learn-secrets-sdk 1.3.0 → 1.5.0

package/dist/index.d.ts

@@ -1,5 +1,385 @@
-export { SecretsSDK } from './client';
-export { SecretsManagement } from './management';
-export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
-export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types';
+interface SecretsSDKOptions {
+    /**
+     * App ID from dashboard (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    appId?: string;
+    /**
+     * SDK token (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    token?: string;
+    sessionToken?: string;
+    /**
+     * Base URL of the proxy server
+     * Default: https://ctklearn.carsontkempf.workers.dev
+     */
+    baseUrl?: string;
+    timeout?: number;
+    retryOn429?: boolean;
+}
+interface ProxyRequest {
+    keyName: string;
+    endpoint: string;
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+    body?: any;
+    headers?: Record<string, string>;
+}
+interface ProxyResponse<T = any> {
+    success: boolean;
+    status: number;
+    data: T;
+}
+interface RateLimitInfo {
+    limit: number;
+    remaining: number;
+    reset: number;
+}
+declare class SecretsSDKError extends Error {
+    status: number;
+    response?: any | undefined;
+    constructor(message: string, status: number, response?: any | undefined);
+}
+declare class OriginMismatchError extends SecretsSDKError {
+    constructor(message?: string);
+}
+declare class RateLimitError extends SecretsSDKError {
+    retryAfter: number;
+    remaining: number;
+    limit: number;
+    constructor(message?: string, retryAfter?: number, remaining?: number, limit?: number);
+}
+declare class InvalidTokenError extends SecretsSDKError {
+    constructor(message?: string);
+}
+interface SecretsManagementOptions {
+    appId: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+interface SecretConfig {
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+}
+interface MaskedSecret {
+    id: string;
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+    created?: string;
+    updated?: string;
+}
+interface SyncOptions {
+    deleteMissing?: boolean;
+    dryRun?: boolean;
+}
+interface SyncDiffItem {
+    name: string;
+    provider?: string;
+    changes?: string[];
+}
+interface SyncResult {
+    success: boolean;
+    diff: {
+        created: SyncDiffItem[];
+        updated: SyncDiffItem[];
+        deleted: SyncDiffItem[];
+        unchanged: SyncDiffItem[];
+    };
+    summary: {
+        created: number;
+        updated: number;
+        deleted: number;
+        unchanged: number;
+    };
+}
+interface CLICredentials {
+    access_token: string;
+    refresh_token: string;
+    expires_at: string;
+    user_id: string;
+}
+
+declare class SecretsSDK {
+    private appId;
+    private token;
+    private baseUrl;
+    private timeout;
+    private retryOn429;
+    private rateLimitInfo;
+    private zeroConfigMode;
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options?: SecretsSDKOptions);
+    /**
+     * Get current rate limit information
+     */
+    getUsage(): RateLimitInfo | null;
+    /**
+     * Parse rate limit headers from response
+     */
+    private parseRateLimitHeaders;
+    /**
+     * Sleep utility for retry backoff
+     */
+    private sleep;
+    /**
+     * Make fetch request with timeout
+     */
+    private fetchWithTimeout;
+    /**
+     * Call an external API securely through the proxy
+     * @param keyName - Name of the API key to use
+     * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
+     * @param options - Request options (method, body, headers)
+     * @returns Promise with the API response
+     */
+    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest, 'keyName' | 'endpoint'>): Promise<T>;
+    /**
+     * Make a GET request
+     */
+    get<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a POST request
+     */
+    post<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a PUT request
+     */
+    put<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a DELETE request
+     */
+    delete<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a PATCH request
+     */
+    patch<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Secrets Management API (zero-config mode)
+     * These methods allow programmatic CRUD operations on project secrets
+     * Requires appId to be set (can be set in constructor or via setAppId)
+     */
+    /**
+     * Set App ID for secrets management
+     * Required before calling secrets management methods
+     */
+    setAppId(appId: string): void;
+    /**
+     * Make authenticated request to secrets management API
+     */
+    private secretsRequest;
+    /**
+     * List all secrets for the project
+     * Returns secret metadata (no API keys)
+     */
+    listSecrets(): Promise<{
+        success: boolean;
+        secrets: Array<{
+            name: string;
+            provider: string;
+            base_url: string;
+            auth_header: string;
+            auth_prefix: string;
+            created: string;
+            updated: string;
+        }>;
+        count: number;
+    }>;
+    /**
+     * Create a new secret
+     */
+    createSecret(secret: {
+        name: string;
+        provider: string;
+        api_key: string;
+        base_url?: string;
+        auth_header?: string;
+        auth_prefix?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+        secret: any;
+    }>;
+    /**
+     * Update an existing secret
+     */
+    updateSecret(update: {
+        name: string;
+        api_key?: string;
+        provider?: string;
+        base_url?: string;
+        auth_header?: string;
+        auth_prefix?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+        secret: any;
+    }>;
+    /**
+     * Delete a secret
+     */
+    deleteSecret(name: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Sync secrets from .env file format
+     * Bulk upload/update secrets
+     */
+    syncEnv(secrets: Record<string, string>, provider?: string): Promise<{
+        success: boolean;
+        message: string;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: Array<{
+                    name: string;
+                    error: string;
+                }>;
+            };
+        };
+    }>;
+}
+
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+declare class SecretsManagement {
+    private appId;
+    private baseUrl;
+    private timeout;
+    constructor(options: SecretsManagementOptions);
+    /**
+     * Open a URL in the default browser
+     */
+    private openBrowser;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+    /**
+     * Browser OAuth login flow
+     * Opens browser for user to authorize, then stores credentials locally
+     */
+    login(): Promise<{
+        success: boolean;
+        user: string;
+    }>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Logout - clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    private getAccessToken;
+    /**
+     * Make authenticated request
+     */
+    private request;
+    /**
+     * List all secrets (with masked API keys)
+     */
+    list(): Promise<MaskedSecret[]>;
+    /**
+     * Sync secrets from config
+     */
+    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    importSecrets(config: {
+        version?: string;
+        origins?: string[];
+        secrets: SecretConfig[];
+    }): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: {
+                    name: string;
+                    error: string;
+                }[];
+            };
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    importFromFile(configPath: string): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+}
+
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+declare function resolveEnvString(value: string): string;
+/**
+ * Resolve environment variables in a single secret config
+ */
+declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
+/**
+ * Resolve environment variables in an array of secrets
+ */
+declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+declare function loadSecretsConfig(configPath: string): {
+    version: string;
+    project: string;
+    secrets: SecretConfig[];
+};
+
+export { type CLICredentials, InvalidTokenError, type MaskedSecret, OriginMismatchError, type ProxyRequest, type ProxyResponse, RateLimitError, type RateLimitInfo, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, loadSecretsConfig, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString };

package/dist/index.global.js

@@ -0,0 +1,7 @@
+"use strict";var SecretsSDK=(()=>{var U=Object.create;var b=Object.defineProperty;var N=Object.getOwnPropertyDescriptor;var F=Object.getOwnPropertyNames;var z=Object.getPrototypeOf,J=Object.prototype.hasOwnProperty;var l=(r=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(r,{get:(e,t)=>(typeof require<"u"?require:e)[t]}):r)(function(r){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+r+'" is not supported')});var K=(r,e)=>()=>(r&&(e=r(r=0)),e);var O=(r,e)=>{for(var t in e)b(r,t,{get:e[t],enumerable:!0})},D=(r,e,t,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of F(e))!J.call(r,n)&&n!==t&&b(r,n,{get:()=>e[n],enumerable:!(s=N(e,n))||s.enumerable});return r};var w=(r,e,t)=>(t=r!=null?U(z(r)):{},D(e||!r||!r.__esModule?b(t,"default",{value:r,enumerable:!0}):t,r)),H=r=>D(b({},"__esModule",{value:!0}),r);var j={};O(j,{loadSecretsConfig:()=>I,resolveEnvInSecret:()=>x,resolveEnvInSecrets:()=>k,resolveEnvString:()=>d});function d(r){return r.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g,(e,t,s)=>{let n=t||s,a=process.env[n];if(a===void 0)throw new Error(`Environment variable ${n} is not defined`);return a})}function x(r){let e={name:d(r.name),provider:d(r.provider),api_key:d(r.api_key)};return r.base_url&&(e.base_url=d(r.base_url)),r.auth_header&&(e.auth_header=d(r.auth_header)),r.auth_prefix&&(e.auth_prefix=d(r.auth_prefix)),e}function k(r){return r.map(x)}function I(r){let e=l("fs"),s=l("path").resolve(r);if(!e.existsSync(s))throw new Error(`Config file not found: ${s}`);let n=e.readFileSync(s,"utf-8"),a=JSON.parse(n);if(!a.version)throw new Error('Config file missing "version" field');if(!a.project)throw new Error('Config file missing "project" field');if(!Array.isArray(a.secrets))throw new Error('Config file missing "secrets" array');let i=k(a.secrets);return{version:a.version,project:a.project,secrets:i}}var P=K(()=>{"use strict"});var G={};O(G,{InvalidTokenError:()=>h,OriginMismatchError:()=>m,RateLimitError:()=>f,SecretsManagement:()=>_,SecretsSDK:()=>S,SecretsSDKError:()=>o,loadSecretsConfig:()=>I,resolveEnvInSecret:()=>x,resolveEnvInSecrets:()=>k,resolveEnvString:()=>d});var o=class extends Error{constructor(t,s,n){super(t);this.status=s;this.response=n;this.name="SecretsSDKError"}},m=class extends o{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},f=class extends o{constructor(e="Rate limit exceeded",t=60,s=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=s,this.limit=n}},h=class extends o{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var S=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),s=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&s&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(s),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,s){let n=new AbortController,a=setTimeout(()=>n.abort(),s);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(a)}}async call(e,t,s={}){let n=0,a=this.retryOn429?3:0;for(;;)try{let i=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,p={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(p.Authorization=`Bearer ${this.token}`);let u=await this.fetchWithTimeout(i,{method:"POST",headers:p,body:JSON.stringify({keyName:e,endpoint:t,method:s.method||"GET",body:s.body,headers:s.headers})},this.timeout);this.parseRateLimitHeaders(u.headers);let g=await u.json();if(!u.ok){let y=g.data?.message||g?.message||`Request failed with status ${u.status}`;if(u.status===403&&y.includes("Origin"))throw new m(y);if(u.status===401)throw new h(y);if(u.status===429){let $=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,q=new f(y,$,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<a){n++;let M=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(M);continue}throw q}throw new o(y,u.status,g)}return g.data}catch(i){throw i instanceof o?i:i instanceof Error&&i.name==="AbortError"?new o("Request timeout",408):new o(i instanceof Error?i.message:"Unknown error occurred",500)}}async get(e,t,s){return this.call(e,t,{method:"GET",headers:s})}async post(e,t,s,n){return this.call(e,t,{method:"POST",body:s,headers:n})}async put(e,t,s,n){return this.call(e,t,{method:"PUT",body:s,headers:n})}async delete(e,t,s){return this.call(e,t,{method:"DELETE",headers:s})}async patch(e,t,s,n){return this.call(e,t,{method:"PATCH",body:s,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new o("App ID required for secrets management. Call setAppId() first.",400);let s=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!s.ok){let n=await s.json().catch(()=>({}));throw new o(n.message||`Secrets management failed: ${s.statusText}`,s.status,n)}return s.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};var c=w(l("fs")),v=w(l("path")),T=w(l("os"));function R(){let r=T.homedir(),e=v.join(r,".learn");return v.join(e,"credentials.json")}function B(){let r=T.homedir(),e=v.join(r,".learn");c.existsSync(e)||c.mkdirSync(e,{recursive:!0,mode:448})}function C(){try{let r=R();if(!c.existsSync(r))return null;let e=c.readFileSync(r,"utf-8"),t=JSON.parse(e);return!t.access_token||!t.refresh_token||!t.expires_at||!t.user_id?null:t}catch{return null}}function E(r){B();let e=R(),t=JSON.stringify(r,null,2);c.writeFileSync(e,t,{mode:384})}function A(){try{let r=R();c.existsSync(r)&&c.unlinkSync(r)}catch{}}function L(){let r=C();return r?new Date(r.expires_at)>new Date:!1}var _=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:s}=await import("util"),n=s(t),a=process.platform;try{a==="darwin"?await n(`open "${e}"`):a==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(i){throw console.error("Failed to open browser:",i),new o("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){try{let e=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!e.ok)throw new o("Failed to generate device code",e.status);let t=await e.json();console.log(`
+To authorize this application, visit:`),console.log(`  ${t.verification_uri}`),console.log(`
+And enter the code:`),console.log(`  ${t.user_code}`),console.log(`
+Opening browser...
+`),await this.openBrowser(t.verification_uri_complete);let s=t.interval*1e3,n=Math.ceil(t.expires_in/t.interval),a=0;for(;a<n;){await this.sleep(s),a++;let i=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:t.device_code})});if(i.status===202){process.stdout.write(".");continue}if(!i.ok){let g=await i.json().catch(()=>({}));throw new o(g.message||"Failed to exchange device code",i.status)}let p=await i.json(),u=new Date(Date.now()+p.expires_in*1e3);return E({access_token:p.access_token,refresh_token:p.refresh_token,expires_at:u.toISOString(),user_id:p.user_id}),console.log(`
+
+Authentication successful!`),{success:!0,user:p.user_id}}throw new o("Authorization timeout",408)}catch(e){throw e instanceof o?e:new o(e.message||"Login failed",e.status||500)}}async isAuthenticated(){return L()}logout(){A(),console.log("Logged out successfully")}getAccessToken(){let e=C();if(!e)throw new o("Not authenticated. Run login() first.",401);if(new Date(e.expires_at)<=new Date)throw new o("Token expired. Run login() again.",401);return e.access_token}async request(e,t,s){let n=this.getAccessToken(),a={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};s&&(a.body=JSON.stringify(s));let i=await fetch(`${this.baseUrl}${t}`,a);if(!i.ok){let p=await i.json().catch(()=>({}));throw new o(p.message||`Request failed: ${i.statusText}`,i.status,p)}return i.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await Promise.resolve().then(()=>(P(),j)),s=t(e);return this.importSecrets(s)}};P();return H(G);})();

package/dist/index.mjs

@@ -0,0 +1,7 @@
+import{a as P,b as C,c as O,d as D}from"./chunk-AS6G7JYX.mjs";var i=class extends Error{constructor(t,r,s){super(t);this.status=r;this.response=s;this.name="SecretsSDKError"}},m=class extends i{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},g=class extends i{constructor(e="Rate limit exceeded",t=60,r=0,s=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=s}},h=class extends i{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var y=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),s=e.get("X-RateLimit-Reset");t&&r&&s&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(s)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let s=new AbortController,a=setTimeout(()=>s.abort(),r);try{return await fetch(e,{...t,signal:s.signal})}finally{clearTimeout(a)}}async call(e,t,r={}){let s=0,a=this.retryOn429?3:0;for(;;)try{let n=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,p={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(p.Authorization=`Bearer ${this.token}`);let u=await this.fetchWithTimeout(n,{method:"POST",headers:p,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(u.headers);let d=await u.json();if(!u.ok){let l=d.data?.message||d?.message||`Request failed with status ${u.status}`;if(u.status===403&&l.includes("Origin"))throw new m(l);if(u.status===401)throw new h(l);if(u.status===429){let R=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,_=new g(l,R,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&s<a){s++;let I=Math.min(1e3*Math.pow(2,s-1),8e3);await this.sleep(I);continue}throw _}throw new i(l,u.status,d)}return d.data}catch(n){throw n instanceof i?n:n instanceof Error&&n.name==="AbortError"?new i("Request timeout",408):new i(n instanceof Error?n.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,s){return this.call(e,t,{method:"POST",body:r,headers:s})}async put(e,t,r,s){return this.call(e,t,{method:"PUT",body:r,headers:s})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,s){return this.call(e,t,{method:"PATCH",body:r,headers:s})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new i("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let s=await r.json().catch(()=>({}));throw new i(s.message||`Secrets management failed: ${r.statusText}`,r.status,s)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};import*as c from"fs";import*as f from"path";import*as w from"os";function b(){let o=w.homedir(),e=f.join(o,".learn");return f.join(e,"credentials.json")}function L(){let o=w.homedir(),e=f.join(o,".learn");c.existsSync(e)||c.mkdirSync(e,{recursive:!0,mode:448})}function x(){try{let o=b();if(!c.existsSync(o))return null;let e=c.readFileSync(o,"utf-8"),t=JSON.parse(e);return!t.access_token||!t.refresh_token||!t.expires_at||!t.user_id?null:t}catch{return null}}function k(o){L();let e=b(),t=JSON.stringify(o,null,2);c.writeFileSync(e,t,{mode:384})}function v(){try{let o=b();c.existsSync(o)&&c.unlinkSync(o)}catch{}}function T(){let o=x();return o?new Date(o.expires_at)>new Date:!1}var S=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:r}=await import("util"),s=r(t),a=process.platform;try{a==="darwin"?await s(`open "${e}"`):a==="win32"?await s(`start "${e}"`):await s(`xdg-open "${e}"`)}catch(n){throw console.error("Failed to open browser:",n),new i("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){try{let e=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!e.ok)throw new i("Failed to generate device code",e.status);let t=await e.json();console.log(`
+To authorize this application, visit:`),console.log(`  ${t.verification_uri}`),console.log(`
+And enter the code:`),console.log(`  ${t.user_code}`),console.log(`
+Opening browser...
+`),await this.openBrowser(t.verification_uri_complete);let r=t.interval*1e3,s=Math.ceil(t.expires_in/t.interval),a=0;for(;a<s;){await this.sleep(r),a++;let n=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:t.device_code})});if(n.status===202){process.stdout.write(".");continue}if(!n.ok){let d=await n.json().catch(()=>({}));throw new i(d.message||"Failed to exchange device code",n.status)}let p=await n.json(),u=new Date(Date.now()+p.expires_in*1e3);return k({access_token:p.access_token,refresh_token:p.refresh_token,expires_at:u.toISOString(),user_id:p.user_id}),console.log(`
+
+Authentication successful!`),{success:!0,user:p.user_id}}throw new i("Authorization timeout",408)}catch(e){throw e instanceof i?e:new i(e.message||"Login failed",e.status||500)}}async isAuthenticated(){return T()}logout(){v(),console.log("Logged out successfully")}getAccessToken(){let e=x();if(!e)throw new i("Not authenticated. Run login() first.",401);if(new Date(e.expires_at)<=new Date)throw new i("Token expired. Run login() again.",401);return e.access_token}async request(e,t,r){let s=this.getAccessToken(),a={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`}};r&&(a.body=JSON.stringify(r));let n=await fetch(`${this.baseUrl}${t}`,a);if(!n.ok){let p=await n.json().catch(()=>({}));throw new i(p.message||`Request failed: ${n.statusText}`,n.status,p)}return n.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await import("./env-resolver-Y4SFGOKB.mjs"),r=t(e);return this.importSecrets(r)}};export{h as InvalidTokenError,m as OriginMismatchError,g as RateLimitError,S as SecretsManagement,y as SecretsSDK,i as SecretsSDKError,D as loadSecretsConfig,C as resolveEnvInSecret,O as resolveEnvInSecrets,P as resolveEnvString};

package/package.json

@@ -1,27 +1,45 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.3.0",
+	"version": "1.5.0",
 	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
 	"types": "dist/index.d.ts",
+	"bin": {
+		"learn-secrets": "./bin/learn-secrets.js"
+	},
 	"files": [
-		"dist"
+		"dist",
+		"bin",
+		"secrets.template.json"
 	],
-	"scripts": {
-		"build": "tsc && tsc --project tsconfig.esm.json",
-		"prepublishOnly": "npm run build"
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/carsontkempf/learn.git",
+		"directory": "packages/secrets-sdk"
 	},
+	"homepage": "https://github.com/carsontkempf/learn/tree/main/packages/secrets-sdk",
+	"author": "Carson Kempf",
 	"keywords": [
 		"api",
 		"proxy",
 		"secrets",
 		"static-sites",
-		"security"
+		"security",
+		"cli",
+		"secrets-management"
 	],
-	"author": "",
 	"license": "MIT",
+	"dependencies": {
+		"commander": "^12.0.0"
+	},
 	"devDependencies": {
+		"@types/node": "^20.0.0",
+		"tsup": "^8.5.1",
 		"typescript": "^5.0.0"
+	},
+	"scripts": {
+		"build": "tsup src/index.ts --format esm,iife --dts --minify --global-name SecretsSDK && tsup src/cli/index.ts --format esm --dts --out-dir dist/cli --external commander",
+		"prepublishOnly": "npm run build"
 	}
 }

package/secrets.template.json

@@ -0,0 +1,42 @@
+{
+  "version": "1.0",
+  "project": "your-app-id",
+  "origins": [
+    "localhost",
+    "yourdomain.com"
+  ],
+  "secrets": [
+    {
+      "name": "test-echo",
+      "provider": "custom",
+      "api_key": "test",
+      "base_url": "https://httpbin.org",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    },
+    {
+      "name": "openai",
+      "provider": "openai",
+      "api_key": "${OPENAI_API_KEY}",
+      "base_url": "https://api.openai.com",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    },
+    {
+      "name": "anthropic",
+      "provider": "anthropic",
+      "api_key": "${ANTHROPIC_API_KEY}",
+      "base_url": "https://api.anthropic.com",
+      "auth_header": "x-api-key",
+      "auth_prefix": ""
+    },
+    {
+      "name": "stripe",
+      "provider": "stripe",
+      "api_key": "${STRIPE_SECRET_KEY}",
+      "base_url": "https://api.stripe.com",
+      "auth_header": "Authorization",
+      "auth_prefix": "Bearer "
+    }
+  ]
+}

package/dist/client.d.ts

@@ -1,65 +0,0 @@
-import type { SecretsSDKOptions, ProxyRequest, RateLimitInfo } from './types';
-export declare class SecretsSDK {
-    private appId;
-    private token;
-    private baseUrl;
-    private timeout;
-    private retryOn429;
-    private rateLimitInfo;
-    private zeroConfigMode;
-    /**
-     * Create a new SecretsSDK instance
-     *
-     * Zero-config mode (recommended for static sites):
-     *   const sdk = new SecretsSDK();
-     *   // Origin header is used for authentication
-     *
-     * Token mode (for backward compatibility):
-     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
-     */
-    constructor(options?: SecretsSDKOptions);
-    /**
-     * Get current rate limit information
-     */
-    getUsage(): RateLimitInfo | null;
-    /**
-     * Parse rate limit headers from response
-     */
-    private parseRateLimitHeaders;
-    /**
-     * Sleep utility for retry backoff
-     */
-    private sleep;
-    /**
-     * Make fetch request with timeout
-     */
-    private fetchWithTimeout;
-    /**
-     * Call an external API securely through the proxy
-     * @param keyName - Name of the API key to use
-     * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
-     * @param options - Request options (method, body, headers)
-     * @returns Promise with the API response
-     */
-    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest, 'keyName' | 'endpoint'>): Promise<T>;
-    /**
-     * Make a GET request
-     */
-    get<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a POST request
-     */
-    post<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a PUT request
-     */
-    put<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a DELETE request
-     */
-    delete<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
-    /**
-     * Make a PATCH request
-     */
-    patch<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
-}