learn-secrets-sdk 1.11.7 → 1.11.12

package/dist/browser.global.js

@@ -1,862 +0,0 @@
-/**
- * SecretsSDK - Browser Global Build
- * Usage: const sdk = new SecretsSDK();
- */
-(function(global) {
-  'use strict';
-  
-  import {
-  loadSecretsConfig,
-  resolveEnvInSecret,
-  resolveEnvInSecrets,
-  resolveEnvString
-} from "./chunk-Y4RHJLDQ.mjs";
-
-// src/types.ts
-var SecretsSDKError = class extends Error {
-  constructor(message, status, response) {
-    super(message);
-    this.status = status;
-    this.response = response;
-    this.name = "SecretsSDKError";
-  }
-};
-var OriginMismatchError = class extends SecretsSDKError {
-  constructor(message = "Origin not allowed for this token") {
-    super(message, 403);
-    this.name = "OriginMismatchError";
-  }
-};
-var RateLimitError = class extends SecretsSDKError {
-  constructor(message = "Rate limit exceeded", retryAfter = 60, remaining = 0, limit = 100) {
-    super(message, 429);
-    this.name = "RateLimitError";
-    this.retryAfter = retryAfter;
-    this.remaining = remaining;
-    this.limit = limit;
-  }
-};
-var InvalidTokenError = class extends SecretsSDKError {
-  constructor(message = "Invalid or expired token") {
-    super(message, 401);
-    this.name = "InvalidTokenError";
-  }
-};
-
-// src/client.ts
-var SecretsSDK = class {
-  /**
-   * Create a new SecretsSDK instance
-   *
-   * Zero-config mode (recommended for static sites):
-   *   const sdk = new SecretsSDK();
-   *   // Origin header is used for authentication
-   *
-   * Token mode (for backward compatibility):
-   *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
-   */
-  constructor(options = {}) {
-    this.rateLimitInfo = null;
-    this.appId = options.appId || null;
-    this.token = options.token || options.sessionToken || null;
-    this.baseUrl = options.baseUrl || "https://cloudprototype.org";
-    this.timeout = options.timeout || 3e4;
-    this.retryOn429 = options.retryOn429 !== void 0 ? options.retryOn429 : true;
-    this.zeroConfigMode = !this.appId && !this.token;
-  }
-  /**
-   * Get current rate limit information
-   */
-  getUsage() {
-    return this.rateLimitInfo;
-  }
-  /**
-   * Parse rate limit headers from response
-   */
-  parseRateLimitHeaders(headers) {
-    const limit = headers.get("X-RateLimit-Limit");
-    const remaining = headers.get("X-RateLimit-Remaining");
-    const reset = headers.get("X-RateLimit-Reset");
-    if (limit && remaining && reset) {
-      this.rateLimitInfo = {
-        limit: parseInt(limit),
-        remaining: parseInt(remaining),
-        reset: parseInt(reset)
-      };
-    }
-  }
-  /**
-   * Sleep utility for retry backoff
-   */
-  sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-  /**
-   * Make fetch request with timeout
-   */
-  async fetchWithTimeout(url, options, timeout) {
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeout);
-    try {
-      const response = await fetch(url, {
-        ...options,
-        signal: controller.signal
-      });
-      return response;
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  }
-  /**
-   * Call an external API securely through the proxy
-   * @param keyName - Name of the API key to use
-   * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
-   * @param options - Request options (method, body, headers)
-   * @returns Promise with the API response
-   */
-  async call(keyName, endpoint, options = {}) {
-    let retries = 0;
-    const maxRetries = this.retryOn429 ? 3 : 0;
-    while (true) {
-      try {
-        const proxyUrl = this.zeroConfigMode ? `${this.baseUrl}/api/sdk/proxy` : `${this.baseUrl}/api/sdk/${this.appId}/proxy`;
-        const requestHeaders = {
-          "Content-Type": "application/json"
-        };
-        if (!this.zeroConfigMode && this.token) {
-          requestHeaders["Authorization"] = `Bearer ${this.token}`;
-        }
-        const response = await this.fetchWithTimeout(
-          proxyUrl,
-          {
-            method: "POST",
-            headers: requestHeaders,
-            body: JSON.stringify({
-              keyName,
-              endpoint,
-              method: options.method || "GET",
-              body: options.body,
-              headers: options.headers
-            })
-          },
-          this.timeout
-        );
-        this.parseRateLimitHeaders(response.headers);
-        const result = await response.json();
-        if (!response.ok) {
-          const errorMessage = result.data?.message || result?.message || `Request failed with status ${response.status}`;
-          if (response.status === 403 && errorMessage.includes("Origin")) {
-            throw new OriginMismatchError(errorMessage);
-          }
-          if (response.status === 401) {
-            throw new InvalidTokenError(errorMessage);
-          }
-          if (response.status === 429) {
-            const retryAfter = this.rateLimitInfo ? this.rateLimitInfo.reset - Math.floor(Date.now() / 1e3) : 60;
-            const error = new RateLimitError(
-              errorMessage,
-              retryAfter,
-              this.rateLimitInfo?.remaining || 0,
-              this.rateLimitInfo?.limit || 100
-            );
-            if (this.retryOn429 && retries < maxRetries) {
-              retries++;
-              const backoffMs = Math.min(1e3 * Math.pow(2, retries - 1), 8e3);
-              await this.sleep(backoffMs);
-              continue;
-            }
-            throw error;
-          }
-          throw new SecretsSDKError(errorMessage, response.status, result);
-        }
-        return result.data;
-      } catch (err) {
-        if (err instanceof SecretsSDKError) {
-          throw err;
-        }
-        if (err instanceof Error && err.name === "AbortError") {
-          throw new SecretsSDKError("Request timeout", 408);
-        }
-        throw new SecretsSDKError(
-          err instanceof Error ? err.message : "Unknown error occurred",
-          500
-        );
-      }
-    }
-  }
-  /**
-   * Make a GET request
-   */
-  async get(keyName, endpoint, headers) {
-    return this.call(keyName, endpoint, { method: "GET", headers });
-  }
-  /**
-   * Make a POST request
-   */
-  async post(keyName, endpoint, body, headers) {
-    return this.call(keyName, endpoint, { method: "POST", body, headers });
-  }
-  /**
-   * Make a PUT request
-   */
-  async put(keyName, endpoint, body, headers) {
-    return this.call(keyName, endpoint, { method: "PUT", body, headers });
-  }
-  /**
-   * Make a DELETE request
-   */
-  async delete(keyName, endpoint, headers) {
-    return this.call(keyName, endpoint, { method: "DELETE", headers });
-  }
-  /**
-   * Make a PATCH request
-   */
-  async patch(keyName, endpoint, body, headers) {
-    return this.call(keyName, endpoint, { method: "PATCH", body, headers });
-  }
-  /**
-   * Secrets Management API (zero-config mode)
-   * These methods allow programmatic CRUD operations on project secrets
-   * Requires appId to be set (can be set in constructor or via setAppId)
-   */
-  /**
-   * Set App ID for secrets management
-   * Required before calling secrets management methods
-   */
-  setAppId(appId) {
-    this.appId = appId;
-  }
-  /**
-   * Make authenticated request to secrets management API
-   */
-  async secretsRequest(action, body) {
-    if (!this.appId) {
-      throw new SecretsSDKError("App ID required for secrets management. Call setAppId() first.", 400);
-    }
-    const response = await this.fetchWithTimeout(
-      `${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${action}`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: body ? JSON.stringify(body) : void 0
-      },
-      this.timeout
-    );
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new SecretsSDKError(
-        errorData.message || `Secrets management failed: ${response.statusText}`,
-        response.status,
-        errorData
-      );
-    }
-    return response.json();
-  }
-  /**
-   * List all secrets for the project
-   * Returns secret metadata (no API keys)
-   */
-  async listSecrets() {
-    return this.secretsRequest("list");
-  }
-  /**
-   * Create a new secret
-   */
-  async createSecret(secret) {
-    return this.secretsRequest("create", secret);
-  }
-  /**
-   * Update an existing secret
-   */
-  async updateSecret(update) {
-    return this.secretsRequest("update", update);
-  }
-  /**
-   * Delete a secret
-   */
-  async deleteSecret(name) {
-    return this.secretsRequest("delete", { name });
-  }
-  /**
-   * Sync secrets from .env file format
-   * Bulk upload/update secrets
-   */
-  async syncEnv(secrets, provider) {
-    return this.secretsRequest("sync", { secrets, provider });
-  }
-};
-
-// src/credentials.ts
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
-function getCredentialsPath() {
-  const homeDir = os.homedir();
-  const learnDir = path.join(homeDir, ".learn");
-  return path.join(learnDir, "credentials.json");
-}
-function ensureLearnDir() {
-  const homeDir = os.homedir();
-  const learnDir = path.join(homeDir, ".learn");
-  if (!fs.existsSync(learnDir)) {
-    fs.mkdirSync(learnDir, { recursive: true, mode: 448 });
-  }
-}
-function readAllCredentials() {
-  try {
-    const credPath = getCredentialsPath();
-    if (!fs.existsSync(credPath)) {
-      return null;
-    }
-    const data = fs.readFileSync(credPath, "utf-8");
-    const store = JSON.parse(data);
-    if (store.access_token && !store["learn-secrets-sdk"] && !store["learn-auth-sdk"]) {
-      return {
-        "learn-secrets-sdk": store
-      };
-    }
-    return store;
-  } catch (err) {
-    return null;
-  }
-}
-function writeAllCredentials(store) {
-  ensureLearnDir();
-  const credPath = getCredentialsPath();
-  const data = JSON.stringify(store, null, 2);
-  fs.writeFileSync(credPath, data, { mode: 384 });
-}
-function readSDKCredentials(sdkName) {
-  const store = readAllCredentials();
-  if (!store) {
-    return null;
-  }
-  return store[sdkName] || null;
-}
-function writeSDKCredentials(sdkName, creds) {
-  const store = readAllCredentials() || {};
-  store[sdkName] = creds;
-  writeAllCredentials(store);
-}
-function deleteSDKCredentials(sdkName) {
-  const store = readAllCredentials();
-  if (!store) {
-    return;
-  }
-  delete store[sdkName];
-  if (Object.keys(store).length === 0) {
-    deleteCredentials();
-  } else {
-    writeAllCredentials(store);
-  }
-}
-function readCredentials() {
-  return readSDKCredentials("learn-secrets-sdk");
-}
-function deleteCredentials() {
-  try {
-    const credPath = getCredentialsPath();
-    if (fs.existsSync(credPath)) {
-      fs.unlinkSync(credPath);
-    }
-  } catch (err) {
-  }
-}
-function hasSDKCredentials(sdkName) {
-  const creds = readSDKCredentials(sdkName);
-  return creds !== null && !!creds.access_token;
-}
-function hasValidCredentials() {
-  const creds = readCredentials();
-  if (!creds) {
-    return false;
-  }
-  if (!creds.expires_at) {
-    return true;
-  }
-  const expiresAt = new Date(creds.expires_at);
-  const now = /* @__PURE__ */ new Date();
-  return expiresAt > now;
-}
-
-// src/machine-id.ts
-import { exec } from "child_process";
-import { promisify } from "util";
-import { createHash } from "crypto";
-import * as os2 from "os";
-var execAsync = promisify(exec);
-async function getMachineId() {
-  const platform2 = process.platform;
-  try {
-    let rawId;
-    if (platform2 === "darwin") {
-      rawId = await getMacOSId();
-    } else if (platform2 === "linux") {
-      rawId = await getLinuxId();
-    } else if (platform2 === "win32") {
-      rawId = await getWindowsId();
-    } else {
-      throw new Error(`Unsupported platform: ${platform2}`);
-    }
-    const machineId = createHash("sha256").update(rawId).digest("hex").substring(0, 32);
-    const fingerprintData = JSON.stringify({
-      machineId,
-      cpus: os2.cpus().length,
-      arch: os2.arch(),
-      platform: os2.platform(),
-      homedir: os2.homedir()
-    });
-    const fingerprint = createHash("sha256").update(fingerprintData).digest("hex");
-    return { machineId, fingerprint };
-  } catch (error) {
-    throw new Error(`Failed to get machine ID: ${error.message}`);
-  }
-}
-async function getMacOSId() {
-  try {
-    const { stdout: serial } = await execAsync(
-      `ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`
-    );
-    const { stdout: hostname } = await execAsync("hostname");
-    const serialTrimmed = serial.trim();
-    const hostnameTrimmed = hostname.trim();
-    if (serialTrimmed && hostnameTrimmed) {
-      return `${serialTrimmed}-${hostnameTrimmed}`;
-    }
-    const { stdout: uuid } = await execAsync(
-      `ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`
-    );
-    return uuid.trim();
-  } catch (error) {
-    throw new Error("Failed to get macOS machine ID");
-  }
-}
-async function getLinuxId() {
-  try {
-    const { stdout } = await execAsync(
-      "cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"
-    );
-    const machineId = stdout.trim();
-    if (machineId) {
-      return machineId;
-    }
-    throw new Error("Machine ID file not found");
-  } catch (error) {
-    throw new Error("Failed to get Linux machine ID");
-  }
-}
-async function getWindowsId() {
-  try {
-    const { stdout } = await execAsync("wmic csproduct get uuid");
-    const lines = stdout.split("\n").map((l) => l.trim());
-    const uuid = lines.find((l) => l && l !== "UUID");
-    if (uuid) {
-      return uuid;
-    }
-    throw new Error("Failed to parse machine UUID from WMIC");
-  } catch (error) {
-    throw new Error("Failed to get Windows machine ID");
-  }
-}
-
-// src/management.ts
-var SecretsManagement = class {
-  constructor(options) {
-    this.appId = options.appId;
-    this.baseUrl = options.baseUrl || "https://cloudprototype.org";
-    this.timeout = options.timeout || 3e4;
-  }
-  /**
-   * Open a URL in the default browser
-   */
-  async openBrowser(url) {
-    const { exec: exec2 } = await import("child_process");
-    const { promisify: promisify2 } = await import("util");
-    const execAsync2 = promisify2(exec2);
-    const platform2 = process.platform;
-    try {
-      if (platform2 === "darwin") {
-        await execAsync2(`open "${url}"`);
-      } else if (platform2 === "win32") {
-        await execAsync2(`start "${url}"`);
-      } else {
-        await execAsync2(`xdg-open "${url}"`);
-      }
-    } catch (err) {
-      console.error("Failed to open browser:", err);
-      throw new SecretsSDKError("Failed to open browser", 500);
-    }
-  }
-  /**
-   * Sleep for specified milliseconds
-   */
-  sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-  /**
-   * Browser OAuth login flow with 2FA
-   * Opens browser for user to authorize, then prompts for 2FA code
-   */
-  async login() {
-    const SDK_NAME = "learn-secrets-sdk";
-    try {
-      console.log(`Authenticating with Learn (${SDK_NAME})...
-`);
-      const machineInfo = await getMachineId();
-      const existingCreds = readSDKCredentials(SDK_NAME);
-      if (existingCreds && existingCreds.access_token) {
-        const checkResponse = await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify({
-            machine_id: machineInfo.machineId,
-            sdk_name: SDK_NAME
-          })
-        });
-        if (checkResponse.ok) {
-          const checkData = await checkResponse.json();
-          if (checkData.authorized) {
-            console.log("This machine is already authorized.");
-            console.log(`Logged in as: ${checkData.user_email || checkData.user_id}`);
-            return {
-              success: true,
-              user: checkData.user_email || checkData.user_id
-            };
-          }
-        }
-      }
-      const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        }
-      });
-      if (!deviceResponse.ok) {
-        throw new SecretsSDKError(
-          "Failed to generate device code",
-          deviceResponse.status
-        );
-      }
-      const deviceData = await deviceResponse.json();
-      console.log(`
-Log in on ${this.baseUrl}`);
-      console.log("Login at:");
-      console.log(deviceData.verification_uri_complete);
-      console.log("\nPress ENTER to open in the browser...");
-      const readline = await import("readline");
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      await new Promise((resolve) => {
-        rl.question("", () => {
-          rl.close();
-          resolve();
-        });
-      });
-      console.log("Opening browser...\n");
-      await this.openBrowser(deviceData.verification_uri_complete);
-      let tokenData = null;
-      const interval = deviceData.interval * 1e3;
-      const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
-      let attempts = 0;
-      while (attempts < maxAttempts) {
-        await this.sleep(interval);
-        attempts++;
-        const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify({
-            device_code: deviceData.device_code
-          })
-        });
-        if (tokenResponse.status === 202) {
-          process.stdout.write(".");
-          continue;
-        }
-        if (tokenResponse.ok) {
-          tokenData = await tokenResponse.json();
-          break;
-        }
-      }
-      if (!tokenData) {
-        throw new SecretsSDKError("Device authorization timeout", 408);
-      }
-      console.log("\n\nDevice authorized! Retrieving access token...");
-      writeSDKCredentials(SDK_NAME, {
-        access_token: tokenData.access_token,
-        refresh_token: null,
-        expires_at: null,
-        user_id: tokenData.user_id,
-        machine_id: machineInfo.machineId,
-        sdk_name: SDK_NAME,
-        authorized_at: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      console.log("\nAuthentication successful!");
-      console.log(`Logged in as: ${tokenData.user_email || tokenData.user_id}`);
-      console.log("This machine is now permanently authorized.\n");
-      return {
-        success: true,
-        user: tokenData.user_email || tokenData.user_id
-      };
-    } catch (err) {
-      if (err instanceof SecretsSDKError) {
-        throw err;
-      }
-      throw new SecretsSDKError(
-        err.message || "Login failed",
-        err.status || 500
-      );
-    }
-  }
-  /**
-   * Check if user is authenticated
-   */
-  async isAuthenticated() {
-    return hasValidCredentials();
-  }
-  /**
-   * Logout - clear stored credentials
-   */
-  logout() {
-    deleteCredentials();
-    console.log("Logged out successfully");
-  }
-  /**
-   * Get access token from stored credentials
-   * Throws error if not authenticated
-   */
-  getAccessToken() {
-    const creds = readCredentials();
-    if (!creds) {
-      throw new SecretsSDKError("Not authenticated. Run login() first.", 401);
-    }
-    if (creds.expires_at) {
-      const expiresAt = new Date(creds.expires_at);
-      const now = /* @__PURE__ */ new Date();
-      if (expiresAt <= now) {
-        throw new SecretsSDKError("Token expired. Run login() again.", 401);
-      }
-    }
-    return creds.access_token;
-  }
-  /**
-   * Make authenticated request
-   */
-  async request(method, path2, body) {
-    const token = this.getAccessToken();
-    const options = {
-      method,
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${token}`
-      }
-    };
-    if (body) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(`${this.baseUrl}${path2}`, options);
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new SecretsSDKError(
-        errorData.message || `Request failed: ${response.statusText}`,
-        response.status,
-        errorData
-      );
-    }
-    return response.json();
-  }
-  /**
-   * List all secrets (with masked API keys)
-   */
-  async list() {
-    const response = await this.request(
-      "GET",
-      `/api/projects/${this.appId}/secrets`
-    );
-    return response.secrets;
-  }
-  /**
-   * Sync secrets from config
-   */
-  async sync(secrets, options) {
-    const response = await this.request(
-      "POST",
-      `/api/projects/${this.appId}/secrets/sync`,
-      {
-        secrets,
-        options: {
-          deleteMissing: options?.deleteMissing ?? false,
-          dryRun: options?.dryRun ?? false
-        }
-      }
-    );
-    return response;
-  }
-  /**
-   * Import secrets from a config object (bulk import)
-   * Also creates SDK token if origins are provided
-   *
-   * @param config - The secrets configuration
-   * @returns Import results including created/updated counts and optional SDK token
-   */
-  async importSecrets(config) {
-    return this.request(
-      "POST",
-      `/api/projects/${this.appId}/import-secrets`,
-      {
-        version: config.version || "1.0",
-        origins: config.origins,
-        secrets: config.secrets
-      }
-    );
-  }
-  /**
-   * Import secrets from a JSON file path
-   * Resolves environment variables in the config
-   */
-  async importFromFile(configPath) {
-    const { loadSecretsConfig: loadSecretsConfig2 } = await import("./env-resolver-FQMR3R4G.mjs");
-    const config = loadSecretsConfig2(configPath);
-    return this.importSecrets(config);
-  }
-};
-
-// src/worker-client.ts
-var WorkerClient = class {
-  constructor(options) {
-    this.workerUrl = options.workerUrl.replace(/\/$/, "");
-  }
-  /**
-   * Get public configuration
-   *
-   * Returns only PUBLIC_* environment variables from Worker
-   * Safe for frontend use
-   */
-  async getConfig() {
-    const response = await fetch(`${this.workerUrl}/config`, {
-      method: "GET",
-      credentials: "include"
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to get config: ${response.status} ${response.statusText}`);
-    }
-    const data = await response.json();
-    return data.public || {};
-  }
-  /**
-   * Proxy API request with secret injection
-   *
-   * Makes API call through Worker which injects secret server-side
-   * Secret never reaches browser
-   *
-   * @param request - Proxy request configuration
-   * @returns API response data
-   */
-  async proxy(request) {
-    const response = await fetch(`${this.workerUrl}/proxy`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      credentials: "include",
-      body: JSON.stringify(request)
-    });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ error: "Unknown error" }));
-      throw new Error(error.error || `Proxy request failed: ${response.status}`);
-    }
-    return response.json();
-  }
-  /**
-   * Generate Apple Music JWT
-   *
-   * Private key stays in Worker, only JWT returned to frontend
-   *
-   * @param request - Apple JWT request with secret name
-   * @returns JWT token
-   */
-  async generateAppleJwt(request) {
-    const response = await fetch(`${this.workerUrl}/auth/apple-jwt`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      credentials: "include",
-      body: JSON.stringify(request)
-    });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ error: "Unknown error" }));
-      throw new Error(error.error || `Apple JWT generation failed: ${response.status}`);
-    }
-    const data = await response.json();
-    return data.token;
-  }
-  /**
-   * Exchange OAuth authorization code for access token
-   *
-   * Client secret stays in Worker, tokens returned to frontend
-   *
-   * @param request - OAuth exchange request
-   * @returns OAuth token response
-   */
-  async exchangeOAuthCode(request) {
-    const response = await fetch(`${this.workerUrl}/auth/oauth`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      credentials: "include",
-      body: JSON.stringify(request)
-    });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ error: "Unknown error" }));
-      throw new Error(error.error || `OAuth exchange failed: ${response.status}`);
-    }
-    return response.json();
-  }
-  /**
-   * Health check
-   */
-  async health() {
-    const response = await fetch(`${this.workerUrl}/health`, {
-      method: "GET"
-    });
-    if (!response.ok) {
-      throw new Error(`Health check failed: ${response.status}`);
-    }
-    return response.json();
-  }
-};
-{
-  InvalidTokenError,
-  OriginMismatchError,
-  RateLimitError,
-  SecretsManagement,
-  SecretsSDK,
-  SecretsSDKError,
-  WorkerClient,
-  deleteSDKCredentials,
-  getMachineId,
-  hasSDKCredentials,
-  loadSecretsConfig,
-  readAllCredentials,
-  readSDKCredentials,
-  resolveEnvInSecret,
-  resolveEnvInSecrets,
-  resolveEnvString,
-  writeAllCredentials,
-  writeSDKCredentials
-};
-
-  
-  // Expose SecretsSDK class as global
-  global.SecretsSDK = SecretsSDK;
-  
-})(typeof window !== 'undefined' ? window : this);