learn-secrets-sdk 1.11.7 → 1.11.12

package/dist/chunk-AS6G7JYX.mjs

@@ -1 +0,0 @@
-var f=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(r,t)=>(typeof require<"u"?require:r)[t]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});function i(e){return e.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g,(r,t,o)=>{let s=t||o,n=process.env[s];if(n===void 0)throw new Error(`Environment variable ${s} is not defined`);return n})}function c(e){let r={name:i(e.name),provider:i(e.provider),api_key:i(e.api_key)};return e.base_url&&(r.base_url=i(e.base_url)),e.auth_header&&(r.auth_header=i(e.auth_header)),e.auth_prefix&&(r.auth_prefix=i(e.auth_prefix)),r}function p(e){return e.map(c)}function g(e){let r=f("fs"),o=f("path").resolve(e);if(!r.existsSync(o))throw new Error(`Config file not found: ${o}`);let s=r.readFileSync(o,"utf-8"),n=JSON.parse(s);if(!n.version)throw new Error('Config file missing "version" field');if(!n.project)throw new Error('Config file missing "project" field');if(!Array.isArray(n.secrets))throw new Error('Config file missing "secrets" array');let a=p(n.secrets);return{version:n.version,project:n.project,secrets:a}}export{i as a,c as b,p as c,g as d};

package/dist/env-resolver-Y4SFGOKB.mjs

@@ -1 +0,0 @@
-import{a,b,c,d}from"./chunk-AS6G7JYX.mjs";export{d as loadSecretsConfig,b as resolveEnvInSecret,c as resolveEnvInSecrets,a as resolveEnvString};

package/dist/index.d.ts

@@ -1,542 +0,0 @@
-interface SecretsSDKOptions {
-    /**
-     * App ID from dashboard (optional in zero-config mode)
-     * If omitted, SDK uses origin-based authentication
-     */
-    appId?: string;
-    /**
-     * SDK token (optional in zero-config mode)
-     * If omitted, SDK uses origin-based authentication
-     */
-    token?: string;
-    sessionToken?: string;
-    /**
-     * Base URL of the proxy server
-     * Default: https://cloudprototype.org
-     */
-    baseUrl?: string;
-    timeout?: number;
-    retryOn429?: boolean;
-}
-interface ProxyRequest$1 {
-    keyName: string;
-    endpoint: string;
-    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
-    body?: any;
-    headers?: Record<string, string>;
-}
-interface ProxyResponse$1<T = any> {
-    success: boolean;
-    status: number;
-    data: T;
-}
-interface RateLimitInfo {
-    limit: number;
-    remaining: number;
-    reset: number;
-}
-declare class SecretsSDKError extends Error {
-    status: number;
-    response?: any | undefined;
-    constructor(message: string, status: number, response?: any | undefined);
-}
-declare class OriginMismatchError extends SecretsSDKError {
-    constructor(message?: string);
-}
-declare class RateLimitError extends SecretsSDKError {
-    retryAfter: number;
-    remaining: number;
-    limit: number;
-    constructor(message?: string, retryAfter?: number, remaining?: number, limit?: number);
-}
-declare class InvalidTokenError extends SecretsSDKError {
-    constructor(message?: string);
-}
-interface SecretsManagementOptions {
-    appId: string;
-    baseUrl?: string;
-    timeout?: number;
-}
-interface SecretConfig {
-    name: string;
-    provider: string;
-    api_key: string;
-    base_url?: string;
-    auth_header?: string;
-    auth_prefix?: string;
-}
-interface MaskedSecret {
-    id: string;
-    name: string;
-    provider: string;
-    api_key: string;
-    base_url?: string;
-    auth_header?: string;
-    auth_prefix?: string;
-    created?: string;
-    updated?: string;
-}
-interface SyncOptions {
-    deleteMissing?: boolean;
-    dryRun?: boolean;
-}
-interface SyncDiffItem {
-    name: string;
-    provider?: string;
-    changes?: string[];
-}
-interface SyncResult {
-    success: boolean;
-    diff: {
-        created: SyncDiffItem[];
-        updated: SyncDiffItem[];
-        deleted: SyncDiffItem[];
-        unchanged: SyncDiffItem[];
-    };
-    summary: {
-        created: number;
-        updated: number;
-        deleted: number;
-        unchanged: number;
-    };
-}
-interface CLICredentials {
-    access_token: string;
-    refresh_token: string | null;
-    expires_at: string | null;
-    user_id: string;
-    machine_id?: string;
-    sdk_name?: string;
-    authorized_at?: string;
-}
-interface SDKCredentialsStore {
-    'learn-secrets-sdk'?: CLICredentials;
-    'learn-auth-sdk'?: CLICredentials;
-}
-type SDKName = 'learn-secrets-sdk' | 'learn-auth-sdk';
-
-declare class SecretsSDK {
-    private appId;
-    private token;
-    private baseUrl;
-    private timeout;
-    private retryOn429;
-    private rateLimitInfo;
-    private zeroConfigMode;
-    /**
-     * Create a new SecretsSDK instance
-     *
-     * Zero-config mode (recommended for static sites):
-     *   const sdk = new SecretsSDK();
-     *   // Origin header is used for authentication
-     *
-     * Token mode (for backward compatibility):
-     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
-     */
-    constructor(options?: SecretsSDKOptions);
-    /**
-     * Get current rate limit information
-     */
-    getUsage(): RateLimitInfo | null;
-    /**
-     * Parse rate limit headers from response
-     */
-    private parseRateLimitHeaders;
-    /**
-     * Sleep utility for retry backoff
-     */
-    private sleep;
-    /**
-     * Make fetch request with timeout
-     */
-    private fetchWithTimeout;
-    /**
-     * Call an external API securely through the proxy
-     * @param keyName - Name of the API key to use
-     * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
-     * @param options - Request options (method, body, headers)
-     * @returns Promise with the API response
-     */
-    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest$1, 'keyName' | 'endpoint'>): Promise<T>;
-    /**
-     * Make a GET request
-     */
-    get<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a POST request
-     */
-    post<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a PUT request
-     */
-    put<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a DELETE request
-     */
-    delete<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a PATCH request
-     */
-    patch<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Secrets Management API (zero-config mode)
-     * These methods allow programmatic CRUD operations on project secrets
-     * Requires appId to be set (can be set in constructor or via setAppId)
-     */
-    /**
-     * Set App ID for secrets management
-     * Required before calling secrets management methods
-     */
-    setAppId(appId: string): void;
-    /**
-     * Make authenticated request to secrets management API
-     */
-    private secretsRequest;
-    /**
-     * List all secrets for the project
-     * Returns secret metadata (no API keys)
-     */
-    listSecrets(): Promise<{
-        success: boolean;
-        secrets: Array<{
-            name: string;
-            provider: string;
-            base_url: string;
-            auth_header: string;
-            auth_prefix: string;
-            created: string;
-            updated: string;
-        }>;
-        count: number;
-    }>;
-    /**
-     * Create a new secret
-     */
-    createSecret(secret: {
-        name: string;
-        provider: string;
-        api_key: string;
-        base_url?: string;
-        auth_header?: string;
-        auth_prefix?: string;
-    }): Promise<{
-        success: boolean;
-        message: string;
-        secret: any;
-    }>;
-    /**
-     * Update an existing secret
-     */
-    updateSecret(update: {
-        name: string;
-        api_key?: string;
-        provider?: string;
-        base_url?: string;
-        auth_header?: string;
-        auth_prefix?: string;
-    }): Promise<{
-        success: boolean;
-        message: string;
-        secret: any;
-    }>;
-    /**
-     * Delete a secret
-     */
-    deleteSecret(name: string): Promise<{
-        success: boolean;
-        message: string;
-    }>;
-    /**
-     * Sync secrets from .env file format
-     * Bulk upload/update secrets
-     */
-    syncEnv(secrets: Record<string, string>, provider?: string): Promise<{
-        success: boolean;
-        message: string;
-        results: {
-            created: number;
-            updated: number;
-            failed: number;
-            details: {
-                created: string[];
-                updated: string[];
-                failed: Array<{
-                    name: string;
-                    error: string;
-                }>;
-            };
-        };
-    }>;
-}
-
-/**
- * SecretsManagement class for CLI authentication and secrets management
- */
-declare class SecretsManagement {
-    private appId;
-    private baseUrl;
-    private timeout;
-    constructor(options: SecretsManagementOptions);
-    /**
-     * Open a URL in the default browser
-     */
-    private openBrowser;
-    /**
-     * Sleep for specified milliseconds
-     */
-    private sleep;
-    /**
-     * Browser OAuth login flow with 2FA
-     * Opens browser for user to authorize, then prompts for 2FA code
-     */
-    login(): Promise<{
-        success: boolean;
-        user: string;
-    }>;
-    /**
-     * Check if user is authenticated
-     */
-    isAuthenticated(): Promise<boolean>;
-    /**
-     * Logout - clear stored credentials
-     */
-    logout(): void;
-    /**
-     * Get access token from stored credentials
-     * Throws error if not authenticated
-     */
-    private getAccessToken;
-    /**
-     * Make authenticated request
-     */
-    private request;
-    /**
-     * List all secrets (with masked API keys)
-     */
-    list(): Promise<MaskedSecret[]>;
-    /**
-     * Sync secrets from config
-     */
-    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
-    /**
-     * Import secrets from a config object (bulk import)
-     * Also creates SDK token if origins are provided
-     *
-     * @param config - The secrets configuration
-     * @returns Import results including created/updated counts and optional SDK token
-     */
-    importSecrets(config: {
-        version?: string;
-        origins?: string[];
-        secrets: SecretConfig[];
-    }): Promise<{
-        success: boolean;
-        results: {
-            created: number;
-            updated: number;
-            failed: number;
-            details: {
-                created: string[];
-                updated: string[];
-                failed: {
-                    name: string;
-                    error: string;
-                }[];
-            };
-        };
-        sdkToken?: {
-            token: string;
-            message: string;
-        };
-    }>;
-    /**
-     * Import secrets from a JSON file path
-     * Resolves environment variables in the config
-     */
-    importFromFile(configPath: string): Promise<{
-        success: boolean;
-        results: {
-            created: number;
-            updated: number;
-            failed: number;
-        };
-        sdkToken?: {
-            token: string;
-            message: string;
-        };
-    }>;
-}
-
-/**
- * Worker Client - Frontend SDK for calling Learn Secrets Worker
- *
- * Use this client to call your deployed Cloudflare Worker from static sites
- */
-interface WorkerClientOptions {
-    workerUrl: string;
-}
-interface ProxyRequest {
-    secret: string;
-    url: string;
-    method?: string;
-    headers?: Record<string, string>;
-    body?: any;
-    authHeader?: string;
-    authPrefix?: string;
-}
-interface ProxyResponse<T = any> {
-    success: boolean;
-    status: number;
-    data: T;
-}
-interface PublicConfig {
-    [key: string]: string;
-}
-interface AppleJwtRequest {
-    teamId?: string;
-    keyId?: string;
-    privateKey: string;
-}
-interface OAuthExchangeRequest {
-    provider: string;
-    code: string;
-    redirectUri: string;
-}
-/**
- * Worker Client for calling Learn Secrets Worker
- *
- * SECURITY:
- * - All requests include Origin header (automatically added by browser)
- * - Worker validates origin before processing
- * - Secrets never exposed to frontend
- * - Only public config returned to frontend
- *
- * Example:
- * ```typescript
- * const client = new WorkerClient({
- *   workerUrl: 'https://learn-secrets-myapp.myaccount.workers.dev'
- * });
- *
- * // Get public config
- * const config = await client.getConfig();
- *
- * // Make API call with secret
- * const response = await client.proxy({
- *   secret: 'openai-api-key',
- *   url: 'https://api.openai.com/v1/chat/completions',
- *   method: 'POST',
- *   body: { model: 'gpt-4', messages: [...] }
- * });
- * ```
- */
-declare class WorkerClient {
-    private workerUrl;
-    constructor(options: WorkerClientOptions);
-    /**
-     * Get public configuration
-     *
-     * Returns only PUBLIC_* environment variables from Worker
-     * Safe for frontend use
-     */
-    getConfig(): Promise<PublicConfig>;
-    /**
-     * Proxy API request with secret injection
-     *
-     * Makes API call through Worker which injects secret server-side
-     * Secret never reaches browser
-     *
-     * @param request - Proxy request configuration
-     * @returns API response data
-     */
-    proxy<T = any>(request: ProxyRequest): Promise<ProxyResponse<T>>;
-    /**
-     * Generate Apple Music JWT
-     *
-     * Private key stays in Worker, only JWT returned to frontend
-     *
-     * @param request - Apple JWT request with secret name
-     * @returns JWT token
-     */
-    generateAppleJwt(request: AppleJwtRequest): Promise<string>;
-    /**
-     * Exchange OAuth authorization code for access token
-     *
-     * Client secret stays in Worker, tokens returned to frontend
-     *
-     * @param request - OAuth exchange request
-     * @returns OAuth token response
-     */
-    exchangeOAuthCode(request: OAuthExchangeRequest): Promise<any>;
-    /**
-     * Health check
-     */
-    health(): Promise<{
-        status: string;
-        version: string;
-        timestamp: string;
-    }>;
-}
-
-/**
- * Resolve environment variable references in a string
- * Supports ${VAR} and $VAR syntax
- */
-declare function resolveEnvString(value: string): string;
-/**
- * Resolve environment variables in a single secret config
- */
-declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
-/**
- * Resolve environment variables in an array of secrets
- */
-declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
-/**
- * Load and parse a secrets config file
- * Resolves environment variables in the config
- */
-declare function loadSecretsConfig(configPath: string): {
-    version: string;
-    project: string;
-    secrets: SecretConfig[];
-};
-
-/**
- * Machine ID Generation
- * Cross-platform machine identification for CLI authentication
- */
-interface MachineInfo {
-    machineId: string;
-    fingerprint: string;
-}
-/**
- * Get a unique machine identifier
- * This ID persists across reboots and SDK reinstalls
- */
-declare function getMachineId(): Promise<MachineInfo>;
-
-/**
- * Read all credentials from file (SDK-keyed format)
- */
-declare function readAllCredentials(): SDKCredentialsStore | null;
-/**
- * Write all credentials to file (SDK-keyed format)
- */
-declare function writeAllCredentials(store: SDKCredentialsStore): void;
-/**
- * Read credentials for a specific SDK
- */
-declare function readSDKCredentials(sdkName: SDKName): CLICredentials | null;
-/**
- * Write credentials for a specific SDK
- */
-declare function writeSDKCredentials(sdkName: SDKName, creds: CLICredentials): void;
-/**
- * Delete credentials for a specific SDK
- */
-declare function deleteSDKCredentials(sdkName: SDKName): void;
-/**
- * Check if credentials exist for a specific SDK
- */
-declare function hasSDKCredentials(sdkName: SDKName): boolean;
-
-export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest$1 as ProxyRequest, type ProxyResponse$1 as ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, WorkerClient, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };

package/dist/index.global.js

@@ -1,10 +0,0 @@
-"use strict";var SecretsSDK=(()=>{var Z=Object.create;var T=Object.defineProperty;var Q=Object.getOwnPropertyDescriptor;var Y=Object.getOwnPropertyNames;var ee=Object.getPrototypeOf,te=Object.prototype.hasOwnProperty;var l=(r=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(r,{get:(e,t)=>(typeof require<"u"?require:e)[t]}):r)(function(r){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+r+'" is not supported')});var re=(r,e)=>()=>(r&&(e=r(r=0)),e);var z=(r,e)=>{for(var t in e)T(r,t,{get:e[t],enumerable:!0})},F=(r,e,t,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Y(e))!te.call(r,n)&&n!==t&&T(r,n,{get:()=>e[n],enumerable:!(s=Q(e,n))||s.enumerable});return r};var y=(r,e,t)=>(t=r!=null?Z(ee(r)):{},F(e||!r||!r.__esModule?T(t,"default",{value:r,enumerable:!0}):t,r)),se=r=>F(T({},"__esModule",{value:!0}),r);var X={};z(X,{loadSecretsConfig:()=>N,resolveEnvInSecret:()=>E,resolveEnvInSecrets:()=>$,resolveEnvString:()=>p});function p(r){return r.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g,(e,t,s)=>{let n=t||s,i=process.env[n];if(i===void 0)throw new Error(`Environment variable ${n} is not defined`);return i})}function E(r){let e={name:p(r.name),provider:p(r.provider),api_key:p(r.api_key)};return r.base_url&&(e.base_url=p(r.base_url)),r.auth_header&&(e.auth_header=p(r.auth_header)),r.auth_prefix&&(e.auth_prefix=p(r.auth_prefix)),e}function $(r){return r.map(E)}function N(r){let e=l("fs"),s=l("path").resolve(r);if(!e.existsSync(s))throw new Error(`Config file not found: ${s}`);let n=e.readFileSync(s,"utf-8"),i=JSON.parse(n);if(!i.version)throw new Error('Config file missing "version" field');if(!i.project)throw new Error('Config file missing "project" field');if(!Array.isArray(i.secrets))throw new Error('Config file missing "secrets" array');let a=$(i.secrets);return{version:i.version,project:i.project,secrets:a}}var J=re(()=>{"use strict"});var ce={};z(ce,{InvalidTokenError:()=>b,OriginMismatchError:()=>S,RateLimitError:()=>x,SecretsManagement:()=>j,SecretsSDK:()=>_,SecretsSDKError:()=>o,WorkerClient:()=>A,deleteSDKCredentials:()=>H,getMachineId:()=>O,hasSDKCredentials:()=>W,loadSecretsConfig:()=>N,readAllCredentials:()=>v,readSDKCredentials:()=>k,resolveEnvInSecret:()=>E,resolveEnvInSecrets:()=>$,resolveEnvString:()=>p,writeAllCredentials:()=>R,writeSDKCredentials:()=>D});var o=class extends Error{constructor(t,s,n){super(t);this.status=s;this.response=n;this.name="SecretsSDKError"}},S=class extends o{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},x=class extends o{constructor(e="Rate limit exceeded",t=60,s=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=s,this.limit=n}},b=class extends o{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var _=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),s=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&s&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(s),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,s){let n=new AbortController,i=setTimeout(()=>n.abort(),s);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(i)}}async call(e,t,s={}){let n=0,i=this.retryOn429?3:0;for(;;)try{let a=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,m={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(m.Authorization=`Bearer ${this.token}`);let c=await this.fetchWithTimeout(a,{method:"POST",headers:m,body:JSON.stringify({keyName:e,endpoint:t,method:s.method||"GET",body:s.body,headers:s.headers})},this.timeout);this.parseRateLimitHeaders(c.headers);let w=await c.json();if(!c.ok){let h=w.data?.message||w?.message||`Request failed with status ${c.status}`;if(c.status===403&&h.includes("Origin"))throw new S(h);if(c.status===401)throw new b(h);if(c.status===429){let I=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,u=new x(h,I,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<i){n++;let f=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(f);continue}throw u}throw new o(h,c.status,w)}return w.data}catch(a){throw a instanceof o?a:a instanceof Error&&a.name==="AbortError"?new o("Request timeout",408):new o(a instanceof Error?a.message:"Unknown error occurred",500)}}async get(e,t,s){return this.call(e,t,{method:"GET",headers:s})}async post(e,t,s,n){return this.call(e,t,{method:"POST",body:s,headers:n})}async put(e,t,s,n){return this.call(e,t,{method:"PUT",body:s,headers:n})}async delete(e,t,s){return this.call(e,t,{method:"DELETE",headers:s})}async patch(e,t,s,n){return this.call(e,t,{method:"PATCH",body:s,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new o("App ID required for secrets management. Call setAppId() first.",400);let s=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!s.ok){let n=await s.json().catch(()=>({}));throw new o(n.message||`Secrets management failed: ${s.statusText}`,s.status,n)}return s.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};var d=y(l("fs")),P=y(l("path")),L=y(l("os"));function U(){let r=L.homedir(),e=P.join(r,".learn");return P.join(e,"credentials.json")}function ne(){let r=L.homedir(),e=P.join(r,".learn");d.existsSync(e)||d.mkdirSync(e,{recursive:!0,mode:448})}function v(){try{let r=U();if(!d.existsSync(r))return null;let e=d.readFileSync(r,"utf-8"),t=JSON.parse(e);return t.access_token&&!t["learn-secrets-sdk"]&&!t["learn-auth-sdk"]?{"learn-secrets-sdk":t}:t}catch{return null}}function R(r){ne();let e=U(),t=JSON.stringify(r,null,2);d.writeFileSync(e,t,{mode:384})}function k(r){let e=v();return e&&e[r]||null}function D(r,e){let t=v()||{};t[r]=e,R(t)}function H(r){let e=v();e&&(delete e[r],Object.keys(e).length===0?K():R(e))}function M(){return k("learn-secrets-sdk")}function K(){try{let r=U();d.existsSync(r)&&d.unlinkSync(r)}catch{}}function W(r){let e=k(r);return e!==null&&!!e.access_token}function G(){let r=M();return r?r.expires_at?new Date(r.expires_at)>new Date:!0:!1}var B=l("child_process"),V=l("util"),q=l("crypto"),g=y(l("os")),C=(0,V.promisify)(B.exec);async function O(){let r=process.platform;try{let e;if(r==="darwin")e=await ie();else if(r==="linux")e=await oe();else if(r==="win32")e=await ae();else throw new Error(`Unsupported platform: ${r}`);let t=(0,q.createHash)("sha256").update(e).digest("hex").substring(0,32),s=JSON.stringify({machineId:t,cpus:g.cpus().length,arch:g.arch(),platform:g.platform(),homedir:g.homedir()}),n=(0,q.createHash)("sha256").update(s).digest("hex");return{machineId:t,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function ie(){try{let{stdout:r}=await C(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await C("hostname"),t=r.trim(),s=e.trim();if(t&&s)return`${t}-${s}`;let{stdout:n}=await C(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function oe(){try{let{stdout:r}=await C("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=r.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function ae(){try{let{stdout:r}=await C("wmic csproduct get uuid"),t=r.split(`
-`).map(s=>s.trim()).find(s=>s&&s!=="UUID");if(t)return t;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var j=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:s}=await import("util"),n=s(t),i=process.platform;try{i==="darwin"?await n(`open "${e}"`):i==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(a){throw console.error("Failed to open browser:",a),new o("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
-`);let t=await O(),s=k(e);if(s&&s.access_token){let u=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:t.machineId,sdk_name:e})});if(u.ok){let f=await u.json();if(f.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${f.user_email||f.user_id}`),{success:!0,user:f.user_email||f.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new o("Failed to generate device code",n.status);let i=await n.json();console.log(`
-Log in on ${this.baseUrl}`),console.log("Login at:"),console.log(i.verification_uri_complete),console.log(`
-Press ENTER to open in the browser...`);let m=(await import("readline")).createInterface({input:process.stdin,output:process.stdout});await new Promise(u=>{m.question("",()=>{m.close(),u()})}),console.log(`Opening browser...
-`),await this.openBrowser(i.verification_uri_complete);let c=null,w=i.interval*1e3,h=Math.ceil(i.expires_in/i.interval),I=0;for(;I<h;){await this.sleep(w),I++;let u=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:i.device_code})});if(u.status===202){process.stdout.write(".");continue}if(u.ok){c=await u.json();break}}if(!c)throw new o("Device authorization timeout",408);return console.log(`
-
-Device authorized! Retrieving access token...`),D(e,{access_token:c.access_token,refresh_token:null,expires_at:null,user_id:c.user_id,machine_id:t.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
-Authentication successful!`),console.log(`Logged in as: ${c.user_email||c.user_id}`),console.log(`This machine is now permanently authorized.
-`),{success:!0,user:c.user_email||c.user_id}}catch(t){throw t instanceof o?t:new o(t.message||"Login failed",t.status||500)}}async isAuthenticated(){return G()}logout(){K(),console.log("Logged out successfully")}getAccessToken(){let e=M();if(!e)throw new o("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new o("Token expired. Run login() again.",401);return e.access_token}async request(e,t,s){let n=this.getAccessToken(),i={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};s&&(i.body=JSON.stringify(s));let a=await fetch(`${this.baseUrl}${t}`,i);if(!a.ok){let m=await a.json().catch(()=>({}));throw new o(m.message||`Request failed: ${a.statusText}`,a.status,m)}return a.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await Promise.resolve().then(()=>(J(),X)),s=t(e);return this.importSecrets(s)}};var A=class{constructor(e){this.workerUrl=e.workerUrl.replace(/\/$/,"")}async getConfig(){let e=await fetch(`${this.workerUrl}/config`,{method:"GET",credentials:"include"});if(!e.ok)throw new Error(`Failed to get config: ${e.status} ${e.statusText}`);return(await e.json()).public||{}}async proxy(e){let t=await fetch(`${this.workerUrl}/proxy`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let s=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(s.error||`Proxy request failed: ${t.status}`)}return t.json()}async generateAppleJwt(e){let t=await fetch(`${this.workerUrl}/auth/apple-jwt`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let n=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(n.error||`Apple JWT generation failed: ${t.status}`)}return(await t.json()).token}async exchangeOAuthCode(e){let t=await fetch(`${this.workerUrl}/auth/oauth`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let s=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(s.error||`OAuth exchange failed: ${t.status}`)}return t.json()}async health(){let e=await fetch(`${this.workerUrl}/health`,{method:"GET"});if(!e.ok)throw new Error(`Health check failed: ${e.status}`);return e.json()}};J();return se(ce);})();