@tillstack/secrets-node 0.3.0 → 0.4.0

package/README.md

@@ -0,0 +1,109 @@
+# @tillstack/secrets-node
+
+[TillSecrets](https://tilldev.dev/secrets) for Node.js. Pull your environment's encrypted config at boot and load it into `process.env`, dotenv-style, without committing a `.env`.
+
+## Install
+
+```sh
+npm install @tillstack/secrets-node
+```
+
+## Load at boot
+
+```ts
+import { load } from '@tillstack/secrets-node'
+
+await load() // existing env vars win unless you pass { override: true }
+```
+
+`load()` throws if the token was refused any restricted (tier 7+) or sealed key, rather than booting without it. Use a token pinned to the environment, or pass `{ allowPartial: true }` to continue without those keys.
+
+Environment:
+
+| Variable | |
+|---|---|
+| `TILLSECRETS_TOKEN` | Service token (`ts_…`). Required unless you use a workload identity. |
+| `TILLSECRETS_IDENTITY` | A workload identity id, instead of a token. Ignored when `TILLSECRETS_TOKEN` is set. |
+| `TILLSECRETS_ID_TOKEN` / `TILLSECRETS_ID_TOKEN_FILE` | An OIDC token for the identity, where the platform doesn't provide one itself. |
+| `TILLSECRETS_ENV` | Environment id, only for project-scoped tokens. |
+| `TILLSECRETS_URL` | API base. Default `https://tilldev.dev`. |
+| `TILLSECRETS_LEASE_URL` | Dynamic-lease service. Default `https://secrets.tilldev.dev`. |
+| `TILLSECRETS_HOST_KEY_FILE` | This host's key file, for a token bound to a host. Default `~/.tilldev/host-key` when it exists. |
+| `TILLSECRETS_HOST_KEY` | The key file's contents, where there is no disk. |
+
+Tokens go only over https (plain http is allowed for localhost). Answers come back encrypted to a post-quantum key (X-Wing) inside TLS: this host's key, or a fresh one per call. A token bound to a host with `tilldev secrets host-key init` and `tilldev secrets tokens create --host-key` answers only to that key, so a copy of it elsewhere gets nothing. A key file other users can read is refused.
+
+## Client
+
+```ts
+import { createClient } from '@tillstack/secrets-node'
+
+const secrets = createClient()
+const { secrets: values, dynamic } = await secrets.pull()
+
+// Short-lived database credentials, minted on demand (read_write token).
+const lease = await secrets.lease({ secretKey: 'REPORTING_DB', ttlSeconds: 900 })
+```
+
+## Workload identity
+
+On a CI run, cloud workload or server with a platform identity, set `TILLSECRETS_IDENTITY` instead of storing a token:
+
+```ts
+import { load, createClient } from '@tillstack/secrets-node'
+
+await load() // reads TILLSECRETS_IDENTITY
+
+const client = createClient({ identity: '3f1c…' })
+```
+
+The SDK finds the platform's proof on its own:
+
+- GitHub Actions: the job's OIDC token;
+- GitLab CI: the token in `TILLSECRETS_ID_TOKEN`;
+- Bitbucket Pipelines, Semaphore, HCP Terraform, Spacelift and Modal: the token the platform puts in the environment or the workspace;
+- CircleCI and Buildkite: a token from `circleci run oidc get` or `buildkite-agent oidc request-token`;
+- Google Cloud: the metadata server;
+- Azure: the managed identity endpoint (App Service, Functions, Container Apps) or instance metadata (VMs);
+- Kubernetes: a projected token at `/var/run/secrets/tilldev/token`;
+- Fly.io: the Machines API;
+- AWS: credentials from the environment, an EKS service account role, ECS or EC2;
+- a server with no platform identity: its host key.
+
+Vercel and Deno Deploy hand out tokens only through their own libraries, so pass one in:
+
+```ts
+import { getVercelOidcToken } from '@vercel/oidc'
+import { createClient } from '@tillstack/secrets-node'
+
+const secrets = createClient({
+  identity: '3f1c…',
+  workload: { idToken: (audience) => getVercelOidcToken({ audience }) },
+})
+```
+
+It trades that proof for a token that lasts an hour by default, and renews it before it expires. `TILLSECRETS_ID_TOKEN` or `TILLSECRETS_ID_TOKEN_FILE` overrides where the token comes from. Create identities with `tilldev secrets identities create`. See https://tilldev.dev/docs/tillsecrets/workload-identity.
+
+## Broker
+
+Let an agent *use* a secret without ever seeing it. It sends `secretref://` handles, and the broker substitutes the real value only into the outgoing request:
+
+```ts
+import { createBroker, secretref } from '@tillstack/secrets-node'
+
+const broker = createBroker()
+const res = await broker.fetch('https://api.stripe.com/v1/charges', {
+  method: 'POST',
+  headers: { authorization: `Bearer ${secretref('shop', 'prod', 'STRIPE_KEY')}` },
+})
+```
+
+When running under the TillForge bridge, `createBroker()` picks up `TILLDEV_BROKER_URL` and `TILLDEV_BROKER_TOKEN`, so the secret is spent on your machine. Otherwise it goes through the cloud broker and needs `TILLDEV_TOKEN` and `TILLDEV_AGENT_KEY`. An agent should use its own [agent token](https://tilldev.dev/docs/tillsecrets/agents) instead: set `TILLDEV_AGENT_TOKEN` (a `ta_…` token) and leave `TILLDEV_AGENT_KEY` unset; the token names the agent.
+
+## Docs
+
+https://tilldev.dev/docs/tillsecrets/quickstart
+
+## License
+
+Apache-2.0

package/dist/index.d.mts

@@ -1,13 +1,21 @@
-import { SecretsClientOptions, BrokerClient, SecretsClient, PullResult } from '@tillstack/secrets-core';
+import { SecretsClientOptions, BrokerClient, SecretsClient, PullResult, WorkloadEnvironment } from '@tillstack/secrets-core';
 export * from '@tillstack/secrets-core';
 
-/** Create a client from options or the environment (`TILLSECRETS_TOKEN`,
- *  optional `TILLSECRETS_URL`, optional `TILLSECRETS_ENV`). */
+/** The host key file made by `tilldev secrets host-key init`. */
+declare const DEFAULT_HOST_KEY_FILE: string;
+/** `hostKey`, else `TILLSECRETS_HOST_KEY_FILE`, `TILLSECRETS_HOST_KEY`, then ~/.tilldev/host-key when it exists. */
+declare function resolveHostKey(opts?: Partial<SecretsClientOptions>, env?: NodeJS.ProcessEnv, defaultFile?: string): string | Uint8Array | undefined;
+/** Where a workload identity's proof comes from on Node: the environment, token files, the Fly Machines socket, and platform CLIs. */
+declare function nodeWorkload(env?: NodeJS.ProcessEnv): Omit<WorkloadEnvironment, 'fetch' | 'timeoutMs'>;
+/** Create a client from options or the environment (`TILLSECRETS_TOKEN` or `TILLSECRETS_IDENTITY`,
+ *  optional `TILLSECRETS_URL`, `TILLSECRETS_ENV`, and the host key as in `resolveHostKey`). */
 declare function createClient(opts?: Partial<SecretsClientOptions>): SecretsClient;
 interface LoadOptions extends Partial<SecretsClientOptions> {
     /** Overwrite keys already present in process.env (default false — existing
      *  wins, matching dotenv). */
     override?: boolean;
+    /** Inject what was returned even if restricted or sealed keys were withheld (default false — throw). */
+    allowPartial?: boolean;
 }
 /** Pull secrets and inject them into process.env. Returns the pulled map. */
 declare function load(opts?: LoadOptions): Promise<PullResult>;
@@ -19,10 +27,10 @@ interface CreateBrokerOptions {
     /** Cloud API base (derives the spend endpoint). Ignored in bridge mode.
      *  Defaults to `TILLDEV_URL` / `TILLSECRETS_URL` / `https://tilldev.dev`. */
     url?: string;
-    /** Bearer token — a session / `tp_` API key (cloud, `TILLDEV_TOKEN`) or the
-     *  bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */
+    /** Bearer token: an agent token (`ta_`, `TILLDEV_AGENT_TOKEN`), a session / `tp_` API key
+     *  (`TILLDEV_TOKEN`), or the bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */
     token?: string;
-    /** Stable agent identity. Required in cloud mode (or `TILLDEV_AGENT_KEY`). */
+    /** Stable agent identity. Required in cloud mode unless the token is a `ta_` agent token, which names itself. */
     agentKey?: string;
     /** Session id for session-scoped grants (or `TILLDEV_SESSION`). */
     sessionId?: string;
@@ -46,4 +54,4 @@ interface CreateBrokerOptions {
  */
 declare function createBroker(opts?: CreateBrokerOptions): BrokerClient;
 
-export { type CreateBrokerOptions, type LoadOptions, createBroker, createClient, load };
+export { type CreateBrokerOptions, DEFAULT_HOST_KEY_FILE, type LoadOptions, createBroker, createClient, load, nodeWorkload, resolveHostKey };

package/dist/index.d.ts

@@ -1,13 +1,21 @@
-import { SecretsClientOptions, BrokerClient, SecretsClient, PullResult } from '@tillstack/secrets-core';
+import { SecretsClientOptions, BrokerClient, SecretsClient, PullResult, WorkloadEnvironment } from '@tillstack/secrets-core';
 export * from '@tillstack/secrets-core';
 
-/** Create a client from options or the environment (`TILLSECRETS_TOKEN`,
- *  optional `TILLSECRETS_URL`, optional `TILLSECRETS_ENV`). */
+/** The host key file made by `tilldev secrets host-key init`. */
+declare const DEFAULT_HOST_KEY_FILE: string;
+/** `hostKey`, else `TILLSECRETS_HOST_KEY_FILE`, `TILLSECRETS_HOST_KEY`, then ~/.tilldev/host-key when it exists. */
+declare function resolveHostKey(opts?: Partial<SecretsClientOptions>, env?: NodeJS.ProcessEnv, defaultFile?: string): string | Uint8Array | undefined;
+/** Where a workload identity's proof comes from on Node: the environment, token files, the Fly Machines socket, and platform CLIs. */
+declare function nodeWorkload(env?: NodeJS.ProcessEnv): Omit<WorkloadEnvironment, 'fetch' | 'timeoutMs'>;
+/** Create a client from options or the environment (`TILLSECRETS_TOKEN` or `TILLSECRETS_IDENTITY`,
+ *  optional `TILLSECRETS_URL`, `TILLSECRETS_ENV`, and the host key as in `resolveHostKey`). */
 declare function createClient(opts?: Partial<SecretsClientOptions>): SecretsClient;
 interface LoadOptions extends Partial<SecretsClientOptions> {
     /** Overwrite keys already present in process.env (default false — existing
      *  wins, matching dotenv). */
     override?: boolean;
+    /** Inject what was returned even if restricted or sealed keys were withheld (default false — throw). */
+    allowPartial?: boolean;
 }
 /** Pull secrets and inject them into process.env. Returns the pulled map. */
 declare function load(opts?: LoadOptions): Promise<PullResult>;
@@ -19,10 +27,10 @@ interface CreateBrokerOptions {
     /** Cloud API base (derives the spend endpoint). Ignored in bridge mode.
      *  Defaults to `TILLDEV_URL` / `TILLSECRETS_URL` / `https://tilldev.dev`. */
     url?: string;
-    /** Bearer token — a session / `tp_` API key (cloud, `TILLDEV_TOKEN`) or the
-     *  bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */
+    /** Bearer token: an agent token (`ta_`, `TILLDEV_AGENT_TOKEN`), a session / `tp_` API key
+     *  (`TILLDEV_TOKEN`), or the bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */
     token?: string;
-    /** Stable agent identity. Required in cloud mode (or `TILLDEV_AGENT_KEY`). */
+    /** Stable agent identity. Required in cloud mode unless the token is a `ta_` agent token, which names itself. */
     agentKey?: string;
     /** Session id for session-scoped grants (or `TILLDEV_SESSION`). */
     sessionId?: string;
@@ -46,4 +54,4 @@ interface CreateBrokerOptions {
  */
 declare function createBroker(opts?: CreateBrokerOptions): BrokerClient;
 
-export { type CreateBrokerOptions, type LoadOptions, createBroker, createClient, load };
+export { type CreateBrokerOptions, DEFAULT_HOST_KEY_FILE, type LoadOptions, createBroker, createClient, load, nodeWorkload, resolveHostKey };

package/dist/index.js

@@ -1,23 +1,71 @@
 'use strict';
 
+var child_process = require('child_process');
+var fs = require('fs');
+var promises = require('fs/promises');
+var http = require('http');
+var os = require('os');
+var path = require('path');
 var secretsCore = require('@tillstack/secrets-core');
 
 // src/index.ts
+var DEFAULT_HOST_KEY_FILE = path.join(os.homedir(), ".tilldev", "host-key");
+function readHostKeyFile(file) {
+  if (process.platform !== "win32" && fs.statSync(file).mode & 63) {
+    throw new secretsCore.SecretsError(`TillSecrets: host key ${file} is readable by other users; run: chmod 600 ${file}`);
+  }
+  return fs.readFileSync(file, "utf8").trim();
+}
+function resolveHostKey(opts, env = process.env, defaultFile = DEFAULT_HOST_KEY_FILE) {
+  if (opts?.hostKey !== void 0 || opts?.seal === false) return opts?.hostKey;
+  if (env.TILLSECRETS_HOST_KEY_FILE) return readHostKeyFile(env.TILLSECRETS_HOST_KEY_FILE);
+  if (env.TILLSECRETS_HOST_KEY) return env.TILLSECRETS_HOST_KEY;
+  if (fs.existsSync(defaultFile)) return readHostKeyFile(defaultFile);
+  return void 0;
+}
+function unixPost(socket, path, body) {
+  return new Promise((ok, fail) => {
+    const req = http.request({ socketPath: socket, path, method: "POST", headers: { "content-type": "application/json" }, timeout: 3e3 }, (res) => {
+      let out = "";
+      res.setEncoding("utf8");
+      res.on("data", (d) => out += d);
+      res.on("end", () => (res.statusCode ?? 0) < 300 ? ok(out) : fail(new Error(`${res.statusCode}`)));
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", fail);
+    req.end(body);
+  });
+}
+function run(command, args) {
+  return new Promise((ok, fail) => child_process.execFile(command, args, { timeout: 1e4, maxBuffer: 64 * 1024 }, (e, out) => e ? fail(e) : ok(out)));
+}
+function nodeWorkload(env = process.env) {
+  return { env, readFile: (p) => promises.readFile(p, "utf8"), unixPost, run };
+}
 function createClient(opts) {
-  const token = opts?.token ?? process.env.TILLSECRETS_TOKEN;
-  if (!token) throw new Error("TillSecrets: no token \u2014 pass one or set TILLSECRETS_TOKEN");
-  const built = { token };
+  const identity = opts?.identity ?? (opts?.token ? void 0 : process.env.TILLSECRETS_IDENTITY || void 0);
+  const token = identity ? void 0 : opts?.token ?? process.env.TILLSECRETS_TOKEN;
+  if (!token && !identity) throw new Error("TillSecrets: no token \u2014 pass one or set TILLSECRETS_TOKEN (or TILLSECRETS_IDENTITY for a workload identity)");
+  const built = identity ? { ...opts, identity, workload: { ...nodeWorkload(), ...opts?.workload } } : { ...opts, token };
   const url = opts?.url ?? process.env.TILLSECRETS_URL;
   if (url) built.url = url;
+  const leaseUrl = opts?.leaseUrl ?? process.env.TILLSECRETS_LEASE_URL;
+  if (leaseUrl) built.leaseUrl = leaseUrl;
   const env = opts?.environmentId ?? process.env.TILLSECRETS_ENV;
   if (env) built.environmentId = env;
-  if (opts?.timeoutMs !== void 0) built.timeoutMs = opts.timeoutMs;
-  if (opts?.fetch) built.fetch = opts.fetch;
+  const hostKey = resolveHostKey(opts);
+  if (hostKey !== void 0) built.hostKey = hostKey;
   return new secretsCore.SecretsClient(built);
 }
 async function load(opts = {}) {
   const client = createClient(opts);
   const result = await client.pull();
+  if (result.withheld.length && !opts.allowPartial) {
+    throw new secretsCore.SecretsError(
+      `TillSecrets: withheld restricted or sealed key(s) ${result.withheld.join(", ")} \u2014 they need a token pinned to this environment (or pass allowPartial)`,
+      403
+    );
+  }
   for (const [k, v] of Object.entries(result.secrets)) {
     if (opts.override || process.env[k] === void 0) process.env[k] = v;
   }
@@ -43,17 +91,22 @@ function createBroker(opts = {}) {
     return new secretsCore.BrokerClient(built);
   }
   const base = (opts.url ?? process.env.TILLDEV_URL ?? process.env.TILLSECRETS_URL ?? "https://tilldev.dev").replace(/\/$/, "");
-  const token = opts.token ?? process.env.TILLDEV_TOKEN ?? process.env.TILLSECRETS_BROKER_TOKEN;
-  if (!token) throw new secretsCore.SecretsError("TillSecrets broker: no token \u2014 pass one or set TILLDEV_TOKEN");
-  if (!built.agentKey) throw new secretsCore.SecretsError("TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY)");
+  const token = opts.token || process.env.TILLDEV_AGENT_TOKEN || process.env.TILLDEV_TOKEN || process.env.TILLSECRETS_BROKER_TOKEN;
+  if (!token) throw new secretsCore.SecretsError("TillSecrets broker: no token \u2014 pass one or set TILLDEV_AGENT_TOKEN");
+  if (!built.agentKey && !token.startsWith("ta_")) {
+    throw new secretsCore.SecretsError("TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY), or a ta_ agent token");
+  }
   built.endpoint = `${base}/api/secrets/broker/spend`;
   built.token = token;
   return new secretsCore.BrokerClient(built);
 }
 
+exports.DEFAULT_HOST_KEY_FILE = DEFAULT_HOST_KEY_FILE;
 exports.createBroker = createBroker;
 exports.createClient = createClient;
 exports.load = load;
+exports.nodeWorkload = nodeWorkload;
+exports.resolveHostKey = resolveHostKey;
 Object.keys(secretsCore).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
     enumerable: true,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["SecretsClient","SecretsError","BrokerClient"],"mappings":";;;;;AAuBO,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,IAAS,OAAA,CAAQ,GAAA,CAAI,iBAAA;AACzC,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,gEAA2D,CAAA;AACvF,EAAA,MAAM,KAAA,GAA8B,EAAE,KAAA,EAAM;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,eAAA;AACrC,EAAA,IAAI,GAAA,QAAW,GAAA,GAAM,GAAA;AACrB,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,eAAA;AAC/C,EAAA,IAAI,GAAA,QAAW,aAAA,GAAgB,GAAA;AAC/B,EAAA,IAAI,IAAA,EAAM,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AAC1D,EAAA,IAAI,IAAA,EAAM,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACpC,EAAA,OAAO,IAAIA,0BAAc,KAAK,CAAA;AAChC;AASA,eAAsB,IAAA,CAAK,IAAA,GAAoB,EAAC,EAAwB;AACtE,EAAA,MAAM,MAAA,GAAS,aAAa,IAAI,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAG;AACnD,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAM,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,MAAA;AACT;AAoCO,SAAS,YAAA,CAAa,IAAA,GAA4B,EAAC,EAAiB;AACzE,EAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,kBAAA;AAC9B,EAAA,MAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,oBAAA;AAChC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,KAAS,QAAA,IAAa,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,CAAC,CAAC,SAAA,IAAa,CAAC,CAAC,WAAA;AAEvF,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,EAAA,EAAI,OAAO,EAAA,EAAG;AAC7D,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,iBAAA;AAC9C,EAAA,IAAI,QAAA,QAAgB,QAAA,GAAW,QAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,eAAA;AAChD,EAAA,IAAI,SAAA,QAAiB,SAAA,GAAY,SAAA;AAEjC,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AAC9B,MAAA,MAAM,IAAIC,yBAAa,iFAAiF,CAAA;AAAA,IAC1G;AACA,IAAA,KAAA,CAAM,WAAW,CAAA,EAAG,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,MAAA,CAAA;AAChD,IAAA,KAAA,CAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,WAAA;AAC5B,IAAA,OAAO,IAAIC,yBAAa,KAAK,CAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,IAAA,GAAA,CAAQ,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC5H,EAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,QAAQ,GAAA,CAAI,aAAA,IAAiB,QAAQ,GAAA,CAAI,wBAAA;AACrE,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAID,yBAAa,mEAA8D,CAAA;AACjG,EAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,MAAM,IAAIA,yBAAa,yEAAyE,CAAA;AACrH,EAAA,KAAA,CAAM,QAAA,GAAW,GAAG,IAAI,CAAA,yBAAA,CAAA;AACxB,EAAA,KAAA,CAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OAAO,IAAIC,yBAAa,KAAK,CAAA;AAC/B","file":"index.js","sourcesContent":["// @tillstack/secrets-node — TillSecrets client for Node.js.\n//\n//   import { load } from '@tillstack/secrets-node'\n//   await load()                       // reads TILLSECRETS_TOKEN, injects into process.env\n//   // ... process.env.STRIPE_KEY is now populated\n//\n// or explicitly:\n//   const client = createClient({ token })\n//   const { secrets } = await client.pull()\n\nimport {\n  SecretsClient,\n  SecretsError,\n  BrokerClient,\n  type SecretsClientOptions,\n  type PullResult,\n  type BrokerClientOptions,\n} from '@tillstack/secrets-core'\n\nexport * from '@tillstack/secrets-core'\n\n/** Create a client from options or the environment (`TILLSECRETS_TOKEN`,\n *  optional `TILLSECRETS_URL`, optional `TILLSECRETS_ENV`). */\nexport function createClient(opts?: Partial<SecretsClientOptions>): SecretsClient {\n  const token = opts?.token ?? process.env.TILLSECRETS_TOKEN\n  if (!token) throw new Error('TillSecrets: no token — pass one or set TILLSECRETS_TOKEN')\n  const built: SecretsClientOptions = { token }\n  const url = opts?.url ?? process.env.TILLSECRETS_URL\n  if (url) built.url = url\n  const env = opts?.environmentId ?? process.env.TILLSECRETS_ENV\n  if (env) built.environmentId = env\n  if (opts?.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n  if (opts?.fetch) built.fetch = opts.fetch\n  return new SecretsClient(built)\n}\n\nexport interface LoadOptions extends Partial<SecretsClientOptions> {\n  /** Overwrite keys already present in process.env (default false — existing\n   *  wins, matching dotenv). */\n  override?: boolean\n}\n\n/** Pull secrets and inject them into process.env. Returns the pulled map. */\nexport async function load(opts: LoadOptions = {}): Promise<PullResult> {\n  const client = createClient(opts)\n  const result = await client.pull()\n  for (const [k, v] of Object.entries(result.secrets)) {\n    if (opts.override || process.env[k] === undefined) process.env[k] = v\n  }\n  return result\n}\n\nexport interface CreateBrokerOptions {\n  /** Force a transport. Default `auto`: use the LOCAL bridge when the process runs\n   *  under the TillForge bridge daemon (`TILLDEV_BROKER_URL` set) — the strongest\n   *  posture, the value never leaves the machine — otherwise the cloud broker. */\n  mode?: 'auto' | 'bridge' | 'cloud'\n  /** Cloud API base (derives the spend endpoint). Ignored in bridge mode.\n   *  Defaults to `TILLDEV_URL` / `TILLSECRETS_URL` / `https://tilldev.dev`. */\n  url?: string\n  /** Bearer token — a session / `tp_` API key (cloud, `TILLDEV_TOKEN`) or the\n   *  bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */\n  token?: string\n  /** Stable agent identity. Required in cloud mode (or `TILLDEV_AGENT_KEY`). */\n  agentKey?: string\n  /** Session id for session-scoped grants (or `TILLDEV_SESSION`). */\n  sessionId?: string\n  timeoutMs?: number\n  fetch?: typeof fetch\n}\n\n/**\n * Create a secretless-broker client. In `auto` mode it prefers the local bridge\n * proxy (value spent on the user's machine) when the daemon has injected\n * `TILLDEV_BROKER_URL` + `TILLDEV_BROKER_TOKEN`, and otherwise talks to the cloud\n * broker with a session / `tp_` token + an agent identity.\n *\n *   import { createBroker, secretref } from '@tillstack/secrets-node'\n *   const broker = createBroker({ agentKey: 'my-job' })\n *   const res = await broker.fetch('https://api.stripe.com/v1/charges', {\n *     method: 'POST',\n *     headers: { authorization: `Bearer ${secretref('prod', 'live', 'STRIPE_KEY')}` },\n *     body,\n *   })\n *   // res.body is the scrubbed reply — the STRIPE_KEY never entered this process.\n */\nexport function createBroker(opts: CreateBrokerOptions = {}): BrokerClient {\n  const bridgeUrl = process.env.TILLDEV_BROKER_URL\n  const bridgeToken = process.env.TILLDEV_BROKER_TOKEN\n  const useBridge = opts.mode === 'bridge' || (opts.mode !== 'cloud' && !!bridgeUrl && !!bridgeToken)\n\n  const built: BrokerClientOptions = { endpoint: '', token: '' }\n  if (opts.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n  if (opts.fetch) built.fetch = opts.fetch\n  const agentKey = opts.agentKey ?? process.env.TILLDEV_AGENT_KEY\n  if (agentKey) built.agentKey = agentKey\n  const sessionId = opts.sessionId ?? process.env.TILLDEV_SESSION\n  if (sessionId) built.sessionId = sessionId\n\n  if (useBridge) {\n    if (!bridgeUrl || !bridgeToken) {\n      throw new SecretsError('TillSecrets broker: bridge mode needs TILLDEV_BROKER_URL + TILLDEV_BROKER_TOKEN')\n    }\n    built.endpoint = `${bridgeUrl.replace(/\\/$/, '')}/spend`\n    built.token = opts.token ?? bridgeToken\n    return new BrokerClient(built)\n  }\n\n  const base = (opts.url ?? process.env.TILLDEV_URL ?? process.env.TILLSECRETS_URL ?? 'https://tilldev.dev').replace(/\\/$/, '')\n  const token = opts.token ?? process.env.TILLDEV_TOKEN ?? process.env.TILLSECRETS_BROKER_TOKEN\n  if (!token) throw new SecretsError('TillSecrets broker: no token — pass one or set TILLDEV_TOKEN')\n  if (!built.agentKey) throw new SecretsError('TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY)')\n  built.endpoint = `${base}/api/secrets/broker/spend`\n  built.token = token\n  return new BrokerClient(built)\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["join","homedir","statSync","SecretsError","readFileSync","existsSync","request","execFile","readFile","SecretsClient","BrokerClient"],"mappings":";;;;;;;;;;;AAgCO,IAAM,qBAAA,GAAwBA,SAAA,CAAKC,UAAA,EAAQ,EAAG,YAAY,UAAU;AAE3E,SAAS,gBAAgB,IAAA,EAAsB;AAC7C,EAAA,IAAI,QAAQ,QAAA,KAAa,OAAA,IAAWC,YAAS,IAAI,CAAA,CAAE,OAAO,EAAA,EAAO;AAC/D,IAAA,MAAM,IAAIC,wBAAA,CAAa,CAAA,sBAAA,EAAyB,IAAI,CAAA,4CAAA,EAA+C,IAAI,CAAA,CAAE,CAAA;AAAA,EAC3G;AACA,EAAA,OAAOC,eAAA,CAAa,IAAA,EAAM,MAAM,CAAA,CAAE,IAAA,EAAK;AACzC;AAGO,SAAS,eAAe,IAAA,EAAsC,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAK,cAAc,qBAAA,EAAwD;AAC/K,EAAA,IAAI,MAAM,OAAA,KAAY,MAAA,IAAa,MAAM,IAAA,KAAS,KAAA,SAAc,IAAA,EAAM,OAAA;AACtE,EAAA,IAAI,GAAA,CAAI,yBAAA,EAA2B,OAAO,eAAA,CAAgB,IAAI,yBAAyB,CAAA;AACvF,EAAA,IAAI,GAAA,CAAI,oBAAA,EAAsB,OAAO,GAAA,CAAI,oBAAA;AACzC,EAAA,IAAIC,aAAA,CAAW,WAAW,CAAA,EAAG,OAAO,gBAAgB,WAAW,CAAA;AAC/D,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,QAAA,CAAS,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA+B;AAC7E,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,EAAA,EAAI,IAAA,KAAS;AAC/B,IAAA,MAAM,MAAMC,YAAA,CAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAM,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,EAAE,gBAAgB,kBAAA,EAAmB,EAAG,SAAS,GAAA,EAAK,EAAG,CAAC,GAAA,KAAQ;AACzI,MAAA,IAAI,GAAA,GAAM,EAAA;AACV,MAAA,GAAA,CAAI,YAAY,MAAM,CAAA;AACtB,MAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAe,OAAO,CAAE,CAAA;AACxC,MAAA,GAAA,CAAI,GAAG,KAAA,EAAO,MAAA,CAAQ,IAAI,UAAA,IAAc,CAAA,IAAK,MAAM,EAAA,CAAG,GAAG,CAAA,GAAI,IAAA,CAAK,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,UAAU,CAAA,CAAE,CAAC,CAAE,CAAA;AAAA,IACpG,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,WAAW,MAAM,GAAA,CAAI,QAAQ,IAAI,KAAA,CAAM,SAAS,CAAC,CAAC,CAAA;AACzD,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,IAAI,CAAA;AACpB,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EACd,CAAC,CAAA;AACH;AAEA,SAAS,GAAA,CAAI,SAAiB,IAAA,EAAiC;AAC7D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,EAAA,EAAI,IAAA,KAASC,uBAAS,OAAA,EAAS,IAAA,EAAM,EAAE,OAAA,EAAS,GAAA,EAAQ,SAAA,EAAW,KAAK,IAAA,EAAK,EAAG,CAAC,CAAA,EAAG,GAAA,KAAS,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA,GAAI,EAAA,CAAG,GAAG,CAAE,CAAC,CAAA;AAC1I;AAGO,SAAS,YAAA,CAAa,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAuD;AACnH,EAAA,OAAO,EAAE,GAAA,EAAK,QAAA,EAAU,CAAC,CAAA,KAAMC,kBAAS,CAAA,EAAG,MAAM,CAAA,EAAG,QAAA,EAAU,GAAA,EAAI;AACpE;AAIO,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,KAAa,IAAA,EAAM,QAAQ,MAAA,GAAY,OAAA,CAAQ,IAAI,oBAAA,IAAwB,MAAA,CAAA;AAClG,EAAA,MAAM,QAAQ,QAAA,GAAW,MAAA,GAAa,IAAA,EAAM,KAAA,IAAS,QAAQ,GAAA,CAAI,iBAAA;AACjE,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,UAAU,MAAM,IAAI,MAAM,kHAA6G,CAAA;AACtJ,EAAA,MAAM,QAA8B,QAAA,GAAW,EAAE,GAAG,IAAA,EAAM,QAAA,EAAU,UAAU,EAAE,GAAG,cAAa,EAAG,GAAG,MAAM,QAAA,EAAS,KAAM,EAAE,GAAG,MAAM,KAAA,EAAc;AACpJ,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,eAAA;AACrC,EAAA,IAAI,GAAA,QAAW,GAAA,GAAM,GAAA;AACrB,EAAA,MAAM,QAAA,GAAW,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAC/C,EAAA,IAAI,QAAA,QAAgB,QAAA,GAAW,QAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,eAAA;AAC/C,EAAA,IAAI,GAAA,QAAW,aAAA,GAAgB,GAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,KAAA,CAAM,OAAA,GAAU,OAAA;AAC3C,EAAA,OAAO,IAAIC,0BAAc,KAAK,CAAA;AAChC;AAWA,eAAsB,IAAA,CAAK,IAAA,GAAoB,EAAC,EAAwB;AACtE,EAAA,MAAM,MAAA,GAAS,aAAa,IAAI,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAA,IAAU,CAAC,KAAK,YAAA,EAAc;AAChD,IAAA,MAAM,IAAIN,wBAAA;AAAA,MACR,CAAA,kDAAA,EAAqD,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,2EAAA,CAAA;AAAA,MAC/E;AAAA,KACF;AAAA,EACF;AACA,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAG;AACnD,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAM,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,MAAA;AACT;AAoCO,SAAS,YAAA,CAAa,IAAA,GAA4B,EAAC,EAAiB;AACzE,EAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,kBAAA;AAC9B,EAAA,MAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,oBAAA;AAChC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,KAAS,QAAA,IAAa,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,CAAC,CAAC,SAAA,IAAa,CAAC,CAAC,WAAA;AAEvF,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,EAAA,EAAI,OAAO,EAAA,EAAG;AAC7D,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,iBAAA;AAC9C,EAAA,IAAI,QAAA,QAAgB,QAAA,GAAW,QAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,eAAA;AAChD,EAAA,IAAI,SAAA,QAAiB,SAAA,GAAY,SAAA;AAEjC,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AAC9B,MAAA,MAAM,IAAIA,yBAAa,iFAAiF,CAAA;AAAA,IAC1G;AACA,IAAA,KAAA,CAAM,WAAW,CAAA,EAAG,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,MAAA,CAAA;AAChD,IAAA,KAAA,CAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,WAAA;AAC5B,IAAA,OAAO,IAAIO,yBAAa,KAAK,CAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,IAAA,GAAA,CAAQ,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC5H,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,OAAA,CAAQ,GAAA,CAAI,uBAAuB,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,wBAAA;AACxG,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAIP,yBAAa,yEAAoE,CAAA;AACvG,EAAA,IAAI,CAAC,KAAA,CAAM,QAAA,IAAY,CAAC,KAAA,CAAM,UAAA,CAAW,KAAK,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAIA,yBAAa,+FAA+F,CAAA;AAAA,EACxH;AACA,EAAA,KAAA,CAAM,QAAA,GAAW,GAAG,IAAI,CAAA,yBAAA,CAAA;AACxB,EAAA,KAAA,CAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OAAO,IAAIO,yBAAa,KAAK,CAAA;AAC/B","file":"index.js","sourcesContent":["// @tillstack/secrets-node — TillSecrets client for Node.js.\n//\n//   import { load } from '@tillstack/secrets-node'\n//   await load()                       // reads TILLSECRETS_TOKEN, injects into process.env\n//   // ... process.env.STRIPE_KEY is now populated\n//\n// With a workload identity instead of a stored token (TILLSECRETS_IDENTITY):\n//   await load({ identity: '<identity id>' })\n//\n// or explicitly:\n//   const client = createClient({ token })\n//   const { secrets } = await client.pull()\n\nimport { execFile } from 'node:child_process'\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { readFile } from 'node:fs/promises'\nimport { request } from 'node:http'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport {\n  SecretsClient,\n  SecretsError,\n  BrokerClient,\n  type SecretsClientOptions,\n  type PullResult,\n  type BrokerClientOptions,\n  type WorkloadEnvironment,\n} from '@tillstack/secrets-core'\n\nexport * from '@tillstack/secrets-core'\n\n/** The host key file made by `tilldev secrets host-key init`. */\nexport const DEFAULT_HOST_KEY_FILE = join(homedir(), '.tilldev', 'host-key')\n\nfunction readHostKeyFile(file: string): string {\n  if (process.platform !== 'win32' && statSync(file).mode & 0o077) {\n    throw new SecretsError(`TillSecrets: host key ${file} is readable by other users; run: chmod 600 ${file}`)\n  }\n  return readFileSync(file, 'utf8').trim()\n}\n\n/** `hostKey`, else `TILLSECRETS_HOST_KEY_FILE`, `TILLSECRETS_HOST_KEY`, then ~/.tilldev/host-key when it exists. */\nexport function resolveHostKey(opts?: Partial<SecretsClientOptions>, env: NodeJS.ProcessEnv = process.env, defaultFile = DEFAULT_HOST_KEY_FILE): string | Uint8Array | undefined {\n  if (opts?.hostKey !== undefined || opts?.seal === false) return opts?.hostKey\n  if (env.TILLSECRETS_HOST_KEY_FILE) return readHostKeyFile(env.TILLSECRETS_HOST_KEY_FILE)\n  if (env.TILLSECRETS_HOST_KEY) return env.TILLSECRETS_HOST_KEY\n  if (existsSync(defaultFile)) return readHostKeyFile(defaultFile)\n  return undefined\n}\n\nfunction unixPost(socket: string, path: string, body: string): Promise<string> {\n  return new Promise((ok, fail) => {\n    const req = request({ socketPath: socket, path, method: 'POST', headers: { 'content-type': 'application/json' }, timeout: 3000 }, (res) => {\n      let out = ''\n      res.setEncoding('utf8')\n      res.on('data', (d: string) => (out += d))\n      res.on('end', () => ((res.statusCode ?? 0) < 300 ? ok(out) : fail(new Error(`${res.statusCode}`))))\n    })\n    req.on('timeout', () => req.destroy(new Error('timeout')))\n    req.on('error', fail)\n    req.end(body)\n  })\n}\n\nfunction run(command: string, args: string[]): Promise<string> {\n  return new Promise((ok, fail) => execFile(command, args, { timeout: 10_000, maxBuffer: 64 * 1024 }, (e, out) => (e ? fail(e) : ok(out))))\n}\n\n/** Where a workload identity's proof comes from on Node: the environment, token files, the Fly Machines socket, and platform CLIs. */\nexport function nodeWorkload(env: NodeJS.ProcessEnv = process.env): Omit<WorkloadEnvironment, 'fetch' | 'timeoutMs'> {\n  return { env, readFile: (p) => readFile(p, 'utf8'), unixPost, run }\n}\n\n/** Create a client from options or the environment (`TILLSECRETS_TOKEN` or `TILLSECRETS_IDENTITY`,\n *  optional `TILLSECRETS_URL`, `TILLSECRETS_ENV`, and the host key as in `resolveHostKey`). */\nexport function createClient(opts?: Partial<SecretsClientOptions>): SecretsClient {\n  const identity = opts?.identity ?? (opts?.token ? undefined : process.env.TILLSECRETS_IDENTITY || undefined)\n  const token = identity ? undefined : (opts?.token ?? process.env.TILLSECRETS_TOKEN)\n  if (!token && !identity) throw new Error('TillSecrets: no token — pass one or set TILLSECRETS_TOKEN (or TILLSECRETS_IDENTITY for a workload identity)')\n  const built: SecretsClientOptions = identity ? { ...opts, identity, workload: { ...nodeWorkload(), ...opts?.workload } } : { ...opts, token: token! }\n  const url = opts?.url ?? process.env.TILLSECRETS_URL\n  if (url) built.url = url\n  const leaseUrl = opts?.leaseUrl ?? process.env.TILLSECRETS_LEASE_URL\n  if (leaseUrl) built.leaseUrl = leaseUrl\n  const env = opts?.environmentId ?? process.env.TILLSECRETS_ENV\n  if (env) built.environmentId = env\n  const hostKey = resolveHostKey(opts)\n  if (hostKey !== undefined) built.hostKey = hostKey\n  return new SecretsClient(built)\n}\n\nexport interface LoadOptions extends Partial<SecretsClientOptions> {\n  /** Overwrite keys already present in process.env (default false — existing\n   *  wins, matching dotenv). */\n  override?: boolean\n  /** Inject what was returned even if restricted or sealed keys were withheld (default false — throw). */\n  allowPartial?: boolean\n}\n\n/** Pull secrets and inject them into process.env. Returns the pulled map. */\nexport async function load(opts: LoadOptions = {}): Promise<PullResult> {\n  const client = createClient(opts)\n  const result = await client.pull()\n  if (result.withheld.length && !opts.allowPartial) {\n    throw new SecretsError(\n      `TillSecrets: withheld restricted or sealed key(s) ${result.withheld.join(', ')} — they need a token pinned to this environment (or pass allowPartial)`,\n      403,\n    )\n  }\n  for (const [k, v] of Object.entries(result.secrets)) {\n    if (opts.override || process.env[k] === undefined) process.env[k] = v\n  }\n  return result\n}\n\nexport interface CreateBrokerOptions {\n  /** Force a transport. Default `auto`: use the LOCAL bridge when the process runs\n   *  under the TillForge bridge daemon (`TILLDEV_BROKER_URL` set) — the strongest\n   *  posture, the value never leaves the machine — otherwise the cloud broker. */\n  mode?: 'auto' | 'bridge' | 'cloud'\n  /** Cloud API base (derives the spend endpoint). Ignored in bridge mode.\n   *  Defaults to `TILLDEV_URL` / `TILLSECRETS_URL` / `https://tilldev.dev`. */\n  url?: string\n  /** Bearer token: an agent token (`ta_`, `TILLDEV_AGENT_TOKEN`), a session / `tp_` API key\n   *  (`TILLDEV_TOKEN`), or the bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */\n  token?: string\n  /** Stable agent identity. Required in cloud mode unless the token is a `ta_` agent token, which names itself. */\n  agentKey?: string\n  /** Session id for session-scoped grants (or `TILLDEV_SESSION`). */\n  sessionId?: string\n  timeoutMs?: number\n  fetch?: typeof fetch\n}\n\n/**\n * Create a secretless-broker client. In `auto` mode it prefers the local bridge\n * proxy (value spent on the user's machine) when the daemon has injected\n * `TILLDEV_BROKER_URL` + `TILLDEV_BROKER_TOKEN`, and otherwise talks to the cloud\n * broker with a session / `tp_` token + an agent identity.\n *\n *   import { createBroker, secretref } from '@tillstack/secrets-node'\n *   const broker = createBroker({ agentKey: 'my-job' })\n *   const res = await broker.fetch('https://api.stripe.com/v1/charges', {\n *     method: 'POST',\n *     headers: { authorization: `Bearer ${secretref('prod', 'live', 'STRIPE_KEY')}` },\n *     body,\n *   })\n *   // res.body is the scrubbed reply — the STRIPE_KEY never entered this process.\n */\nexport function createBroker(opts: CreateBrokerOptions = {}): BrokerClient {\n  const bridgeUrl = process.env.TILLDEV_BROKER_URL\n  const bridgeToken = process.env.TILLDEV_BROKER_TOKEN\n  const useBridge = opts.mode === 'bridge' || (opts.mode !== 'cloud' && !!bridgeUrl && !!bridgeToken)\n\n  const built: BrokerClientOptions = { endpoint: '', token: '' }\n  if (opts.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n  if (opts.fetch) built.fetch = opts.fetch\n  const agentKey = opts.agentKey ?? process.env.TILLDEV_AGENT_KEY\n  if (agentKey) built.agentKey = agentKey\n  const sessionId = opts.sessionId ?? process.env.TILLDEV_SESSION\n  if (sessionId) built.sessionId = sessionId\n\n  if (useBridge) {\n    if (!bridgeUrl || !bridgeToken) {\n      throw new SecretsError('TillSecrets broker: bridge mode needs TILLDEV_BROKER_URL + TILLDEV_BROKER_TOKEN')\n    }\n    built.endpoint = `${bridgeUrl.replace(/\\/$/, '')}/spend`\n    built.token = opts.token ?? bridgeToken\n    return new BrokerClient(built)\n  }\n\n  const base = (opts.url ?? process.env.TILLDEV_URL ?? process.env.TILLSECRETS_URL ?? 'https://tilldev.dev').replace(/\\/$/, '')\n  const token = opts.token || process.env.TILLDEV_AGENT_TOKEN || process.env.TILLDEV_TOKEN || process.env.TILLSECRETS_BROKER_TOKEN\n  if (!token) throw new SecretsError('TillSecrets broker: no token — pass one or set TILLDEV_AGENT_TOKEN')\n  if (!built.agentKey && !token.startsWith('ta_')) {\n    throw new SecretsError('TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY), or a ta_ agent token')\n  }\n  built.endpoint = `${base}/api/secrets/broker/spend`\n  built.token = token\n  return new BrokerClient(built)\n}\n"]}

package/dist/index.mjs

@@ -1,22 +1,70 @@
+import { execFile } from 'child_process';
+import { existsSync, statSync, readFileSync } from 'fs';
+import { readFile } from 'fs/promises';
+import { request } from 'http';
+import { homedir } from 'os';
+import { join } from 'path';
 import { SecretsClient, SecretsError, BrokerClient } from '@tillstack/secrets-core';
 export * from '@tillstack/secrets-core';
 
 // src/index.ts
+var DEFAULT_HOST_KEY_FILE = join(homedir(), ".tilldev", "host-key");
+function readHostKeyFile(file) {
+  if (process.platform !== "win32" && statSync(file).mode & 63) {
+    throw new SecretsError(`TillSecrets: host key ${file} is readable by other users; run: chmod 600 ${file}`);
+  }
+  return readFileSync(file, "utf8").trim();
+}
+function resolveHostKey(opts, env = process.env, defaultFile = DEFAULT_HOST_KEY_FILE) {
+  if (opts?.hostKey !== void 0 || opts?.seal === false) return opts?.hostKey;
+  if (env.TILLSECRETS_HOST_KEY_FILE) return readHostKeyFile(env.TILLSECRETS_HOST_KEY_FILE);
+  if (env.TILLSECRETS_HOST_KEY) return env.TILLSECRETS_HOST_KEY;
+  if (existsSync(defaultFile)) return readHostKeyFile(defaultFile);
+  return void 0;
+}
+function unixPost(socket, path, body) {
+  return new Promise((ok, fail) => {
+    const req = request({ socketPath: socket, path, method: "POST", headers: { "content-type": "application/json" }, timeout: 3e3 }, (res) => {
+      let out = "";
+      res.setEncoding("utf8");
+      res.on("data", (d) => out += d);
+      res.on("end", () => (res.statusCode ?? 0) < 300 ? ok(out) : fail(new Error(`${res.statusCode}`)));
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", fail);
+    req.end(body);
+  });
+}
+function run(command, args) {
+  return new Promise((ok, fail) => execFile(command, args, { timeout: 1e4, maxBuffer: 64 * 1024 }, (e, out) => e ? fail(e) : ok(out)));
+}
+function nodeWorkload(env = process.env) {
+  return { env, readFile: (p) => readFile(p, "utf8"), unixPost, run };
+}
 function createClient(opts) {
-  const token = opts?.token ?? process.env.TILLSECRETS_TOKEN;
-  if (!token) throw new Error("TillSecrets: no token \u2014 pass one or set TILLSECRETS_TOKEN");
-  const built = { token };
+  const identity = opts?.identity ?? (opts?.token ? void 0 : process.env.TILLSECRETS_IDENTITY || void 0);
+  const token = identity ? void 0 : opts?.token ?? process.env.TILLSECRETS_TOKEN;
+  if (!token && !identity) throw new Error("TillSecrets: no token \u2014 pass one or set TILLSECRETS_TOKEN (or TILLSECRETS_IDENTITY for a workload identity)");
+  const built = identity ? { ...opts, identity, workload: { ...nodeWorkload(), ...opts?.workload } } : { ...opts, token };
   const url = opts?.url ?? process.env.TILLSECRETS_URL;
   if (url) built.url = url;
+  const leaseUrl = opts?.leaseUrl ?? process.env.TILLSECRETS_LEASE_URL;
+  if (leaseUrl) built.leaseUrl = leaseUrl;
   const env = opts?.environmentId ?? process.env.TILLSECRETS_ENV;
   if (env) built.environmentId = env;
-  if (opts?.timeoutMs !== void 0) built.timeoutMs = opts.timeoutMs;
-  if (opts?.fetch) built.fetch = opts.fetch;
+  const hostKey = resolveHostKey(opts);
+  if (hostKey !== void 0) built.hostKey = hostKey;
   return new SecretsClient(built);
 }
 async function load(opts = {}) {
   const client = createClient(opts);
   const result = await client.pull();
+  if (result.withheld.length && !opts.allowPartial) {
+    throw new SecretsError(
+      `TillSecrets: withheld restricted or sealed key(s) ${result.withheld.join(", ")} \u2014 they need a token pinned to this environment (or pass allowPartial)`,
+      403
+    );
+  }
   for (const [k, v] of Object.entries(result.secrets)) {
     if (opts.override || process.env[k] === void 0) process.env[k] = v;
   }
@@ -42,14 +90,16 @@ function createBroker(opts = {}) {
     return new BrokerClient(built);
   }
   const base = (opts.url ?? process.env.TILLDEV_URL ?? process.env.TILLSECRETS_URL ?? "https://tilldev.dev").replace(/\/$/, "");
-  const token = opts.token ?? process.env.TILLDEV_TOKEN ?? process.env.TILLSECRETS_BROKER_TOKEN;
-  if (!token) throw new SecretsError("TillSecrets broker: no token \u2014 pass one or set TILLDEV_TOKEN");
-  if (!built.agentKey) throw new SecretsError("TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY)");
+  const token = opts.token || process.env.TILLDEV_AGENT_TOKEN || process.env.TILLDEV_TOKEN || process.env.TILLSECRETS_BROKER_TOKEN;
+  if (!token) throw new SecretsError("TillSecrets broker: no token \u2014 pass one or set TILLDEV_AGENT_TOKEN");
+  if (!built.agentKey && !token.startsWith("ta_")) {
+    throw new SecretsError("TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY), or a ta_ agent token");
+  }
   built.endpoint = `${base}/api/secrets/broker/spend`;
   built.token = token;
   return new BrokerClient(built);
 }
 
-export { createBroker, createClient, load };
+export { DEFAULT_HOST_KEY_FILE, createBroker, createClient, load, nodeWorkload, resolveHostKey };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAuBO,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,IAAS,OAAA,CAAQ,GAAA,CAAI,iBAAA;AACzC,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,gEAA2D,CAAA;AACvF,EAAA,MAAM,KAAA,GAA8B,EAAE,KAAA,EAAM;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,eAAA;AACrC,EAAA,IAAI,GAAA,QAAW,GAAA,GAAM,GAAA;AACrB,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,eAAA;AAC/C,EAAA,IAAI,GAAA,QAAW,aAAA,GAAgB,GAAA;AAC/B,EAAA,IAAI,IAAA,EAAM,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AAC1D,EAAA,IAAI,IAAA,EAAM,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACpC,EAAA,OAAO,IAAI,cAAc,KAAK,CAAA;AAChC;AASA,eAAsB,IAAA,CAAK,IAAA,GAAoB,EAAC,EAAwB;AACtE,EAAA,MAAM,MAAA,GAAS,aAAa,IAAI,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAG;AACnD,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAM,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,MAAA;AACT;AAoCO,SAAS,YAAA,CAAa,IAAA,GAA4B,EAAC,EAAiB;AACzE,EAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,kBAAA;AAC9B,EAAA,MAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,oBAAA;AAChC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,KAAS,QAAA,IAAa,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,CAAC,CAAC,SAAA,IAAa,CAAC,CAAC,WAAA;AAEvF,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,EAAA,EAAI,OAAO,EAAA,EAAG;AAC7D,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,iBAAA;AAC9C,EAAA,IAAI,QAAA,QAAgB,QAAA,GAAW,QAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,eAAA;AAChD,EAAA,IAAI,SAAA,QAAiB,SAAA,GAAY,SAAA;AAEjC,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AAC9B,MAAA,MAAM,IAAI,aAAa,iFAAiF,CAAA;AAAA,IAC1G;AACA,IAAA,KAAA,CAAM,WAAW,CAAA,EAAG,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,MAAA,CAAA;AAChD,IAAA,KAAA,CAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,WAAA;AAC5B,IAAA,OAAO,IAAI,aAAa,KAAK,CAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,IAAA,GAAA,CAAQ,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC5H,EAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,QAAQ,GAAA,CAAI,aAAA,IAAiB,QAAQ,GAAA,CAAI,wBAAA;AACrE,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,aAAa,mEAA8D,CAAA;AACjG,EAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,MAAM,IAAI,aAAa,yEAAyE,CAAA;AACrH,EAAA,KAAA,CAAM,QAAA,GAAW,GAAG,IAAI,CAAA,yBAAA,CAAA;AACxB,EAAA,KAAA,CAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OAAO,IAAI,aAAa,KAAK,CAAA;AAC/B","file":"index.mjs","sourcesContent":["// @tillstack/secrets-node — TillSecrets client for Node.js.\n//\n//   import { load } from '@tillstack/secrets-node'\n//   await load()                       // reads TILLSECRETS_TOKEN, injects into process.env\n//   // ... process.env.STRIPE_KEY is now populated\n//\n// or explicitly:\n//   const client = createClient({ token })\n//   const { secrets } = await client.pull()\n\nimport {\n  SecretsClient,\n  SecretsError,\n  BrokerClient,\n  type SecretsClientOptions,\n  type PullResult,\n  type BrokerClientOptions,\n} from '@tillstack/secrets-core'\n\nexport * from '@tillstack/secrets-core'\n\n/** Create a client from options or the environment (`TILLSECRETS_TOKEN`,\n *  optional `TILLSECRETS_URL`, optional `TILLSECRETS_ENV`). */\nexport function createClient(opts?: Partial<SecretsClientOptions>): SecretsClient {\n  const token = opts?.token ?? process.env.TILLSECRETS_TOKEN\n  if (!token) throw new Error('TillSecrets: no token — pass one or set TILLSECRETS_TOKEN')\n  const built: SecretsClientOptions = { token }\n  const url = opts?.url ?? process.env.TILLSECRETS_URL\n  if (url) built.url = url\n  const env = opts?.environmentId ?? process.env.TILLSECRETS_ENV\n  if (env) built.environmentId = env\n  if (opts?.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n  if (opts?.fetch) built.fetch = opts.fetch\n  return new SecretsClient(built)\n}\n\nexport interface LoadOptions extends Partial<SecretsClientOptions> {\n  /** Overwrite keys already present in process.env (default false — existing\n   *  wins, matching dotenv). */\n  override?: boolean\n}\n\n/** Pull secrets and inject them into process.env. Returns the pulled map. */\nexport async function load(opts: LoadOptions = {}): Promise<PullResult> {\n  const client = createClient(opts)\n  const result = await client.pull()\n  for (const [k, v] of Object.entries(result.secrets)) {\n    if (opts.override || process.env[k] === undefined) process.env[k] = v\n  }\n  return result\n}\n\nexport interface CreateBrokerOptions {\n  /** Force a transport. Default `auto`: use the LOCAL bridge when the process runs\n   *  under the TillForge bridge daemon (`TILLDEV_BROKER_URL` set) — the strongest\n   *  posture, the value never leaves the machine — otherwise the cloud broker. */\n  mode?: 'auto' | 'bridge' | 'cloud'\n  /** Cloud API base (derives the spend endpoint). Ignored in bridge mode.\n   *  Defaults to `TILLDEV_URL` / `TILLSECRETS_URL` / `https://tilldev.dev`. */\n  url?: string\n  /** Bearer token — a session / `tp_` API key (cloud, `TILLDEV_TOKEN`) or the\n   *  bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */\n  token?: string\n  /** Stable agent identity. Required in cloud mode (or `TILLDEV_AGENT_KEY`). */\n  agentKey?: string\n  /** Session id for session-scoped grants (or `TILLDEV_SESSION`). */\n  sessionId?: string\n  timeoutMs?: number\n  fetch?: typeof fetch\n}\n\n/**\n * Create a secretless-broker client. In `auto` mode it prefers the local bridge\n * proxy (value spent on the user's machine) when the daemon has injected\n * `TILLDEV_BROKER_URL` + `TILLDEV_BROKER_TOKEN`, and otherwise talks to the cloud\n * broker with a session / `tp_` token + an agent identity.\n *\n *   import { createBroker, secretref } from '@tillstack/secrets-node'\n *   const broker = createBroker({ agentKey: 'my-job' })\n *   const res = await broker.fetch('https://api.stripe.com/v1/charges', {\n *     method: 'POST',\n *     headers: { authorization: `Bearer ${secretref('prod', 'live', 'STRIPE_KEY')}` },\n *     body,\n *   })\n *   // res.body is the scrubbed reply — the STRIPE_KEY never entered this process.\n */\nexport function createBroker(opts: CreateBrokerOptions = {}): BrokerClient {\n  const bridgeUrl = process.env.TILLDEV_BROKER_URL\n  const bridgeToken = process.env.TILLDEV_BROKER_TOKEN\n  const useBridge = opts.mode === 'bridge' || (opts.mode !== 'cloud' && !!bridgeUrl && !!bridgeToken)\n\n  const built: BrokerClientOptions = { endpoint: '', token: '' }\n  if (opts.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n  if (opts.fetch) built.fetch = opts.fetch\n  const agentKey = opts.agentKey ?? process.env.TILLDEV_AGENT_KEY\n  if (agentKey) built.agentKey = agentKey\n  const sessionId = opts.sessionId ?? process.env.TILLDEV_SESSION\n  if (sessionId) built.sessionId = sessionId\n\n  if (useBridge) {\n    if (!bridgeUrl || !bridgeToken) {\n      throw new SecretsError('TillSecrets broker: bridge mode needs TILLDEV_BROKER_URL + TILLDEV_BROKER_TOKEN')\n    }\n    built.endpoint = `${bridgeUrl.replace(/\\/$/, '')}/spend`\n    built.token = opts.token ?? bridgeToken\n    return new BrokerClient(built)\n  }\n\n  const base = (opts.url ?? process.env.TILLDEV_URL ?? process.env.TILLSECRETS_URL ?? 'https://tilldev.dev').replace(/\\/$/, '')\n  const token = opts.token ?? process.env.TILLDEV_TOKEN ?? process.env.TILLSECRETS_BROKER_TOKEN\n  if (!token) throw new SecretsError('TillSecrets broker: no token — pass one or set TILLDEV_TOKEN')\n  if (!built.agentKey) throw new SecretsError('TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY)')\n  built.endpoint = `${base}/api/secrets/broker/spend`\n  built.token = token\n  return new BrokerClient(built)\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;AAgCO,IAAM,qBAAA,GAAwB,IAAA,CAAK,OAAA,EAAQ,EAAG,YAAY,UAAU;AAE3E,SAAS,gBAAgB,IAAA,EAAsB;AAC7C,EAAA,IAAI,QAAQ,QAAA,KAAa,OAAA,IAAW,SAAS,IAAI,CAAA,CAAE,OAAO,EAAA,EAAO;AAC/D,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,sBAAA,EAAyB,IAAI,CAAA,4CAAA,EAA+C,IAAI,CAAA,CAAE,CAAA;AAAA,EAC3G;AACA,EAAA,OAAO,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA,CAAE,IAAA,EAAK;AACzC;AAGO,SAAS,eAAe,IAAA,EAAsC,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAK,cAAc,qBAAA,EAAwD;AAC/K,EAAA,IAAI,MAAM,OAAA,KAAY,MAAA,IAAa,MAAM,IAAA,KAAS,KAAA,SAAc,IAAA,EAAM,OAAA;AACtE,EAAA,IAAI,GAAA,CAAI,yBAAA,EAA2B,OAAO,eAAA,CAAgB,IAAI,yBAAyB,CAAA;AACvF,EAAA,IAAI,GAAA,CAAI,oBAAA,EAAsB,OAAO,GAAA,CAAI,oBAAA;AACzC,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG,OAAO,gBAAgB,WAAW,CAAA;AAC/D,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,QAAA,CAAS,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA+B;AAC7E,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,EAAA,EAAI,IAAA,KAAS;AAC/B,IAAA,MAAM,MAAM,OAAA,CAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAM,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,EAAE,gBAAgB,kBAAA,EAAmB,EAAG,SAAS,GAAA,EAAK,EAAG,CAAC,GAAA,KAAQ;AACzI,MAAA,IAAI,GAAA,GAAM,EAAA;AACV,MAAA,GAAA,CAAI,YAAY,MAAM,CAAA;AACtB,MAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAe,OAAO,CAAE,CAAA;AACxC,MAAA,GAAA,CAAI,GAAG,KAAA,EAAO,MAAA,CAAQ,IAAI,UAAA,IAAc,CAAA,IAAK,MAAM,EAAA,CAAG,GAAG,CAAA,GAAI,IAAA,CAAK,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,UAAU,CAAA,CAAE,CAAC,CAAE,CAAA;AAAA,IACpG,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,WAAW,MAAM,GAAA,CAAI,QAAQ,IAAI,KAAA,CAAM,SAAS,CAAC,CAAC,CAAA;AACzD,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,IAAI,CAAA;AACpB,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EACd,CAAC,CAAA;AACH;AAEA,SAAS,GAAA,CAAI,SAAiB,IAAA,EAAiC;AAC7D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,EAAA,EAAI,IAAA,KAAS,SAAS,OAAA,EAAS,IAAA,EAAM,EAAE,OAAA,EAAS,GAAA,EAAQ,SAAA,EAAW,KAAK,IAAA,EAAK,EAAG,CAAC,CAAA,EAAG,GAAA,KAAS,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA,GAAI,EAAA,CAAG,GAAG,CAAE,CAAC,CAAA;AAC1I;AAGO,SAAS,YAAA,CAAa,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAuD;AACnH,EAAA,OAAO,EAAE,GAAA,EAAK,QAAA,EAAU,CAAC,CAAA,KAAM,SAAS,CAAA,EAAG,MAAM,CAAA,EAAG,QAAA,EAAU,GAAA,EAAI;AACpE;AAIO,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,KAAa,IAAA,EAAM,QAAQ,MAAA,GAAY,OAAA,CAAQ,IAAI,oBAAA,IAAwB,MAAA,CAAA;AAClG,EAAA,MAAM,QAAQ,QAAA,GAAW,MAAA,GAAa,IAAA,EAAM,KAAA,IAAS,QAAQ,GAAA,CAAI,iBAAA;AACjE,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,UAAU,MAAM,IAAI,MAAM,kHAA6G,CAAA;AACtJ,EAAA,MAAM,QAA8B,QAAA,GAAW,EAAE,GAAG,IAAA,EAAM,QAAA,EAAU,UAAU,EAAE,GAAG,cAAa,EAAG,GAAG,MAAM,QAAA,EAAS,KAAM,EAAE,GAAG,MAAM,KAAA,EAAc;AACpJ,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,eAAA;AACrC,EAAA,IAAI,GAAA,QAAW,GAAA,GAAM,GAAA;AACrB,EAAA,MAAM,QAAA,GAAW,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAC/C,EAAA,IAAI,QAAA,QAAgB,QAAA,GAAW,QAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,eAAA;AAC/C,EAAA,IAAI,GAAA,QAAW,aAAA,GAAgB,GAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,KAAA,CAAM,OAAA,GAAU,OAAA;AAC3C,EAAA,OAAO,IAAI,cAAc,KAAK,CAAA;AAChC;AAWA,eAAsB,IAAA,CAAK,IAAA,GAAoB,EAAC,EAAwB;AACtE,EAAA,MAAM,MAAA,GAAS,aAAa,IAAI,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAA,IAAU,CAAC,KAAK,YAAA,EAAc;AAChD,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,kDAAA,EAAqD,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,2EAAA,CAAA;AAAA,MAC/E;AAAA,KACF;AAAA,EACF;AACA,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAG;AACnD,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAM,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,MAAA;AACT;AAoCO,SAAS,YAAA,CAAa,IAAA,GAA4B,EAAC,EAAiB;AACzE,EAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,kBAAA;AAC9B,EAAA,MAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,oBAAA;AAChC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,KAAS,QAAA,IAAa,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,CAAC,CAAC,SAAA,IAAa,CAAC,CAAC,WAAA;AAEvF,EAAA,MAAM,KAAA,GAA6B,EAAE,QAAA,EAAU,EAAA,EAAI,OAAO,EAAA,EAAG;AAC7D,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,IAAA,CAAK,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,iBAAA;AAC9C,EAAA,IAAI,QAAA,QAAgB,QAAA,GAAW,QAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,eAAA;AAChD,EAAA,IAAI,SAAA,QAAiB,SAAA,GAAY,SAAA;AAEjC,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AAC9B,MAAA,MAAM,IAAI,aAAa,iFAAiF,CAAA;AAAA,IAC1G;AACA,IAAA,KAAA,CAAM,WAAW,CAAA,EAAG,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,MAAA,CAAA;AAChD,IAAA,KAAA,CAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,WAAA;AAC5B,IAAA,OAAO,IAAI,aAAa,KAAK,CAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,IAAA,GAAA,CAAQ,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,qBAAA,EAAuB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC5H,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,OAAA,CAAQ,GAAA,CAAI,uBAAuB,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,wBAAA;AACxG,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,aAAa,yEAAoE,CAAA;AACvG,EAAA,IAAI,CAAC,KAAA,CAAM,QAAA,IAAY,CAAC,KAAA,CAAM,UAAA,CAAW,KAAK,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,aAAa,+FAA+F,CAAA;AAAA,EACxH;AACA,EAAA,KAAA,CAAM,QAAA,GAAW,GAAG,IAAI,CAAA,yBAAA,CAAA;AACxB,EAAA,KAAA,CAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OAAO,IAAI,aAAa,KAAK,CAAA;AAC/B","file":"index.mjs","sourcesContent":["// @tillstack/secrets-node — TillSecrets client for Node.js.\n//\n//   import { load } from '@tillstack/secrets-node'\n//   await load()                       // reads TILLSECRETS_TOKEN, injects into process.env\n//   // ... process.env.STRIPE_KEY is now populated\n//\n// With a workload identity instead of a stored token (TILLSECRETS_IDENTITY):\n//   await load({ identity: '<identity id>' })\n//\n// or explicitly:\n//   const client = createClient({ token })\n//   const { secrets } = await client.pull()\n\nimport { execFile } from 'node:child_process'\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { readFile } from 'node:fs/promises'\nimport { request } from 'node:http'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport {\n  SecretsClient,\n  SecretsError,\n  BrokerClient,\n  type SecretsClientOptions,\n  type PullResult,\n  type BrokerClientOptions,\n  type WorkloadEnvironment,\n} from '@tillstack/secrets-core'\n\nexport * from '@tillstack/secrets-core'\n\n/** The host key file made by `tilldev secrets host-key init`. */\nexport const DEFAULT_HOST_KEY_FILE = join(homedir(), '.tilldev', 'host-key')\n\nfunction readHostKeyFile(file: string): string {\n  if (process.platform !== 'win32' && statSync(file).mode & 0o077) {\n    throw new SecretsError(`TillSecrets: host key ${file} is readable by other users; run: chmod 600 ${file}`)\n  }\n  return readFileSync(file, 'utf8').trim()\n}\n\n/** `hostKey`, else `TILLSECRETS_HOST_KEY_FILE`, `TILLSECRETS_HOST_KEY`, then ~/.tilldev/host-key when it exists. */\nexport function resolveHostKey(opts?: Partial<SecretsClientOptions>, env: NodeJS.ProcessEnv = process.env, defaultFile = DEFAULT_HOST_KEY_FILE): string | Uint8Array | undefined {\n  if (opts?.hostKey !== undefined || opts?.seal === false) return opts?.hostKey\n  if (env.TILLSECRETS_HOST_KEY_FILE) return readHostKeyFile(env.TILLSECRETS_HOST_KEY_FILE)\n  if (env.TILLSECRETS_HOST_KEY) return env.TILLSECRETS_HOST_KEY\n  if (existsSync(defaultFile)) return readHostKeyFile(defaultFile)\n  return undefined\n}\n\nfunction unixPost(socket: string, path: string, body: string): Promise<string> {\n  return new Promise((ok, fail) => {\n    const req = request({ socketPath: socket, path, method: 'POST', headers: { 'content-type': 'application/json' }, timeout: 3000 }, (res) => {\n      let out = ''\n      res.setEncoding('utf8')\n      res.on('data', (d: string) => (out += d))\n      res.on('end', () => ((res.statusCode ?? 0) < 300 ? ok(out) : fail(new Error(`${res.statusCode}`))))\n    })\n    req.on('timeout', () => req.destroy(new Error('timeout')))\n    req.on('error', fail)\n    req.end(body)\n  })\n}\n\nfunction run(command: string, args: string[]): Promise<string> {\n  return new Promise((ok, fail) => execFile(command, args, { timeout: 10_000, maxBuffer: 64 * 1024 }, (e, out) => (e ? fail(e) : ok(out))))\n}\n\n/** Where a workload identity's proof comes from on Node: the environment, token files, the Fly Machines socket, and platform CLIs. */\nexport function nodeWorkload(env: NodeJS.ProcessEnv = process.env): Omit<WorkloadEnvironment, 'fetch' | 'timeoutMs'> {\n  return { env, readFile: (p) => readFile(p, 'utf8'), unixPost, run }\n}\n\n/** Create a client from options or the environment (`TILLSECRETS_TOKEN` or `TILLSECRETS_IDENTITY`,\n *  optional `TILLSECRETS_URL`, `TILLSECRETS_ENV`, and the host key as in `resolveHostKey`). */\nexport function createClient(opts?: Partial<SecretsClientOptions>): SecretsClient {\n  const identity = opts?.identity ?? (opts?.token ? undefined : process.env.TILLSECRETS_IDENTITY || undefined)\n  const token = identity ? undefined : (opts?.token ?? process.env.TILLSECRETS_TOKEN)\n  if (!token && !identity) throw new Error('TillSecrets: no token — pass one or set TILLSECRETS_TOKEN (or TILLSECRETS_IDENTITY for a workload identity)')\n  const built: SecretsClientOptions = identity ? { ...opts, identity, workload: { ...nodeWorkload(), ...opts?.workload } } : { ...opts, token: token! }\n  const url = opts?.url ?? process.env.TILLSECRETS_URL\n  if (url) built.url = url\n  const leaseUrl = opts?.leaseUrl ?? process.env.TILLSECRETS_LEASE_URL\n  if (leaseUrl) built.leaseUrl = leaseUrl\n  const env = opts?.environmentId ?? process.env.TILLSECRETS_ENV\n  if (env) built.environmentId = env\n  const hostKey = resolveHostKey(opts)\n  if (hostKey !== undefined) built.hostKey = hostKey\n  return new SecretsClient(built)\n}\n\nexport interface LoadOptions extends Partial<SecretsClientOptions> {\n  /** Overwrite keys already present in process.env (default false — existing\n   *  wins, matching dotenv). */\n  override?: boolean\n  /** Inject what was returned even if restricted or sealed keys were withheld (default false — throw). */\n  allowPartial?: boolean\n}\n\n/** Pull secrets and inject them into process.env. Returns the pulled map. */\nexport async function load(opts: LoadOptions = {}): Promise<PullResult> {\n  const client = createClient(opts)\n  const result = await client.pull()\n  if (result.withheld.length && !opts.allowPartial) {\n    throw new SecretsError(\n      `TillSecrets: withheld restricted or sealed key(s) ${result.withheld.join(', ')} — they need a token pinned to this environment (or pass allowPartial)`,\n      403,\n    )\n  }\n  for (const [k, v] of Object.entries(result.secrets)) {\n    if (opts.override || process.env[k] === undefined) process.env[k] = v\n  }\n  return result\n}\n\nexport interface CreateBrokerOptions {\n  /** Force a transport. Default `auto`: use the LOCAL bridge when the process runs\n   *  under the TillForge bridge daemon (`TILLDEV_BROKER_URL` set) — the strongest\n   *  posture, the value never leaves the machine — otherwise the cloud broker. */\n  mode?: 'auto' | 'bridge' | 'cloud'\n  /** Cloud API base (derives the spend endpoint). Ignored in bridge mode.\n   *  Defaults to `TILLDEV_URL` / `TILLSECRETS_URL` / `https://tilldev.dev`. */\n  url?: string\n  /** Bearer token: an agent token (`ta_`, `TILLDEV_AGENT_TOKEN`), a session / `tp_` API key\n   *  (`TILLDEV_TOKEN`), or the bridge run token (`TILLDEV_BROKER_TOKEN`, injected by the daemon). */\n  token?: string\n  /** Stable agent identity. Required in cloud mode unless the token is a `ta_` agent token, which names itself. */\n  agentKey?: string\n  /** Session id for session-scoped grants (or `TILLDEV_SESSION`). */\n  sessionId?: string\n  timeoutMs?: number\n  fetch?: typeof fetch\n}\n\n/**\n * Create a secretless-broker client. In `auto` mode it prefers the local bridge\n * proxy (value spent on the user's machine) when the daemon has injected\n * `TILLDEV_BROKER_URL` + `TILLDEV_BROKER_TOKEN`, and otherwise talks to the cloud\n * broker with a session / `tp_` token + an agent identity.\n *\n *   import { createBroker, secretref } from '@tillstack/secrets-node'\n *   const broker = createBroker({ agentKey: 'my-job' })\n *   const res = await broker.fetch('https://api.stripe.com/v1/charges', {\n *     method: 'POST',\n *     headers: { authorization: `Bearer ${secretref('prod', 'live', 'STRIPE_KEY')}` },\n *     body,\n *   })\n *   // res.body is the scrubbed reply — the STRIPE_KEY never entered this process.\n */\nexport function createBroker(opts: CreateBrokerOptions = {}): BrokerClient {\n  const bridgeUrl = process.env.TILLDEV_BROKER_URL\n  const bridgeToken = process.env.TILLDEV_BROKER_TOKEN\n  const useBridge = opts.mode === 'bridge' || (opts.mode !== 'cloud' && !!bridgeUrl && !!bridgeToken)\n\n  const built: BrokerClientOptions = { endpoint: '', token: '' }\n  if (opts.timeoutMs !== undefined) built.timeoutMs = opts.timeoutMs\n  if (opts.fetch) built.fetch = opts.fetch\n  const agentKey = opts.agentKey ?? process.env.TILLDEV_AGENT_KEY\n  if (agentKey) built.agentKey = agentKey\n  const sessionId = opts.sessionId ?? process.env.TILLDEV_SESSION\n  if (sessionId) built.sessionId = sessionId\n\n  if (useBridge) {\n    if (!bridgeUrl || !bridgeToken) {\n      throw new SecretsError('TillSecrets broker: bridge mode needs TILLDEV_BROKER_URL + TILLDEV_BROKER_TOKEN')\n    }\n    built.endpoint = `${bridgeUrl.replace(/\\/$/, '')}/spend`\n    built.token = opts.token ?? bridgeToken\n    return new BrokerClient(built)\n  }\n\n  const base = (opts.url ?? process.env.TILLDEV_URL ?? process.env.TILLSECRETS_URL ?? 'https://tilldev.dev').replace(/\\/$/, '')\n  const token = opts.token || process.env.TILLDEV_AGENT_TOKEN || process.env.TILLDEV_TOKEN || process.env.TILLSECRETS_BROKER_TOKEN\n  if (!token) throw new SecretsError('TillSecrets broker: no token — pass one or set TILLDEV_AGENT_TOKEN')\n  if (!built.agentKey && !token.startsWith('ta_')) {\n    throw new SecretsError('TillSecrets broker: cloud mode needs an agentKey (or TILLDEV_AGENT_KEY), or a ta_ agent token')\n  }\n  built.endpoint = `${base}/api/secrets/broker/spend`\n  built.token = token\n  return new BrokerClient(built)\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tillstack/secrets-node",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "TillSecrets client for Node.js — pull encrypted config at boot and inject it into process.env, with a drop-in dotenv-style API.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -24,7 +24,7 @@
     "dist"
   ],
   "dependencies": {
-    "@tillstack/secrets-core": "^0.3.0"
+    "@tillstack/secrets-core": "^0.4.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -57,6 +57,7 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "test": "tsup && node --test test/*.test.mjs"
   }
 }