.ttlSeconds)
+        cacheTtlMs = options.ttlSeconds * 1000;
+    if (options.timeoutMs)
+        fetchTimeoutMs = options.timeoutMs;
+}
+/** TTL'i runtime'da değiştir (örn. development için kısa, prod için uzun). */
+function setEnvCacheTTL(seconds) {
+    cacheTtlMs = seconds * 1000;
+}
+/** Cache'i invalidate et — webhook ya da admin-driven manual refresh için. */
+async function refreshEnvCache() {
+    cache = null;
+    await ensureCache();
+}
+/** Process start'ında erkenden tetikle — eksik env'i fail-fast yakalar. */
+async function preloadEnv() {
+    await ensureCache();
+}
+async function fetchVariables() {
+    if (!resolvedApiKey) {
+        // Lazy bootstrap — configureEnvClient çağrılmadıysa env'den oku.
+        configureEnvClient();
+    }
+    if (!resolvedApiKey) {
+        throw new Error("@sentroy-co/client-sdk/vault: SENTROY_ENV_API_KEY is not set. " +
+            "Set it on the platform (Coolify env) or call configureEnvClient({ apiKey: ... }) at boot.");
+    }
+    const url = `${resolvedBaseUrl}/api/env-vault/fetch`;
+    const res = await fetch(url, {
+        headers: { Authorization: `Bearer ${resolvedApiKey}` },
+        signal: AbortSignal.timeout(fetchTimeoutMs),
+        cache: "no-store",
+    });
+    if (!res.ok) {
+        throw new Error(`env-vault fetch failed: ${res.status} ${res.statusText} (url=${url})`);
+    }
+    const json = (await res.json());
+    if (!json.data)
+        throw new Error("env-vault fetch: malformed response");
+    const map = new Map();
+    for (const v of json.data.variables)
+        map.set(v.key, v);
+    return {
+        fetchedAt: Date.now(),
+        variables: map,
+        project: json.data.project,
+        environment: json.data.environment,
+    };
+}
+async function ensureCache() {
+    const now = Date.now();
+    if (cache && now - cache.fetchedAt < cacheTtlMs)
+        return cache;
+    if (pendingRefresh) {
+        await pendingRefresh;
+        if (cache)
+            return cache;
+    }
+    pendingRefresh = (async () => {
+        try {
+            cache = await fetchVariables();
+        }
+        finally {
+            pendingRefresh = null;
+        }
+    })();
+    await pendingRefresh;
+    if (!cache)
+        throw new Error("env-vault: cache hydrate failed");
+    return cache;
+}
+/**
+ * Async — env yoksa undefined. Bu fonksiyon TÜM env'leri (server+public)
+ * gizler, çünkü `process.env` fallback yok; sadece vault'ta kayıtlı
+ * olanlar dönder. Token bootstrap fail ederse exception atar.
+ */
+async function getEnv(key) {
+    const c = await ensureCache();
+    return c.variables.get(key)?.value;
+}
+/** Eksik env'i hemen patlatır — config-validation pattern'inde kullanışlı. */
+async function getEnvOrThrow(key) {
+    const v = await getEnv(key);
+    if (v === undefined) {
+        throw new Error(`env-vault: required variable ${key} is not defined (project=${cache?.project ?? "?"}, env=${cache?.environment ?? "?"})`);
+    }
+    return v;
+}
+/** Tüm env'leri map olarak döner (dump için kullanışlı). */
+async function getAllEnvs() {
+    const c = await ensureCache();
+    const out = {};
+    for (const [k, v] of c.variables)
+        out[k] = v.value;
+    return out;
+}
+/** Sadece public (`public: true`) env'ler — SSR helper için. */
+async function getPublicEnvs() {
+    const c = await ensureCache();
+    const out = {};
+    for (const [k, v] of c.variables) {
+        if (v.public)
+            out[k] = v.value;
+    }
+    return out;
+}
+//# sourceMappingURL=index.js.map

package/dist/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AA8CH,gDAYC;AAGD,wCAEC;AAGD,0CAGC;AAGD,gCAEC;AAkED,wBAGC;AAGD,sCAQC;AAGD,gCAKC;AAGD,sCAOC;AA5JD,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACpC,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAa9C,IAAI,eAAe,GAAG,gBAAgB,CAAA;AACtC,IAAI,cAAkC,CAAA;AACtC,IAAI,UAAU,GAAG,cAAc,CAAA;AAC/B,IAAI,cAAc,GAAG,IAAI,CAAA;AACzB,IAAI,KAAK,GAAyB,IAAI,CAAA;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAA;AAE/C,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IACpD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,UAAyB,EAAE;IAC5D,IAAI,OAAO,CAAC,OAAO;QAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;;QAExE,eAAe,GAAG,CAChB,OAAO,CAAC,iCAAiC,CAAC;YAC1C,OAAO,CAAC,qBAAqB,CAAC;YAC9B,OAAO,CAAC,0BAA0B,CAAC;YACnC,gBAAgB,CACjB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACvB,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,UAAU;QAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAA;IAC9D,IAAI,OAAO,CAAC,SAAS;QAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAA;AAC3D,CAAC;AAED,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,OAAe;IAC5C,UAAU,GAAG,OAAO,GAAG,IAAI,CAAA;AAC7B,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,IAAI,CAAA;IACZ,MAAM,WAAW,EAAE,CAAA;AACrB,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,UAAU;IAC9B,MAAM,WAAW,EAAE,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,iEAAiE;QACjE,kBAAkB,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2FAA2F,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,eAAe,sBAAsB,CAAA;IACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;QACtD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;QAC3C,KAAK,EAAE,UAAU;KAClB,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,SAAS,GAAG,GAAG,CACvE,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAA;IACD,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACtD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;QAC1B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,cAAc,CAAA;QACpB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;QAChC,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,IAAI,CAAA;QACvB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,cAAc,CAAA;IACpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;AACpC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,4BAA4B,KAAK,EAAE,OAAO,IAAI,GAAG,SAAS,KAAK,EAAE,WAAW,IAAI,GAAG,GAAG,CAC1H,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,UAAU;IAC9B,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IAClD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AACzD,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/vault/react.d.ts

@@ -0,0 +1,27 @@
+import { type ReactNode } from "react";
+interface EnvProviderProps {
+    /** Server-side fetched public envs — SSR'da inject edilir. */
+    envs: Record<string, string>;
+    /** Public refresh endpoint URL — default `/api/env-vault/public`. */
+    refreshUrl?: string;
+    /** Bearer token — public endpoint için. Default `process.env.NEXT_PUBLIC_SENTROY_ENV_API_KEY`. */
+    apiKey?: string;
+    /** Refresh interval ms; 0 ise polling kapalı. Default 5 dk. */
+    refreshIntervalMs?: number;
+    children: ReactNode;
+}
+export declare function EnvProvider({ envs: initialEnvs, refreshUrl, apiKey, refreshIntervalMs, children, }: EnvProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * `useEnv("KEY")` — provider'ın hydrate ettiği env değerini döner.
+ * Yoksa undefined; çağıran fallback verir (`useEnv("X") ?? "default"`).
+ */
+export declare function useEnv(key: string): string | undefined;
+/** Tüm public env'leri Record olarak döner. */
+export declare function useAllEnvs(): Record<string, string>;
+/** Manuel refresh tetikleme (örn. admin "config updated" notification sonrası). */
+export declare function useEnvRefresh(): {
+    refresh: () => Promise<void>;
+    loading: boolean;
+};
+export {};
+//# sourceMappingURL=react.d.ts.map

package/dist/vault/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../src/vault/react.tsx"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,OAAO,CAAA;AAgCd,UAAU,gBAAgB;IACxB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAID,wBAAgB,WAAW,CAAC,EAC1B,IAAI,EAAE,WAAW,EACjB,UAAoC,EACpC,MAAM,EACN,iBAA+C,EAC/C,QAAQ,GACT,EAAE,gBAAgB,2CA4ClB;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtD;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEnD;AAED,mFAAmF;AACnF,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAGlF"}

package/dist/vault/react.js

@@ -0,0 +1,73 @@
+"use strict";
+"use client";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvProvider = EnvProvider;
+exports.useEnv = useEnv;
+exports.useAllEnvs = useAllEnvs;
+exports.useEnvRefresh = useEnvRefresh;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const EnvContext = (0, react_1.createContext)({
+    envs: {},
+    loading: false,
+    refresh: async () => { },
+});
+const DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+function EnvProvider({ envs: initialEnvs, refreshUrl = "/api/env-vault/public", apiKey, refreshIntervalMs = DEFAULT_REFRESH_INTERVAL_MS, children, }) {
+    const [envs, setEnvs] = (0, react_1.useState)(initialEnvs);
+    const [loading, setLoading] = (0, react_1.useState)(false);
+    const effectiveKey = apiKey ??
+        (typeof process !== "undefined"
+            ? process.env?.NEXT_PUBLIC_SENTROY_ENV_API_KEY
+            : undefined);
+    async function refresh() {
+        if (!effectiveKey)
+            return; // bootstrap yoksa polling no-op
+        setLoading(true);
+        try {
+            const res = await fetch(refreshUrl, {
+                headers: { Authorization: `Bearer ${effectiveKey}` },
+                cache: "no-store",
+            });
+            if (!res.ok)
+                return;
+            const json = (await res.json());
+            const next = {};
+            for (const v of json.data?.variables ?? [])
+                next[v.key] = v.value;
+            setEnvs(next);
+        }
+        catch {
+            // network error — keep previous envs, fail-soft
+        }
+        finally {
+            setLoading(false);
+        }
+    }
+    (0, react_1.useEffect)(() => {
+        if (!refreshIntervalMs || refreshIntervalMs <= 0)
+            return;
+        const id = setInterval(refresh, refreshIntervalMs);
+        return () => clearInterval(id);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [refreshIntervalMs, effectiveKey]);
+    return ((0, jsx_runtime_1.jsx)(EnvContext.Provider, { value: { envs, loading, refresh }, children: children }));
+}
+/**
+ * `useEnv("KEY")` — provider'ın hydrate ettiği env değerini döner.
+ * Yoksa undefined; çağıran fallback verir (`useEnv("X") ?? "default"`).
+ */
+function useEnv(key) {
+    const ctx = (0, react_1.useContext)(EnvContext);
+    return ctx.envs[key];
+}
+/** Tüm public env'leri Record olarak döner. */
+function useAllEnvs() {
+    return (0, react_1.useContext)(EnvContext).envs;
+}
+/** Manuel refresh tetikleme (örn. admin "config updated" notification sonrası). */
+function useEnvRefresh() {
+    const ctx = (0, react_1.useContext)(EnvContext);
+    return { refresh: ctx.refresh, loading: ctx.loading };
+}
+//# sourceMappingURL=react.js.map

package/dist/vault/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../../src/vault/react.tsx"],"names":[],"mappings":";AAAA,YAAY,CAAA;;AAsDZ,kCAkDC;AAMD,wBAGC;AAGD,gCAEC;AAGD,sCAGC;;AA1HD,iCAMc;AA0Bd,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAkB;IAChD,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;CACxB,CAAC,CAAA;AAcF,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAEjD,SAAgB,WAAW,CAAC,EAC1B,IAAI,EAAE,WAAW,EACjB,UAAU,GAAG,uBAAuB,EACpC,MAAM,EACN,iBAAiB,GAAG,2BAA2B,EAC/C,QAAQ,GACS;IACjB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAA,gBAAQ,EAAyB,WAAW,CAAC,CAAA;IACrE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAA;IAE7C,MAAM,YAAY,GAChB,MAAM;QACN,CAAC,OAAO,OAAO,KAAK,WAAW;YAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,+BAA+B;YAC9C,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,KAAK,UAAU,OAAO;QACpB,IAAI,CAAC,YAAY;YAAE,OAAM,CAAC,gCAAgC;QAC1D,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;gBAClC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;gBACpD,KAAK,EAAE,UAAU;aAClB,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAM;YACnB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAA;YACD,MAAM,IAAI,GAA2B,EAAE,CAAA;YACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;YACjE,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,IAAI,CAAC;YAAE,OAAM;QACxD,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAClD,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QAC9B,uDAAuD;IACzD,CAAC,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAA;IAErC,OAAO,CACL,uBAAC,UAAU,CAAC,QAAQ,IAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YACnD,QAAQ,GACW,CACvB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,IAAA,kBAAU,EAAC,UAAU,CAAC,CAAA;IAClC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACtB,CAAC;AAED,+CAA+C;AAC/C,SAAgB,UAAU;IACxB,OAAO,IAAA,kBAAU,EAAC,UAAU,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,mFAAmF;AACnF,SAAgB,aAAa;IAC3B,MAAM,GAAG,GAAG,IAAA,kBAAU,EAAC,UAAU,CAAC,CAAA;IAClC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;AACvD,CAAC"}

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@sentroy-co/client-sdk",
-  "version": "2.6.4",
-  "description": "TypeScript SDK for the Sentroy platform — REST resources + React components.",
+  "version": "2.9.0",
+  "description": "TypeScript SDK + CLI for the Sentroy platform — mail, storage, env vault + React components.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "bin": {
+    "sentroy": "./bin/sentroy.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -24,11 +27,22 @@
       "types": "./dist/react/crop/index.d.ts",
       "import": "./dist/react/crop/index.js",
       "require": "./dist/react/crop/index.js"
+    },
+    "./vault": {
+      "types": "./dist/vault/index.d.ts",
+      "import": "./dist/vault/index.js",
+      "require": "./dist/vault/index.js"
+    },
+    "./vault/react": {
+      "types": "./dist/vault/react.d.ts",
+      "import": "./dist/vault/react.js",
+      "require": "./dist/vault/react.js"
     }
   },
   "files": [
     "dist",
     "src",
+    "bin",
     "AGENTS.md"
   ],
   "scripts": {
@@ -43,7 +57,13 @@
     "mail",
     "typescript",
     "react",
-    "media-manager"
+    "media-manager",
+    "env",
+    "vault",
+    "secrets",
+    "config",
+    "cli",
+    "dotenv"
   ],
   "repository": {
     "type": "git",

package/src/cli/dotenv.ts

@@ -0,0 +1,146 @@
+/**
+ * Minimal .env parser + serializer used by the CLI.
+ *
+ * Format conventions (mirrors apps/core/components/admin/env-vault-content.tsx
+ * developer mode):
+ *   - blank line resets pending description/public flag
+ *   - `# @public` on its own line marks the next variable as browser-readable
+ *   - `# any other text` becomes the next variable's description
+ *   - `KEY=value`               (unquoted)
+ *   - `KEY="value with spaces"` (double-quoted; supports \n, \", \\ escapes)
+ *   - `KEY='single quotes'`     (single-quoted; literal)
+ *   - `export KEY=value`        (export prefix stripped)
+ *
+ * Anything else is reported as a parse error with the offending line number.
+ */
+
+export interface DotenvEntry {
+  key: string
+  value: string
+  public: boolean
+  description: string | null
+}
+
+export interface DotenvParseResult {
+  entries: DotenvEntry[]
+  errors: { line: number; message: string }[]
+}
+
+const KEY_PATTERN = /^[A-Z_][A-Z0-9_]*$/
+
+export function parseDotenv(text: string): DotenvParseResult {
+  const lines = text.split(/\r?\n/)
+  const entries: DotenvEntry[] = []
+  const errors: DotenvParseResult["errors"] = []
+  const seen = new Set<string>()
+
+  let pendingDescription: string[] = []
+  let pendingPublic = false
+
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i] ?? ""
+    const line = raw.trim()
+
+    if (line === "") {
+      pendingDescription = []
+      pendingPublic = false
+      continue
+    }
+
+    if (line.startsWith("#")) {
+      const body = line.slice(1).trim()
+      if (body === "@public") {
+        pendingPublic = true
+      } else if (body) {
+        pendingDescription.push(body)
+      }
+      continue
+    }
+
+    const work = line.startsWith("export ") ? line.slice(7).trimStart() : line
+    const eq = work.indexOf("=")
+    if (eq <= 0) {
+      errors.push({
+        line: i + 1,
+        message: "invalid syntax (expected KEY=value)",
+      })
+      pendingDescription = []
+      pendingPublic = false
+      continue
+    }
+
+    const key = work.slice(0, eq).trim()
+    let value = work.slice(eq + 1)
+
+    if (!KEY_PATTERN.test(key)) {
+      errors.push({
+        line: i + 1,
+        message: "key must match [A-Z_][A-Z0-9_]*",
+      })
+      pendingDescription = []
+      pendingPublic = false
+      continue
+    }
+
+    const trimmed = value.trim()
+    if (
+      (trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+      (trimmed.startsWith("'") && trimmed.endsWith("'"))
+    ) {
+      value = trimmed.slice(1, -1)
+      if (trimmed.startsWith('"')) {
+        value = value
+          .replace(/\\n/g, "\n")
+          .replace(/\\"/g, '"')
+          .replace(/\\\\/g, "\\")
+      }
+    } else {
+      value = trimmed
+    }
+
+    if (seen.has(key)) {
+      errors.push({ line: i + 1, message: `duplicate key ${key}` })
+      pendingDescription = []
+      pendingPublic = false
+      continue
+    }
+    seen.add(key)
+
+    entries.push({
+      key,
+      value,
+      public: pendingPublic,
+      description:
+        pendingDescription.length > 0 ? pendingDescription.join(" ") : null,
+    })
+
+    pendingDescription = []
+    pendingPublic = false
+  }
+
+  return { entries, errors }
+}
+
+/**
+ * Inverse of parseDotenv — emit a .env document that round-trips through it.
+ * Quotes values that contain whitespace or shell-special characters.
+ */
+export function serializeDotenv(entries: DotenvEntry[]): string {
+  const blocks: string[] = []
+  for (const e of entries) {
+    const parts: string[] = []
+    if (e.description) parts.push(`# ${e.description}`)
+    if (e.public) parts.push("# @public")
+    const value = e.value
+    const needsQuote = /[\s"'#$`\\]/.test(value) || value === ""
+    const escaped = needsQuote
+      ? `"${value
+          .replace(/\\/g, "\\\\")
+          .replace(/"/g, '\\"')
+          .replace(/\n/g, "\\n")}"`
+      : value
+    parts.push(`${e.key}=${escaped}`)
+    blocks.push(parts.join("\n"))
+  }
+  return blocks.join("\n\n") + (blocks.length > 0 ? "\n" : "")
+}