learn-secrets-sdk 1.4.0 → 1.6.0

package/dist/index.d.ts

@@ -1,5 +1,432 @@
-export { SecretsSDK } from './client.js';
-export { SecretsManagement } from './management.js';
-export { resolveEnvString, resolveEnvInSecret, resolveEnvInSecrets, loadSecretsConfig } from './env-resolver.js';
-export { SecretsSDKError, OriginMismatchError, RateLimitError, InvalidTokenError } from './types.js';
-export type { SecretsSDKOptions, ProxyRequest, ProxyResponse, RateLimitInfo, SecretsManagementOptions, SecretConfig, MaskedSecret, SyncOptions, SyncResult, CLICredentials } from './types.js';
+interface SecretsSDKOptions {
+    /**
+     * App ID from dashboard (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    appId?: string;
+    /**
+     * SDK token (optional in zero-config mode)
+     * If omitted, SDK uses origin-based authentication
+     */
+    token?: string;
+    sessionToken?: string;
+    /**
+     * Base URL of the proxy server
+     * Default: https://ctklearn.carsontkempf.workers.dev
+     */
+    baseUrl?: string;
+    timeout?: number;
+    retryOn429?: boolean;
+}
+interface ProxyRequest {
+    keyName: string;
+    endpoint: string;
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+    body?: any;
+    headers?: Record<string, string>;
+}
+interface ProxyResponse<T = any> {
+    success: boolean;
+    status: number;
+    data: T;
+}
+interface RateLimitInfo {
+    limit: number;
+    remaining: number;
+    reset: number;
+}
+declare class SecretsSDKError extends Error {
+    status: number;
+    response?: any | undefined;
+    constructor(message: string, status: number, response?: any | undefined);
+}
+declare class OriginMismatchError extends SecretsSDKError {
+    constructor(message?: string);
+}
+declare class RateLimitError extends SecretsSDKError {
+    retryAfter: number;
+    remaining: number;
+    limit: number;
+    constructor(message?: string, retryAfter?: number, remaining?: number, limit?: number);
+}
+declare class InvalidTokenError extends SecretsSDKError {
+    constructor(message?: string);
+}
+interface SecretsManagementOptions {
+    appId: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+interface SecretConfig {
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+}
+interface MaskedSecret {
+    id: string;
+    name: string;
+    provider: string;
+    api_key: string;
+    base_url?: string;
+    auth_header?: string;
+    auth_prefix?: string;
+    created?: string;
+    updated?: string;
+}
+interface SyncOptions {
+    deleteMissing?: boolean;
+    dryRun?: boolean;
+}
+interface SyncDiffItem {
+    name: string;
+    provider?: string;
+    changes?: string[];
+}
+interface SyncResult {
+    success: boolean;
+    diff: {
+        created: SyncDiffItem[];
+        updated: SyncDiffItem[];
+        deleted: SyncDiffItem[];
+        unchanged: SyncDiffItem[];
+    };
+    summary: {
+        created: number;
+        updated: number;
+        deleted: number;
+        unchanged: number;
+    };
+}
+interface CLICredentials {
+    access_token: string;
+    refresh_token: string | null;
+    expires_at: string | null;
+    user_id: string;
+    machine_id?: string;
+    sdk_name?: string;
+    authorized_at?: string;
+}
+interface SDKCredentialsStore {
+    'learn-secrets-sdk'?: CLICredentials;
+    'learn-auth-sdk'?: CLICredentials;
+}
+type SDKName = 'learn-secrets-sdk' | 'learn-auth-sdk';
+
+declare class SecretsSDK {
+    private appId;
+    private token;
+    private baseUrl;
+    private timeout;
+    private retryOn429;
+    private rateLimitInfo;
+    private zeroConfigMode;
+    /**
+     * Create a new SecretsSDK instance
+     *
+     * Zero-config mode (recommended for static sites):
+     *   const sdk = new SecretsSDK();
+     *   // Origin header is used for authentication
+     *
+     * Token mode (for backward compatibility):
+     *   const sdk = new SecretsSDK({ appId: '...', token: 'sk_live_...' });
+     */
+    constructor(options?: SecretsSDKOptions);
+    /**
+     * Get current rate limit information
+     */
+    getUsage(): RateLimitInfo | null;
+    /**
+     * Parse rate limit headers from response
+     */
+    private parseRateLimitHeaders;
+    /**
+     * Sleep utility for retry backoff
+     */
+    private sleep;
+    /**
+     * Make fetch request with timeout
+     */
+    private fetchWithTimeout;
+    /**
+     * Call an external API securely through the proxy
+     * @param keyName - Name of the API key to use
+     * @param endpoint - API endpoint path (e.g., '/v1/chat/completions')
+     * @param options - Request options (method, body, headers)
+     * @returns Promise with the API response
+     */
+    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest, 'keyName' | 'endpoint'>): Promise<T>;
+    /**
+     * Make a GET request
+     */
+    get<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a POST request
+     */
+    post<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a PUT request
+     */
+    put<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a DELETE request
+     */
+    delete<T = any>(keyName: string, endpoint: string, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Make a PATCH request
+     */
+    patch<T = any>(keyName: string, endpoint: string, body: any, headers?: Record<string, string>): Promise<T>;
+    /**
+     * Secrets Management API (zero-config mode)
+     * These methods allow programmatic CRUD operations on project secrets
+     * Requires appId to be set (can be set in constructor or via setAppId)
+     */
+    /**
+     * Set App ID for secrets management
+     * Required before calling secrets management methods
+     */
+    setAppId(appId: string): void;
+    /**
+     * Make authenticated request to secrets management API
+     */
+    private secretsRequest;
+    /**
+     * List all secrets for the project
+     * Returns secret metadata (no API keys)
+     */
+    listSecrets(): Promise<{
+        success: boolean;
+        secrets: Array<{
+            name: string;
+            provider: string;
+            base_url: string;
+            auth_header: string;
+            auth_prefix: string;
+            created: string;
+            updated: string;
+        }>;
+        count: number;
+    }>;
+    /**
+     * Create a new secret
+     */
+    createSecret(secret: {
+        name: string;
+        provider: string;
+        api_key: string;
+        base_url?: string;
+        auth_header?: string;
+        auth_prefix?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+        secret: any;
+    }>;
+    /**
+     * Update an existing secret
+     */
+    updateSecret(update: {
+        name: string;
+        api_key?: string;
+        provider?: string;
+        base_url?: string;
+        auth_header?: string;
+        auth_prefix?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+        secret: any;
+    }>;
+    /**
+     * Delete a secret
+     */
+    deleteSecret(name: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Sync secrets from .env file format
+     * Bulk upload/update secrets
+     */
+    syncEnv(secrets: Record<string, string>, provider?: string): Promise<{
+        success: boolean;
+        message: string;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: Array<{
+                    name: string;
+                    error: string;
+                }>;
+            };
+        };
+    }>;
+}
+
+/**
+ * SecretsManagement class for CLI authentication and secrets management
+ */
+declare class SecretsManagement {
+    private appId;
+    private baseUrl;
+    private timeout;
+    constructor(options: SecretsManagementOptions);
+    /**
+     * Open a URL in the default browser
+     */
+    private openBrowser;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+    /**
+     * Browser OAuth login flow with 2FA
+     * Opens browser for user to authorize, then prompts for 2FA code
+     */
+    login(): Promise<{
+        success: boolean;
+        user: string;
+    }>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Logout - clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Get access token from stored credentials
+     * Throws error if not authenticated
+     */
+    private getAccessToken;
+    /**
+     * Make authenticated request
+     */
+    private request;
+    /**
+     * List all secrets (with masked API keys)
+     */
+    list(): Promise<MaskedSecret[]>;
+    /**
+     * Sync secrets from config
+     */
+    sync(secrets: SecretConfig[], options?: SyncOptions): Promise<SyncResult>;
+    /**
+     * Import secrets from a config object (bulk import)
+     * Also creates SDK token if origins are provided
+     *
+     * @param config - The secrets configuration
+     * @returns Import results including created/updated counts and optional SDK token
+     */
+    importSecrets(config: {
+        version?: string;
+        origins?: string[];
+        secrets: SecretConfig[];
+    }): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+            details: {
+                created: string[];
+                updated: string[];
+                failed: {
+                    name: string;
+                    error: string;
+                }[];
+            };
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+    /**
+     * Import secrets from a JSON file path
+     * Resolves environment variables in the config
+     */
+    importFromFile(configPath: string): Promise<{
+        success: boolean;
+        results: {
+            created: number;
+            updated: number;
+            failed: number;
+        };
+        sdkToken?: {
+            token: string;
+            message: string;
+        };
+    }>;
+}
+
+/**
+ * Resolve environment variable references in a string
+ * Supports ${VAR} and $VAR syntax
+ */
+declare function resolveEnvString(value: string): string;
+/**
+ * Resolve environment variables in a single secret config
+ */
+declare function resolveEnvInSecret(secret: SecretConfig): SecretConfig;
+/**
+ * Resolve environment variables in an array of secrets
+ */
+declare function resolveEnvInSecrets(secrets: SecretConfig[]): SecretConfig[];
+/**
+ * Load and parse a secrets config file
+ * Resolves environment variables in the config
+ */
+declare function loadSecretsConfig(configPath: string): {
+    version: string;
+    project: string;
+    secrets: SecretConfig[];
+};
+
+/**
+ * Machine ID Generation
+ * Cross-platform machine identification for CLI authentication
+ */
+interface MachineInfo {
+    machineId: string;
+    fingerprint: string;
+}
+/**
+ * Get a unique machine identifier
+ * This ID persists across reboots and SDK reinstalls
+ */
+declare function getMachineId(): Promise<MachineInfo>;
+
+/**
+ * Read all credentials from file (SDK-keyed format)
+ */
+declare function readAllCredentials(): SDKCredentialsStore | null;
+/**
+ * Write all credentials to file (SDK-keyed format)
+ */
+declare function writeAllCredentials(store: SDKCredentialsStore): void;
+/**
+ * Read credentials for a specific SDK
+ */
+declare function readSDKCredentials(sdkName: SDKName): CLICredentials | null;
+/**
+ * Write credentials for a specific SDK
+ */
+declare function writeSDKCredentials(sdkName: SDKName, creds: CLICredentials): void;
+/**
+ * Delete credentials for a specific SDK
+ */
+declare function deleteSDKCredentials(sdkName: SDKName): void;
+/**
+ * Check if credentials exist for a specific SDK
+ */
+declare function hasSDKCredentials(sdkName: SDKName): boolean;
+
+export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest, type ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };

package/dist/index.global.js

@@ -0,0 +1,11 @@
+"use strict";var SecretsSDK=(()=>{var ee=Object.create;var D=Object.defineProperty;var te=Object.getOwnPropertyDescriptor;var re=Object.getOwnPropertyNames;var se=Object.getPrototypeOf,ne=Object.prototype.hasOwnProperty;var c=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var ie=(t,e)=>()=>(t&&(e=t(t=0)),e);var W=(t,e)=>{for(var r in e)D(t,r,{get:e[r],enumerable:!0})},B=(t,e,r,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of re(e))!ne.call(t,n)&&n!==r&&D(t,n,{get:()=>e[n],enumerable:!(s=te(e,n))||s.enumerable});return t};var w=(t,e,r)=>(r=t!=null?ee(se(t)):{},B(e||!t||!t.__esModule?D(r,"default",{value:t,enumerable:!0}):r,t)),oe=t=>B(D({},"__esModule",{value:!0}),t);var Y={};W(Y,{loadSecretsConfig:()=>z,resolveEnvInSecret:()=>L,resolveEnvInSecrets:()=>$,resolveEnvString:()=>m});function m(t){return t.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g,(e,r,s)=>{let n=r||s,i=process.env[n];if(i===void 0)throw new Error(`Environment variable ${n} is not defined`);return i})}function L(t){let e={name:m(t.name),provider:m(t.provider),api_key:m(t.api_key)};return t.base_url&&(e.base_url=m(t.base_url)),t.auth_header&&(e.auth_header=m(t.auth_header)),t.auth_prefix&&(e.auth_prefix=m(t.auth_prefix)),e}function $(t){return t.map(L)}function z(t){let e=c("fs"),s=c("path").resolve(t);if(!e.existsSync(s))throw new Error(`Config file not found: ${s}`);let n=e.readFileSync(s,"utf-8"),i=JSON.parse(n);if(!i.version)throw new Error('Config file missing "version" field');if(!i.project)throw new Error('Config file missing "project" field');if(!Array.isArray(i.secrets))throw new Error('Config file missing "secrets" array');let a=$(i.secrets);return{version:i.version,project:i.project,secrets:a}}var J=ie(()=>{"use strict"});var ue={};W(ue,{InvalidTokenError:()=>b,OriginMismatchError:()=>v,RateLimitError:()=>x,SecretsManagement:()=>j,SecretsSDK:()=>R,SecretsSDKError:()=>o,deleteSDKCredentials:()=>G,getMachineId:()=>A,hasSDKCredentials:()=>V,loadSecretsConfig:()=>z,readAllCredentials:()=>C,readSDKCredentials:()=>k,resolveEnvInSecret:()=>L,resolveEnvInSecrets:()=>$,resolveEnvString:()=>m,writeAllCredentials:()=>O,writeSDKCredentials:()=>E});var o=class extends Error{constructor(r,s,n){super(r);this.status=s;this.response=n;this.name="SecretsSDKError"}},v=class extends o{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},x=class extends o{constructor(e="Rate limit exceeded",r=60,s=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=r,this.remaining=s,this.limit=n}},b=class extends o{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var R=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let r=e.get("X-RateLimit-Limit"),s=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");r&&s&&n&&(this.rateLimitInfo={limit:parseInt(r),remaining:parseInt(s),reset:parseInt(n)})}sleep(e){return new Promise(r=>setTimeout(r,e))}async fetchWithTimeout(e,r,s){let n=new AbortController,i=setTimeout(()=>n.abort(),s);try{return await fetch(e,{...r,signal:n.signal})}finally{clearTimeout(i)}}async call(e,r,s={}){let n=0,i=this.retryOn429?3:0;for(;;)try{let a=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,h={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(h.Authorization=`Bearer ${this.token}`);let u=await this.fetchWithTimeout(a,{method:"POST",headers:h,body:JSON.stringify({keyName:e,endpoint:r,method:s.method||"GET",body:s.body,headers:s.headers})},this.timeout);this.parseRateLimitHeaders(u.headers);let f=await u.json();if(!u.ok){let p=f.data?.message||f?.message||`Request failed with status ${u.status}`;if(u.status===403&&p.includes("Origin"))throw new v(p);if(u.status===401)throw new b(p);if(u.status===429){let H=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,I=new x(p,H,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<i){n++;let M=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(M);continue}throw I}throw new o(p,u.status,f)}return f.data}catch(a){throw a instanceof o?a:a instanceof Error&&a.name==="AbortError"?new o("Request timeout",408):new o(a instanceof Error?a.message:"Unknown error occurred",500)}}async get(e,r,s){return this.call(e,r,{method:"GET",headers:s})}async post(e,r,s,n){return this.call(e,r,{method:"POST",body:s,headers:n})}async put(e,r,s,n){return this.call(e,r,{method:"PUT",body:s,headers:n})}async delete(e,r,s){return this.call(e,r,{method:"DELETE",headers:s})}async patch(e,r,s,n){return this.call(e,r,{method:"PATCH",body:s,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,r){if(!this.appId)throw new o("App ID required for secrets management. Call setAppId() first.",400);let s=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:r?JSON.stringify(r):void 0},this.timeout);if(!s.ok){let n=await s.json().catch(()=>({}));throw new o(n.message||`Secrets management failed: ${s.statusText}`,s.status,n)}return s.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,r){return this.secretsRequest("sync",{secrets:e,provider:r})}};var d=w(c("fs")),P=w(c("path")),K=w(c("os"));function U(){let t=K.homedir(),e=P.join(t,".learn");return P.join(e,"credentials.json")}function ae(){let t=K.homedir(),e=P.join(t,".learn");d.existsSync(e)||d.mkdirSync(e,{recursive:!0,mode:448})}function C(){try{let t=U();if(!d.existsSync(t))return null;let e=d.readFileSync(t,"utf-8"),r=JSON.parse(e);return r.access_token&&!r["learn-secrets-sdk"]&&!r["learn-auth-sdk"]?{"learn-secrets-sdk":r}:r}catch{return null}}function O(t){ae();let e=U(),r=JSON.stringify(t,null,2);d.writeFileSync(e,r,{mode:384})}function k(t){let e=C();return e&&e[t]||null}function E(t,e){let r=C()||{};r[t]=e,O(r)}function G(t){let e=C();e&&(delete e[t],Object.keys(e).length===0?N():O(e))}function q(){return k("learn-secrets-sdk")}function N(){try{let t=U();d.existsSync(t)&&d.unlinkSync(t)}catch{}}function V(t){let e=k(t);return e!==null&&!!e.access_token}function X(){let t=q();return t?t.expires_at?new Date(t.expires_at)>new Date:!0:!1}var Z=c("child_process"),Q=c("util"),F=c("crypto"),g=w(c("os")),_=(0,Q.promisify)(Z.exec);async function A(){let t=process.platform;try{let e;if(t==="darwin")e=await ce();else if(t==="linux")e=await de();else if(t==="win32")e=await le();else throw new Error(`Unsupported platform: ${t}`);let r=(0,F.createHash)("sha256").update(e).digest("hex").substring(0,32),s=JSON.stringify({machineId:r,cpus:g.cpus().length,arch:g.arch(),platform:g.platform(),homedir:g.homedir()}),n=(0,F.createHash)("sha256").update(s).digest("hex");return{machineId:r,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function ce(){try{let{stdout:t}=await _(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await _("hostname"),r=t.trim(),s=e.trim();if(r&&s)return`${r}-${s}`;let{stdout:n}=await _(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function de(){try{let{stdout:t}=await _("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=t.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function le(){try{let{stdout:t}=await _("wmic csproduct get uuid"),r=t.split(`
+`).map(s=>s.trim()).find(s=>s&&s!=="UUID");if(r)return r;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var j=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:r}=await import("child_process"),{promisify:s}=await import("util"),n=s(r),i=process.platform;try{i==="darwin"?await n(`open "${e}"`):i==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(a){throw console.error("Failed to open browser:",a),new o("Failed to open browser",500)}}sleep(e){return new Promise(r=>setTimeout(r,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
+`);let r=await A(),s=k(e);if(s&&s.access_token){let l=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:r.machineId,sdk_name:e})});if(l.ok){let y=await l.json();if(y.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${y.user_email||y.user_id}`),{success:!0,user:y.user_email||y.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new o("Failed to generate device code",n.status);let i=await n.json();console.log(`
+To authorize this device:`),console.log(`1. Visit: ${i.verification_uri}`),console.log(`2. Enter code: ${i.user_code}`),console.log("3. Complete 2FA verification"),console.log(`
+Opening browser...
+`),await this.openBrowser(i.verification_uri_complete);let a=!1,h=i.interval*1e3,u=Math.ceil(i.expires_in/i.interval),f=0;for(;f<u;){await this.sleep(h),f++;let l=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:i.device_code})});if(l.status===202){process.stdout.write(".");continue}if(l.ok){a=!0;break}}if(!a)throw new o("Device authorization timeout",408);console.log(`
+
+Device authorized! Sending 2FA code...`);let p=await fetch(`${this.baseUrl}/api/auth/2fa/send`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:i.device_code,sdk_name:e,machine_id:r.machineId})});if(!p.ok){let l=await p.json().catch(()=>({}));throw new o(l.message||"Failed to send 2FA code",p.status)}console.log(`2FA code sent to your email.
+`);let I=(await import("readline")).createInterface({input:process.stdin,output:process.stdout}),M=await new Promise(l=>{I.question("Enter 2FA code from email: ",y=>{I.close(),l(y)})}),T=await fetch(`${this.baseUrl}/api/auth/2fa/verify`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:i.device_code,code:M.trim()})});if(!T.ok){let l=await T.json().catch(()=>({}));throw new o(l.message||"2FA verification failed",T.status)}let S=await T.json();return E(e,{access_token:S.access_token,refresh_token:null,expires_at:null,user_id:S.user_id,machine_id:r.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
+Authentication successful!`),console.log(`Logged in as: ${S.user_email||S.user_id}`),console.log(`This machine is now permanently authorized.
+`),{success:!0,user:S.user_email||S.user_id}}catch(r){throw r instanceof o?r:new o(r.message||"Login failed",r.status||500)}}async isAuthenticated(){return X()}logout(){N(),console.log("Logged out successfully")}getAccessToken(){let e=q();if(!e)throw new o("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new o("Token expired. Run login() again.",401);return e.access_token}async request(e,r,s){let n=this.getAccessToken(),i={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};s&&(i.body=JSON.stringify(s));let a=await fetch(`${this.baseUrl}${r}`,i);if(!a.ok){let h=await a.json().catch(()=>({}));throw new o(h.message||`Request failed: ${a.statusText}`,a.status,h)}return a.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,r){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:r?.deleteMissing??!1,dryRun:r?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:r}=await Promise.resolve().then(()=>(J(),Y)),s=r(e);return this.importSecrets(s)}};J();return oe(ue);})();

package/dist/index.mjs

@@ -0,0 +1,11 @@
+import{a as U,b as q,c as N,d as F}from"./chunk-AS6G7JYX.mjs";var i=class extends Error{constructor(t,r,n){super(t);this.status=r;this.response=n;this.name="SecretsSDKError"}},y=class extends i{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},w=class extends i{constructor(e="Rate limit exceeded",t=60,r=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=n}},S=class extends i{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var _=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&r&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let n=new AbortController,a=setTimeout(()=>n.abort(),r);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(a)}}async call(e,t,r={}){let n=0,a=this.retryOn429?3:0;for(;;)try{let o=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,m={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(m.Authorization=`Bearer ${this.token}`);let l=await this.fetchWithTimeout(o,{method:"POST",headers:m,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(l.headers);let h=await l.json();if(!l.ok){let u=h.data?.message||h?.message||`Request failed with status ${l.status}`;if(l.status===403&&u.includes("Origin"))throw new y(u);if(l.status===401)throw new S(u);if(l.status===429){let M=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,k=new w(u,M,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<a){n++;let T=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(T);continue}throw k}throw new i(u,l.status,h)}return h.data}catch(o){throw o instanceof i?o:o instanceof Error&&o.name==="AbortError"?new i("Request timeout",408):new i(o instanceof Error?o.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,n){return this.call(e,t,{method:"POST",body:r,headers:n})}async put(e,t,r,n){return this.call(e,t,{method:"PUT",body:r,headers:n})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,n){return this.call(e,t,{method:"PATCH",body:r,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new i("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let n=await r.json().catch(()=>({}));throw new i(n.message||`Secrets management failed: ${r.statusText}`,r.status,n)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};import*as c from"fs";import*as v from"path";import*as D from"os";function R(){let s=D.homedir(),e=v.join(s,".learn");return v.join(e,"credentials.json")}function z(){let s=D.homedir(),e=v.join(s,".learn");c.existsSync(e)||c.mkdirSync(e,{recursive:!0,mode:448})}function C(){try{let s=R();if(!c.existsSync(s))return null;let e=c.readFileSync(s,"utf-8"),t=JSON.parse(e);return t.access_token&&!t["learn-secrets-sdk"]&&!t["learn-auth-sdk"]?{"learn-secrets-sdk":t}:t}catch{return null}}function P(s){z();let e=R(),t=JSON.stringify(s,null,2);c.writeFileSync(e,t,{mode:384})}function b(s){let e=C();return e&&e[s]||null}function O(s,e){let t=C()||{};t[s]=e,P(t)}function J(s){let e=C();e&&(delete e[s],Object.keys(e).length===0?A():P(e))}function L(){return b("learn-secrets-sdk")}function A(){try{let s=R();c.existsSync(s)&&c.unlinkSync(s)}catch{}}function H(s){let e=b(s);return e!==null&&!!e.access_token}function K(){let s=L();return s?s.expires_at?new Date(s.expires_at)>new Date:!0:!1}import{exec as W}from"child_process";import{promisify as B}from"util";import{createHash as j}from"crypto";import*as p from"os";var x=B(W);async function E(){let s=process.platform;try{let e;if(s==="darwin")e=await G();else if(s==="linux")e=await V();else if(s==="win32")e=await X();else throw new Error(`Unsupported platform: ${s}`);let t=j("sha256").update(e).digest("hex").substring(0,32),r=JSON.stringify({machineId:t,cpus:p.cpus().length,arch:p.arch(),platform:p.platform(),homedir:p.homedir()}),n=j("sha256").update(r).digest("hex");return{machineId:t,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function G(){try{let{stdout:s}=await x(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await x("hostname"),t=s.trim(),r=e.trim();if(t&&r)return`${t}-${r}`;let{stdout:n}=await x(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function V(){try{let{stdout:s}=await x("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=s.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function X(){try{let{stdout:s}=await x("wmic csproduct get uuid"),t=s.split(`
+`).map(r=>r.trim()).find(r=>r&&r!=="UUID");if(t)return t;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var $=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://ctklearn.carsontkempf.workers.dev",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:r}=await import("util"),n=r(t),a=process.platform;try{a==="darwin"?await n(`open "${e}"`):a==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(o){throw console.error("Failed to open browser:",o),new i("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
+`);let t=await E(),r=b(e);if(r&&r.access_token){let d=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:t.machineId,sdk_name:e})});if(d.ok){let g=await d.json();if(g.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${g.user_email||g.user_id}`),{success:!0,user:g.user_email||g.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new i("Failed to generate device code",n.status);let a=await n.json();console.log(`
+To authorize this device:`),console.log(`1. Visit: ${a.verification_uri}`),console.log(`2. Enter code: ${a.user_code}`),console.log("3. Complete 2FA verification"),console.log(`
+Opening browser...
+`),await this.openBrowser(a.verification_uri_complete);let o=!1,m=a.interval*1e3,l=Math.ceil(a.expires_in/a.interval),h=0;for(;h<l;){await this.sleep(m),h++;let d=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:a.device_code})});if(d.status===202){process.stdout.write(".");continue}if(d.ok){o=!0;break}}if(!o)throw new i("Device authorization timeout",408);console.log(`
+
+Device authorized! Sending 2FA code...`);let u=await fetch(`${this.baseUrl}/api/auth/2fa/send`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:a.device_code,sdk_name:e,machine_id:t.machineId})});if(!u.ok){let d=await u.json().catch(()=>({}));throw new i(d.message||"Failed to send 2FA code",u.status)}console.log(`2FA code sent to your email.
+`);let k=(await import("readline")).createInterface({input:process.stdin,output:process.stdout}),T=await new Promise(d=>{k.question("Enter 2FA code from email: ",g=>{k.close(),d(g)})}),I=await fetch(`${this.baseUrl}/api/auth/2fa/verify`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:a.device_code,code:T.trim()})});if(!I.ok){let d=await I.json().catch(()=>({}));throw new i(d.message||"2FA verification failed",I.status)}let f=await I.json();return O(e,{access_token:f.access_token,refresh_token:null,expires_at:null,user_id:f.user_id,machine_id:t.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
+Authentication successful!`),console.log(`Logged in as: ${f.user_email||f.user_id}`),console.log(`This machine is now permanently authorized.
+`),{success:!0,user:f.user_email||f.user_id}}catch(t){throw t instanceof i?t:new i(t.message||"Login failed",t.status||500)}}async isAuthenticated(){return K()}logout(){A(),console.log("Logged out successfully")}getAccessToken(){let e=L();if(!e)throw new i("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new i("Token expired. Run login() again.",401);return e.access_token}async request(e,t,r){let n=this.getAccessToken(),a={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};r&&(a.body=JSON.stringify(r));let o=await fetch(`${this.baseUrl}${t}`,a);if(!o.ok){let m=await o.json().catch(()=>({}));throw new i(m.message||`Request failed: ${o.statusText}`,o.status,m)}return o.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await import("./env-resolver-Y4SFGOKB.mjs"),r=t(e);return this.importSecrets(r)}};export{S as InvalidTokenError,y as OriginMismatchError,w as RateLimitError,$ as SecretsManagement,_ as SecretsSDK,i as SecretsSDKError,J as deleteSDKCredentials,E as getMachineId,H as hasSDKCredentials,F as loadSecretsConfig,C as readAllCredentials,b as readSDKCredentials,q as resolveEnvInSecret,N as resolveEnvInSecrets,U as resolveEnvString,P as writeAllCredentials,O as writeSDKCredentials};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.4.0",
+	"version": "1.6.0",
 	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
@@ -13,10 +13,13 @@
 		"bin",
 		"secrets.template.json"
 	],
-	"scripts": {
-		"build": "tsc && tsc --project tsconfig.esm.json",
-		"prepublishOnly": "npm run build"
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/carsontkempf/learn.git",
+		"directory": "packages/secrets-sdk"
 	},
+	"homepage": "https://github.com/carsontkempf/learn/tree/main/packages/secrets-sdk",
+	"author": "Carson Kempf",
 	"keywords": [
 		"api",
 		"proxy",
@@ -26,13 +29,17 @@
 		"cli",
 		"secrets-management"
 	],
-	"author": "",
 	"license": "MIT",
 	"dependencies": {
 		"commander": "^12.0.0"
 	},
 	"devDependencies": {
 		"@types/node": "^20.0.0",
+		"tsup": "^8.5.1",
 		"typescript": "^5.0.0"
+	},
+	"scripts": {
+		"build": "tsup src/index.ts --format esm,iife --dts --minify --global-name SecretsSDK && tsup src/cli/index.ts --format esm --dts --out-dir dist/cli --external commander",
+		"prepublishOnly": "npm run build"
 	}
 }

package/dist/cli/commands/init.d.ts

@@ -1,11 +0,0 @@
-export interface InitOptions {
-    origins: string;
-    env?: string;
-    project?: string;
-    baseUrl?: string;
-    yes?: boolean;
-}
-/**
- * Init command - onboard a new site by uploading .env secrets
- */
-export declare function initCommand(options: InitOptions): Promise<void>;

package/dist/cli/commands/init.js

@@ -1,113 +0,0 @@
-import { SecretsManagement } from '../../management.js';
-import { parseEnvFile } from '../utils/env-parser.js';
-import { detectApiKeys, summarizeDetectedSecrets } from '../utils/key-detector.js';
-import { hasValidCredentials } from '../../credentials.js';
-/**
- * Init command - onboard a new site by uploading .env secrets
- */
-export async function initCommand(options) {
-    // Validate authentication
-    if (!hasValidCredentials()) {
-        console.error('Error: Not authenticated. Run "learn-secrets login" first.');
-        process.exit(1);
-    }
-    // Validate required options
-    if (!options.origins) {
-        console.error('Error: --origins is required');
-        console.error('Example: learn-secrets init --origins mysite.com,localhost');
-        process.exit(1);
-    }
-    if (!options.project) {
-        console.error('Error: --project is required');
-        console.error('Example: learn-secrets init --project my-app-id --origins mysite.com');
-        process.exit(1);
-    }
-    // Parse origins
-    const origins = options.origins.split(',').map(o => o.trim()).filter(Boolean);
-    if (origins.length === 0) {
-        console.error('Error: No valid origins provided');
-        process.exit(1);
-    }
-    console.log(`\nOnboarding site for project: ${options.project}`);
-    console.log(`Origins: ${origins.join(', ')}\n`);
-    // Load and detect secrets from .env
-    const envFile = options.env || '.env';
-    let secrets;
-    try {
-        console.log(`Reading ${envFile}...`);
-        const envVars = parseEnvFile(envFile);
-        secrets = detectApiKeys(envVars);
-        if (secrets.length === 0) {
-            console.log('\nNo API keys detected in .env file.');
-            console.log('Make sure your .env contains variables like:');
-            console.log('  OPENAI_API_KEY=sk-...');
-            console.log('  ANTHROPIC_API_KEY=sk-ant-...');
-            process.exit(0);
-        }
-        console.log('\n' + summarizeDetectedSecrets(secrets));
-        console.log('');
-    }
-    catch (error) {
-        console.error(`Error reading ${envFile}:`, error.message);
-        process.exit(1);
-    }
-    // Ask for confirmation unless --yes flag
-    if (!options.yes) {
-        const readline = await import('readline');
-        const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout
-        });
-        const answer = await new Promise((resolve) => {
-            rl.question('Upload these secrets? (y/N): ', resolve);
-        });
-        rl.close();
-        if (answer.toLowerCase() !== 'y' && answer.toLowerCase() !== 'yes') {
-            console.log('Cancelled.');
-            process.exit(0);
-        }
-    }
-    // Upload secrets
-    console.log('\nUploading secrets...');
-    const mgmt = new SecretsManagement({
-        appId: options.project,
-        baseUrl: options.baseUrl
-    });
-    try {
-        const result = await mgmt.importSecrets({
-            version: '1.0',
-            origins,
-            secrets
-        });
-        console.log('\nSuccess!');
-        console.log(`  Created: ${result.results.created} secrets`);
-        console.log(`  Updated: ${result.results.updated} secrets`);
-        if (result.results.failed > 0) {
-            console.log(`  Failed: ${result.results.failed} secrets`);
-            for (const failure of result.results.details.failed) {
-                console.log(`    - ${failure.name}: ${failure.error}`);
-            }
-        }
-        if (result.sdkToken) {
-            console.log('\nSDK Token created:');
-            console.log(`  ${result.sdkToken.token}`);
-            console.log('\n  IMPORTANT: Save this token - it will not be shown again.');
-            console.log('  Add it to your static site code:');
-            console.log('');
-            console.log('    const sdk = new SecretsSDK();');
-            console.log('    // No appId or token needed - uses origin-based auth!');
-        }
-        console.log('\nYour site is ready!');
-        console.log(`Visit: https://ctklearn.carsontkempf.workers.dev to manage secrets`);
-    }
-    catch (error) {
-        console.error('\nUpload failed:', error.message);
-        if (error.status === 401) {
-            console.error('Your session may have expired. Try running "learn-secrets login" again.');
-        }
-        if (error.status === 404) {
-            console.error(`Project "${options.project}" not found. Check your project ID.`);
-        }
-        process.exit(1);
-    }
-}