learn-secrets-sdk 1.11.1 → 1.11.3

package/README.md

@@ -294,11 +294,104 @@ custom providers supported - configure base url in dashboard.
 
 ## security
 
-* **api keys never exposed** - stored and injected server-side only
-* **origin-based auth** - browser origin header enforced, can't be faked
-* **no credentials in code** - zero-config means no tokens to leak
+### security model
+
+the sdk uses origin-based authentication specifically designed for static sites. here's how it protects your api keys:
+
+**zero credentials in code:**
+* no api keys, tokens, or appid in your javascript
+* anyone can view your source code - nothing sensitive to steal
+* works because authentication happens via browser origin header
+
+**browser origin header:**
+* automatically sent by browser on every request
+* contains the domain making the request (e.g., `https://yourdomain.com`)
+* **cannot be spoofed** - browsers prevent javascript from modifying it
+* enforced by browser security model (same-origin policy)
+
+**server-side validation:**
+```
+1. browser sends request with Origin: https://yourdomain.com
+2. proxy checks if yourdomain.com is in allowed origins list
+3. if match: proxy injects api key server-side and calls external api
+4. if no match: request rejected with 403 error
+5. api keys never sent to browser
+```
+
+**what if someone steals your code?**
+* they deploy it on their domain (e.g., `https://attacker.com`)
+* browser sends `Origin: https://attacker.com`
+* proxy rejects - their domain not in your origins list
+* api calls fail - they can't use your api keys
+
+**comparison to alternatives:**
+
+traditional approach (insecure):
+```javascript
+// api key exposed in code
+const apiKey = 'sk-proj-abc123...';
+fetch('https://api.openai.com/v1/chat/completions', {
+  headers: { 'Authorization': `Bearer ${apiKey}` }
+});
+```
+problem: anyone viewing source code gets your api key
+
+environment variables (doesn't work for static sites):
+```javascript
+// process.env doesn't exist in browser
+const apiKey = process.env.OPENAI_API_KEY; // undefined
+```
+problem: static sites have no server to hold env vars
+
+backend proxy (requires server):
+```javascript
+// requires deploying and maintaining your own backend
+fetch('https://yourbackend.com/api/openai', { ... });
+```
+problem: need to deploy and maintain server infrastructure
+
+learn-secrets approach (secure for static sites):
+```javascript
+// zero credentials - authentication via origin header
+const sdk = new SecretsSDK();
+await sdk.post('openai', '/v1/chat/completions', { ... });
+```
+solution: browser origin header provides authentication
+
+### security guarantees
+
+* **api keys never exposed** - stored server-side, injected in proxy layer
+* **origin header enforced** - browsers prevent spoofing, validated server-side
+* **no credentials to leak** - zero-config means no tokens in your code
 * **rate limiting** - 100 req/min per domain prevents abuse
-* **instant updates** - change origins in dashboard anytime
+* **instant revocation** - remove origins in dashboard to block access immediately
+* **encrypted storage** - api keys encrypted at rest in database
+* **https only** - sdk enforces https in production
+
+### best practices
+
+**allowed origins:**
+* only add domains you control
+* use specific domains instead of wildcards
+* localhost allowed for development only
+* remove test domains before going live
+
+**deployment:**
+* deploy to production domain first
+* then add that domain to allowed origins
+* test that api calls work from production
+* never commit credentials to version control
+
+**monitoring:**
+* check usage dashboard regularly
+* watch for unexpected rate limit hits
+* review origins list periodically
+* remove unused origins
+
+**incident response:**
+* if domain compromised: remove from origins list immediately
+* if api key leaked: regenerate in provider dashboard
+* if suspecting abuse: check usage logs in dashboard
 
 ## documentation
 

package/dist/browser.global.js

@@ -0,0 +1 @@
+"use strict";var SecretsSDK=(()=>{var h=Object.defineProperty;var T=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var I=Object.prototype.hasOwnProperty;var k=(i,e)=>{for(var t in e)h(i,t,{get:e[t],enumerable:!0})},_=(i,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of R(e))!I.call(i,s)&&s!==t&&h(i,s,{get:()=>e[s],enumerable:!(r=T(e,s))||r.enumerable});return i};var S=i=>_(h({},"__esModule",{value:!0}),i);var P={};k(P,{InvalidTokenError:()=>g,OriginMismatchError:()=>c,RateLimitError:()=>u,SecretsSDK:()=>d,SecretsSDKError:()=>n});var n=class extends Error{constructor(t,r,s){super(t);this.status=r;this.response=s;this.name="SecretsSDKError"}},c=class extends n{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},u=class extends n{constructor(e="Rate limit exceeded",t=60,r=0,s=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=s}},g=class extends n{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var d=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),s=e.get("X-RateLimit-Reset");t&&r&&s&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(s)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let s=new AbortController,l=setTimeout(()=>s.abort(),r);try{return await fetch(e,{...t,signal:s.signal})}finally{clearTimeout(l)}}async call(e,t,r={}){let s=0,l=this.retryOn429?3:0;for(;;)try{let a=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,f={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(f.Authorization=`Bearer ${this.token}`);let o=await this.fetchWithTimeout(a,{method:"POST",headers:f,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(o.headers);let p=await o.json();if(!o.ok){let m=p.data?.message||p?.message||`Request failed with status ${o.status}`;if(o.status===403&&m.includes("Origin"))throw new c(m);if(o.status===401)throw new g(m);if(o.status===429){let y=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,b=new u(m,y,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&s<l){s++;let x=Math.min(1e3*Math.pow(2,s-1),8e3);await this.sleep(x);continue}throw b}throw new n(m,o.status,p)}return p.data}catch(a){throw a instanceof n?a:a instanceof Error&&a.name==="AbortError"?new n("Request timeout",408):new n(a instanceof Error?a.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,s){return this.call(e,t,{method:"POST",body:r,headers:s})}async put(e,t,r,s){return this.call(e,t,{method:"PUT",body:r,headers:s})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,s){return this.call(e,t,{method:"PATCH",body:r,headers:s})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new n("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let s=await r.json().catch(()=>({}));throw new n(s.message||`Secrets management failed: ${r.statusText}`,r.status,s)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};return S(P);})();

package/dist/chunk-Y4RHJLDQ.mjs

@@ -0,0 +1,70 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/env-resolver.ts
+function resolveEnvString(value) {
+  return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
+    const varName = var1 || var2;
+    const envValue = process.env[varName];
+    if (envValue === void 0) {
+      throw new Error(`Environment variable ${varName} is not defined`);
+    }
+    return envValue;
+  });
+}
+function resolveEnvInSecret(secret) {
+  const resolved = {
+    name: resolveEnvString(secret.name),
+    provider: resolveEnvString(secret.provider),
+    api_key: resolveEnvString(secret.api_key)
+  };
+  if (secret.base_url) {
+    resolved.base_url = resolveEnvString(secret.base_url);
+  }
+  if (secret.auth_header) {
+    resolved.auth_header = resolveEnvString(secret.auth_header);
+  }
+  if (secret.auth_prefix) {
+    resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
+  }
+  return resolved;
+}
+function resolveEnvInSecrets(secrets) {
+  return secrets.map(resolveEnvInSecret);
+}
+function loadSecretsConfig(configPath) {
+  const fs = __require("fs");
+  const path = __require("path");
+  const fullPath = path.resolve(configPath);
+  if (!fs.existsSync(fullPath)) {
+    throw new Error(`Config file not found: ${fullPath}`);
+  }
+  const configData = fs.readFileSync(fullPath, "utf-8");
+  const config = JSON.parse(configData);
+  if (!config.version) {
+    throw new Error('Config file missing "version" field');
+  }
+  if (!config.project) {
+    throw new Error('Config file missing "project" field');
+  }
+  if (!Array.isArray(config.secrets)) {
+    throw new Error('Config file missing "secrets" array');
+  }
+  const resolvedSecrets = resolveEnvInSecrets(config.secrets);
+  return {
+    version: config.version,
+    project: config.project,
+    secrets: resolvedSecrets
+  };
+}
+
+export {
+  resolveEnvString,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  loadSecretsConfig
+};

package/dist/cli/index.mjs

@@ -772,7 +772,7 @@ Onboarding site for project: ${projectId}`);
     console.log(`
 Next steps:`);
     console.log(`  1. Run: learn-secrets deploy (to update secrets)`);
-    console.log(`  2. Visit: ${dashboardUrl}/dashboard/secrets to manage secrets`);
+    console.log(`  2. Visit: ${dashboardUrl}/dashboard/collections/secrets to manage secrets`);
     console.log(`  3. View usage at: ${dashboardUrl}/dashboard/settings/usage`);
     const config = {
       project: projectId,
@@ -915,18 +915,18 @@ Deploying secrets to project: ${config.project}`);
     console.log("\nSuccess!");
     console.log(`  Created: ${result.results.created} secrets`);
     console.log(`  Updated: ${result.results.updated} secrets`);
+    console.log(`  Failed: ${result.results.failed} secrets`);
     if (result.results.failed > 0) {
-      console.log(`  Failed: ${result.results.failed} secrets`);
+      console.log("\nFailed uploads:");
       for (const failure of result.results.details.failed) {
-        console.log(`    - ${failure.name}: ${failure.error}`);
+        console.log(`  - ${failure.name}: ${failure.error}`);
       }
     }
     const dashboardUrl = options.baseUrl || "https://cloudprototype.org";
+    console.log("\nSecrets deployed successfully!");
     console.log(`
-Secrets deployed to Learn dashboard!`);
-    console.log(`View at: ${dashboardUrl}/dashboard/collections/secrets`);
-    console.log(`
-Your secrets are now accessible via the Learn Secrets API.`);
+View your secrets in the dashboard:`);
+    console.log(`  ${dashboardUrl}/dashboard/collections/secrets`);
   } catch (error) {
     console.error("\nDeploy failed:", error.message);
     if (error.status === 401) {

package/dist/env-resolver-FQMR3R4G.mjs

@@ -0,0 +1,12 @@
+import {
+  loadSecretsConfig,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  resolveEnvString
+} from "./chunk-Y4RHJLDQ.mjs";
+export {
+  loadSecretsConfig,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  resolveEnvString
+};

package/dist/index.mjs

@@ -1,10 +1,849 @@
-import{a as j,b as A,c as M,d as K}from"./chunk-AS6G7JYX.mjs";var i=class extends Error{constructor(t,r,n){super(t);this.status=r;this.response=n;this.name="SecretsSDKError"}},f=class extends i{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},y=class extends i{constructor(e="Rate limit exceeded",t=60,r=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=n}},w=class extends i{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var T=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&r&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let n=new AbortController,c=setTimeout(()=>n.abort(),r);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(c)}}async call(e,t,r={}){let n=0,c=this.retryOn429?3:0;for(;;)try{let o=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,u={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(u.Authorization=`Bearer ${this.token}`);let a=await this.fetchWithTimeout(o,{method:"POST",headers:u,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(a.headers);let h=await a.json();if(!a.ok){let m=h.data?.message||h?.message||`Request failed with status ${a.status}`;if(a.status===403&&m.includes("Origin"))throw new f(m);if(a.status===401)throw new w(m);if(a.status===429){let b=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,l=new y(m,b,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<c){n++;let g=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(g);continue}throw l}throw new i(m,a.status,h)}return h.data}catch(o){throw o instanceof i?o:o instanceof Error&&o.name==="AbortError"?new i("Request timeout",408):new i(o instanceof Error?o.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,n){return this.call(e,t,{method:"POST",body:r,headers:n})}async put(e,t,r,n){return this.call(e,t,{method:"PUT",body:r,headers:n})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,n){return this.call(e,t,{method:"PATCH",body:r,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new i("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let n=await r.json().catch(()=>({}));throw new i(n.message||`Secrets management failed: ${r.statusText}`,r.status,n)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};import*as d from"fs";import*as k from"path";import*as C from"os";function v(){let s=C.homedir(),e=k.join(s,".learn");return k.join(e,"credentials.json")}function q(){let s=C.homedir(),e=k.join(s,".learn");d.existsSync(e)||d.mkdirSync(e,{recursive:!0,mode:448})}function I(){try{let s=v();if(!d.existsSync(s))return null;let e=d.readFileSync(s,"utf-8"),t=JSON.parse(e);return t.access_token&&!t["learn-secrets-sdk"]&&!t["learn-auth-sdk"]?{"learn-secrets-sdk":t}:t}catch{return null}}function P(s){q();let e=v(),t=JSON.stringify(s,null,2);d.writeFileSync(e,t,{mode:384})}function S(s){let e=I();return e&&e[s]||null}function R(s,e){let t=I()||{};t[s]=e,P(t)}function N(s){let e=I();e&&(delete e[s],Object.keys(e).length===0?D():P(e))}function _(){return S("learn-secrets-sdk")}function D(){try{let s=v();d.existsSync(s)&&d.unlinkSync(s)}catch{}}function J(s){let e=S(s);return e!==null&&!!e.access_token}function L(){let s=_();return s?s.expires_at?new Date(s.expires_at)>new Date:!0:!1}import{exec as z}from"child_process";import{promisify as F}from"util";import{createHash as U}from"crypto";import*as p from"os";var x=F(z);async function O(){let s=process.platform;try{let e;if(s==="darwin")e=await H();else if(s==="linux")e=await W();else if(s==="win32")e=await G();else throw new Error(`Unsupported platform: ${s}`);let t=U("sha256").update(e).digest("hex").substring(0,32),r=JSON.stringify({machineId:t,cpus:p.cpus().length,arch:p.arch(),platform:p.platform(),homedir:p.homedir()}),n=U("sha256").update(r).digest("hex");return{machineId:t,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function H(){try{let{stdout:s}=await x(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await x("hostname"),t=s.trim(),r=e.trim();if(t&&r)return`${t}-${r}`;let{stdout:n}=await x(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function W(){try{let{stdout:s}=await x("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=s.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function G(){try{let{stdout:s}=await x("wmic csproduct get uuid"),t=s.split(`
-`).map(r=>r.trim()).find(r=>r&&r!=="UUID");if(t)return t;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var E=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:r}=await import("util"),n=r(t),c=process.platform;try{c==="darwin"?await n(`open "${e}"`):c==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(o){throw console.error("Failed to open browser:",o),new i("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
-`);let t=await O(),r=S(e);if(r&&r.access_token){let l=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:t.machineId,sdk_name:e})});if(l.ok){let g=await l.json();if(g.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${g.user_email||g.user_id}`),{success:!0,user:g.user_email||g.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new i("Failed to generate device code",n.status);let c=await n.json();console.log(`
-Log in on ${this.baseUrl}`),console.log("Login at:"),console.log(c.verification_uri_complete),console.log(`
-Press ENTER to open in the browser...`);let u=(await import("readline")).createInterface({input:process.stdin,output:process.stdout});await new Promise(l=>{u.question("",()=>{u.close(),l()})}),console.log(`Opening browser...
-`),await this.openBrowser(c.verification_uri_complete);let a=null,h=c.interval*1e3,m=Math.ceil(c.expires_in/c.interval),b=0;for(;b<m;){await this.sleep(h),b++;let l=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:c.device_code})});if(l.status===202){process.stdout.write(".");continue}if(l.ok){a=await l.json();break}}if(!a)throw new i("Device authorization timeout",408);return console.log(`
-
-Device authorized! Retrieving access token...`),R(e,{access_token:a.access_token,refresh_token:null,expires_at:null,user_id:a.user_id,machine_id:t.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
-Authentication successful!`),console.log(`Logged in as: ${a.user_email||a.user_id}`),console.log(`This machine is now permanently authorized.
-`),{success:!0,user:a.user_email||a.user_id}}catch(t){throw t instanceof i?t:new i(t.message||"Login failed",t.status||500)}}async isAuthenticated(){return L()}logout(){D(),console.log("Logged out successfully")}getAccessToken(){let e=_();if(!e)throw new i("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new i("Token expired. Run login() again.",401);return e.access_token}async request(e,t,r){let n=this.getAccessToken(),c={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};r&&(c.body=JSON.stringify(r));let o=await fetch(`${this.baseUrl}${t}`,c);if(!o.ok){let u=await o.json().catch(()=>({}));throw new i(u.message||`Request failed: ${o.statusText}`,o.status,u)}return o.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await import("./env-resolver-Y4SFGOKB.mjs"),r=t(e);return this.importSecrets(r)}};var $=class{constructor(e){this.workerUrl=e.workerUrl.replace(/\/$/,"")}async getConfig(){let e=await fetch(`${this.workerUrl}/config`,{method:"GET",credentials:"include"});if(!e.ok)throw new Error(`Failed to get config: ${e.status} ${e.statusText}`);return(await e.json()).public||{}}async proxy(e){let t=await fetch(`${this.workerUrl}/proxy`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let r=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(r.error||`Proxy request failed: ${t.status}`)}return t.json()}async generateAppleJwt(e){let t=await fetch(`${this.workerUrl}/auth/apple-jwt`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let n=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(n.error||`Apple JWT generation failed: ${t.status}`)}return(await t.json()).token}async exchangeOAuthCode(e){let t=await fetch(`${this.workerUrl}/auth/oauth`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let r=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(r.error||`OAuth exchange failed: ${t.status}`)}return t.json()}async health(){let e=await fetch(`${this.workerUrl}/health`,{method:"GET"});if(!e.ok)throw new Error(`Health check failed: ${e.status}`);return e.json()}};export{w as InvalidTokenError,f as OriginMismatchError,y as RateLimitError,E as SecretsManagement,T as SecretsSDK,i as SecretsSDKError,$ as WorkerClient,N as deleteSDKCredentials,O as getMachineId,J as hasSDKCredentials,K as loadSecretsConfig,I as readAllCredentials,S as readSDKCredentials,A as resolveEnvInSecret,M as resolveEnvInSecrets,j as resolveEnvString,P as writeAllCredentials,R as writeSDKCredentials};
+import {
+  loadSecretsConfig,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  resolveEnvString
+} from "./chunk-Y4RHJLDQ.mjs";
+
+// src/types.ts
+var SecretsSDKError = class extends Error {
+  constructor(message, status, response) {
+    super(message);
+    this.status = status;
+    this.response = response;
+    this.name = "SecretsSDKError";
+  }
+};
+var OriginMismatchError = class extends SecretsSDKError {
+  constructor(message = "Origin not allowed for this token") {
+    super(message, 403);
+    this.name = "OriginMismatchError";
+  }
+};
+var RateLimitError = class extends SecretsSDKError {
+  constructor(message = "Rate limit exceeded", retryAfter = 60, remaining = 0, limit = 100) {
+    super(message, 429);
+    this.name = "RateLimitError";
+    this.retryAfter = retryAfter;
+    this.remaining = remaining;
+    this.limit = limit;
+  }
+};
+var InvalidTokenError = class extends SecretsSDKError {
+  constructor(message = "Invalid or expired token") {
+    super(message, 401);
+    this.name = "InvalidTokenError";
+  }
+};
+
+// src/client.ts
+var SecretsSDK = class {
+  /**
+   * Create a new SecretsSDK instance
+   *
+   * Zero-config mode (recommended for static sites):
+   *   const sdk = new SecretsSDK();
+   *   // Origin header is used for authentication
+   *
+   * Token mode (for backward compatibility):
+   *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+   */
+  constructor(options = {}) {
+    this.rateLimitInfo = null;
+    this.appId = options.appId || null;
+    this.token = options.token || options.sessionToken || null;
+    this.baseUrl = options.baseUrl || "https://cloudprototype.org";
+    this.timeout = options.timeout || 3e4;
+    this.retryOn429 = options.retryOn429 !== void 0 ? options.retryOn429 : true;
+    this.zeroConfigMode = !this.appId && !this.token;
+  }
+  /**
+   * Get current rate limit information
+   */
+  getUsage() {
+    return this.rateLimitInfo;
+  }
+  /**
+   * Parse rate limit headers from response
+   */
+  parseRateLimitHeaders(headers) {
+    const limit = headers.get("X-RateLimit-Limit");
+    const remaining = headers.get("X-RateLimit-Remaining");
+    const reset = headers.get("X-RateLimit-Reset");
+    if (limit && remaining && reset) {
+      this.rateLimitInfo = {
+        limit: parseInt(limit),
+        remaining: parseInt(remaining),
+        reset: parseInt(reset)
+      };
+    }
+  }
+  /**
+   * Sleep utility for retry backoff
+   */
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  /**
+   * Make fetch request with timeout
+   */
+  async fetchWithTimeout(url, options, timeout) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+      const response = await fetch(url, {
+        ...options,
+        signal: controller.signal
+      });
+      return response;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Call an external API securely through the proxy
+   * @param keyName - Name of the API key to use
+   * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
+   * @param options - Request options (method, body, headers)
+   * @returns Promise with the API response
+   */
+  async call(keyName, endpoint, options = {}) {
+    let retries = 0;
+    const maxRetries = this.retryOn429 ? 3 : 0;
+    while (true) {
+      try {
+        const proxyUrl = this.zeroConfigMode ? `${this.baseUrl}/api/sdk/proxy` : `${this.baseUrl}/api/sdk/${this.appId}/proxy`;
+        const requestHeaders = {
+          "Content-Type": "application/json"
+        };
+        if (!this.zeroConfigMode && this.token) {
+          requestHeaders["Authorization"] = `Bearer ${this.token}`;
+        }
+        const response = await this.fetchWithTimeout(
+          proxyUrl,
+          {
+            method: "POST",
+            headers: requestHeaders,
+            body: JSON.stringify({
+              keyName,
+              endpoint,
+              method: options.method || "GET",
+              body: options.body,
+              headers: options.headers
+            })
+          },
+          this.timeout
+        );
+        this.parseRateLimitHeaders(response.headers);
+        const result = await response.json();
+        if (!response.ok) {
+          const errorMessage = result.data?.message || result?.message || `Request failed with status ${response.status}`;
+          if (response.status === 403 && errorMessage.includes("Origin")) {
+            throw new OriginMismatchError(errorMessage);
+          }
+          if (response.status === 401) {
+            throw new InvalidTokenError(errorMessage);
+          }
+          if (response.status === 429) {
+            const retryAfter = this.rateLimitInfo ? this.rateLimitInfo.reset - Math.floor(Date.now() / 1e3) : 60;
+            const error = new RateLimitError(
+              errorMessage,
+              retryAfter,
+              this.rateLimitInfo?.remaining || 0,
+              this.rateLimitInfo?.limit || 100
+            );
+            if (this.retryOn429 && retries < maxRetries) {
+              retries++;
+              const backoffMs = Math.min(1e3 * Math.pow(2, retries - 1), 8e3);
+              await this.sleep(backoffMs);
+              continue;
+            }
+            throw error;
+          }
+          throw new SecretsSDKError(errorMessage, response.status, result);
+        }
+        return result.data;
+      } catch (err) {
+        if (err instanceof SecretsSDKError) {
+          throw err;
+        }
+        if (err instanceof Error && err.name === "AbortError") {
+          throw new SecretsSDKError("Request timeout", 408);
+        }
+        throw new SecretsSDKError(
+          err instanceof Error ? err.message : "Unknown error occurred",
+          500
+        );
+      }
+    }
+  }
+  /**
+   * Make a GET request
+   */
+  async get(keyName, endpoint, headers) {
+    return this.call(keyName, endpoint, { method: "GET", headers });
+  }
+  /**
+   * Make a POST request
+   */
+  async post(keyName, endpoint, body, headers) {
+    return this.call(keyName, endpoint, { method: "POST", body, headers });
+  }
+  /**
+   * Make a PUT request
+   */
+  async put(keyName, endpoint, body, headers) {
+    return this.call(keyName, endpoint, { method: "PUT", body, headers });
+  }
+  /**
+   * Make a DELETE request
+   */
+  async delete(keyName, endpoint, headers) {
+    return this.call(keyName, endpoint, { method: "DELETE", headers });
+  }
+  /**
+   * Make a PATCH request
+   */
+  async patch(keyName, endpoint, body, headers) {
+    return this.call(keyName, endpoint, { method: "PATCH", body, headers });
+  }
+  /**
+   * Secrets Management API (zero-config mode)
+   * These methods allow programmatic CRUD operations on project secrets
+   * Requires appId to be set (can be set in constructor or via setAppId)
+   */
+  /**
+   * Set App ID for secrets management
+   * Required before calling secrets management methods
+   */
+  setAppId(appId) {
+    this.appId = appId;
+  }
+  /**
+   * Make authenticated request to secrets management API
+   */
+  async secretsRequest(action, body) {
+    if (!this.appId) {
+      throw new SecretsSDKError("App ID required for secrets management. Call setAppId() first.", 400);
+    }
+    const response = await this.fetchWithTimeout(
+      `${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${action}`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: body ? JSON.stringify(body) : void 0
+      },
+      this.timeout
+    );
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new SecretsSDKError(
+        errorData.message || `Secrets management failed: ${response.statusText}`,
+        response.status,
+        errorData
+      );
+    }
+    return response.json();
+  }
+  /**
+   * List all secrets for the project
+   * Returns secret metadata (no API keys)
+   */
+  async listSecrets() {
+    return this.secretsRequest("list");
+  }
+  /**
+   * Create a new secret
+   */
+  async createSecret(secret) {
+    return this.secretsRequest("create", secret);
+  }
+  /**
+   * Update an existing secret
+   */
+  async updateSecret(update) {
+    return this.secretsRequest("update", update);
+  }
+  /**
+   * Delete a secret
+   */
+  async deleteSecret(name) {
+    return this.secretsRequest("delete", { name });
+  }
+  /**
+   * Sync secrets from .env file format
+   * Bulk upload/update secrets
+   */
+  async syncEnv(secrets, provider) {
+    return this.secretsRequest("sync", { secrets, provider });
+  }
+};
+
+// src/credentials.ts
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+function getCredentialsPath() {
+  const homeDir = os.homedir();
+  const learnDir = path.join(homeDir, ".learn");
+  return path.join(learnDir, "credentials.json");
+}
+function ensureLearnDir() {
+  const homeDir = os.homedir();
+  const learnDir = path.join(homeDir, ".learn");
+  if (!fs.existsSync(learnDir)) {
+    fs.mkdirSync(learnDir, { recursive: true, mode: 448 });
+  }
+}
+function readAllCredentials() {
+  try {
+    const credPath = getCredentialsPath();
+    if (!fs.existsSync(credPath)) {
+      return null;
+    }
+    const data = fs.readFileSync(credPath, "utf-8");
+    const store = JSON.parse(data);
+    if (store.access_token && !store["learn-secrets-sdk"] && !store["learn-auth-sdk"]) {
+      return {
+        "learn-secrets-sdk": store
+      };
+    }
+    return store;
+  } catch (err) {
+    return null;
+  }
+}
+function writeAllCredentials(store) {
+  ensureLearnDir();
+  const credPath = getCredentialsPath();
+  const data = JSON.stringify(store, null, 2);
+  fs.writeFileSync(credPath, data, { mode: 384 });
+}
+function readSDKCredentials(sdkName) {
+  const store = readAllCredentials();
+  if (!store) {
+    return null;
+  }
+  return store[sdkName] || null;
+}
+function writeSDKCredentials(sdkName, creds) {
+  const store = readAllCredentials() || {};
+  store[sdkName] = creds;
+  writeAllCredentials(store);
+}
+function deleteSDKCredentials(sdkName) {
+  const store = readAllCredentials();
+  if (!store) {
+    return;
+  }
+  delete store[sdkName];
+  if (Object.keys(store).length === 0) {
+    deleteCredentials();
+  } else {
+    writeAllCredentials(store);
+  }
+}
+function readCredentials() {
+  return readSDKCredentials("learn-secrets-sdk");
+}
+function deleteCredentials() {
+  try {
+    const credPath = getCredentialsPath();
+    if (fs.existsSync(credPath)) {
+      fs.unlinkSync(credPath);
+    }
+  } catch (err) {
+  }
+}
+function hasSDKCredentials(sdkName) {
+  const creds = readSDKCredentials(sdkName);
+  return creds !== null && !!creds.access_token;
+}
+function hasValidCredentials() {
+  const creds = readCredentials();
+  if (!creds) {
+    return false;
+  }
+  if (!creds.expires_at) {
+    return true;
+  }
+  const expiresAt = new Date(creds.expires_at);
+  const now = /* @__PURE__ */ new Date();
+  return expiresAt > now;
+}
+
+// src/machine-id.ts
+import { exec } from "child_process";
+import { promisify } from "util";
+import { createHash } from "crypto";
+import * as os2 from "os";
+var execAsync = promisify(exec);
+async function getMachineId() {
+  const platform2 = process.platform;
+  try {
+    let rawId;
+    if (platform2 === "darwin") {
+      rawId = await getMacOSId();
+    } else if (platform2 === "linux") {
+      rawId = await getLinuxId();
+    } else if (platform2 === "win32") {
+      rawId = await getWindowsId();
+    } else {
+      throw new Error(`Unsupported platform: ${platform2}`);
+    }
+    const machineId = createHash("sha256").update(rawId).digest("hex").substring(0, 32);
+    const fingerprintData = JSON.stringify({
+      machineId,
+      cpus: os2.cpus().length,
+      arch: os2.arch(),
+      platform: os2.platform(),
+      homedir: os2.homedir()
+    });
+    const fingerprint = createHash("sha256").update(fingerprintData).digest("hex");
+    return { machineId, fingerprint };
+  } catch (error) {
+    throw new Error(`Failed to get machine ID: ${error.message}`);
+  }
+}
+async function getMacOSId() {
+  try {
+    const { stdout: serial } = await execAsync(
+      `ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`
+    );
+    const { stdout: hostname } = await execAsync("hostname");
+    const serialTrimmed = serial.trim();
+    const hostnameTrimmed = hostname.trim();
+    if (serialTrimmed && hostnameTrimmed) {
+      return `${serialTrimmed}-${hostnameTrimmed}`;
+    }
+    const { stdout: uuid } = await execAsync(
+      `ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`
+    );
+    return uuid.trim();
+  } catch (error) {
+    throw new Error("Failed to get macOS machine ID");
+  }
+}
+async function getLinuxId() {
+  try {
+    const { stdout } = await execAsync(
+      "cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"
+    );
+    const machineId = stdout.trim();
+    if (machineId) {
+      return machineId;
+    }
+    throw new Error("Machine ID file not found");
+  } catch (error) {
+    throw new Error("Failed to get Linux machine ID");
+  }
+}
+async function getWindowsId() {
+  try {
+    const { stdout } = await execAsync("wmic csproduct get uuid");
+    const lines = stdout.split("\n").map((l) => l.trim());
+    const uuid = lines.find((l) => l && l !== "UUID");
+    if (uuid) {
+      return uuid;
+    }
+    throw new Error("Failed to parse machine UUID from WMIC");
+  } catch (error) {
+    throw new Error("Failed to get Windows machine ID");
+  }
+}
+
+// src/management.ts
+var SecretsManagement = class {
+  constructor(options) {
+    this.appId = options.appId;
+    this.baseUrl = options.baseUrl || "https://cloudprototype.org";
+    this.timeout = options.timeout || 3e4;
+  }
+  /**
+   * Open a URL in the default browser
+   */
+  async openBrowser(url) {
+    const { exec: exec2 } = await import("child_process");
+    const { promisify: promisify2 } = await import("util");
+    const execAsync2 = promisify2(exec2);
+    const platform2 = process.platform;
+    try {
+      if (platform2 === "darwin") {
+        await execAsync2(`open "${url}"`);
+      } else if (platform2 === "win32") {
+        await execAsync2(`start "${url}"`);
+      } else {
+        await execAsync2(`xdg-open "${url}"`);
+      }
+    } catch (err) {
+      console.error("Failed to open browser:", err);
+      throw new SecretsSDKError("Failed to open browser", 500);
+    }
+  }
+  /**
+   * Sleep for specified milliseconds
+   */
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  /**
+   * Browser OAuth login flow with 2FA
+   * Opens browser for user to authorize, then prompts for 2FA code
+   */
+  async login() {
+    const SDK_NAME = "learn-secrets-sdk";
+    try {
+      console.log(`Authenticating with Learn (${SDK_NAME})...
+`);
+      const machineInfo = await getMachineId();
+      const existingCreds = readSDKCredentials(SDK_NAME);
+      if (existingCreds && existingCreds.access_token) {
+        const checkResponse = await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            machine_id: machineInfo.machineId,
+            sdk_name: SDK_NAME
+          })
+        });
+        if (checkResponse.ok) {
+          const checkData = await checkResponse.json();
+          if (checkData.authorized) {
+            console.log("This machine is already authorized.");
+            console.log(`Logged in as: ${checkData.user_email || checkData.user_id}`);
+            return {
+              success: true,
+              user: checkData.user_email || checkData.user_id
+            };
+          }
+        }
+      }
+      const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        }
+      });
+      if (!deviceResponse.ok) {
+        throw new SecretsSDKError(
+          "Failed to generate device code",
+          deviceResponse.status
+        );
+      }
+      const deviceData = await deviceResponse.json();
+      console.log(`
+Log in on ${this.baseUrl}`);
+      console.log("Login at:");
+      console.log(deviceData.verification_uri_complete);
+      console.log("\nPress ENTER to open in the browser...");
+      const readline = await import("readline");
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      await new Promise((resolve) => {
+        rl.question("", () => {
+          rl.close();
+          resolve();
+        });
+      });
+      console.log("Opening browser...\n");
+      await this.openBrowser(deviceData.verification_uri_complete);
+      let tokenData = null;
+      const interval = deviceData.interval * 1e3;
+      const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
+      let attempts = 0;
+      while (attempts < maxAttempts) {
+        await this.sleep(interval);
+        attempts++;
+        const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            device_code: deviceData.device_code
+          })
+        });
+        if (tokenResponse.status === 202) {
+          process.stdout.write(".");
+          continue;
+        }
+        if (tokenResponse.ok) {
+          tokenData = await tokenResponse.json();
+          break;
+        }
+      }
+      if (!tokenData) {
+        throw new SecretsSDKError("Device authorization timeout", 408);
+      }
+      console.log("\n\nDevice authorized! Retrieving access token...");
+      writeSDKCredentials(SDK_NAME, {
+        access_token: tokenData.access_token,
+        refresh_token: null,
+        expires_at: null,
+        user_id: tokenData.user_id,
+        machine_id: machineInfo.machineId,
+        sdk_name: SDK_NAME,
+        authorized_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      console.log("\nAuthentication successful!");
+      console.log(`Logged in as: ${tokenData.user_email || tokenData.user_id}`);
+      console.log("This machine is now permanently authorized.\n");
+      return {
+        success: true,
+        user: tokenData.user_email || tokenData.user_id
+      };
+    } catch (err) {
+      if (err instanceof SecretsSDKError) {
+        throw err;
+      }
+      throw new SecretsSDKError(
+        err.message || "Login failed",
+        err.status || 500
+      );
+    }
+  }
+  /**
+   * Check if user is authenticated
+   */
+  async isAuthenticated() {
+    return hasValidCredentials();
+  }
+  /**
+   * Logout - clear stored credentials
+   */
+  logout() {
+    deleteCredentials();
+    console.log("Logged out successfully");
+  }
+  /**
+   * Get access token from stored credentials
+   * Throws error if not authenticated
+   */
+  getAccessToken() {
+    const creds = readCredentials();
+    if (!creds) {
+      throw new SecretsSDKError("Not authenticated. Run login() first.", 401);
+    }
+    if (creds.expires_at) {
+      const expiresAt = new Date(creds.expires_at);
+      const now = /* @__PURE__ */ new Date();
+      if (expiresAt <= now) {
+        throw new SecretsSDKError("Token expired. Run login() again.", 401);
+      }
+    }
+    return creds.access_token;
+  }
+  /**
+   * Make authenticated request
+   */
+  async request(method, path2, body) {
+    const token = this.getAccessToken();
+    const options = {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      }
+    };
+    if (body) {
+      options.body = JSON.stringify(body);
+    }
+    const response = await fetch(`${this.baseUrl}${path2}`, options);
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new SecretsSDKError(
+        errorData.message || `Request failed: ${response.statusText}`,
+        response.status,
+        errorData
+      );
+    }
+    return response.json();
+  }
+  /**
+   * List all secrets (with masked API keys)
+   */
+  async list() {
+    const response = await this.request(
+      "GET",
+      `/api/projects/${this.appId}/secrets`
+    );
+    return response.secrets;
+  }
+  /**
+   * Sync secrets from config
+   */
+  async sync(secrets, options) {
+    const response = await this.request(
+      "POST",
+      `/api/projects/${this.appId}/secrets/sync`,
+      {
+        secrets,
+        options: {
+          deleteMissing: options?.deleteMissing ?? false,
+          dryRun: options?.dryRun ?? false
+        }
+      }
+    );
+    return response;
+  }
+  /**
+   * Import secrets from a config object (bulk import)
+   * Also creates SDK token if origins are provided
+   *
+   * @param config - The secrets configuration
+   * @returns Import results including created/updated counts and optional SDK token
+   */
+  async importSecrets(config) {
+    return this.request(
+      "POST",
+      `/api/projects/${this.appId}/import-secrets`,
+      {
+        version: config.version || "1.0",
+        origins: config.origins,
+        secrets: config.secrets
+      }
+    );
+  }
+  /**
+   * Import secrets from a JSON file path
+   * Resolves environment variables in the config
+   */
+  async importFromFile(configPath) {
+    const { loadSecretsConfig: loadSecretsConfig2 } = await import("./env-resolver-FQMR3R4G.mjs");
+    const config = loadSecretsConfig2(configPath);
+    return this.importSecrets(config);
+  }
+};
+
+// src/worker-client.ts
+var WorkerClient = class {
+  constructor(options) {
+    this.workerUrl = options.workerUrl.replace(/\/$/, "");
+  }
+  /**
+   * Get public configuration
+   *
+   * Returns only PUBLIC_* environment variables from Worker
+   * Safe for frontend use
+   */
+  async getConfig() {
+    const response = await fetch(`${this.workerUrl}/config`, {
+      method: "GET",
+      credentials: "include"
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to get config: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return data.public || {};
+  }
+  /**
+   * Proxy API request with secret injection
+   *
+   * Makes API call through Worker which injects secret server-side
+   * Secret never reaches browser
+   *
+   * @param request - Proxy request configuration
+   * @returns API response data
+   */
+  async proxy(request) {
+    const response = await fetch(`${this.workerUrl}/proxy`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      credentials: "include",
+      body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Unknown error" }));
+      throw new Error(error.error || `Proxy request failed: ${response.status}`);
+    }
+    return response.json();
+  }
+  /**
+   * Generate Apple Music JWT
+   *
+   * Private key stays in Worker, only JWT returned to frontend
+   *
+   * @param request - Apple JWT request with secret name
+   * @returns JWT token
+   */
+  async generateAppleJwt(request) {
+    const response = await fetch(`${this.workerUrl}/auth/apple-jwt`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      credentials: "include",
+      body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Unknown error" }));
+      throw new Error(error.error || `Apple JWT generation failed: ${response.status}`);
+    }
+    const data = await response.json();
+    return data.token;
+  }
+  /**
+   * Exchange OAuth authorization code for access token
+   *
+   * Client secret stays in Worker, tokens returned to frontend
+   *
+   * @param request - OAuth exchange request
+   * @returns OAuth token response
+   */
+  async exchangeOAuthCode(request) {
+    const response = await fetch(`${this.workerUrl}/auth/oauth`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      credentials: "include",
+      body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Unknown error" }));
+      throw new Error(error.error || `OAuth exchange failed: ${response.status}`);
+    }
+    return response.json();
+  }
+  /**
+   * Health check
+   */
+  async health() {
+    const response = await fetch(`${this.workerUrl}/health`, {
+      method: "GET"
+    });
+    if (!response.ok) {
+      throw new Error(`Health check failed: ${response.status}`);
+    }
+    return response.json();
+  }
+};
+export {
+  InvalidTokenError,
+  OriginMismatchError,
+  RateLimitError,
+  SecretsManagement,
+  SecretsSDK,
+  SecretsSDKError,
+  WorkerClient,
+  deleteSDKCredentials,
+  getMachineId,
+  hasSDKCredentials,
+  loadSecretsConfig,
+  readAllCredentials,
+  readSDKCredentials,
+  resolveEnvInSecret,
+  resolveEnvInSecrets,
+  resolveEnvString,
+  writeAllCredentials,
+  writeSDKCredentials
+};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.11.1",
+	"version": "1.11.3",
 	"description": "Secrets management SDK for static sites with Learn platform",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
@@ -39,7 +39,7 @@
 		"typescript": "^5.0.0"
 	},
 	"scripts": {
-		"build": "tsup src/index.ts --format esm,iife --dts --minify --global-name SecretsSDK && tsup src/cli/index.ts --format esm --dts --out-dir dist/cli --external commander",
+		"build": "tsup src/index.ts --format esm --dts && tsup src/browser.ts --format iife --minify --global-name SecretsSDK && tsup src/cli/index.ts --format esm --dts --out-dir dist/cli --external commander",
 		"prepublishOnly": "npm run build"
 	}
 }