learn-secrets-sdk 1.3.0 → 1.4.0

package/bin/learn-secrets.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+
+// Entry point for the learn-secrets CLI
+// This file is executed when running: learn-secrets <command>
+
+// Check Node version
+const nodeVersion = process.versions.node;
+const majorVersion = parseInt(nodeVersion.split('.')[0], 10);
+
+if (majorVersion < 16) {
+	console.error('Error: Node.js 16 or higher is required');
+	console.error(`You are running Node.js ${nodeVersion}`);
+	process.exit(1);
+}
+
+// Run the CLI
+require('../dist/cli/index.js');

package/dist/cli/commands/init.d.ts

@@ -0,0 +1,11 @@
+export interface InitOptions {
+    origins: string;
+    env?: string;
+    project?: string;
+    baseUrl?: string;
+    yes?: boolean;
+}
+/**
+ * Init command - onboard a new site by uploading .env secrets
+ */
+export declare function initCommand(options: InitOptions): Promise<void>;

package/dist/cli/commands/init.js

@@ -0,0 +1,113 @@
+import { SecretsManagement } from '../../management.js';
+import { parseEnvFile } from '../utils/env-parser.js';
+import { detectApiKeys, summarizeDetectedSecrets } from '../utils/key-detector.js';
+import { hasValidCredentials } from '../../credentials.js';
+/**
+ * Init command - onboard a new site by uploading .env secrets
+ */
+export async function initCommand(options) {
+    // Validate authentication
+    if (!hasValidCredentials()) {
+        console.error('Error: Not authenticated. Run "learn-secrets login" first.');
+        process.exit(1);
+    }
+    // Validate required options
+    if (!options.origins) {
+        console.error('Error: --origins is required');
+        console.error('Example: learn-secrets init --origins mysite.com,localhost');
+        process.exit(1);
+    }
+    if (!options.project) {
+        console.error('Error: --project is required');
+        console.error('Example: learn-secrets init --project my-app-id --origins mysite.com');
+        process.exit(1);
+    }
+    // Parse origins
+    const origins = options.origins.split(',').map(o => o.trim()).filter(Boolean);
+    if (origins.length === 0) {
+        console.error('Error: No valid origins provided');
+        process.exit(1);
+    }
+    console.log(`\nOnboarding site for project: ${options.project}`);
+    console.log(`Origins: ${origins.join(', ')}\n`);
+    // Load and detect secrets from .env
+    const envFile = options.env || '.env';
+    let secrets;
+    try {
+        console.log(`Reading ${envFile}...`);
+        const envVars = parseEnvFile(envFile);
+        secrets = detectApiKeys(envVars);
+        if (secrets.length === 0) {
+            console.log('\nNo API keys detected in .env file.');
+            console.log('Make sure your .env contains variables like:');
+            console.log('  OPENAI_API_KEY=sk-...');
+            console.log('  ANTHROPIC_API_KEY=sk-ant-...');
+            process.exit(0);
+        }
+        console.log('\n' + summarizeDetectedSecrets(secrets));
+        console.log('');
+    }
+    catch (error) {
+        console.error(`Error reading ${envFile}:`, error.message);
+        process.exit(1);
+    }
+    // Ask for confirmation unless --yes flag
+    if (!options.yes) {
+        const readline = await import('readline');
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout
+        });
+        const answer = await new Promise((resolve) => {
+            rl.question('Upload these secrets? (y/N): ', resolve);
+        });
+        rl.close();
+        if (answer.toLowerCase() !== 'y' && answer.toLowerCase() !== 'yes') {
+            console.log('Cancelled.');
+            process.exit(0);
+        }
+    }
+    // Upload secrets
+    console.log('\nUploading secrets...');
+    const mgmt = new SecretsManagement({
+        appId: options.project,
+        baseUrl: options.baseUrl
+    });
+    try {
+        const result = await mgmt.importSecrets({
+            version: '1.0',
+            origins,
+            secrets
+        });
+        console.log('\nSuccess!');
+        console.log(`  Created: ${result.results.created} secrets`);
+        console.log(`  Updated: ${result.results.updated} secrets`);
+        if (result.results.failed > 0) {
+            console.log(`  Failed: ${result.results.failed} secrets`);
+            for (const failure of result.results.details.failed) {
+                console.log(`    - ${failure.name}: ${failure.error}`);
+            }
+        }
+        if (result.sdkToken) {
+            console.log('\nSDK Token created:');
+            console.log(`  ${result.sdkToken.token}`);
+            console.log('\n  IMPORTANT: Save this token - it will not be shown again.');
+            console.log('  Add it to your static site code:');
+            console.log('');
+            console.log('    const sdk = new SecretsSDK();');
+            console.log('    // No appId or token needed - uses origin-based auth!');
+        }
+        console.log('\nYour site is ready!');
+        console.log(`Visit: https://ctklearn.carsontkempf.workers.dev to manage secrets`);
+    }
+    catch (error) {
+        console.error('\nUpload failed:', error.message);
+        if (error.status === 401) {
+            console.error('Your session may have expired. Try running "learn-secrets login" again.');
+        }
+        if (error.status === 404) {
+            console.error(`Project "${options.project}" not found. Check your project ID.`);
+        }
+        process.exit(1);
+    }
+}

package/dist/cli/commands/login.d.ts

@@ -0,0 +1,7 @@
+export interface LoginOptions {
+    baseUrl?: string;
+}
+/**
+ * Login command - authenticate via browser OAuth flow
+ */
+export declare function loginCommand(options?: LoginOptions): Promise<void>;

package/dist/cli/commands/login.js

@@ -0,0 +1,22 @@
+import { SecretsManagement } from '../../management.js';
+/**
+ * Login command - authenticate via browser OAuth flow
+ */
+export async function loginCommand(options = {}) {
+    console.log('Authenticating with Learn Secrets...\n');
+    // Create management client (appId not needed for login)
+    const mgmt = new SecretsManagement({
+        appId: 'temp', // Will be set after login
+        baseUrl: options.baseUrl
+    });
+    try {
+        const result = await mgmt.login();
+        console.log(`\nLogged in as: ${result.user}`);
+        console.log('Credentials saved to ~/.learn/credentials.json');
+        console.log('\nYou can now run: learn-secrets init --origins yourdomain.com');
+    }
+    catch (error) {
+        console.error('\nLogin failed:', error.message);
+        process.exit(1);
+    }
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { loginCommand } from './commands/login.js';
+import { initCommand } from './commands/init.js';
+const program = new Command();
+program
+    .name('learn-secrets')
+    .description('CLI tool for managing API secrets in static sites')
+    .version('1.4.0');
+// Login command
+program
+    .command('login')
+    .description('Authenticate with Learn Secrets via browser')
+    .option('--base-url <url>', 'Custom base URL for API')
+    .action(async (options) => {
+    await loginCommand(options);
+});
+// Init command
+program
+    .command('init')
+    .description('Initialize secrets for a new site')
+    .requiredOption('-o, --origins <domains>', 'Comma-separated list of allowed origins (e.g., mysite.com,localhost)')
+    .requiredOption('-p, --project <appid>', 'Project app ID from dashboard')
+    .option('-e, --env <file>', 'Path to .env file (default: .env)', '.env')
+    .option('--base-url <url>', 'Custom base URL for API')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .action(async (options) => {
+    await initCommand(options);
+});
+// Parse arguments
+program.parse(process.argv);
+// Show help if no command provided
+if (!process.argv.slice(2).length) {
+    program.outputHelp();
+}

package/dist/cli/utils/env-parser.d.ts

@@ -0,0 +1,19 @@
+export interface EnvVariable {
+    key: string;
+    value: string;
+}
+/**
+ * Parse a .env file into key-value pairs
+ * Supports:
+ * - KEY=value
+ * - KEY="value"
+ * - KEY='value'
+ * - # comments
+ * - Empty lines
+ */
+export declare function parseEnvFile(filePath: string): EnvVariable[];
+/**
+ * Load environment variables from a .env file
+ * Returns a Map for easy lookup
+ */
+export declare function loadEnvFile(filePath: string): Map<string, string>;

package/dist/cli/utils/env-parser.js

@@ -0,0 +1,47 @@
+import { readFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+/**
+ * Parse a .env file into key-value pairs
+ * Supports:
+ * - KEY=value
+ * - KEY="value"
+ * - KEY='value'
+ * - # comments
+ * - Empty lines
+ */
+export function parseEnvFile(filePath) {
+    const resolvedPath = resolve(filePath);
+    if (!existsSync(resolvedPath)) {
+        throw new Error(`File not found: ${resolvedPath}`);
+    }
+    const content = readFileSync(resolvedPath, 'utf-8');
+    const lines = content.split('\n');
+    const variables = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        // Skip empty lines and comments
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        // Match KEY=value, KEY="value", or KEY='value'
+        const match = trimmed.match(/^([A-Z0-9_]+)\s*=\s*(['"]?)(.+?)\2$/i);
+        if (match) {
+            const key = match[1];
+            const value = match[3];
+            variables.push({ key, value });
+        }
+    }
+    return variables;
+}
+/**
+ * Load environment variables from a .env file
+ * Returns a Map for easy lookup
+ */
+export function loadEnvFile(filePath) {
+    const variables = parseEnvFile(filePath);
+    const map = new Map();
+    for (const { key, value } of variables) {
+        map.set(key, value);
+    }
+    return map;
+}

package/dist/cli/utils/key-detector.d.ts

@@ -0,0 +1,33 @@
+import type { SecretConfig } from '../../types.js';
+import type { EnvVariable } from './env-parser.js';
+interface ProviderPattern {
+    pattern: RegExp;
+    provider: string;
+    baseUrl?: string;
+    authHeader?: string;
+    authPrefix?: string;
+}
+/**
+ * Detect if an environment variable is likely an API key
+ */
+export declare function isLikelyApiKey(key: string, value: string): boolean;
+/**
+ * Detect provider from environment variable name
+ */
+export declare function detectProvider(key: string): ProviderPattern | null;
+/**
+ * Convert environment variable to secret name
+ * OPENAI_API_KEY -> openai
+ * MY_API_KEY -> my-api
+ */
+export declare function envKeyToSecretName(key: string): string;
+/**
+ * Detect API keys from environment variables
+ * Returns SecretConfig array ready for import
+ */
+export declare function detectApiKeys(envVars: EnvVariable[]): SecretConfig[];
+/**
+ * Display detected secrets summary (for user confirmation)
+ */
+export declare function summarizeDetectedSecrets(secrets: SecretConfig[]): string;
+export {};

package/dist/cli/utils/key-detector.js

@@ -0,0 +1,153 @@
+/**
+ * Common API key patterns and their providers
+ */
+const PROVIDER_PATTERNS = [
+    {
+        pattern: /^OPENAI_API_KEY$/i,
+        provider: 'openai',
+        baseUrl: 'https://api.openai.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    },
+    {
+        pattern: /^ANTHROPIC_API_KEY$/i,
+        provider: 'anthropic',
+        baseUrl: 'https://api.anthropic.com',
+        authHeader: 'x-api-key',
+        authPrefix: ''
+    },
+    {
+        pattern: /^STRIPE_(SECRET_)?KEY$/i,
+        provider: 'stripe',
+        baseUrl: 'https://api.stripe.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    },
+    {
+        pattern: /^GITHUB_TOKEN$/i,
+        provider: 'github',
+        baseUrl: 'https://api.github.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    },
+    {
+        pattern: /^GOOGLE_API_KEY$/i,
+        provider: 'google',
+        baseUrl: 'https://www.googleapis.com',
+        authHeader: 'Authorization',
+        authPrefix: 'Bearer '
+    }
+];
+/**
+ * Detect if an environment variable is likely an API key
+ */
+export function isLikelyApiKey(key, value) {
+    // Check common patterns
+    const keyPatterns = [
+        /_API_KEY$/i,
+        /_SECRET$/i,
+        /_TOKEN$/i,
+        /^API_KEY_/i,
+        /^SECRET_/i,
+        /^TOKEN_/i
+    ];
+    for (const pattern of keyPatterns) {
+        if (pattern.test(key)) {
+            return true;
+        }
+    }
+    // Check value patterns (looks like a key/token)
+    const valuePatterns = [
+        /^sk-[a-zA-Z0-9_-]+$/, // OpenAI, Stripe
+        /^sk-ant-[a-zA-Z0-9_-]+$/, // Anthropic
+        /^ghp_[a-zA-Z0-9]+$/, // GitHub
+        /^ya29\.[a-zA-Z0-9_-]+$/, // Google OAuth
+        /^[a-f0-9]{32}$/, // 32-char hex
+        /^[a-f0-9]{40}$/, // 40-char hex (like GitHub)
+        /^[a-zA-Z0-9_-]{40,}$/ // Long random string
+    ];
+    for (const pattern of valuePatterns) {
+        if (pattern.test(value)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Detect provider from environment variable name
+ */
+export function detectProvider(key) {
+    for (const pattern of PROVIDER_PATTERNS) {
+        if (pattern.pattern.test(key)) {
+            return pattern;
+        }
+    }
+    return null;
+}
+/**
+ * Convert environment variable to secret name
+ * OPENAI_API_KEY -> openai
+ * MY_API_KEY -> my-api
+ */
+export function envKeyToSecretName(key) {
+    return key
+        .toLowerCase()
+        .replace(/_api_key$/i, '')
+        .replace(/_secret$/i, '')
+        .replace(/_token$/i, '')
+        .replace(/_key$/i, '')
+        .replace(/_/g, '-');
+}
+/**
+ * Detect API keys from environment variables
+ * Returns SecretConfig array ready for import
+ */
+export function detectApiKeys(envVars) {
+    const secrets = [];
+    for (const { key, value } of envVars) {
+        // Skip if doesn't look like an API key
+        if (!isLikelyApiKey(key, value)) {
+            continue;
+        }
+        // Detect provider
+        const providerInfo = detectProvider(key);
+        const secretName = envKeyToSecretName(key);
+        if (providerInfo) {
+            // Known provider
+            secrets.push({
+                name: secretName,
+                provider: providerInfo.provider,
+                api_key: value,
+                base_url: providerInfo.baseUrl,
+                auth_header: providerInfo.authHeader,
+                auth_prefix: providerInfo.authPrefix
+            });
+        }
+        else {
+            // Custom/unknown provider
+            secrets.push({
+                name: secretName,
+                provider: 'custom',
+                api_key: value,
+                base_url: '', // User must configure
+                auth_header: 'Authorization',
+                auth_prefix: 'Bearer '
+            });
+        }
+    }
+    return secrets;
+}
+/**
+ * Display detected secrets summary (for user confirmation)
+ */
+export function summarizeDetectedSecrets(secrets) {
+    if (secrets.length === 0) {
+        return 'No API keys detected in .env file';
+    }
+    const lines = ['Detected API keys:'];
+    for (const secret of secrets) {
+        const masked = secret.api_key.substring(0, 8) + '...';
+        lines.push(`  - ${secret.name} (${secret.provider}): ${masked}`);
+    }
+    return lines.join('\n');
+}

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { SecretsSDKOptions, ProxyRequest, RateLimitInfo } from './types';
+import type { SecretsSDKOptions, ProxyRequest, RateLimitInfo } from './types.js';
 export declare class SecretsSDK {
     private appId;
     private token;

package/dist/client.js

@@ -1,4 +1,4 @@
-import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
+import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';
 export class SecretsSDK {
     /**
      * Create a new SecretsSDK instance

package/dist/credentials.d.ts

@@ -1,4 +1,4 @@
-import type { CLICredentials } from './types';
+import type { CLICredentials } from './types.js';
 /**
  * Get the path to the credentials file
  * Defaults to ~/.learn/credentials.json

package/dist/env-resolver.d.ts

@@ -1,4 +1,4 @@
-import type { SecretConfig } from './types';
+import type { SecretConfig } from './types.js';
 /**
  * Resolve environment variable references in a string
  * Supports ${VAR} and $VAR syntax

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { SecretsSDK } from './client';
-export { SecretsManagement } from './management';
-export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
-export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types';
+export { SecretsSDK } from './client.js';
+export { SecretsManagement } from './management.js';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver.js';
+export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';
+export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { SecretsSDK } from './client';
-export { SecretsManagement } from './management';
-export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
+export { SecretsSDK } from './client.js';
+export { SecretsManagement } from './management.js';
+export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver.js';
+export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';

package/dist/management.d.ts

@@ -1,4 +1,4 @@
-import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types';
+import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types.js';
 /**
  * SecretsManagement class for CLI authentication and secrets management
  */
@@ -48,4 +48,51 @@ export declare class SecretsManagement {
      * Sync secrets from config
      */
     sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    importSecrets(config: {
+        version?: string;
+        origins?: string[];
+        secrets: SecretConfig[];
+    }): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: {
+                    name: string;
+                    error: string;
+                }[];
+            };
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    importFromFile(configPath: string): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
 }

package/dist/management.js

@@ -1,5 +1,5 @@
-import { SecretsSDKError } from './types';
-import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials';
+import { SecretsSDKError } from './types.js';
+import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials.js';
 /**
  * SecretsManagement class for CLI authentication and secrets management
  */
@@ -188,4 +188,27 @@ export class SecretsManagement {
         });
         return response;
     }
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    async importSecrets(config) {
+        return this.request('POST', `/api/projects/${this.appId}/import-secrets`, {
+            version: config.version || '1.0',
+            origins: config.origins,
+            secrets: config.secrets
+        });
+    }
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    async importFromFile(configPath) {
+        const { loadSecretsConfig } = await import('./env-resolver');
+        const config = loadSecretsConfig(configPath);
+        return this.importSecrets(config);
+    }
 }

package/package.json

@@ -1,12 +1,17 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.3.0",
+	"version": "1.4.0",
 	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
 	"types": "dist/index.d.ts",
+	"bin": {
+		"learn-secrets": "./bin/learn-secrets.js"
+	},
 	"files": [
-		"dist"
+		"dist",
+		"bin",
+		"secrets.template.json"
 	],
 	"scripts": {
 		"build": "tsc && tsc --project tsconfig.esm.json",
@@ -17,11 +22,17 @@
 		"proxy",
 		"secrets",
 		"static-sites",
-		"security"
+		"security",
+		"cli",
+		"secrets-management"
 	],
 	"author": "",
 	"license": "MIT",
+	"dependencies": {
+		"commander": "^12.0.0"
+	},
 	"devDependencies": {
+		"@types/node": "^20.0.0",
 		"typescript": "^5.0.0"
 	}
 }

package/secrets.template.json

@@ -0,0 +1,42 @@
+{
+  "version": "1.0",
+  "project": "your-app-id",
+  "origins": [
+    "localhost",
+    "yourdomain.com"
+  ],
+  "secrets": [
+    {
+      "name": "test-echo",
+      "provider": "custom",
+      "api_key": "test",
+      "base_url": "https://httpbin.org",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    },
+    {
+      "name": "openai",
+      "provider": "openai",
+      "api_key": "${OPENAI_API_KEY}",
+      "base_url": "https://api.openai.com",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    },
+    {
+      "name": "anthropic",
+      "provider": "anthropic",
+      "api_key": "${ANTHROPIC_API_KEY}",
+      "base_url": "https://api.anthropic.com",
+      "auth_header": "x-api-key",
+      "auth_prefix": ""
+    },
+    {
+      "name": "stripe",
+      "provider": "stripe",
+      "api_key": "${STRIPE_SECRET_KEY}",
+      "base_url": "https://api.stripe.com",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    }
+  ]
+}