@tillstack/secrets-edge 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +46 -0
- package/dist/index.d.mts +3 -3
- package/dist/index.d.ts +3 -3
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +2 -1
- package/dist/index.mjs.map +1 -1
- package/package.json +2 -2
package/README.md
ADDED
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
# @tillstack/secrets-edge
|
|
2
|
+
|
|
3
|
+
[TillSecrets](https://tilldev.dev/secrets) for edge runtimes: Cloudflare Workers, Vercel Edge, Deno and Bun. It makes one authenticated `fetch` and uses no Node built-ins.
|
|
4
|
+
|
|
5
|
+
## Install
|
|
6
|
+
|
|
7
|
+
```sh
|
|
8
|
+
npm install @tillstack/secrets-edge
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Use
|
|
12
|
+
|
|
13
|
+
Pull once per isolate, not once per request:
|
|
14
|
+
|
|
15
|
+
```ts
|
|
16
|
+
import { createClient } from '@tillstack/secrets-edge'
|
|
17
|
+
|
|
18
|
+
interface Env {
|
|
19
|
+
TILLSECRETS_TOKEN: string
|
|
20
|
+
TILLSECRETS_HOST_KEY?: string
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
let values: Promise<Record<string, string>> | null = null
|
|
24
|
+
|
|
25
|
+
export default {
|
|
26
|
+
async fetch(_req: Request, env: Env) {
|
|
27
|
+
values ??= createClient({ token: env.TILLSECRETS_TOKEN, hostKey: env.TILLSECRETS_HOST_KEY }).pull().then((r) => r.secrets)
|
|
28
|
+
const { STRIPE_KEY } = await values
|
|
29
|
+
return new Response(STRIPE_KEY ? 'configured' : 'missing')
|
|
30
|
+
},
|
|
31
|
+
}
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
The answer comes back encrypted to a post-quantum key (X-Wing) inside TLS. Set `TILLSECRETS_HOST_KEY` as a Worker secret when the token is bound to a host key; without one each pull uses a fresh key.
|
|
35
|
+
|
|
36
|
+
A Worker has no platform identity to prove, so [workload identities](https://tilldev.dev/docs/tillsecrets/workload-identity) don't apply here; use a service token, bound to a host key.
|
|
37
|
+
|
|
38
|
+
To keep TillSecrets off the request path entirely, push secrets into Worker secrets at deploy time instead: `tilldev secrets pull --json | jq .secrets | wrangler secret bulk`.
|
|
39
|
+
|
|
40
|
+
## Docs
|
|
41
|
+
|
|
42
|
+
https://tilldev.dev/docs/tillsecrets/quickstart
|
|
43
|
+
|
|
44
|
+
## License
|
|
45
|
+
|
|
46
|
+
Apache-2.0
|
package/dist/index.d.mts
CHANGED
|
@@ -9,10 +9,10 @@ interface CreateEdgeBrokerOptions {
|
|
|
9
9
|
url?: string;
|
|
10
10
|
/** Full spend endpoint; overrides `url`. */
|
|
11
11
|
endpoint?: string;
|
|
12
|
-
/** Bearer token
|
|
12
|
+
/** Bearer token: a `ta_` agent token, or a session / `tp_` API key (NOT the `ts_` service token). */
|
|
13
13
|
token: string;
|
|
14
|
-
/** Stable agent identity
|
|
15
|
-
agentKey
|
|
14
|
+
/** Stable agent identity. Required unless the token is a `ta_` agent token, which names itself. */
|
|
15
|
+
agentKey?: string;
|
|
16
16
|
sessionId?: string;
|
|
17
17
|
timeoutMs?: number;
|
|
18
18
|
fetch?: typeof fetch;
|
package/dist/index.d.ts
CHANGED
|
@@ -9,10 +9,10 @@ interface CreateEdgeBrokerOptions {
|
|
|
9
9
|
url?: string;
|
|
10
10
|
/** Full spend endpoint; overrides `url`. */
|
|
11
11
|
endpoint?: string;
|
|
12
|
-
/** Bearer token
|
|
12
|
+
/** Bearer token: a `ta_` agent token, or a session / `tp_` API key (NOT the `ts_` service token). */
|
|
13
13
|
token: string;
|
|
14
|
-
/** Stable agent identity
|
|
15
|
-
agentKey
|
|
14
|
+
/** Stable agent identity. Required unless the token is a `ta_` agent token, which names itself. */
|
|
15
|
+
agentKey?: string;
|
|
16
16
|
sessionId?: string;
|
|
17
17
|
timeoutMs?: number;
|
|
18
18
|
fetch?: typeof fetch;
|
package/dist/index.js
CHANGED
|
@@ -10,7 +10,8 @@ function createClient(opts) {
|
|
|
10
10
|
}
|
|
11
11
|
function createBroker(opts) {
|
|
12
12
|
const endpoint = opts.endpoint ?? `${(opts.url ?? "https://tilldev.dev").replace(/\/$/, "")}/api/secrets/broker/spend`;
|
|
13
|
-
const built = { endpoint, token: opts.token
|
|
13
|
+
const built = { endpoint, token: opts.token };
|
|
14
|
+
if (opts.agentKey) built.agentKey = opts.agentKey;
|
|
14
15
|
if (opts.sessionId !== void 0) built.sessionId = opts.sessionId;
|
|
15
16
|
if (opts.timeoutMs !== void 0) built.timeoutMs = opts.timeoutMs;
|
|
16
17
|
if (opts.fetch) built.fetch = opts.fetch;
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts"],"names":["SecretsClient","BrokerClient"],"mappings":";;;;;;;AAYO,SAAS,aAAa,IAAA,EAA2C;AACtE,EAAA,OAAO,IAAIA,0BAAc,IAAI,CAAA;AAC/B;AAmBO,SAAS,aAAa,IAAA,EAA6C;AACxE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,CAAA,EAAA,CAAI,IAAA,CAAK,OAAO,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,yBAAA,CAAA;AAC3F,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,KAAA,EAAO,KAAK,KAAA,
|
|
1
|
+
{"version":3,"sources":["../src/index.ts"],"names":["SecretsClient","BrokerClient"],"mappings":";;;;;;;AAYO,SAAS,aAAa,IAAA,EAA2C;AACtE,EAAA,OAAO,IAAIA,0BAAc,IAAI,CAAA;AAC/B;AAmBO,SAAS,aAAa,IAAA,EAA6C;AACxE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,CAAA,EAAA,CAAI,IAAA,CAAK,OAAO,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,yBAAA,CAAA;AAC3F,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,KAAA,EAAO,KAAK,KAAA,EAAM;AACjE,EAAA,IAAI,IAAA,CAAK,QAAA,EAAU,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,QAAA;AACzC,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACnC,EAAA,OAAO,IAAIC,yBAAa,KAAK,CAAA;AAC/B;AAEA,IAAO,WAAA,GAAQ","file":"index.js","sourcesContent":["// @tillstack/secrets-edge — TillSecrets client for edge runtimes.\n//\n// import { createClient } from '@tillstack/secrets-edge'\n// const secrets = createClient({ url: env.TILLSECRETS_URL, token: env.TILLSECRETS_TOKEN, hostKey: env.TILLSECRETS_HOST_KEY })\n// const { secrets: map } = await secrets.pull()\n\nimport { SecretsClient, BrokerClient, type SecretsClientOptions, type BrokerClientOptions } from '@tillstack/secrets-core'\n\nexport * from '@tillstack/secrets-core'\n\n/** Create a TillSecrets client. Pass an explicit `fetch` if the runtime has no\n * global one. */\nexport function createClient(opts: SecretsClientOptions): SecretsClient {\n return new SecretsClient(opts)\n}\n\nexport interface CreateEdgeBrokerOptions {\n /** Cloud API base (derives the spend endpoint) — or pass `endpoint` directly. */\n url?: string\n /** Full spend endpoint; overrides `url`. */\n endpoint?: string\n /** Bearer token: a `ta_` agent token, or a session / `tp_` API key (NOT the `ts_` service token). */\n token: string\n /** Stable agent identity. Required unless the token is a `ta_` agent token, which names itself. */\n agentKey?: string\n sessionId?: string\n timeoutMs?: number\n fetch?: typeof fetch\n}\n\n/** Create a secretless-broker client for an edge runtime. Edge has no local bridge,\n * so this always targets the cloud broker; pass config explicitly (edge runtimes\n * have no `process.env`). See `@tillstack/secrets-node` for the auto/bridge mode. */\nexport function createBroker(opts: CreateEdgeBrokerOptions): BrokerClient {\n const endpoint = opts.endpoint ?? `${(opts.url ?? 'https://tilldev.dev').replace(/\\/$/, '')}/api/secrets/broker/spend`\n const built: BrokerClientOptions = { endpoint, token: opts.token }\n if (opts.agentKey) built.agentKey = opts.agentKey\n if (opts.sessionId !== undefined) built.sessionId = opts.sessionId\n if (opts.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n if (opts.fetch) built.fetch = opts.fetch\n return new BrokerClient(built)\n}\n\nexport default createClient\n"]}
|
package/dist/index.mjs
CHANGED
|
@@ -7,7 +7,8 @@ function createClient(opts) {
|
|
|
7
7
|
}
|
|
8
8
|
function createBroker(opts) {
|
|
9
9
|
const endpoint = opts.endpoint ?? `${(opts.url ?? "https://tilldev.dev").replace(/\/$/, "")}/api/secrets/broker/spend`;
|
|
10
|
-
const built = { endpoint, token: opts.token
|
|
10
|
+
const built = { endpoint, token: opts.token };
|
|
11
|
+
if (opts.agentKey) built.agentKey = opts.agentKey;
|
|
11
12
|
if (opts.sessionId !== void 0) built.sessionId = opts.sessionId;
|
|
12
13
|
if (opts.timeoutMs !== void 0) built.timeoutMs = opts.timeoutMs;
|
|
13
14
|
if (opts.fetch) built.fetch = opts.fetch;
|
package/dist/index.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAYO,SAAS,aAAa,IAAA,EAA2C;AACtE,EAAA,OAAO,IAAI,cAAc,IAAI,CAAA;AAC/B;AAmBO,SAAS,aAAa,IAAA,EAA6C;AACxE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,CAAA,EAAA,CAAI,IAAA,CAAK,OAAO,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,yBAAA,CAAA;AAC3F,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,KAAA,EAAO,KAAK,KAAA,
|
|
1
|
+
{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAYO,SAAS,aAAa,IAAA,EAA2C;AACtE,EAAA,OAAO,IAAI,cAAc,IAAI,CAAA;AAC/B;AAmBO,SAAS,aAAa,IAAA,EAA6C;AACxE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,CAAA,EAAA,CAAI,IAAA,CAAK,OAAO,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,yBAAA,CAAA;AAC3F,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,KAAA,EAAO,KAAK,KAAA,EAAM;AACjE,EAAA,IAAI,IAAA,CAAK,QAAA,EAAU,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,QAAA;AACzC,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACnC,EAAA,OAAO,IAAI,aAAa,KAAK,CAAA;AAC/B;AAEA,IAAO,WAAA,GAAQ","file":"index.mjs","sourcesContent":["// @tillstack/secrets-edge — TillSecrets client for edge runtimes.\n//\n// import { createClient } from '@tillstack/secrets-edge'\n// const secrets = createClient({ url: env.TILLSECRETS_URL, token: env.TILLSECRETS_TOKEN, hostKey: env.TILLSECRETS_HOST_KEY })\n// const { secrets: map } = await secrets.pull()\n\nimport { SecretsClient, BrokerClient, type SecretsClientOptions, type BrokerClientOptions } from '@tillstack/secrets-core'\n\nexport * from '@tillstack/secrets-core'\n\n/** Create a TillSecrets client. Pass an explicit `fetch` if the runtime has no\n * global one. */\nexport function createClient(opts: SecretsClientOptions): SecretsClient {\n return new SecretsClient(opts)\n}\n\nexport interface CreateEdgeBrokerOptions {\n /** Cloud API base (derives the spend endpoint) — or pass `endpoint` directly. */\n url?: string\n /** Full spend endpoint; overrides `url`. */\n endpoint?: string\n /** Bearer token: a `ta_` agent token, or a session / `tp_` API key (NOT the `ts_` service token). */\n token: string\n /** Stable agent identity. Required unless the token is a `ta_` agent token, which names itself. */\n agentKey?: string\n sessionId?: string\n timeoutMs?: number\n fetch?: typeof fetch\n}\n\n/** Create a secretless-broker client for an edge runtime. Edge has no local bridge,\n * so this always targets the cloud broker; pass config explicitly (edge runtimes\n * have no `process.env`). See `@tillstack/secrets-node` for the auto/bridge mode. */\nexport function createBroker(opts: CreateEdgeBrokerOptions): BrokerClient {\n const endpoint = opts.endpoint ?? `${(opts.url ?? 'https://tilldev.dev').replace(/\\/$/, '')}/api/secrets/broker/spend`\n const built: BrokerClientOptions = { endpoint, token: opts.token }\n if (opts.agentKey) built.agentKey = opts.agentKey\n if (opts.sessionId !== undefined) built.sessionId = opts.sessionId\n if (opts.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n if (opts.fetch) built.fetch = opts.fetch\n return new BrokerClient(built)\n}\n\nexport default createClient\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tillstack/secrets-edge",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "TillSecrets client for any edge runtime (Cloudflare Workers, Vercel Edge, Deno, Bun) — pull encrypted config over one authenticated fetch, zero Node built-ins.",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"module": "./dist/index.mjs",
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
"dist"
|
|
25
25
|
],
|
|
26
26
|
"dependencies": {
|
|
27
|
-
"@tillstack/secrets-core": "^0.
|
|
27
|
+
"@tillstack/secrets-core": "^0.4.0"
|
|
28
28
|
},
|
|
29
29
|
"devDependencies": {
|
|
30
30
|
"tsup": "^8.5.1",
|