learn-secrets-sdk 1.2.0 → 1.3.0

package/dist/client.d.ts

@@ -6,7 +6,18 @@ export declare class SecretsSDK {
     private timeout;
     private retryOn429;
     private rateLimitInfo;
-    constructor(options: SecretsSDKOptions);
+    private zeroConfigMode;
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options?: SecretsSDKOptions);
     /**
      * Get current rate limit information
      */

package/dist/client.js

@@ -1,15 +1,25 @@
 import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
 export class SecretsSDK {
-    constructor(options) {
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options = {}) {
         this.rateLimitInfo = null;
-        this.appId = options.appId;
-        this.token = options.token || options.sessionToken || '';
-        this.baseUrl = options.baseUrl || 'https://learn.pages.dev';
+        this.appId = options.appId || null;
+        this.token = options.token || options.sessionToken || null;
+        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
         this.timeout = options.timeout || 30000;
         this.retryOn429 = options.retryOn429 !== undefined ? options.retryOn429 : true;
-        if (!this.token) {
-            throw new Error('token is required');
-        }
+        // Zero-config mode: no appId or token required
+        // Authentication is based on Origin header
+        this.zeroConfigMode = !this.appId && !this.token;
     }
     /**
      * Get current rate limit information
@@ -67,12 +77,20 @@ export class SecretsSDK {
         const maxRetries = this.retryOn429 ? 3 : 0;
         while (true) {
             try {
-                const response = await this.fetchWithTimeout(`${this.baseUrl}/api/sdk/${this.appId}/proxy`, {
+                // Build URL based on mode
+                const proxyUrl = this.zeroConfigMode
+                    ? `${this.baseUrl}/api/sdk/proxy`
+                    : `${this.baseUrl}/api/sdk/${this.appId}/proxy`;
+                // Build headers based on mode
+                const requestHeaders = {
+                    'Content-Type': 'application/json'
+                };
+                if (!this.zeroConfigMode && this.token) {
+                    requestHeaders['Authorization'] = `Bearer ${this.token}`;
+                }
+                const response = await this.fetchWithTimeout(proxyUrl, {
                     method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        Authorization: `Bearer ${this.token}`
-                    },
+                    headers: requestHeaders,
                     body: JSON.stringify({
                         keyName,
                         endpoint,

package/dist/credentials.d.ts

@@ -0,0 +1,24 @@
+import type { CLICredentials } from './types';
+/**
+ * Get the path to the credentials file
+ * Defaults to ~/.learn/credentials.json
+ */
+export declare function getCredentialsPath(): string;
+/**
+ * Read credentials from file
+ * Returns null if file doesn't exist or is invalid
+ */
+export declare function readCredentials(): CLICredentials | null;
+/**
+ * Write credentials to file
+ * Creates ~/.learn directory if it doesn't exist
+ */
+export declare function writeCredentials(creds: CLICredentials): void;
+/**
+ * Delete credentials file
+ */
+export declare function deleteCredentials(): void;
+/**
+ * Check if credentials exist and are not expired
+ */
+export declare function hasValidCredentials(): boolean;

package/dist/credentials.js

@@ -0,0 +1,86 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+/**
+ * Get the path to the credentials file
+ * Defaults to ~/.learn/credentials.json
+ */
+export function getCredentialsPath() {
+    const homeDir = os.homedir();
+    const learnDir = path.join(homeDir, '.learn');
+    return path.join(learnDir, 'credentials.json');
+}
+/**
+ * Ensure the ~/.learn directory exists
+ */
+function ensureLearnDir() {
+    const homeDir = os.homedir();
+    const learnDir = path.join(homeDir, '.learn');
+    if (!fs.existsSync(learnDir)) {
+        fs.mkdirSync(learnDir, { recursive: true, mode: 0o700 }); // Owner-only permissions
+    }
+}
+/**
+ * Read credentials from file
+ * Returns null if file doesn't exist or is invalid
+ */
+export function readCredentials() {
+    try {
+        const credPath = getCredentialsPath();
+        if (!fs.existsSync(credPath)) {
+            return null;
+        }
+        const data = fs.readFileSync(credPath, 'utf-8');
+        const creds = JSON.parse(data);
+        // Validate required fields
+        if (!creds.access_token ||
+            !creds.refresh_token ||
+            !creds.expires_at ||
+            !creds.user_id) {
+            return null;
+        }
+        return creds;
+    }
+    catch (err) {
+        // Invalid JSON or read error
+        return null;
+    }
+}
+/**
+ * Write credentials to file
+ * Creates ~/.learn directory if it doesn't exist
+ */
+export function writeCredentials(creds) {
+    ensureLearnDir();
+    const credPath = getCredentialsPath();
+    const data = JSON.stringify(creds, null, 2);
+    // Write with owner-only permissions
+    fs.writeFileSync(credPath, data, { mode: 0o600 });
+}
+/**
+ * Delete credentials file
+ */
+export function deleteCredentials() {
+    try {
+        const credPath = getCredentialsPath();
+        if (fs.existsSync(credPath)) {
+            fs.unlinkSync(credPath);
+        }
+    }
+    catch (err) {
+        // Ignore errors (file might not exist)
+    }
+}
+/**
+ * Check if credentials exist and are not expired
+ */
+export function hasValidCredentials() {
+    const creds = readCredentials();
+    if (!creds) {
+        return false;
+    }
+    // Check if expired
+    const expiresAt = new Date(creds.expires_at);
+    const now = new Date();
+    return expiresAt > now;
+}

package/dist/env-resolver.d.ts

@@ -0,0 +1,23 @@
+import type { SecretConfig } from './types';
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+export declare function resolveEnvString(value: string): string;
+/**
+ * Resolve environment variables in a single secret config
+ */
+export declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
+/**
+ * Resolve environment variables in an array of secrets
+ */
+export declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+export declare function loadSecretsConfig(configPath: string): {
+    version: string;
+    project: string;
+    secrets: SecretConfig[];
+};

package/dist/env-resolver.js

@@ -0,0 +1,73 @@
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+export function resolveEnvString(value) {
+    // Replace ${VAR} and $VAR references
+    return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
+        const varName = var1 || var2;
+        const envValue = process.env[varName];
+        if (envValue === undefined) {
+            throw new Error(`Environment variable ${varName} is not defined`);
+        }
+        return envValue;
+    });
+}
+/**
+ * Resolve environment variables in a single secret config
+ */
+export function resolveEnvInSecret(secret) {
+    const resolved = {
+        name: resolveEnvString(secret.name),
+        provider: resolveEnvString(secret.provider),
+        api_key: resolveEnvString(secret.api_key)
+    };
+    if (secret.base_url) {
+        resolved.base_url = resolveEnvString(secret.base_url);
+    }
+    if (secret.auth_header) {
+        resolved.auth_header = resolveEnvString(secret.auth_header);
+    }
+    if (secret.auth_prefix) {
+        resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
+    }
+    return resolved;
+}
+/**
+ * Resolve environment variables in an array of secrets
+ */
+export function resolveEnvInSecrets(secrets) {
+    return secrets.map(resolveEnvInSecret);
+}
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+export function loadSecretsConfig(configPath) {
+    const fs = require('fs');
+    const path = require('path');
+    // Read config file
+    const fullPath = path.resolve(configPath);
+    if (!fs.existsSync(fullPath)) {
+        throw new Error(`Config file not found: ${fullPath}`);
+    }
+    const configData = fs.readFileSync(fullPath, 'utf-8');
+    const config = JSON.parse(configData);
+    // Validate config
+    if (!config.version) {
+        throw new Error('Config file missing "version" field');
+    }
+    if (!config.project) {
+        throw new Error('Config file missing "project" field');
+    }
+    if (!Array.isArray(config.secrets)) {
+        throw new Error('Config file missing "secrets" array');
+    }
+    // Resolve environment variables
+    const resolvedSecrets = resolveEnvInSecrets(config.secrets);
+    return {
+        version: config.version,
+        project: config.project,
+        secrets: resolvedSecrets
+    };
+}

package/dist/index.d.ts

@@ -1,3 +1,5 @@
 export { SecretsSDK } from './client';
+export { SecretsManagement } from './management';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
 export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
-export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo } from './types';
+export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types';

package/dist/index.js

@@ -1,2 +1,4 @@
 export { SecretsSDK } from './client';
+export { SecretsManagement } from './management';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
 export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';

package/dist/management.d.ts

@@ -0,0 +1,51 @@
+import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types';
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+export declare class SecretsManagement {
+    private appId;
+    private baseUrl;
+    private timeout;
+    constructor(options: SecretsManagementOptions);
+    /**
+     * Open a URL in the default browser
+     */
+    private openBrowser;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    login(): Promise<{
+        success: boolean;
+        user: string;
+    }>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Logout - clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    private getAccessToken;
+    /**
+     * Make authenticated request
+     */
+    private request;
+    /**
+     * List all secrets (with masked API keys)
+     */
+    list(): Promise<MaskedSecret[]>;
+    /**
+     * Sync secrets from config
+     */
+    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+}

package/dist/management.js

@@ -0,0 +1,191 @@
+import { SecretsSDKError } from './types';
+import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials';
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+export class SecretsManagement {
+    constructor(options) {
+        this.appId = options.appId;
+        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
+        this.timeout = options.timeout || 30000;
+    }
+    /**
+     * Open a URL in the default browser
+     */
+    async openBrowser(url) {
+        const { exec } = await import('child_process');
+        const { promisify } = await import('util');
+        const execAsync = promisify(exec);
+        const platform = process.platform;
+        try {
+            if (platform === 'darwin') {
+                await execAsync(`open "${url}"`);
+            }
+            else if (platform === 'win32') {
+                await execAsync(`start "${url}"`);
+            }
+            else {
+                // Linux
+                await execAsync(`xdg-open "${url}"`);
+            }
+        }
+        catch (err) {
+            console.error('Failed to open browser:', err);
+            throw new SecretsSDKError('Failed to open browser', 500);
+        }
+    }
+    /**
+     * Sleep for specified milliseconds
+     */
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    async login() {
+        try {
+            // Step 1: Request device code
+            const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                }
+            });
+            if (!deviceResponse.ok) {
+                throw new SecretsSDKError('Failed to generate device code', deviceResponse.status);
+            }
+            const deviceData = await deviceResponse.json();
+            // Step 2: Display user code and verification URI
+            console.log('\nTo authorize this application, visit:');
+            console.log(`  ${deviceData.verification_uri}`);
+            console.log('\nAnd enter the code:');
+            console.log(`  ${deviceData.user_code}`);
+            console.log('\nOpening browser...\n');
+            // Step 3: Open browser
+            await this.openBrowser(deviceData.verification_uri_complete);
+            // Step 4: Poll for token
+            const interval = deviceData.interval * 1000; // Convert to ms
+            const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
+            let attempts = 0;
+            while (attempts < maxAttempts) {
+                await this.sleep(interval);
+                attempts++;
+                const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({
+                        device_code: deviceData.device_code
+                    })
+                });
+                if (tokenResponse.status === 202) {
+                    // Still pending
+                    process.stdout.write('.');
+                    continue;
+                }
+                if (!tokenResponse.ok) {
+                    const errorData = await tokenResponse.json().catch(() => ({}));
+                    throw new SecretsSDKError(errorData.message || 'Failed to exchange device code', tokenResponse.status);
+                }
+                // Success!
+                const tokenData = await tokenResponse.json();
+                // Step 5: Store credentials
+                const expiresAt = new Date(Date.now() + tokenData.expires_in * 1000);
+                writeCredentials({
+                    access_token: tokenData.access_token,
+                    refresh_token: tokenData.refresh_token,
+                    expires_at: expiresAt.toISOString(),
+                    user_id: tokenData.user_id
+                });
+                console.log('\n\nAuthentication successful!');
+                return {
+                    success: true,
+                    user: tokenData.user_id
+                };
+            }
+            // Timeout
+            throw new SecretsSDKError('Authorization timeout', 408);
+        }
+        catch (err) {
+            if (err instanceof SecretsSDKError) {
+                throw err;
+            }
+            throw new SecretsSDKError(err.message || 'Login failed', err.status || 500);
+        }
+    }
+    /**
+     * Check if user is authenticated
+     */
+    async isAuthenticated() {
+        return hasValidCredentials();
+    }
+    /**
+     * Logout - clear stored credentials
+     */
+    logout() {
+        deleteCredentials();
+        console.log('Logged out successfully');
+    }
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    getAccessToken() {
+        const creds = readCredentials();
+        if (!creds) {
+            throw new SecretsSDKError('Not authenticated. Run login() first.', 401);
+        }
+        // Check if expired
+        const expiresAt = new Date(creds.expires_at);
+        const now = new Date();
+        if (expiresAt <= now) {
+            throw new SecretsSDKError('Token expired. Run login() again.', 401);
+        }
+        return creds.access_token;
+    }
+    /**
+     * Make authenticated request
+     */
+    async request(method, path, body) {
+        const token = this.getAccessToken();
+        const options = {
+            method,
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`
+            }
+        };
+        if (body) {
+            options.body = JSON.stringify(body);
+        }
+        const response = await fetch(`${this.baseUrl}${path}`, options);
+        if (!response.ok) {
+            const errorData = await response.json().catch(() => ({}));
+            throw new SecretsSDKError(errorData.message || `Request failed: ${response.statusText}`, response.status, errorData);
+        }
+        return response.json();
+    }
+    /**
+     * List all secrets (with masked API keys)
+     */
+    async list() {
+        const response = await this.request('GET', `/api/projects/${this.appId}/secrets`);
+        return response.secrets;
+    }
+    /**
+     * Sync secrets from config
+     */
+    async sync(secrets, options) {
+        const response = await this.request('POST', `/api/projects/${this.appId}/secrets/sync`, {
+            secrets,
+            options: {
+                deleteMissing: options?.deleteMissing ?? false,
+                dryRun: options?.dryRun ?? false
+            }
+        });
+        return response;
+    }
+}

package/dist/types.d.ts

@@ -1,7 +1,19 @@
 export interface SecretsSDKOptions {
-    appId: string;
-    token: string;
+    /**
+     * App ID from dashboard (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    appId?: string;
+    /**
+     * SDK token (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    token?: string;
     sessionToken?: string;
+    /**
+     * Base URL of the proxy server
+     * Default: https://ctklearn.carsontkempf.workers.dev
+     */
     baseUrl?: string;
     timeout?: number;
     retryOn429?: boolean;
@@ -40,3 +52,72 @@ export declare class RateLimitError extends SecretsSDKError {
 export declare class InvalidTokenError extends SecretsSDKError {
     constructor(message?: string);
 }
+export interface SecretsManagementOptions {
+    appId: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+export interface SecretConfig {
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+}
+export interface MaskedSecret {
+    id: string;
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+    created?: string;
+    updated?: string;
+}
+export interface SyncOptions {
+    deleteMissing?: boolean;
+    dryRun?: boolean;
+}
+export interface SyncDiffItem {
+    name: string;
+    provider?: string;
+    changes?: string[];
+}
+export interface SyncResult {
+    success: boolean;
+    diff: {
+        created: SyncDiffItem[];
+        updated: SyncDiffItem[];
+        deleted: SyncDiffItem[];
+        unchanged: SyncDiffItem[];
+    };
+    summary: {
+        created: number;
+        updated: number;
+        deleted: number;
+        unchanged: number;
+    };
+}
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface TokenResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    user_id: string;
+}
+export interface CLICredentials {
+    access_token: string;
+    refresh_token: string;
+    expires_at: string;
+    user_id: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.2.0",
+	"version": "1.3.0",
 	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",