learn-secrets-sdk 1.4.0 → 1.6.0

package/dist/env-resolver-Y4SFGOKB.mjs

@@ -0,0 +1 @@
+import{a,b,c,d}from"./chunk-AS6G7JYX.mjs";export{d as loadSecretsConfig,b as resolveEnvInSecret,c as resolveEnvInSecrets,a as resolveEnvString};

package/dist/index.d.mts

@@ -0,0 +1,432 @@
+interface SecretsSDKOptions {
+    /**
+     * App ID from dashboard (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    appId?: string;
+    /**
+     * SDK token (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    token?: string;
+    sessionToken?: string;
+    /**
+     * Base URL of the proxy server
+     * Default: https://ctklearn.carsontkempf.workers.dev
+     */
+    baseUrl?: string;
+    timeout?: number;
+    retryOn429?: boolean;
+}
+interface ProxyRequest {
+    keyName: string;
+    endpoint: string;
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+    body?: any;
+    headers?: Record<string, string>;
+}
+interface ProxyResponse<T = any> {
+    success: boolean;
+    status: number;
+    data: T;
+}
+interface RateLimitInfo {
+    limit: number;
+    remaining: number;
+    reset: number;
+}
+declare class SecretsSDKError extends Error {
+    status: number;
+    response?: any | undefined;
+    constructor(message: string, status: number, response?: any | undefined);
+}
+declare class OriginMismatchError extends SecretsSDKError {
+    constructor(message?: string);
+}
+declare class RateLimitError extends SecretsSDKError {
+    retryAfter: number;
+    remaining: number;
+    limit: number;
+    constructor(message?: string, retryAfter?: number, remaining?: number, limit?: number);
+}
+declare class InvalidTokenError extends SecretsSDKError {
+    constructor(message?: string);
+}
+interface SecretsManagementOptions {
+    appId: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+interface SecretConfig {
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+}
+interface MaskedSecret {
+    id: string;
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+    created?: string;
+    updated?: string;
+}
+interface SyncOptions {
+    deleteMissing?: boolean;
+    dryRun?: boolean;
+}
+interface SyncDiffItem {
+    name: string;
+    provider?: string;
+    changes?: string[];
+}
+interface SyncResult {
+    success: boolean;
+    diff: {
+        created: SyncDiffItem[];
+        updated: SyncDiffItem[];
+        deleted: SyncDiffItem[];
+        unchanged: SyncDiffItem[];
+    };
+    summary: {
+        created: number;
+        updated: number;
+        deleted: number;
+        unchanged: number;
+    };
+}
+interface CLICredentials {
+    access_token: string;
+    refresh_token: string | null;
+    expires_at: string | null;
+    user_id: string;
+    machine_id?: string;
+    sdk_name?: string;
+    authorized_at?: string;
+}
+interface SDKCredentialsStore {
+    'learn-secrets-sdk'?: CLICredentials;
+    'learn-auth-sdk'?: CLICredentials;
+}
+type SDKName = 'learn-secrets-sdk' | 'learn-auth-sdk';
+
+declare class SecretsSDK {
+    private appId;
+    private token;
+    private baseUrl;
+    private timeout;
+    private retryOn429;
+    private rateLimitInfo;
+    private zeroConfigMode;
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options?: SecretsSDKOptions);
+    /**
+     * Get current rate limit information
+     */
+    getUsage(): RateLimitInfo | null;
+    /**
+     * Parse rate limit headers from response
+     */
+    private parseRateLimitHeaders;
+    /**
+     * Sleep utility for retry backoff
+     */
+    private sleep;
+    /**
+     * Make fetch request with timeout
+     */
+    private fetchWithTimeout;
+    /**
+     * Call an external API securely through the proxy
+     * @param keyName - Name of the API key to use
+     * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
+     * @param options - Request options (method, body, headers)
+     * @returns Promise with the API response
+     */
+    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest, 'keyName' | 'endpoint'>): Promise<T>;
+    /**
+     * Make a GET request
+     */
+    get<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a POST request
+     */
+    post<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a PUT request
+     */
+    put<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a DELETE request
+     */
+    delete<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a PATCH request
+     */
+    patch<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Secrets Management API (zero-config mode)
+     * These methods allow programmatic CRUD operations on project secrets
+     * Requires appId to be set (can be set in constructor or via setAppId)
+     */
+    /**
+     * Set App ID for secrets management
+     * Required before calling secrets management methods
+     */
+    setAppId(appId: string): void;
+    /**
+     * Make authenticated request to secrets management API
+     */
+    private secretsRequest;
+    /**
+     * List all secrets for the project
+     * Returns secret metadata (no API keys)
+     */
+    listSecrets(): Promise<{
+        success: boolean;
+        secrets: Array<{
+            name: string;
+            provider: string;
+            base_url: string;
+            auth_header: string;
+            auth_prefix: string;
+            created: string;
+            updated: string;
+        }>;
+        count: number;
+    }>;
+    /**
+     * Create a new secret
+     */
+    createSecret(secret: {
+        name: string;
+        provider: string;
+        api_key: string;
+        base_url?: string;
+        auth_header?: string;
+        auth_prefix?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+        secret: any;
+    }>;
+    /**
+     * Update an existing secret
+     */
+    updateSecret(update: {
+        name: string;
+        api_key?: string;
+        provider?: string;
+        base_url?: string;
+        auth_header?: string;
+        auth_prefix?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+        secret: any;
+    }>;
+    /**
+     * Delete a secret
+     */
+    deleteSecret(name: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Sync secrets from .env file format
+     * Bulk upload/update secrets
+     */
+    syncEnv(secrets: Record<string, string>, provider?: string): Promise<{
+        success: boolean;
+        message: string;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: Array<{
+                    name: string;
+                    error: string;
+                }>;
+            };
+        };
+    }>;
+}
+
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+declare class SecretsManagement {
+    private appId;
+    private baseUrl;
+    private timeout;
+    constructor(options: SecretsManagementOptions);
+    /**
+     * Open a URL in the default browser
+     */
+    private openBrowser;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+    /**
+     * Browser OAuth login flow with 2FA
+     * Opens browser for user to authorize, then prompts for 2FA code
+     */
+    login(): Promise<{
+        success: boolean;
+        user: string;
+    }>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Logout - clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    private getAccessToken;
+    /**
+     * Make authenticated request
+     */
+    private request;
+    /**
+     * List all secrets (with masked API keys)
+     */
+    list(): Promise<MaskedSecret[]>;
+    /**
+     * Sync secrets from config
+     */
+    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    importSecrets(config: {
+        version?: string;
+        origins?: string[];
+        secrets: SecretConfig[];
+    }): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: {
+                    name: string;
+                    error: string;
+                }[];
+            };
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    importFromFile(configPath: string): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+}
+
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+declare function resolveEnvString(value: string): string;
+/**
+ * Resolve environment variables in a single secret config
+ */
+declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
+/**
+ * Resolve environment variables in an array of secrets
+ */
+declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+declare function loadSecretsConfig(configPath: string): {
+    version: string;
+    project: string;
+    secrets: SecretConfig[];
+};
+
+/**
+ * Machine ID Generation
+ * Cross-platform machine identification for CLI authentication
+ */
+interface MachineInfo {
+    machineId: string;
+    fingerprint: string;
+}
+/**
+ * Get a unique machine identifier
+ * This ID persists across reboots and SDK reinstalls
+ */
+declare function getMachineId(): Promise<MachineInfo>;
+
+/**
+ * Read all credentials from file (SDK-keyed format)
+ */
+declare function readAllCredentials(): SDKCredentialsStore | null;
+/**
+ * Write all credentials to file (SDK-keyed format)
+ */
+declare function writeAllCredentials(store: SDKCredentialsStore): void;
+/**
+ * Read credentials for a specific SDK
+ */
+declare function readSDKCredentials(sdkName: SDKName): CLICredentials | null;
+/**
+ * Write credentials for a specific SDK
+ */
+declare function writeSDKCredentials(sdkName: SDKName, creds: CLICredentials): void;
+/**
+ * Delete credentials for a specific SDK
+ */
+declare function deleteSDKCredentials(sdkName: SDKName): void;
+/**
+ * Check if credentials exist for a specific SDK
+ */
+declare function hasSDKCredentials(sdkName: SDKName): boolean;
+
+export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest, type ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };