learn-secrets-sdk 1.4.0 → 1.5.0

package/dist/env-resolver.js

@@ -1,73 +0,0 @@
-/**
- * Resolve environment variable references in a string
- * Supports ${VAR} and $VAR syntax
- */
-export function resolveEnvString(value) {
-    // Replace ${VAR} and $VAR references
-    return value.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g, (match, var1, var2) => {
-        const varName = var1 || var2;
-        const envValue = process.env[varName];
-        if (envValue === undefined) {
-            throw new Error(`Environment variable ${varName} is not defined`);
-        }
-        return envValue;
-    });
-}
-/**
- * Resolve environment variables in a single secret config
- */
-export function resolveEnvInSecret(secret) {
-    const resolved = {
-        name: resolveEnvString(secret.name),
-        provider: resolveEnvString(secret.provider),
-        api_key: resolveEnvString(secret.api_key)
-    };
-    if (secret.base_url) {
-        resolved.base_url = resolveEnvString(secret.base_url);
-    }
-    if (secret.auth_header) {
-        resolved.auth_header = resolveEnvString(secret.auth_header);
-    }
-    if (secret.auth_prefix) {
-        resolved.auth_prefix = resolveEnvString(secret.auth_prefix);
-    }
-    return resolved;
-}
-/**
- * Resolve environment variables in an array of secrets
- */
-export function resolveEnvInSecrets(secrets) {
-    return secrets.map(resolveEnvInSecret);
-}
-/**
- * Load and parse a secrets config file
- * Resolves environment variables in the config
- */
-export function loadSecretsConfig(configPath) {
-    const fs = require('fs');
-    const path = require('path');
-    // Read config file
-    const fullPath = path.resolve(configPath);
-    if (!fs.existsSync(fullPath)) {
-        throw new Error(`Config file not found: ${fullPath}`);
-    }
-    const configData = fs.readFileSync(fullPath, 'utf-8');
-    const config = JSON.parse(configData);
-    // Validate config
-    if (!config.version) {
-        throw new Error('Config file missing "version" field');
-    }
-    if (!config.project) {
-        throw new Error('Config file missing "project" field');
-    }
-    if (!Array.isArray(config.secrets)) {
-        throw new Error('Config file missing "secrets" array');
-    }
-    // Resolve environment variables
-    const resolvedSecrets = resolveEnvInSecrets(config.secrets);
-    return {
-        version: config.version,
-        project: config.project,
-        secrets: resolvedSecrets
-    };
-}

package/dist/index.js

@@ -1,4 +0,0 @@
-export { SecretsSDK } from './client.js';
-export { SecretsManagement } from './management.js';
-export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver.js';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';

package/dist/management.d.ts

@@ -1,98 +0,0 @@
-import { type SecretsManagementOptions, type SecretConfig, type MaskedSecret, type SyncOptions, type SyncResult } from './types.js';
-/**
- * SecretsManagement class for CLI authentication and secrets management
- */
-export declare class SecretsManagement {
-    private appId;
-    private baseUrl;
-    private timeout;
-    constructor(options: SecretsManagementOptions);
-    /**
-     * Open a URL in the default browser
-     */
-    private openBrowser;
-    /**
-     * Sleep for specified milliseconds
-     */
-    private sleep;
-    /**
-     * Browser OAuth login flow
-     * Opens browser for user to authorize, then stores credentials locally
-     */
-    login(): Promise<{
-        success: boolean;
-        user: string;
-    }>;
-    /**
-     * Check if user is authenticated
-     */
-    isAuthenticated(): Promise<boolean>;
-    /**
-     * Logout - clear stored credentials
-     */
-    logout(): void;
-    /**
-     * Get access token from stored credentials
-     * Throws error if not authenticated
-     */
-    private getAccessToken;
-    /**
-     * Make authenticated request
-     */
-    private request;
-    /**
-     * List all secrets (with masked API keys)
-     */
-    list(): Promise<MaskedSecret[]>;
-    /**
-     * Sync secrets from config
-     */
-    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
-    /**
-     * Import secrets from a config object (bulk import)
-     * Also creates SDK token if origins are provided
-     *
-     * @param config - The secrets configuration
-     * @returns Import results including created/updated counts and optional SDK token
-     */
-    importSecrets(config: {
-        version?: string;
-        origins?: string[];
-        secrets: SecretConfig[];
-    }): Promise<{
-        success: boolean;
-        results: {
-            created: number;
-            updated: number;
-            failed: number;
-            details: {
-                created: string[];
-                updated: string[];
-                failed: {
-                    name: string;
-                    error: string;
-                }[];
-            };
-        };
-        sdkToken?: {
-            token: string;
-            message: string;
-        };
-    }>;
-    /**
-     * Import secrets from a JSON file path
-     * Resolves environment variables in the config
-     */
-    importFromFile(configPath: string): Promise<{
-        success: boolean;
-        results: {
-            created: number;
-            updated: number;
-            failed: number;
-        };
-        sdkToken?: {
-            token: string;
-            message: string;
-        };
-    }>;
-}

package/dist/management.js

@@ -1,214 +0,0 @@
-import { SecretsSDKError } from './types.js';
-import { readCredentials, writeCredentials, deleteCredentials, hasValidCredentials } from './credentials.js';
-/**
- * SecretsManagement class for CLI authentication and secrets management
- */
-export class SecretsManagement {
-    constructor(options) {
-        this.appId = options.appId;
-        this.baseUrl = options.baseUrl || 'https://ctklearn.carsontkempf.workers.dev';
-        this.timeout = options.timeout || 30000;
-    }
-    /**
-     * Open a URL in the default browser
-     */
-    async openBrowser(url) {
-        const { exec } = await import('child_process');
-        const { promisify } = await import('util');
-        const execAsync = promisify(exec);
-        const platform = process.platform;
-        try {
-            if (platform === 'darwin') {
-                await execAsync(`open "${url}"`);
-            }
-            else if (platform === 'win32') {
-                await execAsync(`start "${url}"`);
-            }
-            else {
-                // Linux
-                await execAsync(`xdg-open "${url}"`);
-            }
-        }
-        catch (err) {
-            console.error('Failed to open browser:', err);
-            throw new SecretsSDKError('Failed to open browser', 500);
-        }
-    }
-    /**
-     * Sleep for specified milliseconds
-     */
-    sleep(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
-    }
-    /**
-     * Browser OAuth login flow
-     * Opens browser for user to authorize, then stores credentials locally
-     */
-    async login() {
-        try {
-            // Step 1: Request device code
-            const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                }
-            });
-            if (!deviceResponse.ok) {
-                throw new SecretsSDKError('Failed to generate device code', deviceResponse.status);
-            }
-            const deviceData = await deviceResponse.json();
-            // Step 2: Display user code and verification URI
-            console.log('\nTo authorize this application, visit:');
-            console.log(`  ${deviceData.verification_uri}`);
-            console.log('\nAnd enter the code:');
-            console.log(`  ${deviceData.user_code}`);
-            console.log('\nOpening browser...\n');
-            // Step 3: Open browser
-            await this.openBrowser(deviceData.verification_uri_complete);
-            // Step 4: Poll for token
-            const interval = deviceData.interval * 1000; // Convert to ms
-            const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
-            let attempts = 0;
-            while (attempts < maxAttempts) {
-                await this.sleep(interval);
-                attempts++;
-                const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json'
-                    },
-                    body: JSON.stringify({
-                        device_code: deviceData.device_code
-                    })
-                });
-                if (tokenResponse.status === 202) {
-                    // Still pending
-                    process.stdout.write('.');
-                    continue;
-                }
-                if (!tokenResponse.ok) {
-                    const errorData = await tokenResponse.json().catch(() => ({}));
-                    throw new SecretsSDKError(errorData.message || 'Failed to exchange device code', tokenResponse.status);
-                }
-                // Success!
-                const tokenData = await tokenResponse.json();
-                // Step 5: Store credentials
-                const expiresAt = new Date(Date.now() + tokenData.expires_in * 1000);
-                writeCredentials({
-                    access_token: tokenData.access_token,
-                    refresh_token: tokenData.refresh_token,
-                    expires_at: expiresAt.toISOString(),
-                    user_id: tokenData.user_id
-                });
-                console.log('\n\nAuthentication successful!');
-                return {
-                    success: true,
-                    user: tokenData.user_id
-                };
-            }
-            // Timeout
-            throw new SecretsSDKError('Authorization timeout', 408);
-        }
-        catch (err) {
-            if (err instanceof SecretsSDKError) {
-                throw err;
-            }
-            throw new SecretsSDKError(err.message || 'Login failed', err.status || 500);
-        }
-    }
-    /**
-     * Check if user is authenticated
-     */
-    async isAuthenticated() {
-        return hasValidCredentials();
-    }
-    /**
-     * Logout - clear stored credentials
-     */
-    logout() {
-        deleteCredentials();
-        console.log('Logged out successfully');
-    }
-    /**
-     * Get access token from stored credentials
-     * Throws error if not authenticated
-     */
-    getAccessToken() {
-        const creds = readCredentials();
-        if (!creds) {
-            throw new SecretsSDKError('Not authenticated. Run login() first.', 401);
-        }
-        // Check if expired
-        const expiresAt = new Date(creds.expires_at);
-        const now = new Date();
-        if (expiresAt <= now) {
-            throw new SecretsSDKError('Token expired. Run login() again.', 401);
-        }
-        return creds.access_token;
-    }
-    /**
-     * Make authenticated request
-     */
-    async request(method, path, body) {
-        const token = this.getAccessToken();
-        const options = {
-            method,
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${token}`
-            }
-        };
-        if (body) {
-            options.body = JSON.stringify(body);
-        }
-        const response = await fetch(`${this.baseUrl}${path}`, options);
-        if (!response.ok) {
-            const errorData = await response.json().catch(() => ({}));
-            throw new SecretsSDKError(errorData.message || `Request failed: ${response.statusText}`, response.status, errorData);
-        }
-        return response.json();
-    }
-    /**
-     * List all secrets (with masked API keys)
-     */
-    async list() {
-        const response = await this.request('GET', `/api/projects/${this.appId}/secrets`);
-        return response.secrets;
-    }
-    /**
-     * Sync secrets from config
-     */
-    async sync(secrets, options) {
-        const response = await this.request('POST', `/api/projects/${this.appId}/secrets/sync`, {
-            secrets,
-            options: {
-                deleteMissing: options?.deleteMissing ?? false,
-                dryRun: options?.dryRun ?? false
-            }
-        });
-        return response;
-    }
-    /**
-     * Import secrets from a config object (bulk import)
-     * Also creates SDK token if origins are provided
-     *
-     * @param config - The secrets configuration
-     * @returns Import results including created/updated counts and optional SDK token
-     */
-    async importSecrets(config) {
-        return this.request('POST', `/api/projects/${this.appId}/import-secrets`, {
-            version: config.version || '1.0',
-            origins: config.origins,
-            secrets: config.secrets
-        });
-    }
-    /**
-     * Import secrets from a JSON file path
-     * Resolves environment variables in the config
-     */
-    async importFromFile(configPath) {
-        const { loadSecretsConfig } = await import('./env-resolver');
-        const config = loadSecretsConfig(configPath);
-        return this.importSecrets(config);
-    }
-}

package/dist/types.d.ts

@@ -1,123 +0,0 @@
-export interface SecretsSDKOptions {
-    /**
-     * App ID from dashboard (optional in zero-config mode)
-     * If omitted, SDK uses origin-based authentication
-     */
-    appId?: string;
-    /**
-     * SDK token (optional in zero-config mode)
-     * If omitted, SDK uses origin-based authentication
-     */
-    token?: string;
-    sessionToken?: string;
-    /**
-     * Base URL of the proxy server
-     * Default: https://ctklearn.carsontkempf.workers.dev
-     */
-    baseUrl?: string;
-    timeout?: number;
-    retryOn429?: boolean;
-}
-export interface ProxyRequest {
-    keyName: string;
-    endpoint: string;
-    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
-    body?: any;
-    headers?: Record<string, string>;
-}
-export interface ProxyResponse<T = any> {
-    success: boolean;
-    status: number;
-    data: T;
-}
-export interface RateLimitInfo {
-    limit: number;
-    remaining: number;
-    reset: number;
-}
-export declare class SecretsSDKError extends Error {
-    status: number;
-    response?: any | undefined;
-    constructor(message: string, status: number, response?: any | undefined);
-}
-export declare class OriginMismatchError extends SecretsSDKError {
-    constructor(message?: string);
-}
-export declare class RateLimitError extends SecretsSDKError {
-    retryAfter: number;
-    remaining: number;
-    limit: number;
-    constructor(message?: string, retryAfter?: number, remaining?: number, limit?: number);
-}
-export declare class InvalidTokenError extends SecretsSDKError {
-    constructor(message?: string);
-}
-export interface SecretsManagementOptions {
-    appId: string;
-    baseUrl?: string;
-    timeout?: number;
-}
-export interface SecretConfig {
-    name: string;
-    provider: string;
-    api_key: string;
-    base_url?: string;
-    auth_header?: string;
-    auth_prefix?: string;
-}
-export interface MaskedSecret {
-    id: string;
-    name: string;
-    provider: string;
-    api_key: string;
-    base_url?: string;
-    auth_header?: string;
-    auth_prefix?: string;
-    created?: string;
-    updated?: string;
-}
-export interface SyncOptions {
-    deleteMissing?: boolean;
-    dryRun?: boolean;
-}
-export interface SyncDiffItem {
-    name: string;
-    provider?: string;
-    changes?: string[];
-}
-export interface SyncResult {
-    success: boolean;
-    diff: {
-        created: SyncDiffItem[];
-        updated: SyncDiffItem[];
-        deleted: SyncDiffItem[];
-        unchanged: SyncDiffItem[];
-    };
-    summary: {
-        created: number;
-        updated: number;
-        deleted: number;
-        unchanged: number;
-    };
-}
-export interface DeviceCodeResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-export interface TokenResponse {
-    access_token: string;
-    refresh_token: string;
-    token_type: string;
-    expires_in: number;
-    user_id: string;
-}
-export interface CLICredentials {
-    access_token: string;
-    refresh_token: string;
-    expires_at: string;
-    user_id: string;
-}

package/dist/types.js

@@ -1,29 +0,0 @@
-export class SecretsSDKError extends Error {
-    constructor(message, status, response) {
-        super(message);
-        this.status = status;
-        this.response = response;
-        this.name = 'SecretsSDKError';
-    }
-}
-export class OriginMismatchError extends SecretsSDKError {
-    constructor(message = 'Origin not allowed for this token') {
-        super(message, 403);
-        this.name = 'OriginMismatchError';
-    }
-}
-export class RateLimitError extends SecretsSDKError {
-    constructor(message = 'Rate limit exceeded', retryAfter = 60, remaining = 0, limit = 100) {
-        super(message, 429);
-        this.name = 'RateLimitError';
-        this.retryAfter = retryAfter;
-        this.remaining = remaining;
-        this.limit = limit;
-    }
-}
-export class InvalidTokenError extends SecretsSDKError {
-    constructor(message = 'Invalid or expired token') {
-        super(message, 401);
-        this.name = 'InvalidTokenError';
-    }
-}