learn-secrets-sdk 1.2.0 → 1.4.0

package/bin/learn-secrets.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+
+// Entry point for the learn-secrets CLI
+// This file is executed when running: learn-secrets <command>
+
+// Check Node version
+const nodeVersion = process.versions.node;
+const majorVersion = parseInt(nodeVersion.split('.')[0], 10);
+
+if (majorVersion < 16) {
+	console.error('Error: Node.js 16 or higher is required');
+	console.error(`You are running Node.js ${nodeVersion}`);
+	process.exit(1);
+}
+
+// Run the CLI
+require('../dist/cli/index.js');

package/dist/cli/commands/init.d.ts

@@ -0,0 +1,11 @@
+export interface InitOptions {
+    origins: string;
+    env?: string;
+    project?: string;
+    baseUrl?: string;
+    yes?: boolean;
+}
+/**
+ * Init command - onboard a new site by uploading .env secrets
+ */
+export declare function initCommand(options: InitOptions): Promise<void>;

package/dist/cli/commands/init.js

@@ -0,0 +1,113 @@
+import { SecretsManagement } from '../../management.js';
+import { parseEnvFile } from '../utils/env-parser.js';
+import { detectApiKeys, summarizeDetectedSecrets } from '../utils/key-detector.js';
+import { hasValidCredentials } from '../../credentials.js';
+/**
+ * Init command - onboard a new site by uploading .env secrets
+ */
+export async function initCommand(options) {
+    // Validate authentication
+    if (!hasValidCredentials()) {
+        console.error('Error: Not authenticated. Run "learn-secrets login" first.');
+        process.exit(1);
+    }
+    // Validate required options
+    if (!options.origins) {
+        console.error('Error: --origins is required');
+        console.error('Example: learn-secrets init --origins mysite.com,localhost');
+        process.exit(1);
+    }
+    if (!options.project) {
+        console.error('Error: --project is required');
+        console.error('Example: learn-secrets init --project my-app-id --origins mysite.com');
+        process.exit(1);
+    }
+    // Parse origins
+    const origins = options.origins.split(',').map(o => o.trim()).filter(Boolean);
+    if (origins.length === 0) {
+        console.error('Error: No valid origins provided');
+        process.exit(1);
+    }
+    console.log(`\nOnboarding site for project: ${options.project}`);
+    console.log(`Origins: ${origins.join(', ')}\n`);
+    // Load and detect secrets from .env
+    const envFile = options.env || '.env';
+    let secrets;
+    try {
+        console.log(`Reading ${envFile}...`);
+        const envVars = parseEnvFile(envFile);
+        secrets = detectApiKeys(envVars);
+        if (secrets.length === 0) {
+            console.log('\nNo API keys detected in .env file.');
+            console.log('Make sure your .env contains variables like:');
+            console.log('  OPENAI_API_KEY=sk-...');
+            console.log('  ANTHROPIC_API_KEY=sk-ant-...');
+            process.exit(0);
+        }
+        console.log('\n' + summarizeDetectedSecrets(secrets));
+        console.log('');
+    }
+    catch (error) {
+        console.error(`Error reading ${envFile}:`, error.message);
+        process.exit(1);
+    }
+    // Ask for confirmation unless --yes flag
+    if (!options.yes) {
+        const readline = await import('readline');
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout
+        });
+        const answer = await new Promise((resolve) => {
+            rl.question('Upload these secrets? (y/N): ', resolve);
+        });
+        rl.close();
+        if (answer.toLowerCase() !== 'y' && answer.toLowerCase() !== 'yes') {
+            console.log('Cancelled.');
+            process.exit(0);
+        }
+    }
+    // Upload secrets
+    console.log('\nUploading secrets...');
+    const mgmt = new SecretsManagement({
+        appId: options.project,
+        baseUrl: options.baseUrl
+    });
+    try {
+        const result = await mgmt.importSecrets({
+            version: '1.0',
+            origins,
+            secrets
+        });
+        console.log('\nSuccess!');
+        console.log(`  Created: ${result.results.created} secrets`);
+        console.log(`  Updated: ${result.results.updated} secrets`);
+        if (result.results.failed > 0) {
+            console.log(`  Failed: ${result.results.failed} secrets`);
+            for (const failure of result.results.details.failed) {
+                console.log(`    - ${failure.name}: ${failure.error}`);
+            }
+        }
+        if (result.sdkToken) {
+            console.log('\nSDK Token created:');
+            console.log(`  ${result.sdkToken.token}`);
+            console.log('\n  IMPORTANT: Save this token - it will not be shown again.');
+            console.log('  Add it to your static site code:');
+            console.log('');
+            console.log('    const sdk = new SecretsSDK();');
+            console.log('    // No appId or token needed - uses origin-based auth!');
+        }
+        console.log('\nYour site is ready!');
+        console.log(`Visit: https://ctklearn.carsontkempf.workers.dev to manage secrets`);
+    }
+    catch (error) {
+        console.error('\nUpload failed:', error.message);
+        if (error.status === 401) {
+            console.error('Your session may have expired. Try running "learn-secrets login" again.');
+        }
+        if (error.status === 404) {
+            console.error(`Project "${options.project}" not found. Check your project ID.`);
+        }
+        process.exit(1);
+    }
+}

package/dist/cli/commands/login.d.ts

@@ -0,0 +1,7 @@
+export interface LoginOptions {
+    baseUrl?: string;
+}
+/**
+ * Login command - authenticate via browser OAuth flow
+ */
+export declare function loginCommand(options?: LoginOptions): Promise<void>;

package/dist/cli/commands/login.js

@@ -0,0 +1,22 @@
+import { SecretsManagement } from '../../management.js';
+/**
+ * Login command - authenticate via browser OAuth flow
+ */
+export async function loginCommand(options = {}) {
+    console.log('Authenticating with Learn Secrets...\n');
+    // Create management client (appId not needed for login)
+    const mgmt = new SecretsManagement({
+        appId: 'temp', // Will be set after login
+        baseUrl: options.baseUrl
+    });
+    try {
+        const result = await mgmt.login();
+        console.log(`\nLogged in as: ${result.user}`);
+        console.log('Credentials saved to ~/.learn/credentials.json');
+        console.log('\nYou can now run: learn-secrets init --origins yourdomain.com');
+    }
+    catch (error) {
+        console.error('\nLogin failed:', error.message);
+        process.exit(1);
+    }
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { loginCommand } from './commands/login.js';
+import { initCommand } from './commands/init.js';
+const program = new Command();
+program
+    .name('learn-secrets')
+    .description('CLI tool for managing API secrets in static sites')
+    .version('1.4.0');
+// Login command
+program
+    .command('login')
+    .description('Authenticate with Learn Secrets via browser')
+    .option('--base-url <url>', 'Custom base URL for API')
+    .action(async (options) => {
+    await loginCommand(options);
+});
+// Init command
+program
+    .command('init')
+    .description('Initialize secrets for a new site')
+    .requiredOption('-o, --origins <domains>', 'Comma-separated list of allowed origins (e.g., mysite.com,localhost)')
+    .requiredOption('-p, --project <appid>', 'Project app ID from dashboard')
+    .option('-e, --env <file>', 'Path to .env file (default: .env)', '.env')
+    .option('--base-url <url>', 'Custom base URL for API')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .action(async (options) => {
+    await initCommand(options);
+});
+// Parse arguments
+program.parse(process.argv);
+// Show help if no command provided
+if (!process.argv.slice(2).length) {
+    program.outputHelp();
+}

package/dist/cli/utils/env-parser.d.ts

@@ -0,0 +1,19 @@
+export interface EnvVariable {
+    key: string;
+    value: string;
+}
+/**
+ * Parse a .env file into key-value pairs
+ * Supports:
+ * - KEY=value
+ * - KEY="value"
+ * - KEY='value'
+ * - # comments
+ * - Empty lines
+ */
+export declare function parseEnvFile(filePath: string): EnvVariable[];
+/**
+ * Load environment variables from a .env file
+ * Returns a Map for easy lookup
+ */
+export declare function loadEnvFile(filePath: string): Map<string, string>;

package/dist/cli/utils/env-parser.js

@@ -0,0 +1,47 @@
+import { readFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+/**
+ * Parse a .env file into key-value pairs
+ * Supports:
+ * - KEY=value
+ * - KEY="value"
+ * - KEY='value'
+ * - # comments
+ * - Empty lines
+ */
+export function parseEnvFile(filePath) {
+    const resolvedPath = resolve(filePath);
+    if (!existsSync(resolvedPath)) {
+        throw new Error(`File not found: ${resolvedPath}`);
+    }
+    const content = readFileSync(resolvedPath, 'utf-8');
+    const lines = content.split('\n');
+    const variables = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        // Skip empty lines and comments
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        // Match KEY=value, KEY="value", or KEY='value'
+        const match = trimmed.match(/^([A-Z0-9_]+)\s*=\s*(['"]?)(.+?)\2$/i);
+        if (match) {
+            const key = match[1];
+            const value = match[3];
+            variables.push({ key, value });
+        }
+    }
+    return variables;
+}
+/**
+ * Load environment variables from a .env file
+ * Returns a Map for easy lookup
+ */
+export function loadEnvFile(filePath) {
+    const variables = parseEnvFile(filePath);
+    const map = new Map();
+    for (const { key, value } of variables) {
+        map.set(key, value);
+    }
+    return map;
+}

package/dist/cli/utils/key-detector.d.ts

@@ -0,0 +1,33 @@
+import type { SecretConfig } from '../../types.js';
+import type { EnvVariable } from './env-parser.js';
+interface ProviderPattern {
+    pattern: RegExp;
+    provider: string;
+    baseUrl?: string;
+    authHeader?: string;
+    authPrefix?: string;
+}
+/**
+ * Detect if an environment variable is likely an API key
+ */
+export declare function isLikelyApiKey(key: string, value: string): boolean;
+/**
+ * Detect provider from environment variable name
+ */
+export declare function detectProvider(key: string): ProviderPattern | null;
+/**
+ * Convert environment variable to secret name
+ * OPENAI_API_KEY -> openai
+ * MY_API_KEY -> my-api
+ */
+export declare function envKeyToSecretName(key: string): string;
+/**
+ * Detect API keys from environment variables
+ * Returns SecretConfig array ready for import
+ */
+export declare function detectApiKeys(envVars: EnvVariable[]): SecretConfig[];
+/**
+ * Display detected secrets summary (for user confirmation)
+ */
+export declare function summarizeDetectedSecrets(secrets: SecretConfig[]): string;
+export {};

package/dist/cli/utils/key-detector.js

@@ -0,0 +1,153 @@
+/**
+ * Common API key patterns and their providers
+ */
+const PROVIDER_PATTERNS = [
+    {
+        pattern: /^OPENAI_API_KEY$/i,
+        provider: 'openai',
+        baseUrl: 'https://api.openai.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    },
+    {
+        pattern: /^ANTHROPIC_API_KEY$/i,
+        provider: 'anthropic',
+        baseUrl: 'https://api.anthropic.com',
+        authHeader: 'x-api-key',
+        authPrefix: ''
+    },
+    {
+        pattern: /^STRIPE_(SECRET_)?KEY$/i,
+        provider: 'stripe',
+        baseUrl: 'https://api.stripe.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    },
+    {
+        pattern: /^GITHUB_TOKEN$/i,
+        provider: 'github',
+        baseUrl: 'https://api.github.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    },
+    {
+        pattern: /^GOOGLE_API_KEY$/i,
+        provider: 'google',
+        baseUrl: 'https://www.googleapis.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    }
+];
+/**
+ * Detect if an environment variable is likely an API key
+ */
+export function isLikelyApiKey(key, value) {
+    // Check common patterns
+    const keyPatterns = [
+        /_API_KEY$/i,
+        /_SECRET$/i,
+        /_TOKEN$/i,
+        /^API_KEY_/i,
+        /^SECRET_/i,
+        /^TOKEN_/i
+    ];
+    for (const pattern of keyPatterns) {
+        if (pattern.test(key)) {
+            return true;
+        }
+    }
+    // Check value patterns (looks like a key/token)
+    const valuePatterns = [
+        /^sk-[a-zA-Z0-9_-]+$/, // OpenAI, Stripe
+        /^sk-ant-[a-zA-Z0-9_-]+$/, // Anthropic
+        /^ghp_[a-zA-Z0-9]+$/, // GitHub
+        /^ya29\.[a-zA-Z0-9_-]+$/, // Google OAuth
+        /^[a-f0-9]{32}$/, // 32-char hex
+        /^[a-f0-9]{40}$/, // 40-char hex (like GitHub)
+        /^[a-zA-Z0-9_-]{40,}$/ // Long random string
+    ];
+    for (const pattern of valuePatterns) {
+        if (pattern.test(value)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Detect provider from environment variable name
+ */
+export function detectProvider(key) {
+    for (const pattern of PROVIDER_PATTERNS) {
+        if (pattern.pattern.test(key)) {
+            return pattern;
+        }
+    }
+    return null;
+}
+/**
+ * Convert environment variable to secret name
+ * OPENAI_API_KEY -> openai
+ * MY_API_KEY -> my-api
+ */
+export function envKeyToSecretName(key) {
+    return key
+        .toLowerCase()
+        .replace(/_api_key$/i, '')
+        .replace(/_secret$/i, '')
+        .replace(/_token$/i, '')
+        .replace(/_key$/i, '')
+        .replace(/_/g, '-');
+}
+/**
+ * Detect API keys from environment variables
+ * Returns SecretConfig array ready for import
+ */
+export function detectApiKeys(envVars) {
+    const secrets = [];
+    for (const { key, value } of envVars) {
+        // Skip if doesn't look like an API key
+        if (!isLikelyApiKey(key, value)) {
+            continue;
+        }
+        // Detect provider
+        const providerInfo = detectProvider(key);
+        const secretName = envKeyToSecretName(key);
+        if (providerInfo) {
+            // Known provider
+            secrets.push({
+                name: secretName,
+                provider: providerInfo.provider,
+                api_key: value,
+                base_url: providerInfo.baseUrl,
+                auth_header: providerInfo.authHeader,
+                auth_prefix: providerInfo.authPrefix
+            });
+        }
+        else {
+            // Custom/unknown provider
+            secrets.push({
+                name: secretName,
+                provider: 'custom',
+                api_key: value,
+                base_url: '', // User must configure
+                auth_header: 'Authorization',
+                auth_prefix: 'Bearer '
+            });
+        }
+    }
+    return secrets;
+}
+/**
+ * Display detected secrets summary (for user confirmation)
+ */
+export function summarizeDetectedSecrets(secrets) {
+    if (secrets.length === 0) {
+        return 'No API keys detected in .env file';
+    }
+    const lines = ['Detected API keys:'];
+    for (const secret of secrets) {
+        const masked = secret.api_key.substring(0, 8) + '...';
+        lines.push(`  - ${secret.name} (${secret.provider}): ${masked}`);
+    }
+    return lines.join('\n');
+}

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { SecretsSDKOptions, ProxyRequest, RateLimitInfo } from './types';
+import type { SecretsSDKOptions, ProxyRequest, RateLimitInfo } from './types.js';
 export declare class SecretsSDK {
     private appId;
     private token;
@@ -6,7 +6,18 @@ export declare class SecretsSDK {
     private timeout;
     private retryOn429;
     private rateLimitInfo;
-    constructor(options: SecretsSDKOptions);
+    private zeroConfigMode;
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options?: SecretsSDKOptions);
     /**
      * Get current rate limit information
      */

package/dist/client.js

@@ -1,15 +1,25 @@
-import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
+import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';
 export class SecretsSDK {
-    constructor(options) {
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options = {}) {
         this.rateLimitInfo = null;
-        this.appId = options.appId;
-        this.token = options.token || options.sessionToken || '';
-        this.baseUrl = options.baseUrl || 'https://learn.pages.dev';
+        this.appId = options.appId || null;
+        this.token = options.token || options.sessionToken || null;
+        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
         this.timeout = options.timeout || 30000;
         this.retryOn429 = options.retryOn429 !== undefined ? options.retryOn429 : true;
-        if (!this.token) {
-            throw new Error('token is required');
-        }
+        // Zero-config mode: no appId or token required
+        // Authentication is based on Origin header
+        this.zeroConfigMode = !this.appId && !this.token;
     }
     /**
      * Get current rate limit information
@@ -67,12 +77,20 @@ export class SecretsSDK {
         const maxRetries = this.retryOn429 ? 3 : 0;
         while (true) {
             try {
-                const response = await this.fetchWithTimeout(`${this.baseUrl}/api/sdk/${this.appId}/proxy`, {
+                // Build URL based on mode
+                const proxyUrl = this.zeroConfigMode
+                    ? `${this.baseUrl}/api/sdk/proxy`
+                    : `${this.baseUrl}/api/sdk/${this.appId}/proxy`;
+                // Build headers based on mode
+                const requestHeaders = {
+                    'Content-Type': 'application/json'
+                };
+                if (!this.zeroConfigMode && this.token) {
+                    requestHeaders['Authorization'] = `Bearer ${this.token}`;
+                }
+                const response = await this.fetchWithTimeout(proxyUrl, {
                     method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        Authorization: `Bearer ${this.token}`
-                    },
+                    headers: requestHeaders,
                     body: JSON.stringify({
                         keyName,
                         endpoint,

package/dist/credentials.d.ts

@@ -0,0 +1,24 @@
+import type { CLICredentials } from './types.js';
+/**
+ * Get the path to the credentials file
+ * Defaults to ~/.learn/credentials.json
+ */
+export declare function getCredentialsPath(): string;
+/**
+ * Read credentials from file
+ * Returns null if file doesn't exist or is invalid
+ */
+export declare function readCredentials(): CLICredentials | null;
+/**
+ * Write credentials to file
+ * Creates ~/.learn directory if it doesn't exist
+ */
+export declare function writeCredentials(creds: CLICredentials): void;
+/**
+ * Delete credentials file
+ */
+export declare function deleteCredentials(): void;
+/**
+ * Check if credentials exist and are not expired
+ */
+export declare function hasValidCredentials(): boolean;

package/dist/credentials.js

@@ -0,0 +1,86 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+/**
+ * Get the path to the credentials file
+ * Defaults to ~/.learn/credentials.json
+ */
+export function getCredentialsPath() {
+    const homeDir = os.homedir();
+    const learnDir = path.join(homeDir, '.learn');
+    return path.join(learnDir, 'credentials.json');
+}
+/**
+ * Ensure the ~/.learn directory exists
+ */
+function ensureLearnDir() {
+    const homeDir = os.homedir();
+    const learnDir = path.join(homeDir, '.learn');
+    if (!fs.existsSync(learnDir)) {
+        fs.mkdirSync(learnDir, { recursive: true, mode: 0o700 }); // Owner-only permissions
+    }
+}
+/**
+ * Read credentials from file
+ * Returns null if file doesn't exist or is invalid
+ */
+export function readCredentials() {
+    try {
+        const credPath = getCredentialsPath();
+        if (!fs.existsSync(credPath)) {
+            return null;
+        }
+        const data = fs.readFileSync(credPath, 'utf-8');
+        const creds = JSON.parse(data);
+        // Validate required fields
+        if (!creds.access_token ||
+            !creds.refresh_token ||
+            !creds.expires_at ||
+            !creds.user_id) {
+            return null;
+        }
+        return creds;
+    }
+    catch (err) {
+        // Invalid JSON or read error
+        return null;
+    }
+}
+/**
+ * Write credentials to file
+ * Creates ~/.learn directory if it doesn't exist
+ */
+export function writeCredentials(creds) {
+    ensureLearnDir();
+    const credPath = getCredentialsPath();
+    const data = JSON.stringify(creds, null, 2);
+    // Write with owner-only permissions
+    fs.writeFileSync(credPath, data, { mode: 0o600 });
+}
+/**
+ * Delete credentials file
+ */
+export function deleteCredentials() {
+    try {
+        const credPath = getCredentialsPath();
+        if (fs.existsSync(credPath)) {
+            fs.unlinkSync(credPath);
+        }
+    }
+    catch (err) {
+        // Ignore errors (file might not exist)
+    }
+}
+/**
+ * Check if credentials exist and are not expired
+ */
+export function hasValidCredentials() {
+    const creds = readCredentials();
+    if (!creds) {
+        return false;
+    }
+    // Check if expired
+    const expiresAt = new Date(creds.expires_at);
+    const now = new Date();
+    return expiresAt > now;
+}

package/dist/env-resolver.d.ts

@@ -0,0 +1,23 @@
+import type { SecretConfig } from './types.js';
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+export declare function resolveEnvString(value: string): string;
+/**
+ * Resolve environment variables in a single secret config
+ */
+export declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
+/**
+ * Resolve environment variables in an array of secrets
+ */
+export declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+export declare function loadSecretsConfig(configPath: string): {
+    version: string;
+    project: string;
+    secrets: SecretConfig[];
+};

package/dist/env-resolver.js

@@ -0,0 +1,73 @@
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+export function resolveEnvString(value) {
+    // Replace ${VAR} and $VAR references
+    return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
+        const varName = var1 || var2;
+        const envValue = process.env[varName];
+        if (envValue === undefined) {
+            throw new Error(`Environment variable ${varName} is not defined`);
+        }
+        return envValue;
+    });
+}
+/**
+ * Resolve environment variables in a single secret config
+ */
+export function resolveEnvInSecret(secret) {
+    const resolved = {
+        name: resolveEnvString(secret.name),
+        provider: resolveEnvString(secret.provider),
+        api_key: resolveEnvString(secret.api_key)
+    };
+    if (secret.base_url) {
+        resolved.base_url = resolveEnvString(secret.base_url);
+    }
+    if (secret.auth_header) {
+        resolved.auth_header = resolveEnvString(secret.auth_header);
+    }
+    if (secret.auth_prefix) {
+        resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
+    }
+    return resolved;
+}
+/**
+ * Resolve environment variables in an array of secrets
+ */
+export function resolveEnvInSecrets(secrets) {
+    return secrets.map(resolveEnvInSecret);
+}
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+export function loadSecretsConfig(configPath) {
+    const fs = require('fs');
+    const path = require('path');
+    // Read config file
+    const fullPath = path.resolve(configPath);
+    if (!fs.existsSync(fullPath)) {
+        throw new Error(`Config file not found: ${fullPath}`);
+    }
+    const configData = fs.readFileSync(fullPath, 'utf-8');
+    const config = JSON.parse(configData);
+    // Validate config
+    if (!config.version) {
+        throw new Error('Config file missing "version" field');
+    }
+    if (!config.project) {
+        throw new Error('Config file missing "project" field');
+    }
+    if (!Array.isArray(config.secrets)) {
+        throw new Error('Config file missing "secrets" array');
+    }
+    // Resolve environment variables
+    const resolvedSecrets = resolveEnvInSecrets(config.secrets);
+    return {
+        version: config.version,
+        project: config.project,
+        secrets: resolvedSecrets
+    };
+}

package/dist/index.d.ts

@@ -1,3 +1,5 @@
-export { SecretsSDK } from './client';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
-export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo } from './types';
+export { SecretsSDK } from './client.js';
+export { SecretsManagement } from './management.js';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver.js';
+export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';
+export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types.js';

package/dist/index.js

@@ -1,2 +1,4 @@
-export { SecretsSDK } from './client';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
+export { SecretsSDK } from './client.js';
+export { SecretsManagement } from './management.js';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver.js';
+export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';

package/dist/management.d.ts

@@ -0,0 +1,98 @@
+import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types.js';
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+export declare class SecretsManagement {
+    private appId;
+    private baseUrl;
+    private timeout;
+    constructor(options: SecretsManagementOptions);
+    /**
+     * Open a URL in the default browser
+     */
+    private openBrowser;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    login(): Promise<{
+        success: boolean;
+        user: string;
+    }>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Logout - clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    private getAccessToken;
+    /**
+     * Make authenticated request
+     */
+    private request;
+    /**
+     * List all secrets (with masked API keys)
+     */
+    list(): Promise<MaskedSecret[]>;
+    /**
+     * Sync secrets from config
+     */
+    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    importSecrets(config: {
+        version?: string;
+        origins?: string[];
+        secrets: SecretConfig[];
+    }): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: {
+                    name: string;
+                    error: string;
+                }[];
+            };
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    importFromFile(configPath: string): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+}

package/dist/management.js

@@ -0,0 +1,214 @@
+import { SecretsSDKError } from './types.js';
+import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials.js';
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+export class SecretsManagement {
+    constructor(options) {
+        this.appId = options.appId;
+        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
+        this.timeout = options.timeout || 30000;
+    }
+    /**
+     * Open a URL in the default browser
+     */
+    async openBrowser(url) {
+        const { exec } = await import('child_process');
+        const { promisify } = await import('util');
+        const execAsync = promisify(exec);
+        const platform = process.platform;
+        try {
+            if (platform === 'darwin') {
+                await execAsync(`open "${url}"`);
+            }
+            else if (platform === 'win32') {
+                await execAsync(`start "${url}"`);
+            }
+            else {
+                // Linux
+                await execAsync(`xdg-open "${url}"`);
+            }
+        }
+        catch (err) {
+            console.error('Failed to open browser:', err);
+            throw new SecretsSDKError('Failed to open browser', 500);
+        }
+    }
+    /**
+     * Sleep for specified milliseconds
+     */
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    async login() {
+        try {
+            // Step 1: Request device code
+            const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                }
+            });
+            if (!deviceResponse.ok) {
+                throw new SecretsSDKError('Failed to generate device code', deviceResponse.status);
+            }
+            const deviceData = await deviceResponse.json();
+            // Step 2: Display user code and verification URI
+            console.log('\nTo authorize this application, visit:');
+            console.log(`  ${deviceData.verification_uri}`);
+            console.log('\nAnd enter the code:');
+            console.log(`  ${deviceData.user_code}`);
+            console.log('\nOpening browser...\n');
+            // Step 3: Open browser
+            await this.openBrowser(deviceData.verification_uri_complete);
+            // Step 4: Poll for token
+            const interval = deviceData.interval * 1000; // Convert to ms
+            const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
+            let attempts = 0;
+            while (attempts < maxAttempts) {
+                await this.sleep(interval);
+                attempts++;
+                const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({
+                        device_code: deviceData.device_code
+                    })
+                });
+                if (tokenResponse.status === 202) {
+                    // Still pending
+                    process.stdout.write('.');
+                    continue;
+                }
+                if (!tokenResponse.ok) {
+                    const errorData = await tokenResponse.json().catch(() => ({}));
+                    throw new SecretsSDKError(errorData.message || 'Failed to exchange device code', tokenResponse.status);
+                }
+                // Success!
+                const tokenData = await tokenResponse.json();
+                // Step 5: Store credentials
+                const expiresAt = new Date(Date.now() + tokenData.expires_in * 1000);
+                writeCredentials({
+                    access_token: tokenData.access_token,
+                    refresh_token: tokenData.refresh_token,
+                    expires_at: expiresAt.toISOString(),
+                    user_id: tokenData.user_id
+                });
+                console.log('\n\nAuthentication successful!');
+                return {
+                    success: true,
+                    user: tokenData.user_id
+                };
+            }
+            // Timeout
+            throw new SecretsSDKError('Authorization timeout', 408);
+        }
+        catch (err) {
+            if (err instanceof SecretsSDKError) {
+                throw err;
+            }
+            throw new SecretsSDKError(err.message || 'Login failed', err.status || 500);
+        }
+    }
+    /**
+     * Check if user is authenticated
+     */
+    async isAuthenticated() {
+        return hasValidCredentials();
+    }
+    /**
+     * Logout - clear stored credentials
+     */
+    logout() {
+        deleteCredentials();
+        console.log('Logged out successfully');
+    }
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    getAccessToken() {
+        const creds = readCredentials();
+        if (!creds) {
+            throw new SecretsSDKError('Not authenticated. Run login() first.', 401);
+        }
+        // Check if expired
+        const expiresAt = new Date(creds.expires_at);
+        const now = new Date();
+        if (expiresAt <= now) {
+            throw new SecretsSDKError('Token expired. Run login() again.', 401);
+        }
+        return creds.access_token;
+    }
+    /**
+     * Make authenticated request
+     */
+    async request(method, path, body) {
+        const token = this.getAccessToken();
+        const options = {
+            method,
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`
+            }
+        };
+        if (body) {
+            options.body = JSON.stringify(body);
+        }
+        const response = await fetch(`${this.baseUrl}${path}`, options);
+        if (!response.ok) {
+            const errorData = await response.json().catch(() => ({}));
+            throw new SecretsSDKError(errorData.message || `Request failed: ${response.statusText}`, response.status, errorData);
+        }
+        return response.json();
+    }
+    /**
+     * List all secrets (with masked API keys)
+     */
+    async list() {
+        const response = await this.request('GET', `/api/projects/${this.appId}/secrets`);
+        return response.secrets;
+    }
+    /**
+     * Sync secrets from config
+     */
+    async sync(secrets, options) {
+        const response = await this.request('POST', `/api/projects/${this.appId}/secrets/sync`, {
+            secrets,
+            options: {
+                deleteMissing: options?.deleteMissing ?? false,
+                dryRun: options?.dryRun ?? false
+            }
+        });
+        return response;
+    }
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    async importSecrets(config) {
+        return this.request('POST', `/api/projects/${this.appId}/import-secrets`, {
+            version: config.version || '1.0',
+            origins: config.origins,
+            secrets: config.secrets
+        });
+    }
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    async importFromFile(configPath) {
+        const { loadSecretsConfig } = await import('./env-resolver');
+        const config = loadSecretsConfig(configPath);
+        return this.importSecrets(config);
+    }
+}

package/dist/types.d.ts

@@ -1,7 +1,19 @@
 export interface SecretsSDKOptions {
-    appId: string;
-    token: string;
+    /**
+     * App ID from dashboard (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    appId?: string;
+    /**
+     * SDK token (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    token?: string;
     sessionToken?: string;
+    /**
+     * Base URL of the proxy server
+     * Default: https://ctklearn.carsontkempf.workers.dev
+     */
     baseUrl?: string;
     timeout?: number;
     retryOn429?: boolean;
@@ -40,3 +52,72 @@ export declare class RateLimitError extends SecretsSDKError {
 export declare class InvalidTokenError extends SecretsSDKError {
     constructor(message?: string);
 }
+export interface SecretsManagementOptions {
+    appId: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+export interface SecretConfig {
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+}
+export interface MaskedSecret {
+    id: string;
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+    created?: string;
+    updated?: string;
+}
+export interface SyncOptions {
+    deleteMissing?: boolean;
+    dryRun?: boolean;
+}
+export interface SyncDiffItem {
+    name: string;
+    provider?: string;
+    changes?: string[];
+}
+export interface SyncResult {
+    success: boolean;
+    diff: {
+        created: SyncDiffItem[];
+        updated: SyncDiffItem[];
+        deleted: SyncDiffItem[];
+        unchanged: SyncDiffItem[];
+    };
+    summary: {
+        created: number;
+        updated: number;
+        deleted: number;
+        unchanged: number;
+    };
+}
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface TokenResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    user_id: string;
+}
+export interface CLICredentials {
+    access_token: string;
+    refresh_token: string;
+    expires_at: string;
+    user_id: string;
+}

package/package.json

@@ -1,12 +1,17 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.2.0",
+	"version": "1.4.0",
 	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
 	"types": "dist/index.d.ts",
+	"bin": {
+		"learn-secrets": "./bin/learn-secrets.js"
+	},
 	"files": [
-		"dist"
+		"dist",
+		"bin",
+		"secrets.template.json"
 	],
 	"scripts": {
 		"build": "tsc && tsc --project tsconfig.esm.json",
@@ -17,11 +22,17 @@
 		"proxy",
 		"secrets",
 		"static-sites",
-		"security"
+		"security",
+		"cli",
+		"secrets-management"
 	],
 	"author": "",
 	"license": "MIT",
+	"dependencies": {
+		"commander": "^12.0.0"
+	},
 	"devDependencies": {
+		"@types/node": "^20.0.0",
 		"typescript": "^5.0.0"
 	}
 }

package/secrets.template.json

@@ -0,0 +1,42 @@
+{
+  "version": "1.0",
+  "project": "your-app-id",
+  "origins": [
+    "localhost",
+    "yourdomain.com"
+  ],
+  "secrets": [
+    {
+      "name": "test-echo",
+      "provider": "custom",
+      "api_key": "test",
+      "base_url": "https://httpbin.org",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    },
+    {
+      "name": "openai",
+      "provider": "openai",
+      "api_key": "${OPENAI_API_KEY}",
+      "base_url": "https://api.openai.com",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    },
+    {
+      "name": "anthropic",
+      "provider": "anthropic",
+      "api_key": "${ANTHROPIC_API_KEY}",
+      "base_url": "https://api.anthropic.com",
+      "auth_header": "x-api-key",
+      "auth_prefix": ""
+    },
+    {
+      "name": "stripe",
+      "provider": "stripe",
+      "api_key": "${STRIPE_SECRET_KEY}",
+      "base_url": "https://api.stripe.com",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    }
+  ]
+}