learn-secrets-sdk 1.10.0 → 1.11.2

package/README.md

@@ -294,11 +294,104 @@ custom providers supported - configure base url in dashboard.
 
 ## security
 
-* **api keys never exposed** - stored and injected server-side only
-* **origin-based auth** - browser origin header enforced, can't be faked
-* **no credentials in code** - zero-config means no tokens to leak
+### security model
+
+the sdk uses origin-based authentication specifically designed for static sites. here's how it protects your api keys:
+
+**zero credentials in code:**
+* no api keys, tokens, or appid in your javascript
+* anyone can view your source code - nothing sensitive to steal
+* works because authentication happens via browser origin header
+
+**browser origin header:**
+* automatically sent by browser on every request
+* contains the domain making the request (e.g., `https://yourdomain.com`)
+* **cannot be spoofed** - browsers prevent javascript from modifying it
+* enforced by browser security model (same-origin policy)
+
+**server-side validation:**
+```
+1. browser sends request with Origin: https://yourdomain.com
+2. proxy checks if yourdomain.com is in allowed origins list
+3. if match: proxy injects api key server-side and calls external api
+4. if no match: request rejected with 403 error
+5. api keys never sent to browser
+```
+
+**what if someone steals your code?**
+* they deploy it on their domain (e.g., `https://attacker.com`)
+* browser sends `Origin: https://attacker.com`
+* proxy rejects - their domain not in your origins list
+* api calls fail - they can't use your api keys
+
+**comparison to alternatives:**
+
+traditional approach (insecure):
+```javascript
+// api key exposed in code
+const apiKey = 'sk-proj-abc123...';
+fetch('https://api.openai.com/v1/chat/completions', {
+  headers: { 'Authorization': `Bearer ${apiKey}` }
+});
+```
+problem: anyone viewing source code gets your api key
+
+environment variables (doesn't work for static sites):
+```javascript
+// process.env doesn't exist in browser
+const apiKey = process.env.OPENAI_API_KEY; // undefined
+```
+problem: static sites have no server to hold env vars
+
+backend proxy (requires server):
+```javascript
+// requires deploying and maintaining your own backend
+fetch('https://yourbackend.com/api/openai', { ... });
+```
+problem: need to deploy and maintain server infrastructure
+
+learn-secrets approach (secure for static sites):
+```javascript
+// zero credentials - authentication via origin header
+const sdk = new SecretsSDK();
+await sdk.post('openai', '/v1/chat/completions', { ... });
+```
+solution: browser origin header provides authentication
+
+### security guarantees
+
+* **api keys never exposed** - stored server-side, injected in proxy layer
+* **origin header enforced** - browsers prevent spoofing, validated server-side
+* **no credentials to leak** - zero-config means no tokens in your code
 * **rate limiting** - 100 req/min per domain prevents abuse
-* **instant updates** - change origins in dashboard anytime
+* **instant revocation** - remove origins in dashboard to block access immediately
+* **encrypted storage** - api keys encrypted at rest in database
+* **https only** - sdk enforces https in production
+
+### best practices
+
+**allowed origins:**
+* only add domains you control
+* use specific domains instead of wildcards
+* localhost allowed for development only
+* remove test domains before going live
+
+**deployment:**
+* deploy to production domain first
+* then add that domain to allowed origins
+* test that api calls work from production
+* never commit credentials to version control
+
+**monitoring:**
+* check usage dashboard regularly
+* watch for unexpected rate limit hits
+* review origins list periodically
+* remove unused origins
+
+**incident response:**
+* if domain compromised: remove from origins list immediately
+* if api key leaked: regenerate in provider dashboard
+* if suspecting abuse: check usage logs in dashboard
 
 ## documentation
 

package/dist/browser.global.js

@@ -0,0 +1 @@
+"use strict";var SecretsSDK=(()=>{var h=Object.defineProperty;var T=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var I=Object.prototype.hasOwnProperty;var k=(i,e)=>{for(var t in e)h(i,t,{get:e[t],enumerable:!0})},_=(i,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of R(e))!I.call(i,s)&&s!==t&&h(i,s,{get:()=>e[s],enumerable:!(r=T(e,s))||r.enumerable});return i};var S=i=>_(h({},"__esModule",{value:!0}),i);var P={};k(P,{InvalidTokenError:()=>g,OriginMismatchError:()=>c,RateLimitError:()=>u,SecretsSDK:()=>d,SecretsSDKError:()=>n});var n=class extends Error{constructor(t,r,s){super(t);this.status=r;this.response=s;this.name="SecretsSDKError"}},c=class extends n{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},u=class extends n{constructor(e="Rate limit exceeded",t=60,r=0,s=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=s}},g=class extends n{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var d=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),s=e.get("X-RateLimit-Reset");t&&r&&s&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(s)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let s=new AbortController,l=setTimeout(()=>s.abort(),r);try{return await fetch(e,{...t,signal:s.signal})}finally{clearTimeout(l)}}async call(e,t,r={}){let s=0,l=this.retryOn429?3:0;for(;;)try{let a=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,f={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(f.Authorization=`Bearer ${this.token}`);let o=await this.fetchWithTimeout(a,{method:"POST",headers:f,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(o.headers);let p=await o.json();if(!o.ok){let m=p.data?.message||p?.message||`Request failed with status ${o.status}`;if(o.status===403&&m.includes("Origin"))throw new c(m);if(o.status===401)throw new g(m);if(o.status===429){let y=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,b=new u(m,y,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&s<l){s++;let x=Math.min(1e3*Math.pow(2,s-1),8e3);await this.sleep(x);continue}throw b}throw new n(m,o.status,p)}return p.data}catch(a){throw a instanceof n?a:a instanceof Error&&a.name==="AbortError"?new n("Request timeout",408):new n(a instanceof Error?a.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,s){return this.call(e,t,{method:"POST",body:r,headers:s})}async put(e,t,r,s){return this.call(e,t,{method:"PUT",body:r,headers:s})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,s){return this.call(e,t,{method:"PATCH",body:r,headers:s})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new n("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let s=await r.json().catch(()=>({}));throw new n(s.message||`Secrets management failed: ${r.statusText}`,r.status,s)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};return S(P);})();

package/dist/chunk-Y4RHJLDQ.mjs

@@ -0,0 +1,70 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/env-resolver.ts
+function resolveEnvString(value) {
+  return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
+    const varName = var1 || var2;
+    const envValue = process.env[varName];
+    if (envValue === void 0) {
+      throw new Error(`Environment variable ${varName} is not defined`);
+    }
+    return envValue;
+  });
+}
+function resolveEnvInSecret(secret) {
+  const resolved = {
+    name: resolveEnvString(secret.name),
+    provider: resolveEnvString(secret.provider),
+    api_key: resolveEnvString(secret.api_key)
+  };
+  if (secret.base_url) {
+    resolved.base_url = resolveEnvString(secret.base_url);
+  }
+  if (secret.auth_header) {
+    resolved.auth_header = resolveEnvString(secret.auth_header);
+  }
+  if (secret.auth_prefix) {
+    resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
+  }
+  return resolved;
+}
+function resolveEnvInSecrets(secrets) {
+  return secrets.map(resolveEnvInSecret);
+}
+function loadSecretsConfig(configPath) {
+  const fs = __require("fs");
+  const path = __require("path");
+  const fullPath = path.resolve(configPath);
+  if (!fs.existsSync(fullPath)) {
+    throw new Error(`Config file not found: ${fullPath}`);
+  }
+  const configData = fs.readFileSync(fullPath, "utf-8");
+  const config = JSON.parse(configData);
+  if (!config.version) {
+    throw new Error('Config file missing "version" field');
+  }
+  if (!config.project) {
+    throw new Error('Config file missing "project" field');
+  }
+  if (!Array.isArray(config.secrets)) {
+    throw new Error('Config file missing "secrets" array');
+  }
+  const resolvedSecrets = resolveEnvInSecrets(config.secrets);
+  return {
+    version: config.version,
+    project: config.project,
+    secrets: resolvedSecrets
+  };
+}
+
+export {
+  resolveEnvString,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  loadSecretsConfig
+};

package/dist/cli/index.mjs

@@ -362,7 +362,7 @@ Log in on ${this.baseUrl}`);
   /**
    * Make authenticated request
    */
-  async request(method, path3, body) {
+  async request(method, path2, body) {
     const token = this.getAccessToken();
     const options = {
       method,
@@ -374,7 +374,7 @@ Log in on ${this.baseUrl}`);
     if (body) {
       options.body = JSON.stringify(body);
     }
-    const response = await fetch(`${this.baseUrl}${path3}`, options);
+    const response = await fetch(`${this.baseUrl}${path2}`, options);
     if (!response.ok) {
       const errorData = await response.json().catch(() => ({}));
       throw new SecretsSDKError(
@@ -675,107 +675,6 @@ function summarizeDetectedSecrets(secrets) {
   return lines.join("\n");
 }
 
-// src/cli/commands/connect-cloudflare.ts
-function getApiUrl(baseUrl) {
-  return baseUrl || "https://cloudprototype.org";
-}
-async function connectCloudflare(apiToken, baseUrl) {
-  if (!apiToken.match(/^[A-Za-z0-9_-]{40,}$/)) {
-    return {
-      success: false,
-      error: "Invalid API token format. Token should be 40+ alphanumeric characters"
-    };
-  }
-  const validation = await validateCloudflareToken(apiToken);
-  if (!validation.valid) {
-    return {
-      success: false,
-      error: validation.error || "Token validation failed"
-    };
-  }
-  try {
-    const apiUrl = getApiUrl(baseUrl);
-    const response = await fetch(`${apiUrl}/api/cloudflare/connect`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      credentials: "include",
-      body: JSON.stringify({
-        apiToken,
-        accountId: validation.accountId,
-        accountName: validation.accountName
-      })
-    });
-    if (!response.ok) {
-      const error = await response.json();
-      return {
-        success: false,
-        error: error.message || "Failed to store token"
-      };
-    }
-    return {
-      success: true,
-      accountId: validation.accountId,
-      accountName: validation.accountName
-    };
-  } catch (error) {
-    return {
-      success: false,
-      error: error.message || "Failed to connect Cloudflare account"
-    };
-  }
-}
-async function validateCloudflareToken(token) {
-  try {
-    const response = await fetch("https://api.cloudflare.com/client/v4/user", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json"
-      }
-    });
-    if (!response.ok) {
-      const error = await response.json();
-      return {
-        valid: false,
-        error: error.errors?.[0]?.message || "Invalid token"
-      };
-    }
-    const data = await response.json();
-    const accountsResponse = await fetch("https://api.cloudflare.com/client/v4/accounts", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json"
-      }
-    });
-    if (!accountsResponse.ok) {
-      return {
-        valid: false,
-        error: "Token does not have access to accounts"
-      };
-    }
-    const accountsData = await accountsResponse.json();
-    const accounts = accountsData.result || [];
-    if (accounts.length === 0) {
-      return {
-        valid: false,
-        error: "No accounts found for this token"
-      };
-    }
-    const account = accounts[0];
-    return {
-      valid: true,
-      accountId: account.id,
-      accountName: account.name
-    };
-  } catch (error) {
-    return {
-      valid: false,
-      error: error.message || "Failed to validate token"
-    };
-  }
-}
-
 // src/cli/commands/init.ts
 async function initCommand(options) {
   if (!hasValidCredentials()) {
@@ -865,67 +764,16 @@ Onboarding site for project: ${projectId}`);
         console.log(`    - ${failure.name}: ${failure.error}`);
       }
     }
+    const dashboardUrl = options.baseUrl || "https://cloudprototype.org";
     console.log("\nYour site is ready!");
     console.log("\nAdd to your static site code:");
     console.log("    const sdk = new SecretsSDK();");
     console.log("    // Uses origin-based auth - no token needed!");
-    console.log("\n--- Cloudflare Worker Setup ---");
-    const dashboardUrl = options.baseUrl || "https://cloudprototype.org";
-    let cloudflareConnected = false;
-    try {
-      const statusResponse = await fetch(`${dashboardUrl}/api/cloudflare/status`, {
-        credentials: "include"
-      });
-      cloudflareConnected = statusResponse.ok;
-    } catch {
-      cloudflareConnected = false;
-    }
-    if (cloudflareConnected) {
-      console.log("Cloudflare account is already connected.");
-    } else {
-      console.log("To deploy secrets via Cloudflare Worker, we need your Cloudflare API token.");
-      console.log("\nRequired permissions:");
-      console.log("  - Workers Scripts: Edit");
-      console.log("  - Workers Routes: Edit");
-      console.log("  - Account Settings: Read");
-      console.log("\nCreate token at: https://dash.cloudflare.com/profile/api-tokens");
-      const readline = await import("readline");
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      const apiToken = await new Promise((resolve2) => {
-        rl.question("\nCloudflare API Token (or press Enter to skip): ", (answer) => {
-          rl.close();
-          resolve2(answer.trim());
-        });
-      });
-      if (apiToken) {
-        console.log("\nValidating token...");
-        const result2 = await connectCloudflare(apiToken, options.baseUrl);
-        if (result2.success) {
-          console.log("Cloudflare account connected");
-          console.log(`  Account: ${result2.accountName}`);
-          cloudflareConnected = true;
-        } else {
-          console.log(`
-Warning: Failed to connect Cloudflare: ${result2.error}`);
-          console.log("You can connect later by running: learn-secrets deploy");
-        }
-      } else {
-        console.log("\nSkipped Cloudflare connection.");
-        console.log("You can connect later when you run: learn-secrets deploy");
-      }
-    }
     console.log(`
 Next steps:`);
-    console.log(`  1. Run: learn-secrets deploy`);
-    if (cloudflareConnected) {
-      console.log(`     (Deploy Worker to Cloudflare with your secrets)`);
-    } else {
-      console.log(`     (Connect Cloudflare and deploy Worker with your secrets)`);
-    }
-    console.log(`  2. Visit: ${dashboardUrl}/dashboard to manage secrets`);
+    console.log(`  1. Run: learn-secrets deploy (to update secrets)`);
+    console.log(`  2. Visit: ${dashboardUrl}/dashboard/secrets to manage secrets`);
+    console.log(`  3. View usage at: ${dashboardUrl}/dashboard/settings/usage`);
     const config = {
       project: projectId,
       origins,
@@ -994,87 +842,6 @@ Configuration saved to: ${configFile}`);
 
 // src/cli/commands/deploy.ts
 import fs5 from "fs";
-
-// src/cli/commands/provision-worker.ts
-import path2 from "path";
-import { fileURLToPath } from "url";
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = path2.dirname(__filename);
-function getApiUrl2(baseUrl) {
-  return baseUrl || "https://cloudprototype.org";
-}
-async function provisionWorker(workerName, origins, envVars, baseUrl) {
-  const publicVars = [];
-  const secretVars = [];
-  for (const { key, value } of envVars) {
-    if (isPublicConfig(key)) {
-      publicVars.push({ key, value });
-    } else {
-      secretVars.push({ key, value });
-    }
-  }
-  try {
-    const apiUrl = getApiUrl2(baseUrl);
-    const deployResponse = await fetch(`${apiUrl}/api/cloudflare/provision-worker`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      credentials: "include",
-      body: JSON.stringify({
-        workerName,
-        allowedOrigins: origins,
-        publicVars: publicVars.map((v) => ({
-          key: `PUBLIC_${v.key}`,
-          value: v.value
-        })),
-        secrets: secretVars.map((v) => ({
-          key: `SECRET_${v.key}`,
-          value: v.value
-        }))
-      })
-    });
-    if (!deployResponse.ok) {
-      const error = await deployResponse.json();
-      return {
-        success: false,
-        error: error.message || "Failed to deploy Worker"
-      };
-    }
-    const result = await deployResponse.json();
-    return {
-      success: true,
-      workerUrl: result.workerUrl,
-      workerName: result.workerName
-    };
-  } catch (error) {
-    return {
-      success: false,
-      error: error.message || "Failed to provision Worker"
-    };
-  }
-}
-function isPublicConfig(key) {
-  const publicPatterns = [
-    /_DOMAIN$/,
-    /_CLIENT_ID$/,
-    /_AUDIENCE$/,
-    /_CALLBACK_URL$/,
-    /_ISSUER$/,
-    /_TEAM_ID$/,
-    /_KEY_ID$/,
-    /^API_BASE_URL$/,
-    /^PUBLIC_/
-  ];
-  for (const pattern of publicPatterns) {
-    if (pattern.test(key)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// src/cli/commands/deploy.ts
 async function deployCommand(options = {}) {
   if (!hasValidCredentials()) {
     console.error('Error: Not authenticated. Run "learn-secrets login" first.');
@@ -1148,101 +915,18 @@ Deploying secrets to project: ${config.project}`);
     console.log("\nSuccess!");
     console.log(`  Created: ${result.results.created} secrets`);
     console.log(`  Updated: ${result.results.updated} secrets`);
+    console.log(`  Failed: ${result.results.failed} secrets`);
     if (result.results.failed > 0) {
-      console.log(`  Failed: ${result.results.failed} secrets`);
+      console.log("\nFailed uploads:");
       for (const failure of result.results.details.failed) {
-        console.log(`    - ${failure.name}: ${failure.error}`);
+        console.log(`  - ${failure.name}: ${failure.error}`);
       }
     }
     const dashboardUrl = options.baseUrl || "https://cloudprototype.org";
+    console.log("\nSecrets deployed successfully!");
     console.log(`
-Secrets deployed! View them at: ${dashboardUrl}/dashboard/collections/secrets`);
-    console.log("\n--- Cloudflare Worker Deployment ---");
-    let cloudflareConnected = false;
-    try {
-      const statusResponse = await fetch(`${dashboardUrl}/api/cloudflare/status`, {
-        credentials: "include"
-      });
-      cloudflareConnected = statusResponse.ok;
-    } catch {
-      cloudflareConnected = false;
-    }
-    if (!cloudflareConnected) {
-      console.log("Cloudflare account not connected.");
-      console.log("\nTo deploy Worker, we need your Cloudflare API token.");
-      console.log("Required permissions:");
-      console.log("  - Workers Scripts: Edit");
-      console.log("  - Workers Routes: Edit");
-      console.log("  - Account Settings: Read");
-      console.log("\nCreate token at: https://dash.cloudflare.com/profile/api-tokens");
-      const readline = await import("readline");
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      const apiToken = await new Promise((resolve2) => {
-        rl.question("\nCloudflare API Token (or press Enter to skip): ", (answer) => {
-          rl.close();
-          resolve2(answer.trim());
-        });
-      });
-      if (apiToken) {
-        console.log("\nValidating token...");
-        const result2 = await connectCloudflare(apiToken, options.baseUrl);
-        if (result2.success) {
-          console.log("Cloudflare account connected");
-          console.log(`  Account: ${result2.accountName}`);
-          cloudflareConnected = true;
-        } else {
-          console.log(`
-Error: Failed to connect Cloudflare: ${result2.error}`);
-          console.log("Worker deployment skipped.");
-        }
-      } else {
-        console.log("\nSkipped Cloudflare connection. Worker deployment skipped.");
-      }
-    } else {
-      console.log("Cloudflare account is connected.");
-    }
-    if (cloudflareConnected) {
-      const readline = await import("readline");
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      const shouldProvision = await new Promise((resolve2) => {
-        rl.question("\nDeploy/update Worker to Cloudflare? (y/N): ", (answer) => {
-          rl.close();
-          resolve2(answer.trim());
-        });
-      });
-      if (shouldProvision.toLowerCase() === "y" || shouldProvision.toLowerCase() === "yes") {
-        console.log("\nDeploying Worker to Cloudflare...");
-        const workerName = `learn-secrets-${config.project.toLowerCase()}`;
-        const provisionResult = await provisionWorker(
-          workerName,
-          config.origins,
-          envVars,
-          options.baseUrl
-        );
-        if (provisionResult.success) {
-          console.log("\nWorker deployed successfully");
-          console.log(`  Name: ${provisionResult.workerName}`);
-          console.log(`  URL: ${provisionResult.workerUrl}`);
-          config.workerUrl = provisionResult.workerUrl;
-          fs5.writeFileSync(configFile, JSON.stringify(config, null, 2));
-          console.log("\nNext steps:");
-          console.log(`  1. Test Worker: curl ${provisionResult.workerUrl}/health`);
-          console.log(`  2. Update your frontend to use Worker URL`);
-          console.log(`  3. Test origin validation from your site`);
-        } else {
-          console.log(`
-Error: Worker deployment failed: ${provisionResult.error}`);
-        }
-      } else {
-        console.log("\nSkipped Worker deployment.");
-      }
-    }
+View your secrets in the dashboard:`);
+    console.log(`  ${dashboardUrl}/dashboard/collections/secrets`);
   } catch (error) {
     console.error("\nDeploy failed:", error.message);
     if (error.status === 401) {
@@ -1257,7 +941,7 @@ Error: Worker deployment failed: ${provisionResult.error}`);
 
 // src/cli/index.ts
 var program = new Command();
-program.name("learn-secrets").description("CLI tool for managing API secrets with Cloudflare Worker deployment").version("1.10.0");
+program.name("learn-secrets").description("CLI tool for managing secrets with the Learn platform").version("1.11.1");
 program.command("login").description("Authenticate with Learn Secrets via browser").option("--base-url <url>", "Custom base URL for API").action(async (options) => {
   await loginCommand(options);
 });

package/dist/env-resolver-FQMR3R4G.mjs

@@ -0,0 +1,12 @@
+import {
+  loadSecretsConfig,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  resolveEnvString
+} from "./chunk-Y4RHJLDQ.mjs";
+export {
+  loadSecretsConfig,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  resolveEnvString
+};