learn-secrets-sdk 1.0.0 → 1.3.0

package/README.md

@@ -0,0 +1,206 @@
+# learn-secrets-sdk
+
+secure api proxy sdk for static sites. call external apis (openai, anthropic, stripe, etc.) without exposing api keys.
+
+## quick start
+
+### 1. setup in dashboard
+
+* login at [learn.pages.dev](https://learn.pages.dev)
+* add api key in secrets → api_keys
+* create sdk token in settings → sdk tokens
+* configure allowed origins (e.g., `example.com`, `*.example.com`)
+* copy app id from sidebar
+
+### 2. install
+
+```bash
+npm install learn-secrets-sdk
+```
+
+### 3. use in your app
+
+```typescript
+import { SecretsSDK } from 'learn-secrets-sdk';
+
+const sdk = new SecretsSDK({
+  appId: 'your-app-id',
+  token: 'sk_live_...'
+});
+
+// call openai
+const response = await sdk.post('my-openai-key', '/v1/chat/completions', {
+  model: 'gpt-4',
+  messages: [{ role: 'user', content: 'hello' }]
+});
+```
+
+## features
+
+* **domain-scoped tokens** - tokens only work from configured origins
+* **zero api key exposure** - keys stay server-side, never sent to client
+* **works anywhere** - cloudflare pages, netlify, vercel, any static host
+* **rate limiting** - 100 req/min per domain built-in
+* **typescript support** - full type definitions included
+
+## api methods
+
+```typescript
+// http methods
+await sdk.get(keyName, endpoint, headers?)
+await sdk.post(keyName, endpoint, body, headers?)
+await sdk.put(keyName, endpoint, body, headers?)
+await sdk.delete(keyName, endpoint, headers?)
+await sdk.patch(keyName, endpoint, body, headers?)
+
+// custom request
+await sdk.call(keyName, endpoint, {
+  method: 'POST',
+  body: { },
+  headers: { }
+})
+```
+
+## constructor options
+
+```typescript
+new SecretsSDK({
+  appId: string,              // required - from dashboard
+  token: string,              // required - from settings → sdk tokens
+  baseUrl?: string,           // optional - defaults to https://learn.pages.dev
+  timeout?: number,           // optional - request timeout in ms (default: 30000)
+  retryOn429?: boolean        // optional - auto-retry on rate limit (default: true)
+})
+```
+
+## error handling
+
+```typescript
+import { SecretsSDK, SecretsSDKError, OriginMismatchError, RateLimitError } from 'learn-secrets-sdk';
+
+try {
+  const response = await sdk.post('key', '/endpoint', data);
+} catch (error) {
+  if (error instanceof OriginMismatchError) {
+    // domain not in allowed origins
+  } else if (error instanceof RateLimitError) {
+    // exceeded 100 req/min
+    console.log('retry after:', error.retryAfter);
+  } else if (error instanceof SecretsSDKError) {
+    // other api errors
+    console.log('status:', error.status);
+  }
+}
+```
+
+## usage tracking
+
+```typescript
+const sdk = new SecretsSDK({ appId, token });
+
+await sdk.post('key', '/endpoint', data);
+
+// check rate limit status
+const usage = sdk.getUsage();
+console.log('remaining:', usage.remaining);  // requests left this minute
+console.log('resets at:', usage.reset);      // unix timestamp
+```
+
+## examples
+
+### vanilla html
+
+```html
+<script type="module">
+  import { SecretsSDK } from 'https://unpkg.com/learn-secrets-sdk';
+
+  const sdk = new SecretsSDK({
+    appId: 'abc123',
+    token: 'sk_live_...'
+  });
+
+  const result = await sdk.post('my-openai-key', '/v1/chat/completions', {
+    model: 'gpt-4',
+    messages: [{ role: 'user', content: 'hello' }]
+  });
+</script>
+```
+
+### react
+
+```typescript
+import { useMemo } from 'react';
+import { SecretsSDK } from 'learn-secrets-sdk';
+
+function App() {
+  const sdk = useMemo(() => new SecretsSDK({
+    appId: import.meta.env.VITE_APP_ID,
+    token: import.meta.env.VITE_SDK_TOKEN
+  }), []);
+
+  const handleClick = async () => {
+    const result = await sdk.post('my-openai-key', '/v1/chat/completions', {
+      model: 'gpt-4',
+      messages: [{ role: 'user', content: 'hello' }]
+    });
+  };
+}
+```
+
+### vue
+
+```typescript
+import { ref } from 'vue';
+import { SecretsSDK } from 'learn-secrets-sdk';
+
+const sdk = new SecretsSDK({
+  appId: import.meta.env.VITE_APP_ID,
+  token: import.meta.env.VITE_SDK_TOKEN
+});
+
+const response = ref('');
+
+async function callAPI() {
+  const result = await sdk.post('my-openai-key', '/v1/chat/completions', {
+    model: 'gpt-4',
+    messages: [{ role: 'user', content: 'hello' }]
+  });
+  response.value = result.choices[0].message.content;
+}
+```
+
+## supported providers
+
+* openai
+* anthropic
+* stripe
+* any http-based api
+
+## how it works
+
+```
+your static site → sdk token (domain-restricted)
+                ↓
+        proxy server (validates origin)
+                ↓
+        injects api key (server-side)
+                ↓
+        external api (openai, etc.)
+```
+
+## security
+
+* **api keys never exposed** - stored and injected server-side only
+* **domain-scoped tokens** - browser origin header enforced, can't be spoofed
+* **rate limiting** - 100 req/min per domain prevents abuse
+* **instant revocation** - revoke tokens anytime in dashboard
+
+## documentation
+
+* [quick start guide](https://learn.pages.dev/docs/sdk/quick-start)
+* [full api reference](https://learn.pages.dev/docs/sdk/secrets-proxy)
+* [dashboard](https://learn.pages.dev)
+
+## license
+
+mit

package/dist/client.d.ts

@@ -1,9 +1,39 @@
-import type { SecretsSDKOptions, ProxyRequest } from './types';
+import type { SecretsSDKOptions, ProxyRequest, RateLimitInfo } from './types';
 export declare class SecretsSDK {
     private appId;
-    private sessionToken;
+    private token;
     private baseUrl;
-    constructor(options: SecretsSDKOptions);
+    private timeout;
+    private retryOn429;
+    private rateLimitInfo;
+    private zeroConfigMode;
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options?: SecretsSDKOptions);
+    /**
+     * Get current rate limit information
+     */
+    getUsage(): RateLimitInfo | null;
+    /**
+     * Parse rate limit headers from response
+     */
+    private parseRateLimitHeaders;
+    /**
+     * Sleep utility for retry backoff
+     */
+    private sleep;
+    /**
+     * Make fetch request with timeout
+     */
+    private fetchWithTimeout;
     /**
      * Call an external API securely through the proxy
      * @param keyName - Name of the API key to use

package/dist/client.js

@@ -1,9 +1,69 @@
-import { SecretsSDKError } from './types';
+import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
 export class SecretsSDK {
-    constructor(options) {
-        this.appId = options.appId;
-        this.sessionToken = options.sessionToken;
-        this.baseUrl = options.baseUrl || 'https://learn.pages.dev';
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options = {}) {
+        this.rateLimitInfo = null;
+        this.appId = options.appId || null;
+        this.token = options.token || options.sessionToken || null;
+        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
+        this.timeout = options.timeout || 30000;
+        this.retryOn429 = options.retryOn429 !== undefined ? options.retryOn429 : true;
+        // Zero-config mode: no appId or token required
+        // Authentication is based on Origin header
+        this.zeroConfigMode = !this.appId && !this.token;
+    }
+    /**
+     * Get current rate limit information
+     */
+    getUsage() {
+        return this.rateLimitInfo;
+    }
+    /**
+     * Parse rate limit headers from response
+     */
+    parseRateLimitHeaders(headers) {
+        const limit = headers.get('X-RateLimit-Limit');
+        const remaining = headers.get('X-RateLimit-Remaining');
+        const reset = headers.get('X-RateLimit-Reset');
+        if (limit && remaining && reset) {
+            this.rateLimitInfo = {
+                limit: parseInt(limit),
+                remaining: parseInt(remaining),
+                reset: parseInt(reset)
+            };
+        }
+    }
+    /**
+     * Sleep utility for retry backoff
+     */
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    /**
+     * Make fetch request with timeout
+     */
+    async fetchWithTimeout(url, options, timeout) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        try {
+            const response = await fetch(url, {
+                ...options,
+                signal: controller.signal
+            });
+            return response;
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
     }
     /**
      * Call an external API securely through the proxy
@@ -13,35 +73,70 @@ export class SecretsSDK {
      * @returns Promise with the API response
      */
     async call(keyName, endpoint, options = {}) {
-        try {
-            const response = await fetch(`${this.baseUrl}/api/sdk/${this.appId}/proxy`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Authorization: `Bearer ${this.sessionToken}`
-                },
-                body: JSON.stringify({
-                    keyName,
-                    endpoint,
-                    method: options.method || 'GET',
-                    body: options.body,
-                    headers: options.headers
-                })
-            });
-            const result = await response.json();
-            if (!response.ok) {
-                const errorMessage = result.data?.message ||
-                    result?.message ||
-                    `Request failed with status ${response.status}`;
-                throw new SecretsSDKError(errorMessage, response.status, result);
+        let retries = 0;
+        const maxRetries = this.retryOn429 ? 3 : 0;
+        while (true) {
+            try {
+                // Build URL based on mode
+                const proxyUrl = this.zeroConfigMode
+                    ? `${this.baseUrl}/api/sdk/proxy`
+                    : `${this.baseUrl}/api/sdk/${this.appId}/proxy`;
+                // Build headers based on mode
+                const requestHeaders = {
+                    'Content-Type': 'application/json'
+                };
+                if (!this.zeroConfigMode && this.token) {
+                    requestHeaders['Authorization'] = `Bearer ${this.token}`;
+                }
+                const response = await this.fetchWithTimeout(proxyUrl, {
+                    method: 'POST',
+                    headers: requestHeaders,
+                    body: JSON.stringify({
+                        keyName,
+                        endpoint,
+                        method: options.method || 'GET',
+                        body: options.body,
+                        headers: options.headers
+                    })
+                }, this.timeout);
+                this.parseRateLimitHeaders(response.headers);
+                const result = await response.json();
+                if (!response.ok) {
+                    const errorMessage = result.data?.message ||
+                        result?.message ||
+                        `Request failed with status ${response.status}`;
+                    if (response.status === 403 && errorMessage.includes('Origin')) {
+                        throw new OriginMismatchError(errorMessage);
+                    }
+                    if (response.status === 401) {
+                        throw new InvalidTokenError(errorMessage);
+                    }
+                    if (response.status === 429) {
+                        const retryAfter = this.rateLimitInfo
+                            ? this.rateLimitInfo.reset - Math.floor(Date.now() / 1000)
+                            : 60;
+                        const error = new RateLimitError(errorMessage, retryAfter, this.rateLimitInfo?.remaining || 0, this.rateLimitInfo?.limit || 100);
+                        if (this.retryOn429 && retries < maxRetries) {
+                            retries++;
+                            const backoffMs = Math.min(1000 * Math.pow(2, retries - 1), 8000);
+                            await this.sleep(backoffMs);
+                            continue;
+                        }
+                        throw error;
+                    }
+                    throw new SecretsSDKError(errorMessage, response.status, result);
+                }
+                return result.data;
             }
-            return result.data;
-        }
-        catch (err) {
-            if (err instanceof SecretsSDKError) {
-                throw err;
+            catch (err) {
+                if (err instanceof SecretsSDKError) {
+                    throw err;
+                }
+                if (err instanceof Error && err.name === 'AbortError') {
+                    throw new SecretsSDKError('Request timeout', 408);
+                }
+                throw new SecretsSDKError(err instanceof Error ? err.message : 'Unknown error occurred', 500);
             }
-            throw new SecretsSDKError(err instanceof Error ? err.message : 'Unknown error occurred', 500);
         }
     }
     /**

package/dist/credentials.d.ts

@@ -0,0 +1,24 @@
+import type { CLICredentials } from './types';
+/**
+ * Get the path to the credentials file
+ * Defaults to ~/.learn/credentials.json
+ */
+export declare function getCredentialsPath(): string;
+/**
+ * Read credentials from file
+ * Returns null if file doesn't exist or is invalid
+ */
+export declare function readCredentials(): CLICredentials | null;
+/**
+ * Write credentials to file
+ * Creates ~/.learn directory if it doesn't exist
+ */
+export declare function writeCredentials(creds: CLICredentials): void;
+/**
+ * Delete credentials file
+ */
+export declare function deleteCredentials(): void;
+/**
+ * Check if credentials exist and are not expired
+ */
+export declare function hasValidCredentials(): boolean;

package/dist/credentials.js

@@ -0,0 +1,86 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+/**
+ * Get the path to the credentials file
+ * Defaults to ~/.learn/credentials.json
+ */
+export function getCredentialsPath() {
+    const homeDir = os.homedir();
+    const learnDir = path.join(homeDir, '.learn');
+    return path.join(learnDir, 'credentials.json');
+}
+/**
+ * Ensure the ~/.learn directory exists
+ */
+function ensureLearnDir() {
+    const homeDir = os.homedir();
+    const learnDir = path.join(homeDir, '.learn');
+    if (!fs.existsSync(learnDir)) {
+        fs.mkdirSync(learnDir, { recursive: true, mode: 0o700 }); // Owner-only permissions
+    }
+}
+/**
+ * Read credentials from file
+ * Returns null if file doesn't exist or is invalid
+ */
+export function readCredentials() {
+    try {
+        const credPath = getCredentialsPath();
+        if (!fs.existsSync(credPath)) {
+            return null;
+        }
+        const data = fs.readFileSync(credPath, 'utf-8');
+        const creds = JSON.parse(data);
+        // Validate required fields
+        if (!creds.access_token ||
+            !creds.refresh_token ||
+            !creds.expires_at ||
+            !creds.user_id) {
+            return null;
+        }
+        return creds;
+    }
+    catch (err) {
+        // Invalid JSON or read error
+        return null;
+    }
+}
+/**
+ * Write credentials to file
+ * Creates ~/.learn directory if it doesn't exist
+ */
+export function writeCredentials(creds) {
+    ensureLearnDir();
+    const credPath = getCredentialsPath();
+    const data = JSON.stringify(creds, null, 2);
+    // Write with owner-only permissions
+    fs.writeFileSync(credPath, data, { mode: 0o600 });
+}
+/**
+ * Delete credentials file
+ */
+export function deleteCredentials() {
+    try {
+        const credPath = getCredentialsPath();
+        if (fs.existsSync(credPath)) {
+            fs.unlinkSync(credPath);
+        }
+    }
+    catch (err) {
+        // Ignore errors (file might not exist)
+    }
+}
+/**
+ * Check if credentials exist and are not expired
+ */
+export function hasValidCredentials() {
+    const creds = readCredentials();
+    if (!creds) {
+        return false;
+    }
+    // Check if expired
+    const expiresAt = new Date(creds.expires_at);
+    const now = new Date();
+    return expiresAt > now;
+}

package/dist/env-resolver.d.ts

@@ -0,0 +1,23 @@
+import type { SecretConfig } from './types';
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+export declare function resolveEnvString(value: string): string;
+/**
+ * Resolve environment variables in a single secret config
+ */
+export declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
+/**
+ * Resolve environment variables in an array of secrets
+ */
+export declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+export declare function loadSecretsConfig(configPath: string): {
+    version: string;
+    project: string;
+    secrets: SecretConfig[];
+};

package/dist/env-resolver.js

@@ -0,0 +1,73 @@
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+export function resolveEnvString(value) {
+    // Replace ${VAR} and $VAR references
+    return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
+        const varName = var1 || var2;
+        const envValue = process.env[varName];
+        if (envValue === undefined) {
+            throw new Error(`Environment variable ${varName} is not defined`);
+        }
+        return envValue;
+    });
+}
+/**
+ * Resolve environment variables in a single secret config
+ */
+export function resolveEnvInSecret(secret) {
+    const resolved = {
+        name: resolveEnvString(secret.name),
+        provider: resolveEnvString(secret.provider),
+        api_key: resolveEnvString(secret.api_key)
+    };
+    if (secret.base_url) {
+        resolved.base_url = resolveEnvString(secret.base_url);
+    }
+    if (secret.auth_header) {
+        resolved.auth_header = resolveEnvString(secret.auth_header);
+    }
+    if (secret.auth_prefix) {
+        resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
+    }
+    return resolved;
+}
+/**
+ * Resolve environment variables in an array of secrets
+ */
+export function resolveEnvInSecrets(secrets) {
+    return secrets.map(resolveEnvInSecret);
+}
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+export function loadSecretsConfig(configPath) {
+    const fs = require('fs');
+    const path = require('path');
+    // Read config file
+    const fullPath = path.resolve(configPath);
+    if (!fs.existsSync(fullPath)) {
+        throw new Error(`Config file not found: ${fullPath}`);
+    }
+    const configData = fs.readFileSync(fullPath, 'utf-8');
+    const config = JSON.parse(configData);
+    // Validate config
+    if (!config.version) {
+        throw new Error('Config file missing "version" field');
+    }
+    if (!config.project) {
+        throw new Error('Config file missing "project" field');
+    }
+    if (!Array.isArray(config.secrets)) {
+        throw new Error('Config file missing "secrets" array');
+    }
+    // Resolve environment variables
+    const resolvedSecrets = resolveEnvInSecrets(config.secrets);
+    return {
+        version: config.version,
+        project: config.project,
+        secrets: resolvedSecrets
+    };
+}

package/dist/index.d.ts

@@ -1,3 +1,5 @@
 export { SecretsSDK } from './client';
-export { SecretsSDKError } from './types';
-export type { SecretsSDKOptions, ProxyRequest, ProxyResponse } from './types';
+export { SecretsManagement } from './management';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
+export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
+export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types';

package/dist/index.js

@@ -1,2 +1,4 @@
 export { SecretsSDK } from './client';
-export { SecretsSDKError } from './types';
+export { SecretsManagement } from './management';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
+export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';

package/dist/management.d.ts

@@ -0,0 +1,51 @@
+import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types';
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+export declare class SecretsManagement {
+    private appId;
+    private baseUrl;
+    private timeout;
+    constructor(options: SecretsManagementOptions);
+    /**
+     * Open a URL in the default browser
+     */
+    private openBrowser;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    login(): Promise<{
+        success: boolean;
+        user: string;
+    }>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Logout - clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    private getAccessToken;
+    /**
+     * Make authenticated request
+     */
+    private request;
+    /**
+     * List all secrets (with masked API keys)
+     */
+    list(): Promise<MaskedSecret[]>;
+    /**
+     * Sync secrets from config
+     */
+    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+}

package/dist/management.js

@@ -0,0 +1,191 @@
+import { SecretsSDKError } from './types';
+import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials';
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+export class SecretsManagement {
+    constructor(options) {
+        this.appId = options.appId;
+        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
+        this.timeout = options.timeout || 30000;
+    }
+    /**
+     * Open a URL in the default browser
+     */
+    async openBrowser(url) {
+        const { exec } = await import('child_process');
+        const { promisify } = await import('util');
+        const execAsync = promisify(exec);
+        const platform = process.platform;
+        try {
+            if (platform === 'darwin') {
+                await execAsync(`open "${url}"`);
+            }
+            else if (platform === 'win32') {
+                await execAsync(`start "${url}"`);
+            }
+            else {
+                // Linux
+                await execAsync(`xdg-open "${url}"`);
+            }
+        }
+        catch (err) {
+            console.error('Failed to open browser:', err);
+            throw new SecretsSDKError('Failed to open browser', 500);
+        }
+    }
+    /**
+     * Sleep for specified milliseconds
+     */
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    async login() {
+        try {
+            // Step 1: Request device code
+            const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                }
+            });
+            if (!deviceResponse.ok) {
+                throw new SecretsSDKError('Failed to generate device code', deviceResponse.status);
+            }
+            const deviceData = await deviceResponse.json();
+            // Step 2: Display user code and verification URI
+            console.log('\nTo authorize this application, visit:');
+            console.log(`  ${deviceData.verification_uri}`);
+            console.log('\nAnd enter the code:');
+            console.log(`  ${deviceData.user_code}`);
+            console.log('\nOpening browser...\n');
+            // Step 3: Open browser
+            await this.openBrowser(deviceData.verification_uri_complete);
+            // Step 4: Poll for token
+            const interval = deviceData.interval * 1000; // Convert to ms
+            const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
+            let attempts = 0;
+            while (attempts < maxAttempts) {
+                await this.sleep(interval);
+                attempts++;
+                const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({
+                        device_code: deviceData.device_code
+                    })
+                });
+                if (tokenResponse.status === 202) {
+                    // Still pending
+                    process.stdout.write('.');
+                    continue;
+                }
+                if (!tokenResponse.ok) {
+                    const errorData = await tokenResponse.json().catch(() => ({}));
+                    throw new SecretsSDKError(errorData.message || 'Failed to exchange device code', tokenResponse.status);
+                }
+                // Success!
+                const tokenData = await tokenResponse.json();
+                // Step 5: Store credentials
+                const expiresAt = new Date(Date.now() + tokenData.expires_in * 1000);
+                writeCredentials({
+                    access_token: tokenData.access_token,
+                    refresh_token: tokenData.refresh_token,
+                    expires_at: expiresAt.toISOString(),
+                    user_id: tokenData.user_id
+                });
+                console.log('\n\nAuthentication successful!');
+                return {
+                    success: true,
+                    user: tokenData.user_id
+                };
+            }
+            // Timeout
+            throw new SecretsSDKError('Authorization timeout', 408);
+        }
+        catch (err) {
+            if (err instanceof SecretsSDKError) {
+                throw err;
+            }
+            throw new SecretsSDKError(err.message || 'Login failed', err.status || 500);
+        }
+    }
+    /**
+     * Check if user is authenticated
+     */
+    async isAuthenticated() {
+        return hasValidCredentials();
+    }
+    /**
+     * Logout - clear stored credentials
+     */
+    logout() {
+        deleteCredentials();
+        console.log('Logged out successfully');
+    }
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    getAccessToken() {
+        const creds = readCredentials();
+        if (!creds) {
+            throw new SecretsSDKError('Not authenticated. Run login() first.', 401);
+        }
+        // Check if expired
+        const expiresAt = new Date(creds.expires_at);
+        const now = new Date();
+        if (expiresAt <= now) {
+            throw new SecretsSDKError('Token expired. Run login() again.', 401);
+        }
+        return creds.access_token;
+    }
+    /**
+     * Make authenticated request
+     */
+    async request(method, path, body) {
+        const token = this.getAccessToken();
+        const options = {
+            method,
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`
+            }
+        };
+        if (body) {
+            options.body = JSON.stringify(body);
+        }
+        const response = await fetch(`${this.baseUrl}${path}`, options);
+        if (!response.ok) {
+            const errorData = await response.json().catch(() => ({}));
+            throw new SecretsSDKError(errorData.message || `Request failed: ${response.statusText}`, response.status, errorData);
+        }
+        return response.json();
+    }
+    /**
+     * List all secrets (with masked API keys)
+     */
+    async list() {
+        const response = await this.request('GET', `/api/projects/${this.appId}/secrets`);
+        return response.secrets;
+    }
+    /**
+     * Sync secrets from config
+     */
+    async sync(secrets, options) {
+        const response = await this.request('POST', `/api/projects/${this.appId}/secrets/sync`, {
+            secrets,
+            options: {
+                deleteMissing: options?.deleteMissing ?? false,
+                dryRun: options?.dryRun ?? false
+            }
+        });
+        return response;
+    }
+}

package/dist/types.d.ts

@@ -1,7 +1,22 @@
 export interface SecretsSDKOptions {
-    appId: string;
-    sessionToken: string;
+    /**
+     * App ID from dashboard (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    appId?: string;
+    /**
+     * SDK token (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    token?: string;
+    sessionToken?: string;
+    /**
+     * Base URL of the proxy server
+     * Default: https://ctklearn.carsontkempf.workers.dev
+     */
     baseUrl?: string;
+    timeout?: number;
+    retryOn429?: boolean;
 }
 export interface ProxyRequest {
     keyName: string;
@@ -15,8 +30,94 @@ export interface ProxyResponse<T = any> {
     status: number;
     data: T;
 }
+export interface RateLimitInfo {
+    limit: number;
+    remaining: number;
+    reset: number;
+}
 export declare class SecretsSDKError extends Error {
     status: number;
     response?: any | undefined;
     constructor(message: string, status: number, response?: any | undefined);
 }
+export declare class OriginMismatchError extends SecretsSDKError {
+    constructor(message?: string);
+}
+export declare class RateLimitError extends SecretsSDKError {
+    retryAfter: number;
+    remaining: number;
+    limit: number;
+    constructor(message?: string, retryAfter?: number, remaining?: number, limit?: number);
+}
+export declare class InvalidTokenError extends SecretsSDKError {
+    constructor(message?: string);
+}
+export interface SecretsManagementOptions {
+    appId: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+export interface SecretConfig {
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+}
+export interface MaskedSecret {
+    id: string;
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+    created?: string;
+    updated?: string;
+}
+export interface SyncOptions {
+    deleteMissing?: boolean;
+    dryRun?: boolean;
+}
+export interface SyncDiffItem {
+    name: string;
+    provider?: string;
+    changes?: string[];
+}
+export interface SyncResult {
+    success: boolean;
+    diff: {
+        created: SyncDiffItem[];
+        updated: SyncDiffItem[];
+        deleted: SyncDiffItem[];
+        unchanged: SyncDiffItem[];
+    };
+    summary: {
+        created: number;
+        updated: number;
+        deleted: number;
+        unchanged: number;
+    };
+}
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface TokenResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    user_id: string;
+}
+export interface CLICredentials {
+    access_token: string;
+    refresh_token: string;
+    expires_at: string;
+    user_id: string;
+}

package/dist/types.js

@@ -6,3 +6,24 @@ export class SecretsSDKError extends Error {
         this.name = 'SecretsSDKError';
     }
 }
+export class OriginMismatchError extends SecretsSDKError {
+    constructor(message = 'Origin not allowed for this token') {
+        super(message, 403);
+        this.name = 'OriginMismatchError';
+    }
+}
+export class RateLimitError extends SecretsSDKError {
+    constructor(message = 'Rate limit exceeded', retryAfter = 60, remaining = 0, limit = 100) {
+        super(message, 429);
+        this.name = 'RateLimitError';
+        this.retryAfter = retryAfter;
+        this.remaining = remaining;
+        this.limit = limit;
+    }
+}
+export class InvalidTokenError extends SecretsSDKError {
+    constructor(message = 'Invalid or expired token') {
+        super(message, 401);
+        this.name = 'InvalidTokenError';
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.0.0",
-	"description": "Secure API proxy SDK for static sites",
+	"version": "1.3.0",
+	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
 	"types": "dist/index.d.ts",