learn-secrets-sdk 1.4.0 → 1.6.0

package/dist/cli/index.mjs

@@ -0,0 +1,1020 @@
+#!/usr/bin/env node
+import "./chunk-Y6FXYEAI.mjs";
+
+// src/cli/index.ts
+import { Command } from "commander";
+
+// src/types.ts
+var SecretsSDKError = class extends Error {
+  constructor(message, status, response) {
+    super(message);
+    this.status = status;
+    this.response = response;
+    this.name = "SecretsSDKError";
+  }
+};
+
+// src/credentials.ts
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+function getCredentialsPath() {
+  const homeDir = os.homedir();
+  const learnDir = path.join(homeDir, ".learn");
+  return path.join(learnDir, "credentials.json");
+}
+function ensureLearnDir() {
+  const homeDir = os.homedir();
+  const learnDir = path.join(homeDir, ".learn");
+  if (!fs.existsSync(learnDir)) {
+    fs.mkdirSync(learnDir, { recursive: true, mode: 448 });
+  }
+}
+function readAllCredentials() {
+  try {
+    const credPath = getCredentialsPath();
+    if (!fs.existsSync(credPath)) {
+      return null;
+    }
+    const data = fs.readFileSync(credPath, "utf-8");
+    const store = JSON.parse(data);
+    if (store.access_token && !store["learn-secrets-sdk"] && !store["learn-auth-sdk"]) {
+      return {
+        "learn-secrets-sdk": store
+      };
+    }
+    return store;
+  } catch (err) {
+    return null;
+  }
+}
+function writeAllCredentials(store) {
+  ensureLearnDir();
+  const credPath = getCredentialsPath();
+  const data = JSON.stringify(store, null, 2);
+  fs.writeFileSync(credPath, data, { mode: 384 });
+}
+function readSDKCredentials(sdkName) {
+  const store = readAllCredentials();
+  if (!store) {
+    return null;
+  }
+  return store[sdkName] || null;
+}
+function writeSDKCredentials(sdkName, creds) {
+  const store = readAllCredentials() || {};
+  store[sdkName] = creds;
+  writeAllCredentials(store);
+}
+function readCredentials() {
+  return readSDKCredentials("learn-secrets-sdk");
+}
+function deleteCredentials() {
+  try {
+    const credPath = getCredentialsPath();
+    if (fs.existsSync(credPath)) {
+      fs.unlinkSync(credPath);
+    }
+  } catch (err) {
+  }
+}
+function hasValidCredentials() {
+  const creds = readCredentials();
+  if (!creds) {
+    return false;
+  }
+  if (!creds.expires_at) {
+    return true;
+  }
+  const expiresAt = new Date(creds.expires_at);
+  const now = /* @__PURE__ */ new Date();
+  return expiresAt > now;
+}
+
+// src/machine-id.ts
+import { exec } from "child_process";
+import { promisify } from "util";
+import { createHash } from "crypto";
+import * as os2 from "os";
+var execAsync = promisify(exec);
+async function getMachineId() {
+  const platform2 = process.platform;
+  try {
+    let rawId;
+    if (platform2 === "darwin") {
+      rawId = await getMacOSId();
+    } else if (platform2 === "linux") {
+      rawId = await getLinuxId();
+    } else if (platform2 === "win32") {
+      rawId = await getWindowsId();
+    } else {
+      throw new Error(`Unsupported platform: ${platform2}`);
+    }
+    const machineId = createHash("sha256").update(rawId).digest("hex").substring(0, 32);
+    const fingerprintData = JSON.stringify({
+      machineId,
+      cpus: os2.cpus().length,
+      arch: os2.arch(),
+      platform: os2.platform(),
+      homedir: os2.homedir()
+    });
+    const fingerprint = createHash("sha256").update(fingerprintData).digest("hex");
+    return { machineId, fingerprint };
+  } catch (error) {
+    throw new Error(`Failed to get machine ID: ${error.message}`);
+  }
+}
+async function getMacOSId() {
+  try {
+    const { stdout: serial } = await execAsync(
+      `ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`
+    );
+    const { stdout: hostname } = await execAsync("hostname");
+    const serialTrimmed = serial.trim();
+    const hostnameTrimmed = hostname.trim();
+    if (serialTrimmed && hostnameTrimmed) {
+      return `${serialTrimmed}-${hostnameTrimmed}`;
+    }
+    const { stdout: uuid } = await execAsync(
+      `ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`
+    );
+    return uuid.trim();
+  } catch (error) {
+    throw new Error("Failed to get macOS machine ID");
+  }
+}
+async function getLinuxId() {
+  try {
+    const { stdout } = await execAsync(
+      "cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"
+    );
+    const machineId = stdout.trim();
+    if (machineId) {
+      return machineId;
+    }
+    throw new Error("Machine ID file not found");
+  } catch (error) {
+    throw new Error("Failed to get Linux machine ID");
+  }
+}
+async function getWindowsId() {
+  try {
+    const { stdout } = await execAsync("wmic csproduct get uuid");
+    const lines = stdout.split("\n").map((l) => l.trim());
+    const uuid = lines.find((l) => l && l !== "UUID");
+    if (uuid) {
+      return uuid;
+    }
+    throw new Error("Failed to parse machine UUID from WMIC");
+  } catch (error) {
+    throw new Error("Failed to get Windows machine ID");
+  }
+}
+
+// src/management.ts
+var SecretsManagement = class {
+  constructor(options) {
+    this.appId = options.appId;
+    this.baseUrl = options.baseUrl || "https://ctklearn.carsontkempf.workers.dev";
+    this.timeout = options.timeout || 3e4;
+  }
+  /**
+   * Open a URL in the default browser
+   */
+  async openBrowser(url) {
+    const { exec: exec2 } = await import("child_process");
+    const { promisify: promisify2 } = await import("util");
+    const execAsync2 = promisify2(exec2);
+    const platform2 = process.platform;
+    try {
+      if (platform2 === "darwin") {
+        await execAsync2(`open "${url}"`);
+      } else if (platform2 === "win32") {
+        await execAsync2(`start "${url}"`);
+      } else {
+        await execAsync2(`xdg-open "${url}"`);
+      }
+    } catch (err) {
+      console.error("Failed to open browser:", err);
+      throw new SecretsSDKError("Failed to open browser", 500);
+    }
+  }
+  /**
+   * Sleep for specified milliseconds
+   */
+  sleep(ms) {
+    return new Promise((resolve2) => setTimeout(resolve2, ms));
+  }
+  /**
+   * Browser OAuth login flow with 2FA
+   * Opens browser for user to authorize, then prompts for 2FA code
+   */
+  async login() {
+    const SDK_NAME = "learn-secrets-sdk";
+    try {
+      console.log(`Authenticating with Learn (${SDK_NAME})...
+`);
+      const machineInfo = await getMachineId();
+      const existingCreds = readSDKCredentials(SDK_NAME);
+      if (existingCreds && existingCreds.access_token) {
+        const checkResponse = await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            machine_id: machineInfo.machineId,
+            sdk_name: SDK_NAME
+          })
+        });
+        if (checkResponse.ok) {
+          const checkData = await checkResponse.json();
+          if (checkData.authorized) {
+            console.log("This machine is already authorized.");
+            console.log(`Logged in as: ${checkData.user_email || checkData.user_id}`);
+            return {
+              success: true,
+              user: checkData.user_email || checkData.user_id
+            };
+          }
+        }
+      }
+      const deviceResponse = await fetch(`${this.baseUrl}/api/auth/cli/device`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        }
+      });
+      if (!deviceResponse.ok) {
+        throw new SecretsSDKError(
+          "Failed to generate device code",
+          deviceResponse.status
+        );
+      }
+      const deviceData = await deviceResponse.json();
+      console.log("\nTo authorize this device:");
+      console.log(`1. Visit: ${deviceData.verification_uri}`);
+      console.log(`2. Enter code: ${deviceData.user_code}`);
+      console.log(`3. Complete 2FA verification`);
+      console.log("\nOpening browser...\n");
+      await this.openBrowser(deviceData.verification_uri_complete);
+      let deviceAuthorized = false;
+      const interval = deviceData.interval * 1e3;
+      const maxAttempts = Math.ceil(deviceData.expires_in / deviceData.interval);
+      let attempts = 0;
+      while (attempts < maxAttempts) {
+        await this.sleep(interval);
+        attempts++;
+        const tokenResponse = await fetch(`${this.baseUrl}/api/auth/cli/token`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            device_code: deviceData.device_code
+          })
+        });
+        if (tokenResponse.status === 202) {
+          process.stdout.write(".");
+          continue;
+        }
+        if (tokenResponse.ok) {
+          deviceAuthorized = true;
+          break;
+        }
+      }
+      if (!deviceAuthorized) {
+        throw new SecretsSDKError("Device authorization timeout", 408);
+      }
+      console.log("\n\nDevice authorized! Sending 2FA code...");
+      const tfaResponse = await fetch(`${this.baseUrl}/api/auth/2fa/send`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          device_code: deviceData.device_code,
+          sdk_name: SDK_NAME,
+          machine_id: machineInfo.machineId
+        })
+      });
+      if (!tfaResponse.ok) {
+        const errorData = await tfaResponse.json().catch(() => ({}));
+        throw new SecretsSDKError(
+          errorData.message || "Failed to send 2FA code",
+          tfaResponse.status
+        );
+      }
+      console.log("2FA code sent to your email.\n");
+      const readline = await import("readline");
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const tfaCode = await new Promise((resolve2) => {
+        rl.question("Enter 2FA code from email: ", (answer) => {
+          rl.close();
+          resolve2(answer);
+        });
+      });
+      const verifyResponse = await fetch(`${this.baseUrl}/api/auth/2fa/verify`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          device_code: deviceData.device_code,
+          code: tfaCode.trim()
+        })
+      });
+      if (!verifyResponse.ok) {
+        const errorData = await verifyResponse.json().catch(() => ({}));
+        throw new SecretsSDKError(
+          errorData.message || "2FA verification failed",
+          verifyResponse.status
+        );
+      }
+      const tokenData = await verifyResponse.json();
+      writeSDKCredentials(SDK_NAME, {
+        access_token: tokenData.access_token,
+        refresh_token: null,
+        expires_at: null,
+        user_id: tokenData.user_id,
+        machine_id: machineInfo.machineId,
+        sdk_name: SDK_NAME,
+        authorized_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      console.log("\nAuthentication successful!");
+      console.log(`Logged in as: ${tokenData.user_email || tokenData.user_id}`);
+      console.log("This machine is now permanently authorized.\n");
+      return {
+        success: true,
+        user: tokenData.user_email || tokenData.user_id
+      };
+    } catch (err) {
+      if (err instanceof SecretsSDKError) {
+        throw err;
+      }
+      throw new SecretsSDKError(
+        err.message || "Login failed",
+        err.status || 500
+      );
+    }
+  }
+  /**
+   * Check if user is authenticated
+   */
+  async isAuthenticated() {
+    return hasValidCredentials();
+  }
+  /**
+   * Logout - clear stored credentials
+   */
+  logout() {
+    deleteCredentials();
+    console.log("Logged out successfully");
+  }
+  /**
+   * Get access token from stored credentials
+   * Throws error if not authenticated
+   */
+  getAccessToken() {
+    const creds = readCredentials();
+    if (!creds) {
+      throw new SecretsSDKError("Not authenticated. Run login() first.", 401);
+    }
+    if (creds.expires_at) {
+      const expiresAt = new Date(creds.expires_at);
+      const now = /* @__PURE__ */ new Date();
+      if (expiresAt <= now) {
+        throw new SecretsSDKError("Token expired. Run login() again.", 401);
+      }
+    }
+    return creds.access_token;
+  }
+  /**
+   * Make authenticated request
+   */
+  async request(method, path2, body) {
+    const token = this.getAccessToken();
+    const options = {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      }
+    };
+    if (body) {
+      options.body = JSON.stringify(body);
+    }
+    const response = await fetch(`${this.baseUrl}${path2}`, options);
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new SecretsSDKError(
+        errorData.message || `Request failed: ${response.statusText}`,
+        response.status,
+        errorData
+      );
+    }
+    return response.json();
+  }
+  /**
+   * List all secrets (with masked API keys)
+   */
+  async list() {
+    const response = await this.request(
+      "GET",
+      `/api/projects/${this.appId}/secrets`
+    );
+    return response.secrets;
+  }
+  /**
+   * Sync secrets from config
+   */
+  async sync(secrets, options) {
+    const response = await this.request(
+      "POST",
+      `/api/projects/${this.appId}/secrets/sync`,
+      {
+        secrets,
+        options: {
+          deleteMissing: options?.deleteMissing ?? false,
+          dryRun: options?.dryRun ?? false
+        }
+      }
+    );
+    return response;
+  }
+  /**
+   * Import secrets from a config object (bulk import)
+   * Also creates SDK token if origins are provided
+   *
+   * @param config - The secrets configuration
+   * @returns Import results including created/updated counts and optional SDK token
+   */
+  async importSecrets(config) {
+    return this.request(
+      "POST",
+      `/api/projects/${this.appId}/import-secrets`,
+      {
+        version: config.version || "1.0",
+        origins: config.origins,
+        secrets: config.secrets
+      }
+    );
+  }
+  /**
+   * Import secrets from a JSON file path
+   * Resolves environment variables in the config
+   */
+  async importFromFile(configPath) {
+    const { loadSecretsConfig } = await import("./env-resolver-4ASC2IMR.mjs");
+    const config = loadSecretsConfig(configPath);
+    return this.importSecrets(config);
+  }
+};
+
+// src/cli/commands/login.ts
+async function loginCommand(options = {}) {
+  console.log("Authenticating with Learn Secrets...\n");
+  const mgmt = new SecretsManagement({
+    appId: "temp",
+    // Will be set after login
+    baseUrl: options.baseUrl
+  });
+  try {
+    const result = await mgmt.login();
+    console.log(`
+Logged in as: ${result.user}`);
+    console.log("Credentials saved to ~/.learn/credentials.json");
+    console.log("\nYou can now run: learn-secrets init --origins yourdomain.com");
+  } catch (error) {
+    console.error("\nLogin failed:", error.message);
+    process.exit(1);
+  }
+}
+
+// src/cli/commands/init.ts
+import fs2 from "fs";
+
+// src/cli/utils/env-parser.ts
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { resolve } from "path";
+function parseEnvFile(filePath) {
+  const resolvedPath = resolve(filePath);
+  if (!existsSync2(resolvedPath)) {
+    throw new Error(`File not found: ${resolvedPath}`);
+  }
+  const content = readFileSync2(resolvedPath, "utf-8");
+  const lines = content.split("\n");
+  const variables = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const match = trimmed.match(/^([A-Z0-9_]+)\s*=\s*(['"]?)(.+?)\2$/i);
+    if (match) {
+      const key = match[1];
+      const value = match[3];
+      variables.push({ key, value });
+    }
+  }
+  return variables;
+}
+
+// src/cli/utils/key-detector.ts
+var PROVIDER_PATTERNS = [
+  {
+    pattern: /^OPENAI_API_KEY$/i,
+    provider: "openai",
+    baseUrl: "https://api.openai.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^ANTHROPIC_API_KEY$/i,
+    provider: "anthropic",
+    baseUrl: "https://api.anthropic.com",
+    authHeader: "x-api-key",
+    authPrefix: ""
+  },
+  {
+    pattern: /^STRIPE_(SECRET_)?KEY$/i,
+    provider: "stripe",
+    baseUrl: "https://api.stripe.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^GITHUB_TOKEN$/i,
+    provider: "github",
+    baseUrl: "https://api.github.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^GOOGLE_API_KEY$/i,
+    provider: "google",
+    baseUrl: "https://www.googleapis.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  }
+];
+function isLikelyApiKey(key, value) {
+  const keyPatterns = [
+    /_API_KEY$/i,
+    /_SECRET$/i,
+    /_TOKEN$/i,
+    /^API_KEY_/i,
+    /^SECRET_/i,
+    /^TOKEN_/i
+  ];
+  for (const pattern of keyPatterns) {
+    if (pattern.test(key)) {
+      return true;
+    }
+  }
+  const valuePatterns = [
+    /^sk-[a-zA-Z0-9_-]+$/,
+    // OpenAI, Stripe
+    /^sk-ant-[a-zA-Z0-9_-]+$/,
+    // Anthropic
+    /^ghp_[a-zA-Z0-9]+$/,
+    // GitHub
+    /^ya29\.[a-zA-Z0-9_-]+$/,
+    // Google OAuth
+    /^[a-f0-9]{32}$/,
+    // 32-char hex
+    /^[a-f0-9]{40}$/,
+    // 40-char hex (like GitHub)
+    /^[a-zA-Z0-9_-]{40,}$/
+    // Long random string
+  ];
+  for (const pattern of valuePatterns) {
+    if (pattern.test(value)) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectProvider(key) {
+  for (const pattern of PROVIDER_PATTERNS) {
+    if (pattern.pattern.test(key)) {
+      return pattern;
+    }
+  }
+  return null;
+}
+function envKeyToSecretName(key) {
+  return key.toLowerCase().replace(/_api_key$/i, "").replace(/_secret$/i, "").replace(/_token$/i, "").replace(/_key$/i, "").replace(/_/g, "-");
+}
+function detectApiKeys(envVars) {
+  const secrets = [];
+  for (const { key, value } of envVars) {
+    if (!isLikelyApiKey(key, value)) {
+      continue;
+    }
+    const providerInfo = detectProvider(key);
+    const secretName = envKeyToSecretName(key);
+    if (providerInfo) {
+      secrets.push({
+        name: secretName,
+        provider: providerInfo.provider,
+        api_key: value,
+        base_url: providerInfo.baseUrl,
+        auth_header: providerInfo.authHeader,
+        auth_prefix: providerInfo.authPrefix
+      });
+    } else {
+      secrets.push({
+        name: secretName,
+        provider: "custom",
+        api_key: value,
+        base_url: "",
+        // User must configure
+        auth_header: "Authorization",
+        auth_prefix: "Bearer "
+      });
+    }
+  }
+  return secrets;
+}
+function summarizeDetectedSecrets(secrets) {
+  if (secrets.length === 0) {
+    return "No API keys detected in .env file";
+  }
+  const lines = ["Detected API keys:"];
+  for (const secret of secrets) {
+    const masked = secret.api_key.substring(0, 8) + "...";
+    lines.push(`  - ${secret.name} (${secret.provider}): ${masked}`);
+  }
+  return lines.join("\n");
+}
+
+// src/cli/commands/init.ts
+async function initCommand(options) {
+  if (!hasValidCredentials()) {
+    console.error('Error: Not authenticated. Run "learn-secrets login" first.');
+    process.exit(1);
+  }
+  if (!options.origins) {
+    console.error("Error: --origins is required");
+    console.error("Example: learn-secrets init --origins mysite.com,localhost");
+    process.exit(1);
+  }
+  if (!options.project) {
+    console.error("Error: --project is required");
+    console.error("Example: learn-secrets init --project my-app-id --origins mysite.com");
+    process.exit(1);
+  }
+  const origins = options.origins.split(",").map((o) => o.trim()).filter(Boolean);
+  if (origins.length === 0) {
+    console.error("Error: No valid origins provided");
+    process.exit(1);
+  }
+  console.log(`
+Onboarding site for project: ${options.project}`);
+  console.log(`Origins: ${origins.join(", ")}
+`);
+  const envFile = options.env || ".env";
+  let secrets;
+  try {
+    console.log(`Reading ${envFile}...`);
+    const envVars = parseEnvFile(envFile);
+    secrets = detectApiKeys(envVars);
+    if (secrets.length === 0) {
+      console.log("\nNo API keys detected in .env file.");
+      console.log("Make sure your .env contains variables like:");
+      console.log("  OPENAI_API_KEY=sk-...");
+      console.log("  ANTHROPIC_API_KEY=sk-ant-...");
+      process.exit(0);
+    }
+    console.log("\n" + summarizeDetectedSecrets(secrets));
+    console.log("");
+  } catch (error) {
+    console.error(`Error reading ${envFile}:`, error.message);
+    process.exit(1);
+  }
+  if (!options.yes) {
+    const readline = await import("readline");
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    const answer = await new Promise((resolve2) => {
+      rl.question("Upload these secrets? (y/N): ", resolve2);
+    });
+    rl.close();
+    if (answer.toLowerCase() !== "y" && answer.toLowerCase() !== "yes") {
+      console.log("Cancelled.");
+      process.exit(0);
+    }
+  }
+  console.log("\nUploading secrets...");
+  const mgmt = new SecretsManagement({
+    appId: options.project,
+    baseUrl: options.baseUrl
+  });
+  try {
+    const result = await mgmt.importSecrets({
+      version: "1.0",
+      origins,
+      secrets
+    });
+    console.log("\nSuccess!");
+    console.log(`  Created: ${result.results.created} secrets`);
+    console.log(`  Updated: ${result.results.updated} secrets`);
+    if (result.results.failed > 0) {
+      console.log(`  Failed: ${result.results.failed} secrets`);
+      for (const failure of result.results.details.failed) {
+        console.log(`    - ${failure.name}: ${failure.error}`);
+      }
+    }
+    if (result.sdkToken) {
+      console.log("\nSDK Token created:");
+      console.log(`  ${result.sdkToken.token}`);
+      console.log("\n  IMPORTANT: Save this token - it will not be shown again.");
+      console.log("  Add it to your static site code:");
+      console.log("");
+      console.log("    const sdk = new SecretsSDK();");
+      console.log("    // No appId or token needed - uses origin-based auth!");
+    }
+    console.log("\nYour site is ready!");
+    console.log(`Visit: https://ctklearn.carsontkempf.workers.dev to manage secrets`);
+    const configFile = "secrets-config.json";
+    const config = {
+      project: options.project,
+      origins
+    };
+    fs2.writeFileSync(configFile, JSON.stringify(config, null, 2));
+    console.log(`
+Created local config: ${configFile}`);
+  } catch (error) {
+    console.error("\nUpload failed:", error.message);
+    if (error.status === 401) {
+      console.error('Your session may have expired. Try running "learn-secrets login" again.');
+    }
+    if (error.status === 404) {
+      console.error(`Project "${options.project}" not found. Check your project ID.`);
+    }
+    process.exit(1);
+  }
+}
+
+// src/cli/commands/setup.ts
+async function setupCommand(options) {
+  const baseUrl = options.baseUrl || "https://ctklearn.carsontkempf.workers.dev";
+  const envFile = options.env || ".env";
+  const projectName = options.projectName || `Project - ${options.origin}`;
+  console.log("\n\u{1F680} Learn Secrets Setup\n");
+  console.log(`Email: ${options.email}`);
+  console.log(`Origin: ${options.origin}`);
+  console.log(`Project: ${projectName}`);
+  console.log(`Env File: ${envFile}
+`);
+  let secrets;
+  try {
+    console.log(`\u{1F4D6} Reading ${envFile}...`);
+    const envVars = parseEnvFile(envFile);
+    secrets = detectApiKeys(envVars);
+    if (secrets.length === 0) {
+      console.log("\n\u26A0\uFE0F  No API keys detected in .env file.");
+      console.log("Make sure your .env contains variables like:");
+      console.log("  OPENAI_API_KEY=sk-...");
+      console.log("  STRIPE_API_KEY=sk_live_...");
+      console.log("  SPOTIFY_CLIENT_ID=abc123...");
+      process.exit(0);
+    }
+    console.log("\n" + summarizeDetectedSecrets(secrets));
+    console.log("");
+  } catch (error) {
+    console.error(`\u274C Error reading ${envFile}:`, error.message);
+    process.exit(1);
+  }
+  if (!options.yes) {
+    const readline = await import("readline");
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    const answer = await new Promise((resolve2) => {
+      rl.question("Continue with setup? (y/N): ", resolve2);
+    });
+    rl.close();
+    if (answer.toLowerCase() !== "y" && answer.toLowerCase() !== "yes") {
+      console.log("\u274C Cancelled.");
+      process.exit(0);
+    }
+  }
+  console.log("\n\u{1F510} Authenticating...");
+  let cookies;
+  try {
+    const loginResponse = await fetch(`${baseUrl}/api/login`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        email: options.email,
+        password: options.password
+      })
+    });
+    if (!loginResponse.ok) {
+      const errorData = await loginResponse.json().catch(() => ({}));
+      throw new Error(errorData.error || errorData.message || "Authentication failed");
+    }
+    const setCookieHeader = loginResponse.headers.get("set-cookie");
+    if (!setCookieHeader) {
+      throw new Error("No session cookie received");
+    }
+    const cookieParts = setCookieHeader.split(";")[0];
+    cookies = cookieParts;
+    console.log("\u2705 Authenticated successfully");
+  } catch (error) {
+    console.error(`\u274C Authentication failed: ${error.message}`);
+    console.log("\n\u{1F4A1} Make sure:");
+    console.log("  - Email and password are correct");
+    console.log("  - User account exists in the system");
+    console.log("  - Backend is accessible at", baseUrl);
+    process.exit(1);
+  }
+  console.log("\n\u{1F4E6} Creating project...");
+  let projectAppId;
+  try {
+    const createProjectResponse = await fetch(`${baseUrl}/api/projects`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Cookie": cookies
+      },
+      body: JSON.stringify({
+        name: projectName,
+        description: `Auto-provisioned for ${options.origin}`
+      })
+    });
+    if (!createProjectResponse.ok) {
+      const errorData = await createProjectResponse.json().catch(() => ({}));
+      throw new Error(errorData.message || "Failed to create project");
+    }
+    const projectData = await createProjectResponse.json();
+    projectAppId = projectData.project.appid;
+    console.log(`\u2705 Project created: ${projectAppId}`);
+  } catch (error) {
+    console.error(`\u274C Project creation failed: ${error.message}`);
+    process.exit(1);
+  }
+  console.log("\n\u{1F511} Generating SDK token...");
+  let sdkToken;
+  try {
+    const tokenResponse = await fetch(`${baseUrl}/api/projects/${projectAppId}/sdk-tokens`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Cookie": cookies
+      },
+      body: JSON.stringify({
+        label: `Production - ${options.origin}`,
+        origins: [options.origin],
+        expiresInDays: 365
+      })
+    });
+    if (!tokenResponse.ok) {
+      const errorData = await tokenResponse.json().catch(() => ({}));
+      throw new Error(errorData.message || "Failed to generate SDK token");
+    }
+    const tokenData = await tokenResponse.json();
+    sdkToken = tokenData.token;
+    console.log(`\u2705 SDK token generated`);
+    console.log(`   Token: ${sdkToken.substring(0, 15)}...${sdkToken.slice(-4)}`);
+  } catch (error) {
+    console.error(`\u274C Token generation failed: ${error.message}`);
+    process.exit(1);
+  }
+  console.log("\n\u{1F4E4} Uploading secrets...");
+  try {
+    const importResponse = await fetch(`${baseUrl}/api/projects/${projectAppId}/import-secrets`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Cookie": cookies
+      },
+      body: JSON.stringify({
+        version: "1.0",
+        secrets
+      })
+    });
+    if (!importResponse.ok) {
+      const errorData = await importResponse.json().catch(() => ({}));
+      throw new Error(errorData.message || "Failed to upload secrets");
+    }
+    const result = await importResponse.json();
+    console.log("\u2705 Secrets uploaded:");
+    console.log(`   Created: ${result.results.created}`);
+    console.log(`   Updated: ${result.results.updated}`);
+    if (result.results.failed > 0) {
+      console.log(`   \u26A0\uFE0F  Failed: ${result.results.failed}`);
+      for (const failure of result.results.details.failed) {
+        console.log(`      - ${failure.name}: ${failure.error}`);
+      }
+    }
+  } catch (error) {
+    console.error(`\u274C Upload failed: ${error.message}`);
+  }
+  console.log("\n" + "=".repeat(60));
+  console.log("\u2705 SETUP COMPLETE!");
+  console.log("=".repeat(60));
+  console.log("\nConfiguration:");
+  console.log(`  LEARN_TENANT_URL: ${baseUrl}/api/auth`);
+  console.log(`  LEARN_PROJECT_APPID: ${projectAppId}`);
+  console.log(`  LEARN_SDK_TOKEN: ${sdkToken}`);
+  console.log(`  LEARN_ORIGIN: ${options.origin}`);
+  console.log("\nUsage in your static site:");
+  console.log('  <script src="https://unpkg.com/learn-secrets-sdk/dist/index.global.js"></script>');
+  console.log("  <script>");
+  console.log("    // Zero-config mode - no tokens needed in client code!");
+  console.log("    const sdk = new SecretsSDK.SecretsSDK();");
+  console.log(`    sdk.setAppId('${projectAppId}');`);
+  console.log("    ");
+  console.log("    // Use your secrets");
+  console.log('    const data = await sdk.get("newsapi", "/v2/top-headlines");');
+  console.log("  </script>");
+  console.log("\nManage secrets:");
+  console.log(`  Visit: ${baseUrl}`);
+  console.log(`  Or use CLI: learn-secrets init --project ${projectAppId} --origins ${options.origin}`);
+  console.log("\n" + "=".repeat(60));
+  const configPath = ".env.learn";
+  const configContent = `# Learn Platform Configuration
+# Generated on ${(/* @__PURE__ */ new Date()).toISOString()}
+# DO NOT COMMIT THIS FILE TO GIT
+
+LEARN_TENANT_URL=${baseUrl}/api/auth
+LEARN_PROJECT_APPID=${projectAppId}
+LEARN_SDK_TOKEN=${sdkToken}
+LEARN_ORIGIN=${options.origin}
+
+# Token expires: 365 days
+# Token prefix: ${sdkToken.slice(-4)}
+`;
+  try {
+    const fs5 = await import("fs");
+    fs5.writeFileSync(configPath, configContent, "utf-8");
+    console.log(`
+\u{1F4BE} Configuration saved to: ${configPath}`);
+  } catch (error) {
+    console.error(`
+\u26A0\uFE0F  Could not save configuration file: ${error.message}`);
+  }
+  console.log("\n\u{1F389} Your site is ready to use Learn Secrets!\n");
+}
+
+// src/cli/commands/config.ts
+import fs3 from "fs";
+async function configCommand(options) {
+  const configFile = "secrets-config.json";
+  if (!fs3.existsSync(configFile)) {
+    console.error("Run learn-secrets init first to generate config.");
+    return;
+  }
+  const config = JSON.parse(fs3.readFileSync(configFile, "utf8"));
+  if (options.origins) {
+    config.origins = options.origins.split(",").map((o) => o.trim());
+    console.log("Updated origins:", config.origins);
+  }
+  fs3.writeFileSync(configFile, JSON.stringify(config, null, 2));
+}
+
+// src/cli/commands/deploy.ts
+import fs4 from "fs";
+async function deployCommand() {
+  const configFile = "secrets-config.json";
+  if (!fs4.existsSync(configFile)) {
+    console.error("No config found.");
+    return;
+  }
+  const config = JSON.parse(fs4.readFileSync(configFile, "utf8"));
+  console.log("Deploying secrets config to backend:", config);
+}
+
+// src/cli/index.ts
+var program = new Command();
+program.name("learn-secrets").description("CLI tool for managing API secrets in static sites").version("1.5.0");
+program.command("setup").description("Complete setup: create project, generate token, upload secrets").requiredOption("-e, --email <email>", "Your Learn account email").requiredOption("-p, --password <password>", "Your Learn account password").requiredOption("-o, --origin <domain>", "Your site origin (e.g., mysite.com)").option("--project-name <name>", 'Project name (default: "Project - <origin>")').option("--env <file>", "Path to .env file (default: .env)", ".env").option("--base-url <url>", "Custom base URL for API").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
+  await setupCommand(options);
+});
+program.command("login").description("Authenticate with Learn Secrets via browser").option("--base-url <url>", "Custom base URL for API").action(async (options) => {
+  await loginCommand(options);
+});
+program.command("init").description("Initialize secrets for a new site").requiredOption("-o, --origins <domains>", "Comma-separated list of allowed origins (e.g., mysite.com,localhost)").requiredOption("-p, --project <appid>", "Project app ID from dashboard").option("-e, --env <file>", "Path to .env file (default: .env)", ".env").option("--base-url <url>", "Custom base URL for API").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
+  await initCommand(options);
+});
+program.command("config").description("Configure allowed origins").option("--origins <origins>", "Comma separated origins").action(async (options) => {
+  await configCommand(options);
+});
+program.command("deploy").description("Deploy secrets config live").action(async () => {
+  await deployCommand();
+});
+program.parse(process.argv);
+if (!process.argv.slice(2).length) {
+  program.outputHelp();
+}