learn-secrets-sdk 1.3.0 → 1.5.0

package/dist/client.js

@@ -1,172 +0,0 @@
-import { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';
-export class SecretsSDK {
-    /**
-     * Create a new SecretsSDK instance
-     *
-     * Zero-config mode (recommended for static sites):
-     *   const sdk = new SecretsSDK();
-     *   // Origin header is used for authentication
-     *
-     * Token mode (for backward compatibility):
-     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
-     */
-    constructor(options = {}) {
-        this.rateLimitInfo = null;
-        this.appId = options.appId || null;
-        this.token = options.token || options.sessionToken || null;
-        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
-        this.timeout = options.timeout || 30000;
-        this.retryOn429 = options.retryOn429 !== undefined ? options.retryOn429 : true;
-        // Zero-config mode: no appId or token required
-        // Authentication is based on Origin header
-        this.zeroConfigMode = !this.appId && !this.token;
-    }
-    /**
-     * Get current rate limit information
-     */
-    getUsage() {
-        return this.rateLimitInfo;
-    }
-    /**
-     * Parse rate limit headers from response
-     */
-    parseRateLimitHeaders(headers) {
-        const limit = headers.get('X-RateLimit-Limit');
-        const remaining = headers.get('X-RateLimit-Remaining');
-        const reset = headers.get('X-RateLimit-Reset');
-        if (limit && remaining && reset) {
-            this.rateLimitInfo = {
-                limit: parseInt(limit),
-                remaining: parseInt(remaining),
-                reset: parseInt(reset)
-            };
-        }
-    }
-    /**
-     * Sleep utility for retry backoff
-     */
-    sleep(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
-    }
-    /**
-     * Make fetch request with timeout
-     */
-    async fetchWithTimeout(url, options, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal
-            });
-            return response;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
-    }
-    /**
-     * Call an external API securely through the proxy
-     * @param keyName - Name of the API key to use
-     * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
-     * @param options - Request options (method, body, headers)
-     * @returns Promise with the API response
-     */
-    async call(keyName, endpoint, options = {}) {
-        let retries = 0;
-        const maxRetries = this.retryOn429 ? 3 : 0;
-        while (true) {
-            try {
-                // Build URL based on mode
-                const proxyUrl = this.zeroConfigMode
-                    ? `${this.baseUrl}/api/sdk/proxy`
-                    : `${this.baseUrl}/api/sdk/${this.appId}/proxy`;
-                // Build headers based on mode
-                const requestHeaders = {
-                    'Content-Type': 'application/json'
-                };
-                if (!this.zeroConfigMode && this.token) {
-                    requestHeaders['Authorization'] = `Bearer ${this.token}`;
-                }
-                const response = await this.fetchWithTimeout(proxyUrl, {
-                    method: 'POST',
-                    headers: requestHeaders,
-                    body: JSON.stringify({
-                        keyName,
-                        endpoint,
-                        method: options.method || 'GET',
-                        body: options.body,
-                        headers: options.headers
-                    })
-                }, this.timeout);
-                this.parseRateLimitHeaders(response.headers);
-                const result = await response.json();
-                if (!response.ok) {
-                    const errorMessage = result.data?.message ||
-                        result?.message ||
-                        `Request failed with status ${response.status}`;
-                    if (response.status === 403 && errorMessage.includes('Origin')) {
-                        throw new OriginMismatchError(errorMessage);
-                    }
-                    if (response.status === 401) {
-                        throw new InvalidTokenError(errorMessage);
-                    }
-                    if (response.status === 429) {
-                        const retryAfter = this.rateLimitInfo
-                            ? this.rateLimitInfo.reset - Math.floor(Date.now() / 1000)
-                            : 60;
-                        const error = new RateLimitError(errorMessage, retryAfter, this.rateLimitInfo?.remaining || 0, this.rateLimitInfo?.limit || 100);
-                        if (this.retryOn429 && retries < maxRetries) {
-                            retries++;
-                            const backoffMs = Math.min(1000 * Math.pow(2, retries - 1), 8000);
-                            await this.sleep(backoffMs);
-                            continue;
-                        }
-                        throw error;
-                    }
-                    throw new SecretsSDKError(errorMessage, response.status, result);
-                }
-                return result.data;
-            }
-            catch (err) {
-                if (err instanceof SecretsSDKError) {
-                    throw err;
-                }
-                if (err instanceof Error && err.name === 'AbortError') {
-                    throw new SecretsSDKError('Request timeout', 408);
-                }
-                throw new SecretsSDKError(err instanceof Error ? err.message : 'Unknown error occurred', 500);
-            }
-        }
-    }
-    /**
-     * Make a GET request
-     */
-    async get(keyName, endpoint, headers) {
-        return this.call(keyName, endpoint, { method: 'GET', headers });
-    }
-    /**
-     * Make a POST request
-     */
-    async post(keyName, endpoint, body, headers) {
-        return this.call(keyName, endpoint, { method: 'POST', body, headers });
-    }
-    /**
-     * Make a PUT request
-     */
-    async put(keyName, endpoint, body, headers) {
-        return this.call(keyName, endpoint, { method: 'PUT', body, headers });
-    }
-    /**
-     * Make a DELETE request
-     */
-    async delete(keyName, endpoint, headers) {
-        return this.call(keyName, endpoint, { method: 'DELETE', headers });
-    }
-    /**
-     * Make a PATCH request
-     */
-    async patch(keyName, endpoint, body, headers) {
-        return this.call(keyName, endpoint, { method: 'PATCH', body, headers });
-    }
-}

package/dist/credentials.d.ts

@@ -1,24 +0,0 @@
-import type { CLICredentials } from './types';
-/**
- * Get the path to the credentials file
- * Defaults to ~/.learn/credentials.json
- */
-export declare function getCredentialsPath(): string;
-/**
- * Read credentials from file
- * Returns null if file doesn't exist or is invalid
- */
-export declare function readCredentials(): CLICredentials | null;
-/**
- * Write credentials to file
- * Creates ~/.learn directory if it doesn't exist
- */
-export declare function writeCredentials(creds: CLICredentials): void;
-/**
- * Delete credentials file
- */
-export declare function deleteCredentials(): void;
-/**
- * Check if credentials exist and are not expired
- */
-export declare function hasValidCredentials(): boolean;

package/dist/credentials.js

@@ -1,86 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-/**
- * Get the path to the credentials file
- * Defaults to ~/.learn/credentials.json
- */
-export function getCredentialsPath() {
-    const homeDir = os.homedir();
-    const learnDir = path.join(homeDir, '.learn');
-    return path.join(learnDir, 'credentials.json');
-}
-/**
- * Ensure the ~/.learn directory exists
- */
-function ensureLearnDir() {
-    const homeDir = os.homedir();
-    const learnDir = path.join(homeDir, '.learn');
-    if (!fs.existsSync(learnDir)) {
-        fs.mkdirSync(learnDir, { recursive: true, mode: 0o700 }); // Owner-only permissions
-    }
-}
-/**
- * Read credentials from file
- * Returns null if file doesn't exist or is invalid
- */
-export function readCredentials() {
-    try {
-        const credPath = getCredentialsPath();
-        if (!fs.existsSync(credPath)) {
-            return null;
-        }
-        const data = fs.readFileSync(credPath, 'utf-8');
-        const creds = JSON.parse(data);
-        // Validate required fields
-        if (!creds.access_token ||
-            !creds.refresh_token ||
-            !creds.expires_at ||
-            !creds.user_id) {
-            return null;
-        }
-        return creds;
-    }
-    catch (err) {
-        // Invalid JSON or read error
-        return null;
-    }
-}
-/**
- * Write credentials to file
- * Creates ~/.learn directory if it doesn't exist
- */
-export function writeCredentials(creds) {
-    ensureLearnDir();
-    const credPath = getCredentialsPath();
-    const data = JSON.stringify(creds, null, 2);
-    // Write with owner-only permissions
-    fs.writeFileSync(credPath, data, { mode: 0o600 });
-}
-/**
- * Delete credentials file
- */
-export function deleteCredentials() {
-    try {
-        const credPath = getCredentialsPath();
-        if (fs.existsSync(credPath)) {
-            fs.unlinkSync(credPath);
-        }
-    }
-    catch (err) {
-        // Ignore errors (file might not exist)
-    }
-}
-/**
- * Check if credentials exist and are not expired
- */
-export function hasValidCredentials() {
-    const creds = readCredentials();
-    if (!creds) {
-        return false;
-    }
-    // Check if expired
-    const expiresAt = new Date(creds.expires_at);
-    const now = new Date();
-    return expiresAt > now;
-}

package/dist/env-resolver.d.ts

@@ -1,23 +0,0 @@
-import type { SecretConfig } from './types';
-/**
- * Resolve environment variable references in a string
- * Supports ${VAR} and $VAR syntax
- */
-export declare function resolveEnvString(value: string): string;
-/**
- * Resolve environment variables in a single secret config
- */
-export declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
-/**
- * Resolve environment variables in an array of secrets
- */
-export declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
-/**
- * Load and parse a secrets config file
- * Resolves environment variables in the config
- */
-export declare function loadSecretsConfig(configPath: string): {
-    version: string;
-    project: string;
-    secrets: SecretConfig[];
-};

package/dist/env-resolver.js

@@ -1,73 +0,0 @@
-/**
- * Resolve environment variable references in a string
- * Supports ${VAR} and $VAR syntax
- */
-export function resolveEnvString(value) {
-    // Replace ${VAR} and $VAR references
-    return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
-        const varName = var1 || var2;
-        const envValue = process.env[varName];
-        if (envValue === undefined) {
-            throw new Error(`Environment variable ${varName} is not defined`);
-        }
-        return envValue;
-    });
-}
-/**
- * Resolve environment variables in a single secret config
- */
-export function resolveEnvInSecret(secret) {
-    const resolved = {
-        name: resolveEnvString(secret.name),
-        provider: resolveEnvString(secret.provider),
-        api_key: resolveEnvString(secret.api_key)
-    };
-    if (secret.base_url) {
-        resolved.base_url = resolveEnvString(secret.base_url);
-    }
-    if (secret.auth_header) {
-        resolved.auth_header = resolveEnvString(secret.auth_header);
-    }
-    if (secret.auth_prefix) {
-        resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
-    }
-    return resolved;
-}
-/**
- * Resolve environment variables in an array of secrets
- */
-export function resolveEnvInSecrets(secrets) {
-    return secrets.map(resolveEnvInSecret);
-}
-/**
- * Load and parse a secrets config file
- * Resolves environment variables in the config
- */
-export function loadSecretsConfig(configPath) {
-    const fs = require('fs');
-    const path = require('path');
-    // Read config file
-    const fullPath = path.resolve(configPath);
-    if (!fs.existsSync(fullPath)) {
-        throw new Error(`Config file not found: ${fullPath}`);
-    }
-    const configData = fs.readFileSync(fullPath, 'utf-8');
-    const config = JSON.parse(configData);
-    // Validate config
-    if (!config.version) {
-        throw new Error('Config file missing "version" field');
-    }
-    if (!config.project) {
-        throw new Error('Config file missing "project" field');
-    }
-    if (!Array.isArray(config.secrets)) {
-        throw new Error('Config file missing "secrets" array');
-    }
-    // Resolve environment variables
-    const resolvedSecrets = resolveEnvInSecrets(config.secrets);
-    return {
-        version: config.version,
-        project: config.project,
-        secrets: resolvedSecrets
-    };
-}

package/dist/index.js

@@ -1,4 +0,0 @@
-export { SecretsSDK } from './client';
-export { SecretsManagement } from './management';
-export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types';

package/dist/management.d.ts

@@ -1,51 +0,0 @@
-import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types';
-/**
- * SecretsManagement class for CLI authentication and secrets management
- */
-export declare class SecretsManagement {
-    private appId;
-    private baseUrl;
-    private timeout;
-    constructor(options: SecretsManagementOptions);
-    /**
-     * Open a URL in the default browser
-     */
-    private openBrowser;
-    /**
-     * Sleep for specified milliseconds
-     */
-    private sleep;
-    /**
-     * Browser OAuth login flow
-     * Opens browser for user to authorize, then stores credentials locally
-     */
-    login(): Promise<{
-        success: boolean;
-        user: string;
-    }>;
-    /**
-     * Check if user is authenticated
-     */
-    isAuthenticated(): Promise<boolean>;
-    /**
-     * Logout - clear stored credentials
-     */
-    logout(): void;
-    /**
-     * Get access token from stored credentials
-     * Throws error if not authenticated
-     */
-    private getAccessToken;
-    /**
-     * Make authenticated request
-     */
-    private request;
-    /**
-     * List all secrets (with masked API keys)
-     */
-    list(): Promise<MaskedSecret[]>;
-    /**
-     * Sync secrets from config
-     */
-    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
-}

package/dist/management.js

@@ -1,191 +0,0 @@
-import { SecretsSDKError } from './types';
-import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials';
-/**
- * SecretsManagement class for CLI authentication and secrets management
- */
-export class SecretsManagement {
-    constructor(options) {
-        this.appId = options.appId;
-        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
-        this.timeout = options.timeout || 30000;
-    }
-    /**
-     * Open a URL in the default browser
-     */
-    async openBrowser(url) {
-        const { exec } = await import('child_process');
-        const { promisify } = await import('util');
-        const execAsync = promisify(exec);
-        const platform = process.platform;
-        try {
-            if (platform === 'darwin') {
-                await execAsync(`open "${url}"`);
-            }
-            else if (platform === 'win32') {
-                await execAsync(`start "${url}"`);
-            }
-            else {
-                // Linux
-                await execAsync(`xdg-open "${url}"`);
-            }
-        }
-        catch (err) {
-            console.error('Failed to open browser:', err);
-            throw new SecretsSDKError('Failed to open browser', 500);
-        }
-    }
-    /**
-     * Sleep for specified milliseconds
-     */
-    sleep(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
-    }
-    /**
-     * Browser OAuth login flow
-     * Opens browser for user to authorize, then stores credentials locally
-     */
-    async login() {
-        try {
-            // Step 1: Request device code
-            const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                }
-            });
-            if (!deviceResponse.ok) {
-                throw new SecretsSDKError('Failed to generate device code', deviceResponse.status);
-            }
-            const deviceData = await deviceResponse.json();
-            // Step 2: Display user code and verification URI
-            console.log('\nTo authorize this application, visit:');
-            console.log(`  ${deviceData.verification_uri}`);
-            console.log('\nAnd enter the code:');
-            console.log(`  ${deviceData.user_code}`);
-            console.log('\nOpening browser...\n');
-            // Step 3: Open browser
-            await this.openBrowser(deviceData.verification_uri_complete);
-            // Step 4: Poll for token
-            const interval = deviceData.interval * 1000; // Convert to ms
-            const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
-            let attempts = 0;
-            while (attempts < maxAttempts) {
-                await this.sleep(interval);
-                attempts++;
-                const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json'
-                    },
-                    body: JSON.stringify({
-                        device_code: deviceData.device_code
-                    })
-                });
-                if (tokenResponse.status === 202) {
-                    // Still pending
-                    process.stdout.write('.');
-                    continue;
-                }
-                if (!tokenResponse.ok) {
-                    const errorData = await tokenResponse.json().catch(() => ({}));
-                    throw new SecretsSDKError(errorData.message || 'Failed to exchange device code', tokenResponse.status);
-                }
-                // Success!
-                const tokenData = await tokenResponse.json();
-                // Step 5: Store credentials
-                const expiresAt = new Date(Date.now() + tokenData.expires_in * 1000);
-                writeCredentials({
-                    access_token: tokenData.access_token,
-                    refresh_token: tokenData.refresh_token,
-                    expires_at: expiresAt.toISOString(),
-                    user_id: tokenData.user_id
-                });
-                console.log('\n\nAuthentication successful!');
-                return {
-                    success: true,
-                    user: tokenData.user_id
-                };
-            }
-            // Timeout
-            throw new SecretsSDKError('Authorization timeout', 408);
-        }
-        catch (err) {
-            if (err instanceof SecretsSDKError) {
-                throw err;
-            }
-            throw new SecretsSDKError(err.message || 'Login failed', err.status || 500);
-        }
-    }
-    /**
-     * Check if user is authenticated
-     */
-    async isAuthenticated() {
-        return hasValidCredentials();
-    }
-    /**
-     * Logout - clear stored credentials
-     */
-    logout() {
-        deleteCredentials();
-        console.log('Logged out successfully');
-    }
-    /**
-     * Get access token from stored credentials
-     * Throws error if not authenticated
-     */
-    getAccessToken() {
-        const creds = readCredentials();
-        if (!creds) {
-            throw new SecretsSDKError('Not authenticated. Run login() first.', 401);
-        }
-        // Check if expired
-        const expiresAt = new Date(creds.expires_at);
-        const now = new Date();
-        if (expiresAt <= now) {
-            throw new SecretsSDKError('Token expired. Run login() again.', 401);
-        }
-        return creds.access_token;
-    }
-    /**
-     * Make authenticated request
-     */
-    async request(method, path, body) {
-        const token = this.getAccessToken();
-        const options = {
-            method,
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${token}`
-            }
-        };
-        if (body) {
-            options.body = JSON.stringify(body);
-        }
-        const response = await fetch(`${this.baseUrl}${path}`, options);
-        if (!response.ok) {
-            const errorData = await response.json().catch(() => ({}));
-            throw new SecretsSDKError(errorData.message || `Request failed: ${response.statusText}`, response.status, errorData);
-        }
-        return response.json();
-    }
-    /**
-     * List all secrets (with masked API keys)
-     */
-    async list() {
-        const response = await this.request('GET', `/api/projects/${this.appId}/secrets`);
-        return response.secrets;
-    }
-    /**
-     * Sync secrets from config
-     */
-    async sync(secrets, options) {
-        const response = await this.request('POST', `/api/projects/${this.appId}/secrets/sync`, {
-            secrets,
-            options: {
-                deleteMissing: options?.deleteMissing ?? false,
-                dryRun: options?.dryRun ?? false
-            }
-        });
-        return response;
-    }
-}