learn-secrets-sdk 1.6.9 → 1.9.0

package/dist/cli/index.mjs

@@ -362,7 +362,7 @@ Log in on ${this.baseUrl}`);
   /**
    * Make authenticated request
    */
-  async request(method, path2, body) {
+  async request(method, path3, body) {
     const token = this.getAccessToken();
     const options = {
       method,
@@ -374,7 +374,7 @@ Log in on ${this.baseUrl}`);
     if (body) {
       options.body = JSON.stringify(body);
     }
-    const response = await fetch(`${this.baseUrl}${path2}`, options);
+    const response = await fetch(`${this.baseUrl}${path3}`, options);
     if (!response.ok) {
       const errorData = await response.json().catch(() => ({}));
       throw new SecretsSDKError(
@@ -539,7 +539,7 @@ function parseEnvFile(filePath) {
     if (!trimmed || trimmed.startsWith("#")) {
       continue;
     }
-    const match = trimmed.match(/^([A-Z0-9_]+)\s*=\s*(['"]?)(.+?)\2$/i);
+    const match = trimmed.match(/^([A-Z0-9_]+)\s*=\s*(['"]?)(.+)\2\s*$/i);
     if (match) {
       const key = match[1];
       const value = match[3];
@@ -585,45 +585,43 @@ var PROVIDER_PATTERNS = [
     baseUrl: "https://www.googleapis.com",
     authHeader: "Authorization",
     authPrefix: "Bearer "
+  },
+  {
+    pattern: /^AUTH0_.*_SECRET$/i,
+    provider: "auth0",
+    baseUrl: "",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^SPOTIFY_(CLIENT_ID|CLIENT_SECRET|API_KEY)$/i,
+    provider: "spotify",
+    baseUrl: "https://api.spotify.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^APPLE_(KEY_ID|TEAM_ID|P8_KEY)$/i,
+    provider: "apple",
+    baseUrl: "https://api.music.apple.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^LICHESS_KEY$/i,
+    provider: "lichess",
+    baseUrl: "https://lichess.org/api",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
+  },
+  {
+    pattern: /^GITHUB_PAT$/i,
+    provider: "github",
+    baseUrl: "https://api.github.com",
+    authHeader: "Authorization",
+    authPrefix: "Bearer "
   }
 ];
-function isLikelyApiKey(key, value) {
-  const keyPatterns = [
-    /_API_KEY$/i,
-    /_SECRET$/i,
-    /_TOKEN$/i,
-    /^API_KEY_/i,
-    /^SECRET_/i,
-    /^TOKEN_/i
-  ];
-  for (const pattern of keyPatterns) {
-    if (pattern.test(key)) {
-      return true;
-    }
-  }
-  const valuePatterns = [
-    /^sk-[a-zA-Z0-9_-]+$/,
-    // OpenAI, Stripe
-    /^sk-ant-[a-zA-Z0-9_-]+$/,
-    // Anthropic
-    /^ghp_[a-zA-Z0-9]+$/,
-    // GitHub
-    /^ya29\.[a-zA-Z0-9_-]+$/,
-    // Google OAuth
-    /^[a-f0-9]{32}$/,
-    // 32-char hex
-    /^[a-f0-9]{40}$/,
-    // 40-char hex (like GitHub)
-    /^[a-zA-Z0-9_-]{40,}$/
-    // Long random string
-  ];
-  for (const pattern of valuePatterns) {
-    if (pattern.test(value)) {
-      return true;
-    }
-  }
-  return false;
-}
 function detectProvider(key) {
   for (const pattern of PROVIDER_PATTERNS) {
     if (pattern.pattern.test(key)) {
@@ -633,12 +631,12 @@ function detectProvider(key) {
   return null;
 }
 function envKeyToSecretName(key) {
-  return key.toLowerCase().replace(/_api_key$/i, "").replace(/_secret$/i, "").replace(/_token$/i, "").replace(/_key$/i, "").replace(/_/g, "-");
+  return key.toLowerCase().replace(/_/g, "-");
 }
-function detectApiKeys(envVars) {
+function convertAllEnvVarsToSecrets(envVars) {
   const secrets = [];
   for (const { key, value } of envVars) {
-    if (!isLikelyApiKey(key, value)) {
+    if (!value || value.trim() === "") {
       continue;
     }
     const providerInfo = detectProvider(key);
@@ -658,7 +656,6 @@ function detectApiKeys(envVars) {
         provider: "custom",
         api_key: value,
         base_url: "",
-        // User must configure
         auth_header: "Authorization",
         auth_prefix: "Bearer "
       });
@@ -668,16 +665,117 @@ function detectApiKeys(envVars) {
 }
 function summarizeDetectedSecrets(secrets) {
   if (secrets.length === 0) {
-    return "No API keys detected in .env file";
+    return "No secrets found in .env file";
   }
-  const lines = ["Detected API keys:"];
+  const lines = ["Detected secrets:"];
   for (const secret of secrets) {
-    const masked = secret.api_key.substring(0, 8) + "...";
+    const masked = secret.api_key.length > 8 ? secret.api_key.substring(0, 8) + "..." : "***";
     lines.push(`  - ${secret.name} (${secret.provider}): ${masked}`);
   }
   return lines.join("\n");
 }
 
+// src/cli/commands/connect-cloudflare.ts
+function getApiUrl(baseUrl) {
+  return baseUrl || "https://cloudprototype.org";
+}
+async function connectCloudflare(apiToken, baseUrl) {
+  if (!apiToken.match(/^[A-Za-z0-9_-]{40,}$/)) {
+    return {
+      success: false,
+      error: "Invalid API token format. Token should be 40+ alphanumeric characters"
+    };
+  }
+  const validation = await validateCloudflareToken(apiToken);
+  if (!validation.valid) {
+    return {
+      success: false,
+      error: validation.error || "Token validation failed"
+    };
+  }
+  try {
+    const apiUrl = getApiUrl(baseUrl);
+    const response = await fetch(`${apiUrl}/api/cloudflare/connect`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      credentials: "include",
+      body: JSON.stringify({
+        apiToken,
+        accountId: validation.accountId,
+        accountName: validation.accountName
+      })
+    });
+    if (!response.ok) {
+      const error = await response.json();
+      return {
+        success: false,
+        error: error.message || "Failed to store token"
+      };
+    }
+    return {
+      success: true,
+      accountId: validation.accountId,
+      accountName: validation.accountName
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: error.message || "Failed to connect Cloudflare account"
+    };
+  }
+}
+async function validateCloudflareToken(token) {
+  try {
+    const response = await fetch("https://api.cloudflare.com/client/v4/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      }
+    });
+    if (!response.ok) {
+      const error = await response.json();
+      return {
+        valid: false,
+        error: error.errors?.[0]?.message || "Invalid token"
+      };
+    }
+    const data = await response.json();
+    const accountsResponse = await fetch("https://api.cloudflare.com/client/v4/accounts", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      }
+    });
+    if (!accountsResponse.ok) {
+      return {
+        valid: false,
+        error: "Token does not have access to accounts"
+      };
+    }
+    const accountsData = await accountsResponse.json();
+    const accounts = accountsData.result || [];
+    if (accounts.length === 0) {
+      return {
+        valid: false,
+        error: "No accounts found for this token"
+      };
+    }
+    const account = accounts[0];
+    return {
+      valid: true,
+      accountId: account.id,
+      accountName: account.name
+    };
+  } catch (error) {
+    return {
+      valid: false,
+      error: error.message || "Failed to validate token"
+    };
+  }
+}
+
 // src/cli/commands/init.ts
 async function initCommand(options) {
   if (!hasValidCredentials()) {
@@ -720,12 +818,10 @@ Onboarding site for project: ${projectId}`);
   try {
     console.log(`Reading ${envFile}...`);
     const envVars = parseEnvFile(envFile);
-    secrets = detectApiKeys(envVars);
+    secrets = convertAllEnvVarsToSecrets(envVars);
     if (secrets.length === 0) {
-      console.log("\nNo API keys detected in .env file.");
-      console.log("Make sure your .env contains variables like:");
-      console.log("  OPENAI_API_KEY=sk-...");
-      console.log("  ANTHROPIC_API_KEY=sk-ant-...");
+      console.log("\nNo environment variables found in .env file.");
+      console.log("Make sure your .env file is not empty.");
       process.exit(0);
     }
     console.log("\n" + summarizeDetectedSecrets(secrets));
@@ -773,15 +869,67 @@ Onboarding site for project: ${projectId}`);
     console.log("\nAdd to your static site code:");
     console.log("    const sdk = new SecretsSDK();");
     console.log("    // Uses origin-based auth - no token needed!");
+    console.log("\n--- Cloudflare Worker Setup ---");
     const dashboardUrl = options.baseUrl || "https://cloudprototype.org";
+    let cloudflareConnected = false;
+    try {
+      const statusResponse = await fetch(`${dashboardUrl}/api/cloudflare/status`, {
+        credentials: "include"
+      });
+      cloudflareConnected = statusResponse.ok;
+    } catch {
+      cloudflareConnected = false;
+    }
+    if (cloudflareConnected) {
+      console.log("Cloudflare account is already connected.");
+    } else {
+      console.log("To deploy secrets via Cloudflare Worker, we need your Cloudflare API token.");
+      console.log("\nRequired permissions:");
+      console.log("  - Workers Scripts: Edit");
+      console.log("  - Workers Routes: Edit");
+      console.log("  - Account Settings: Read");
+      console.log("\nCreate token at: https://dash.cloudflare.com/profile/api-tokens");
+      const readline = await import("readline");
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const apiToken = await new Promise((resolve2) => {
+        rl.question("\nCloudflare API Token (or press Enter to skip): ", (answer) => {
+          rl.close();
+          resolve2(answer.trim());
+        });
+      });
+      if (apiToken) {
+        console.log("\nValidating token...");
+        const result2 = await connectCloudflare(apiToken, options.baseUrl);
+        if (result2.success) {
+          console.log("Cloudflare account connected");
+          console.log(`  Account: ${result2.accountName}`);
+          cloudflareConnected = true;
+        } else {
+          console.log(`
+Warning: Failed to connect Cloudflare: ${result2.error}`);
+          console.log("You can connect later by running: learn-secrets deploy");
+        }
+      } else {
+        console.log("\nSkipped Cloudflare connection.");
+        console.log("You can connect later when you run: learn-secrets deploy");
+      }
+    }
     console.log(`
 Next steps:`);
     console.log(`  1. Run: learn-secrets deploy`);
-    console.log(`     (Push these secrets to dashboard at ${dashboardUrl}/dashboard/secrets/api_keys)`);
+    if (cloudflareConnected) {
+      console.log(`     (Deploy Worker to Cloudflare with your secrets)`);
+    } else {
+      console.log(`     (Connect Cloudflare and deploy Worker with your secrets)`);
+    }
     console.log(`  2. Visit: ${dashboardUrl}/dashboard to manage secrets`);
     const config = {
       project: projectId,
-      origins
+      origins,
+      env: envFile
     };
     fs3.writeFileSync(configFile, JSON.stringify(config, null, 2));
     console.log(`
@@ -798,212 +946,6 @@ Updated local config: ${configFile}`);
   }
 }
 
-// src/cli/commands/setup.ts
-async function setupCommand(options) {
-  const baseUrl = options.baseUrl || "https://cloudprototype.org";
-  const envFile = options.env || ".env";
-  const projectName = options.projectName || `Project - ${options.origin}`;
-  console.log("\n\u{1F680} Learn Secrets Setup\n");
-  console.log(`Email: ${options.email}`);
-  console.log(`Origin: ${options.origin}`);
-  console.log(`Project: ${projectName}`);
-  console.log(`Env File: ${envFile}
-`);
-  let secrets;
-  try {
-    console.log(`\u{1F4D6} Reading ${envFile}...`);
-    const envVars = parseEnvFile(envFile);
-    secrets = detectApiKeys(envVars);
-    if (secrets.length === 0) {
-      console.log("\n\u26A0\uFE0F  No API keys detected in .env file.");
-      console.log("Make sure your .env contains variables like:");
-      console.log("  OPENAI_API_KEY=sk-...");
-      console.log("  STRIPE_API_KEY=sk_live_...");
-      console.log("  SPOTIFY_CLIENT_ID=abc123...");
-      process.exit(0);
-    }
-    console.log("\n" + summarizeDetectedSecrets(secrets));
-    console.log("");
-  } catch (error) {
-    console.error(`\u274C Error reading ${envFile}:`, error.message);
-    process.exit(1);
-  }
-  if (!options.yes) {
-    const readline = await import("readline");
-    const rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout
-    });
-    const answer = await new Promise((resolve2) => {
-      rl.question("Continue with setup? (y/N): ", resolve2);
-    });
-    rl.close();
-    if (answer.toLowerCase() !== "y" && answer.toLowerCase() !== "yes") {
-      console.log("\u274C Cancelled.");
-      process.exit(0);
-    }
-  }
-  console.log("\n\u{1F510} Authenticating...");
-  let cookies;
-  try {
-    const loginResponse = await fetch(`${baseUrl}/api/login`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        email: options.email,
-        password: options.password
-      })
-    });
-    if (!loginResponse.ok) {
-      const errorData = await loginResponse.json().catch(() => ({}));
-      throw new Error(errorData.error || errorData.message || "Authentication failed");
-    }
-    const setCookieHeader = loginResponse.headers.get("set-cookie");
-    if (!setCookieHeader) {
-      throw new Error("No session cookie received");
-    }
-    const cookieParts = setCookieHeader.split(";")[0];
-    cookies = cookieParts;
-    console.log("\u2705 Authenticated successfully");
-  } catch (error) {
-    console.error(`\u274C Authentication failed: ${error.message}`);
-    console.log("\n\u{1F4A1} Make sure:");
-    console.log("  - Email and password are correct");
-    console.log("  - User account exists in the system");
-    console.log("  - Backend is accessible at", baseUrl);
-    process.exit(1);
-  }
-  console.log("\n\u{1F4E6} Creating project...");
-  let projectAppId;
-  try {
-    const createProjectResponse = await fetch(`${baseUrl}/api/projects`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Cookie": cookies
-      },
-      body: JSON.stringify({
-        name: projectName,
-        description: `Auto-provisioned for ${options.origin}`
-      })
-    });
-    if (!createProjectResponse.ok) {
-      const errorData = await createProjectResponse.json().catch(() => ({}));
-      throw new Error(errorData.message || "Failed to create project");
-    }
-    const projectData = await createProjectResponse.json();
-    projectAppId = projectData.project.appid;
-    console.log(`\u2705 Project created: ${projectAppId}`);
-  } catch (error) {
-    console.error(`\u274C Project creation failed: ${error.message}`);
-    process.exit(1);
-  }
-  console.log("\n\u{1F511} Generating SDK token...");
-  let sdkToken;
-  try {
-    const tokenResponse = await fetch(`${baseUrl}/api/projects/${projectAppId}/sdk-tokens`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Cookie": cookies
-      },
-      body: JSON.stringify({
-        label: `Production - ${options.origin}`,
-        origins: [options.origin],
-        expiresInDays: 365
-      })
-    });
-    if (!tokenResponse.ok) {
-      const errorData = await tokenResponse.json().catch(() => ({}));
-      throw new Error(errorData.message || "Failed to generate SDK token");
-    }
-    const tokenData = await tokenResponse.json();
-    sdkToken = tokenData.token;
-    console.log(`\u2705 SDK token generated`);
-    console.log(`   Token: ${sdkToken.substring(0, 15)}...${sdkToken.slice(-4)}`);
-  } catch (error) {
-    console.error(`\u274C Token generation failed: ${error.message}`);
-    process.exit(1);
-  }
-  console.log("\n\u{1F4E4} Uploading secrets...");
-  try {
-    const importResponse = await fetch(`${baseUrl}/api/projects/${projectAppId}/import-secrets`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Cookie": cookies
-      },
-      body: JSON.stringify({
-        version: "1.0",
-        secrets
-      })
-    });
-    if (!importResponse.ok) {
-      const errorData = await importResponse.json().catch(() => ({}));
-      throw new Error(errorData.message || "Failed to upload secrets");
-    }
-    const result = await importResponse.json();
-    console.log("\u2705 Secrets uploaded:");
-    console.log(`   Created: ${result.results.created}`);
-    console.log(`   Updated: ${result.results.updated}`);
-    if (result.results.failed > 0) {
-      console.log(`   \u26A0\uFE0F  Failed: ${result.results.failed}`);
-      for (const failure of result.results.details.failed) {
-        console.log(`      - ${failure.name}: ${failure.error}`);
-      }
-    }
-  } catch (error) {
-    console.error(`\u274C Upload failed: ${error.message}`);
-  }
-  console.log("\n" + "=".repeat(60));
-  console.log("\u2705 SETUP COMPLETE!");
-  console.log("=".repeat(60));
-  console.log("\nConfiguration:");
-  console.log(`  LEARN_TENANT_URL: ${baseUrl}/api/auth`);
-  console.log(`  LEARN_PROJECT_APPID: ${projectAppId}`);
-  console.log(`  LEARN_SDK_TOKEN: ${sdkToken}`);
-  console.log(`  LEARN_ORIGIN: ${options.origin}`);
-  console.log("\nUsage in your static site:");
-  console.log('  <script src="https://unpkg.com/learn-secrets-sdk/dist/index.global.js"></script>');
-  console.log("  <script>");
-  console.log("    // Zero-config mode - no tokens needed in client code!");
-  console.log("    const sdk = new SecretsSDK.SecretsSDK();");
-  console.log(`    sdk.setAppId('${projectAppId}');`);
-  console.log("    ");
-  console.log("    // Use your secrets");
-  console.log('    const data = await sdk.get("newsapi", "/v2/top-headlines");');
-  console.log("  </script>");
-  console.log("\nManage secrets:");
-  console.log(`  Visit: ${baseUrl}`);
-  console.log(`  Or use CLI: learn-secrets init --project ${projectAppId} --origins ${options.origin}`);
-  console.log("\n" + "=".repeat(60));
-  const configPath = ".env.learn";
-  const configContent = `# Learn Platform Configuration
-# Generated on ${(/* @__PURE__ */ new Date()).toISOString()}
-# DO NOT COMMIT THIS FILE TO GIT
-
-LEARN_TENANT_URL=${baseUrl}/api/auth
-LEARN_PROJECT_APPID=${projectAppId}
-LEARN_SDK_TOKEN=${sdkToken}
-LEARN_ORIGIN=${options.origin}
-
-# Token expires: 365 days
-# Token prefix: ${sdkToken.slice(-4)}
-`;
-  try {
-    const fs6 = await import("fs");
-    fs6.writeFileSync(configPath, configContent, "utf-8");
-    console.log(`
-\u{1F4BE} Configuration saved to: ${configPath}`);
-  } catch (error) {
-    console.error(`
-\u26A0\uFE0F  Could not save configuration file: ${error.message}`);
-  }
-  console.log("\n\u{1F389} Your site is ready to use Learn Secrets!\n");
-}
-
 // src/cli/commands/config.ts
 import fs4 from "fs";
 async function configCommand(options) {
@@ -1014,15 +956,17 @@ async function configCommand(options) {
     process.exit(1);
   }
   const config = JSON.parse(fs4.readFileSync(configFile, "utf8"));
-  if (!options.project && !options.origins) {
+  if (!options.project && !options.origins && !options.env) {
     console.log("\nCurrent configuration:");
     console.log(`  Project ID: ${config.project || "(not set)"}`);
     console.log(`  Origins: ${config.origins?.length > 0 ? config.origins.join(", ") : "(not set)"}`);
+    console.log(`  Env file: ${config.env || ".env (default)"}`);
     console.log(`
 Config file: ${configFile}`);
     console.log("\nTo update:");
     console.log("  learn-secrets config --project <appid>");
     console.log("  learn-secrets config --origins domain1.com,domain2.com");
+    console.log("  learn-secrets config --env .custom_env");
     return;
   }
   let updated = false;
@@ -1036,6 +980,11 @@ Config file: ${configFile}`);
     console.log(`Updated origins: ${config.origins.join(", ")}`);
     updated = true;
   }
+  if (options.env) {
+    config.env = options.env;
+    console.log(`Updated env file path: ${options.env}`);
+    updated = true;
+  }
   if (updated) {
     fs4.writeFileSync(configFile, JSON.stringify(config, null, 2));
     console.log(`
@@ -1045,6 +994,87 @@ Configuration saved to: ${configFile}`);
 
 // src/cli/commands/deploy.ts
 import fs5 from "fs";
+
+// src/cli/commands/provision-worker.ts
+import path2 from "path";
+import { fileURLToPath } from "url";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = path2.dirname(__filename);
+function getApiUrl2(baseUrl) {
+  return baseUrl || "https://cloudprototype.org";
+}
+async function provisionWorker(workerName, origins, envVars, baseUrl) {
+  const publicVars = [];
+  const secretVars = [];
+  for (const { key, value } of envVars) {
+    if (isPublicConfig(key)) {
+      publicVars.push({ key, value });
+    } else {
+      secretVars.push({ key, value });
+    }
+  }
+  try {
+    const apiUrl = getApiUrl2(baseUrl);
+    const deployResponse = await fetch(`${apiUrl}/api/cloudflare/provision-worker`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      credentials: "include",
+      body: JSON.stringify({
+        workerName,
+        allowedOrigins: origins,
+        publicVars: publicVars.map((v) => ({
+          key: `PUBLIC_${v.key}`,
+          value: v.value
+        })),
+        secrets: secretVars.map((v) => ({
+          key: `SECRET_${v.key}`,
+          value: v.value
+        }))
+      })
+    });
+    if (!deployResponse.ok) {
+      const error = await deployResponse.json();
+      return {
+        success: false,
+        error: error.message || "Failed to deploy Worker"
+      };
+    }
+    const result = await deployResponse.json();
+    return {
+      success: true,
+      workerUrl: result.workerUrl,
+      workerName: result.workerName
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: error.message || "Failed to provision Worker"
+    };
+  }
+}
+function isPublicConfig(key) {
+  const publicPatterns = [
+    /_DOMAIN$/,
+    /_CLIENT_ID$/,
+    /_AUDIENCE$/,
+    /_CALLBACK_URL$/,
+    /_ISSUER$/,
+    /_TEAM_ID$/,
+    /_KEY_ID$/,
+    /^API_BASE_URL$/,
+    /^PUBLIC_/
+  ];
+  for (const pattern of publicPatterns) {
+    if (pattern.test(key)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// src/cli/commands/deploy.ts
 async function deployCommand(options = {}) {
   if (!hasValidCredentials()) {
     console.error('Error: Not authenticated. Run "learn-secrets login" first.');
@@ -1071,17 +1101,16 @@ async function deployCommand(options = {}) {
 Deploying secrets to project: ${config.project}`);
   console.log(`Origins: ${config.origins.join(", ")}
 `);
-  const envFile = options.env || ".env";
+  const envFile = options.env || config.env || ".env";
   let secrets;
+  let envVars = [];
   try {
     console.log(`Reading ${envFile}...`);
-    const envVars = parseEnvFile(envFile);
-    secrets = detectApiKeys(envVars);
+    envVars = parseEnvFile(envFile);
+    secrets = convertAllEnvVarsToSecrets(envVars);
     if (secrets.length === 0) {
-      console.log("\nNo API keys detected in .env file.");
-      console.log("Make sure your .env contains variables like:");
-      console.log("  OPENAI_API_KEY=sk-...");
-      console.log("  ANTHROPIC_API_KEY=sk-ant-...");
+      console.log("\nNo environment variables found in .env file.");
+      console.log("Make sure your .env file is not empty.");
       process.exit(0);
     }
     console.log("\n" + summarizeDetectedSecrets(secrets));
@@ -1127,7 +1156,93 @@ Deploying secrets to project: ${config.project}`);
     }
     const dashboardUrl = options.baseUrl || "https://cloudprototype.org";
     console.log(`
-Secrets deployed! View them at: ${dashboardUrl}/dashboard/secrets/api_keys`);
+Secrets deployed! View them at: ${dashboardUrl}/dashboard/collections/secrets`);
+    console.log("\n--- Cloudflare Worker Deployment ---");
+    let cloudflareConnected = false;
+    try {
+      const statusResponse = await fetch(`${dashboardUrl}/api/cloudflare/status`, {
+        credentials: "include"
+      });
+      cloudflareConnected = statusResponse.ok;
+    } catch {
+      cloudflareConnected = false;
+    }
+    if (!cloudflareConnected) {
+      console.log("Cloudflare account not connected.");
+      console.log("\nTo deploy Worker, we need your Cloudflare API token.");
+      console.log("Required permissions:");
+      console.log("  - Workers Scripts: Edit");
+      console.log("  - Workers Routes: Edit");
+      console.log("  - Account Settings: Read");
+      console.log("\nCreate token at: https://dash.cloudflare.com/profile/api-tokens");
+      const readline = await import("readline");
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const apiToken = await new Promise((resolve2) => {
+        rl.question("\nCloudflare API Token (or press Enter to skip): ", (answer) => {
+          rl.close();
+          resolve2(answer.trim());
+        });
+      });
+      if (apiToken) {
+        console.log("\nValidating token...");
+        const result2 = await connectCloudflare(apiToken, options.baseUrl);
+        if (result2.success) {
+          console.log("Cloudflare account connected");
+          console.log(`  Account: ${result2.accountName}`);
+          cloudflareConnected = true;
+        } else {
+          console.log(`
+Error: Failed to connect Cloudflare: ${result2.error}`);
+          console.log("Worker deployment skipped.");
+        }
+      } else {
+        console.log("\nSkipped Cloudflare connection. Worker deployment skipped.");
+      }
+    } else {
+      console.log("Cloudflare account is connected.");
+    }
+    if (cloudflareConnected) {
+      const readline = await import("readline");
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const shouldProvision = await new Promise((resolve2) => {
+        rl.question("\nDeploy/update Worker to Cloudflare? (y/N): ", (answer) => {
+          rl.close();
+          resolve2(answer.trim());
+        });
+      });
+      if (shouldProvision.toLowerCase() === "y" || shouldProvision.toLowerCase() === "yes") {
+        console.log("\nDeploying Worker to Cloudflare...");
+        const workerName = `learn-secrets-${config.project.toLowerCase()}`;
+        const provisionResult = await provisionWorker(
+          workerName,
+          config.origins,
+          envVars,
+          options.baseUrl
+        );
+        if (provisionResult.success) {
+          console.log("\nWorker deployed successfully");
+          console.log(`  Name: ${provisionResult.workerName}`);
+          console.log(`  URL: ${provisionResult.workerUrl}`);
+          config.workerUrl = provisionResult.workerUrl;
+          fs5.writeFileSync(configFile, JSON.stringify(config, null, 2));
+          console.log("\nNext steps:");
+          console.log(`  1. Test Worker: curl ${provisionResult.workerUrl}/health`);
+          console.log(`  2. Update your frontend to use Worker URL`);
+          console.log(`  3. Test origin validation from your site`);
+        } else {
+          console.log(`
+Error: Worker deployment failed: ${provisionResult.error}`);
+        }
+      } else {
+        console.log("\nSkipped Worker deployment.");
+      }
+    }
   } catch (error) {
     console.error("\nDeploy failed:", error.message);
     if (error.status === 401) {
@@ -1142,17 +1257,14 @@ Secrets deployed! View them at: ${dashboardUrl}/dashboard/secrets/api_keys`);
 
 // src/cli/index.ts
 var program = new Command();
-program.name("learn-secrets").description("CLI tool for managing API secrets in static sites").version("1.6.9");
-program.command("setup").description("Complete setup: create project, generate token, upload secrets").requiredOption("-e, --email <email>", "Your Learn account email").requiredOption("-p, --password <password>", "Your Learn account password").requiredOption("-o, --origin <domain>", "Your site origin (e.g., mysite.com)").option("--project-name <name>", 'Project name (default: "Project - <origin>")').option("--env <file>", "Path to .env file (default: .env)", ".env").option("--base-url <url>", "Custom base URL for API").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
-  await setupCommand(options);
-});
+program.name("learn-secrets").description("CLI tool for managing API secrets with Cloudflare Worker deployment").version("1.9.0");
 program.command("login").description("Authenticate with Learn Secrets via browser").option("--base-url <url>", "Custom base URL for API").action(async (options) => {
   await loginCommand(options);
 });
 program.command("init").description("Initialize secrets for a new site").requiredOption("-o, --origins <domains>", "Comma-separated list of allowed origins (e.g., mysite.com,localhost)").option("-p, --project <appid>", "Project app ID (auto-detected from login if not specified)").option("-e, --env <file>", "Path to .env file (default: .env)", ".env").option("--base-url <url>", "Custom base URL for API").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
   await initCommand(options);
 });
-program.command("config").description("View or update project configuration").option("-p, --project <appid>", "Change project ID").option("--origins <origins>", "Comma separated origins").action(async (options) => {
+program.command("config").description("View or update project configuration").option("-p, --project <appid>", "Change project ID").option("--origins <origins>", "Comma separated origins").option("-e, --env <file>", "Path to .env file").action(async (options) => {
   await configCommand(options);
 });
 program.command("deploy").description("Deploy secrets from .env to dashboard").option("-e, --env <file>", "Path to .env file (default: .env)", ".env").option("--base-url <url>", "Custom base URL for API").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {

package/dist/index.d.mts

@@ -18,14 +18,14 @@ interface SecretsSDKOptions {
     timeout?: number;
     retryOn429?: boolean;
 }
-interface ProxyRequest {
+interface ProxyRequest$1 {
     keyName: string;
     endpoint: string;
     method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
     body?: any;
     headers?: Record<string, string>;
 }
-interface ProxyResponse<T = any> {
+interface ProxyResponse$1<T = any> {
     success: boolean;
     status: number;
     data: T;
@@ -157,7 +157,7 @@ declare class SecretsSDK {
      * @param options - Request options (method, body, headers)
      * @returns Promise with the API response
      */
-    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest, 'keyName' | 'endpoint'>): Promise<T>;
+    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest$1, 'keyName' | 'endpoint'>): Promise<T>;
     /**
      * Make a GET request
      */
@@ -367,6 +367,116 @@ declare class SecretsManagement {
     }>;
 }
 
+/**
+ * Worker Client - Frontend SDK for calling Learn Secrets Worker
+ *
+ * Use this client to call your deployed Cloudflare Worker from static sites
+ */
+interface WorkerClientOptions {
+    workerUrl: string;
+}
+interface ProxyRequest {
+    secret: string;
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: any;
+    authHeader?: string;
+    authPrefix?: string;
+}
+interface ProxyResponse<T = any> {
+    success: boolean;
+    status: number;
+    data: T;
+}
+interface PublicConfig {
+    [key: string]: string;
+}
+interface AppleJwtRequest {
+    teamId?: string;
+    keyId?: string;
+    privateKey: string;
+}
+interface OAuthExchangeRequest {
+    provider: string;
+    code: string;
+    redirectUri: string;
+}
+/**
+ * Worker Client for calling Learn Secrets Worker
+ *
+ * SECURITY:
+ * - All requests include Origin header (automatically added by browser)
+ * - Worker validates origin before processing
+ * - Secrets never exposed to frontend
+ * - Only public config returned to frontend
+ *
+ * Example:
+ * ```typescript
+ * const client = new WorkerClient({
+ *   workerUrl: 'https://learn-secrets-myapp.myaccount.workers.dev'
+ * });
+ *
+ * // Get public config
+ * const config = await client.getConfig();
+ *
+ * // Make API call with secret
+ * const response = await client.proxy({
+ *   secret: 'openai-api-key',
+ *   url: 'https://api.openai.com/v1/chat/completions',
+ *   method: 'POST',
+ *   body: { model: 'gpt-4', messages: [...] }
+ * });
+ * ```
+ */
+declare class WorkerClient {
+    private workerUrl;
+    constructor(options: WorkerClientOptions);
+    /**
+     * Get public configuration
+     *
+     * Returns only PUBLIC_* environment variables from Worker
+     * Safe for frontend use
+     */
+    getConfig(): Promise<PublicConfig>;
+    /**
+     * Proxy API request with secret injection
+     *
+     * Makes API call through Worker which injects secret server-side
+     * Secret never reaches browser
+     *
+     * @param request - Proxy request configuration
+     * @returns API response data
+     */
+    proxy<T = any>(request: ProxyRequest): Promise<ProxyResponse<T>>;
+    /**
+     * Generate Apple Music JWT
+     *
+     * Private key stays in Worker, only JWT returned to frontend
+     *
+     * @param request - Apple JWT request with secret name
+     * @returns JWT token
+     */
+    generateAppleJwt(request: AppleJwtRequest): Promise<string>;
+    /**
+     * Exchange OAuth authorization code for access token
+     *
+     * Client secret stays in Worker, tokens returned to frontend
+     *
+     * @param request - OAuth exchange request
+     * @returns OAuth token response
+     */
+    exchangeOAuthCode(request: OAuthExchangeRequest): Promise<any>;
+    /**
+     * Health check
+     */
+    health(): Promise<{
+        status: string;
+        version: string;
+        timestamp: string;
+    }>;
+}
+
 /**
  * Resolve environment variable references in a string
  * Supports ${VAR} and $VAR syntax
@@ -429,4 +539,4 @@ declare function deleteSDKCredentials(sdkName: SDKName): void;
  */
 declare function hasSDKCredentials(sdkName: SDKName): boolean;
 
-export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest, type ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };
+export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest$1 as ProxyRequest, type ProxyResponse$1 as ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, WorkerClient, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };

package/dist/index.d.ts

@@ -18,14 +18,14 @@ interface SecretsSDKOptions {
     timeout?: number;
     retryOn429?: boolean;
 }
-interface ProxyRequest {
+interface ProxyRequest$1 {
     keyName: string;
     endpoint: string;
     method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
     body?: any;
     headers?: Record<string, string>;
 }
-interface ProxyResponse<T = any> {
+interface ProxyResponse$1<T = any> {
     success: boolean;
     status: number;
     data: T;
@@ -157,7 +157,7 @@ declare class SecretsSDK {
      * @param options - Request options (method, body, headers)
      * @returns Promise with the API response
      */
-    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest, 'keyName' | 'endpoint'>): Promise<T>;
+    call<T = any>(keyName: string, endpoint: string, options?: Omit<ProxyRequest$1, 'keyName' | 'endpoint'>): Promise<T>;
     /**
      * Make a GET request
      */
@@ -367,6 +367,116 @@ declare class SecretsManagement {
     }>;
 }
 
+/**
+ * Worker Client - Frontend SDK for calling Learn Secrets Worker
+ *
+ * Use this client to call your deployed Cloudflare Worker from static sites
+ */
+interface WorkerClientOptions {
+    workerUrl: string;
+}
+interface ProxyRequest {
+    secret: string;
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: any;
+    authHeader?: string;
+    authPrefix?: string;
+}
+interface ProxyResponse<T = any> {
+    success: boolean;
+    status: number;
+    data: T;
+}
+interface PublicConfig {
+    [key: string]: string;
+}
+interface AppleJwtRequest {
+    teamId?: string;
+    keyId?: string;
+    privateKey: string;
+}
+interface OAuthExchangeRequest {
+    provider: string;
+    code: string;
+    redirectUri: string;
+}
+/**
+ * Worker Client for calling Learn Secrets Worker
+ *
+ * SECURITY:
+ * - All requests include Origin header (automatically added by browser)
+ * - Worker validates origin before processing
+ * - Secrets never exposed to frontend
+ * - Only public config returned to frontend
+ *
+ * Example:
+ * ```typescript
+ * const client = new WorkerClient({
+ *   workerUrl: 'https://learn-secrets-myapp.myaccount.workers.dev'
+ * });
+ *
+ * // Get public config
+ * const config = await client.getConfig();
+ *
+ * // Make API call with secret
+ * const response = await client.proxy({
+ *   secret: 'openai-api-key',
+ *   url: 'https://api.openai.com/v1/chat/completions',
+ *   method: 'POST',
+ *   body: { model: 'gpt-4', messages: [...] }
+ * });
+ * ```
+ */
+declare class WorkerClient {
+    private workerUrl;
+    constructor(options: WorkerClientOptions);
+    /**
+     * Get public configuration
+     *
+     * Returns only PUBLIC_* environment variables from Worker
+     * Safe for frontend use
+     */
+    getConfig(): Promise<PublicConfig>;
+    /**
+     * Proxy API request with secret injection
+     *
+     * Makes API call through Worker which injects secret server-side
+     * Secret never reaches browser
+     *
+     * @param request - Proxy request configuration
+     * @returns API response data
+     */
+    proxy<T = any>(request: ProxyRequest): Promise<ProxyResponse<T>>;
+    /**
+     * Generate Apple Music JWT
+     *
+     * Private key stays in Worker, only JWT returned to frontend
+     *
+     * @param request - Apple JWT request with secret name
+     * @returns JWT token
+     */
+    generateAppleJwt(request: AppleJwtRequest): Promise<string>;
+    /**
+     * Exchange OAuth authorization code for access token
+     *
+     * Client secret stays in Worker, tokens returned to frontend
+     *
+     * @param request - OAuth exchange request
+     * @returns OAuth token response
+     */
+    exchangeOAuthCode(request: OAuthExchangeRequest): Promise<any>;
+    /**
+     * Health check
+     */
+    health(): Promise<{
+        status: string;
+        version: string;
+        timestamp: string;
+    }>;
+}
+
 /**
  * Resolve environment variable references in a string
  * Supports ${VAR} and $VAR syntax
@@ -429,4 +539,4 @@ declare function deleteSDKCredentials(sdkName: SDKName): void;
  */
 declare function hasSDKCredentials(sdkName: SDKName): boolean;
 
-export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest, type ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };
+export { type CLICredentials, InvalidTokenError, type MachineInfo, type MaskedSecret, OriginMismatchError, type ProxyRequest$1 as ProxyRequest, type ProxyResponse$1 as ProxyResponse, RateLimitError, type RateLimitInfo, type SDKCredentialsStore, type SDKName, type SecretConfig, SecretsManagement, type SecretsManagementOptions, SecretsSDK, SecretsSDKError, type SecretsSDKOptions, type SyncOptions, type SyncResult, WorkerClient, deleteSDKCredentials, getMachineId, hasSDKCredentials, loadSecretsConfig, readAllCredentials, readSDKCredentials, resolveEnvInSecret, resolveEnvInSecrets, resolveEnvString, writeAllCredentials, writeSDKCredentials };

package/dist/index.global.js

@@ -1,10 +1,10 @@
-"use strict";var SecretsSDK=(()=>{var X=Object.create;var _=Object.defineProperty;var Z=Object.getOwnPropertyDescriptor;var Q=Object.getOwnPropertyNames;var Y=Object.getPrototypeOf,ee=Object.prototype.hasOwnProperty;var d=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var te=(t,e)=>()=>(t&&(e=t(t=0)),e);var z=(t,e)=>{for(var r in e)_(t,r,{get:e[r],enumerable:!0})},F=(t,e,r,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Q(e))!ee.call(t,n)&&n!==r&&_(t,n,{get:()=>e[n],enumerable:!(s=Z(e,n))||s.enumerable});return t};var y=(t,e,r)=>(r=t!=null?X(Y(t)):{},F(e||!t||!t.__esModule?_(r,"default",{value:t,enumerable:!0}):r,t)),re=t=>F(_({},"__esModule",{value:!0}),t);var V={};z(V,{loadSecretsConfig:()=>q,resolveEnvInSecret:()=>E,resolveEnvInSecrets:()=>L,resolveEnvString:()=>p});function p(t){return t.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g,(e,r,s)=>{let n=r||s,i=process.env[n];if(i===void 0)throw new Error(`Environment variable ${n} is not defined`);return i})}function E(t){let e={name:p(t.name),provider:p(t.provider),api_key:p(t.api_key)};return t.base_url&&(e.base_url=p(t.base_url)),t.auth_header&&(e.auth_header=p(t.auth_header)),t.auth_prefix&&(e.auth_prefix=p(t.auth_prefix)),e}function L(t){return t.map(E)}function q(t){let e=d("fs"),s=d("path").resolve(t);if(!e.existsSync(s))throw new Error(`Config file not found: ${s}`);let n=e.readFileSync(s,"utf-8"),i=JSON.parse(n);if(!i.version)throw new Error('Config file missing "version" field');if(!i.project)throw new Error('Config file missing "project" field');if(!Array.isArray(i.secrets))throw new Error('Config file missing "secrets" array');let a=L(i.secrets);return{version:i.version,project:i.project,secrets:a}}var N=te(()=>{"use strict"});var ae={};z(ae,{InvalidTokenError:()=>b,OriginMismatchError:()=>S,RateLimitError:()=>x,SecretsManagement:()=>$,SecretsSDK:()=>T,SecretsSDKError:()=>o,deleteSDKCredentials:()=>J,getMachineId:()=>O,hasSDKCredentials:()=>H,loadSecretsConfig:()=>q,readAllCredentials:()=>I,readSDKCredentials:()=>v,resolveEnvInSecret:()=>E,resolveEnvInSecrets:()=>L,resolveEnvString:()=>p,writeAllCredentials:()=>R,writeSDKCredentials:()=>P});var o=class extends Error{constructor(r,s,n){super(r);this.status=s;this.response=n;this.name="SecretsSDKError"}},S=class extends o{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},x=class extends o{constructor(e="Rate limit exceeded",r=60,s=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=r,this.remaining=s,this.limit=n}},b=class extends o{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var T=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let r=e.get("X-RateLimit-Limit"),s=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");r&&s&&n&&(this.rateLimitInfo={limit:parseInt(r),remaining:parseInt(s),reset:parseInt(n)})}sleep(e){return new Promise(r=>setTimeout(r,e))}async fetchWithTimeout(e,r,s){let n=new AbortController,i=setTimeout(()=>n.abort(),s);try{return await fetch(e,{...r,signal:n.signal})}finally{clearTimeout(i)}}async call(e,r,s={}){let n=0,i=this.retryOn429?3:0;for(;;)try{let a=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,m={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(m.Authorization=`Bearer ${this.token}`);let c=await this.fetchWithTimeout(a,{method:"POST",headers:m,body:JSON.stringify({keyName:e,endpoint:r,method:s.method||"GET",body:s.body,headers:s.headers})},this.timeout);this.parseRateLimitHeaders(c.headers);let w=await c.json();if(!c.ok){let h=w.data?.message||w?.message||`Request failed with status ${c.status}`;if(c.status===403&&h.includes("Origin"))throw new S(h);if(c.status===401)throw new b(h);if(c.status===429){let k=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,u=new x(h,k,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<i){n++;let f=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(f);continue}throw u}throw new o(h,c.status,w)}return w.data}catch(a){throw a instanceof o?a:a instanceof Error&&a.name==="AbortError"?new o("Request timeout",408):new o(a instanceof Error?a.message:"Unknown error occurred",500)}}async get(e,r,s){return this.call(e,r,{method:"GET",headers:s})}async post(e,r,s,n){return this.call(e,r,{method:"POST",body:s,headers:n})}async put(e,r,s,n){return this.call(e,r,{method:"PUT",body:s,headers:n})}async delete(e,r,s){return this.call(e,r,{method:"DELETE",headers:s})}async patch(e,r,s,n){return this.call(e,r,{method:"PATCH",body:s,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,r){if(!this.appId)throw new o("App ID required for secrets management. Call setAppId() first.",400);let s=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:r?JSON.stringify(r):void 0},this.timeout);if(!s.ok){let n=await s.json().catch(()=>({}));throw new o(n.message||`Secrets management failed: ${s.statusText}`,s.status,n)}return s.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,r){return this.secretsRequest("sync",{secrets:e,provider:r})}};var l=y(d("fs")),D=y(d("path")),A=y(d("os"));function M(){let t=A.homedir(),e=D.join(t,".learn");return D.join(e,"credentials.json")}function se(){let t=A.homedir(),e=D.join(t,".learn");l.existsSync(e)||l.mkdirSync(e,{recursive:!0,mode:448})}function I(){try{let t=M();if(!l.existsSync(t))return null;let e=l.readFileSync(t,"utf-8"),r=JSON.parse(e);return r.access_token&&!r["learn-secrets-sdk"]&&!r["learn-auth-sdk"]?{"learn-secrets-sdk":r}:r}catch{return null}}function R(t){se();let e=M(),r=JSON.stringify(t,null,2);l.writeFileSync(e,r,{mode:384})}function v(t){let e=I();return e&&e[t]||null}function P(t,e){let r=I()||{};r[t]=e,R(r)}function J(t){let e=I();e&&(delete e[t],Object.keys(e).length===0?K():R(e))}function j(){return v("learn-secrets-sdk")}function K(){try{let t=M();l.existsSync(t)&&l.unlinkSync(t)}catch{}}function H(t){let e=v(t);return e!==null&&!!e.access_token}function W(){let t=j();return t?t.expires_at?new Date(t.expires_at)>new Date:!0:!1}var B=d("child_process"),G=d("util"),U=d("crypto"),g=y(d("os")),C=(0,G.promisify)(B.exec);async function O(){let t=process.platform;try{let e;if(t==="darwin")e=await ne();else if(t==="linux")e=await ie();else if(t==="win32")e=await oe();else throw new Error(`Unsupported platform: ${t}`);let r=(0,U.createHash)("sha256").update(e).digest("hex").substring(0,32),s=JSON.stringify({machineId:r,cpus:g.cpus().length,arch:g.arch(),platform:g.platform(),homedir:g.homedir()}),n=(0,U.createHash)("sha256").update(s).digest("hex");return{machineId:r,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function ne(){try{let{stdout:t}=await C(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await C("hostname"),r=t.trim(),s=e.trim();if(r&&s)return`${r}-${s}`;let{stdout:n}=await C(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function ie(){try{let{stdout:t}=await C("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=t.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function oe(){try{let{stdout:t}=await C("wmic csproduct get uuid"),r=t.split(`
-`).map(s=>s.trim()).find(s=>s&&s!=="UUID");if(r)return r;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var $=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:r}=await import("child_process"),{promisify:s}=await import("util"),n=s(r),i=process.platform;try{i==="darwin"?await n(`open "${e}"`):i==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(a){throw console.error("Failed to open browser:",a),new o("Failed to open browser",500)}}sleep(e){return new Promise(r=>setTimeout(r,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
-`);let r=await O(),s=v(e);if(s&&s.access_token){let u=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:r.machineId,sdk_name:e})});if(u.ok){let f=await u.json();if(f.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${f.user_email||f.user_id}`),{success:!0,user:f.user_email||f.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new o("Failed to generate device code",n.status);let i=await n.json();console.log(`
+"use strict";var SecretsSDK=(()=>{var Z=Object.create;var T=Object.defineProperty;var Q=Object.getOwnPropertyDescriptor;var Y=Object.getOwnPropertyNames;var ee=Object.getPrototypeOf,te=Object.prototype.hasOwnProperty;var l=(r=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(r,{get:(e,t)=>(typeof require<"u"?require:e)[t]}):r)(function(r){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+r+'" is not supported')});var re=(r,e)=>()=>(r&&(e=r(r=0)),e);var z=(r,e)=>{for(var t in e)T(r,t,{get:e[t],enumerable:!0})},F=(r,e,t,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Y(e))!te.call(r,n)&&n!==t&&T(r,n,{get:()=>e[n],enumerable:!(s=Q(e,n))||s.enumerable});return r};var y=(r,e,t)=>(t=r!=null?Z(ee(r)):{},F(e||!r||!r.__esModule?T(t,"default",{value:r,enumerable:!0}):t,r)),se=r=>F(T({},"__esModule",{value:!0}),r);var X={};z(X,{loadSecretsConfig:()=>N,resolveEnvInSecret:()=>E,resolveEnvInSecrets:()=>$,resolveEnvString:()=>p});function p(r){return r.replace(/\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g,(e,t,s)=>{let n=t||s,i=process.env[n];if(i===void 0)throw new Error(`Environment variable ${n} is not defined`);return i})}function E(r){let e={name:p(r.name),provider:p(r.provider),api_key:p(r.api_key)};return r.base_url&&(e.base_url=p(r.base_url)),r.auth_header&&(e.auth_header=p(r.auth_header)),r.auth_prefix&&(e.auth_prefix=p(r.auth_prefix)),e}function $(r){return r.map(E)}function N(r){let e=l("fs"),s=l("path").resolve(r);if(!e.existsSync(s))throw new Error(`Config file not found: ${s}`);let n=e.readFileSync(s,"utf-8"),i=JSON.parse(n);if(!i.version)throw new Error('Config file missing "version" field');if(!i.project)throw new Error('Config file missing "project" field');if(!Array.isArray(i.secrets))throw new Error('Config file missing "secrets" array');let a=$(i.secrets);return{version:i.version,project:i.project,secrets:a}}var J=re(()=>{"use strict"});var ce={};z(ce,{InvalidTokenError:()=>b,OriginMismatchError:()=>S,RateLimitError:()=>x,SecretsManagement:()=>j,SecretsSDK:()=>_,SecretsSDKError:()=>o,WorkerClient:()=>A,deleteSDKCredentials:()=>H,getMachineId:()=>O,hasSDKCredentials:()=>W,loadSecretsConfig:()=>N,readAllCredentials:()=>v,readSDKCredentials:()=>k,resolveEnvInSecret:()=>E,resolveEnvInSecrets:()=>$,resolveEnvString:()=>p,writeAllCredentials:()=>R,writeSDKCredentials:()=>D});var o=class extends Error{constructor(t,s,n){super(t);this.status=s;this.response=n;this.name="SecretsSDKError"}},S=class extends o{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},x=class extends o{constructor(e="Rate limit exceeded",t=60,s=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=s,this.limit=n}},b=class extends o{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var _=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),s=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&s&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(s),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,s){let n=new AbortController,i=setTimeout(()=>n.abort(),s);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(i)}}async call(e,t,s={}){let n=0,i=this.retryOn429?3:0;for(;;)try{let a=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,m={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(m.Authorization=`Bearer ${this.token}`);let c=await this.fetchWithTimeout(a,{method:"POST",headers:m,body:JSON.stringify({keyName:e,endpoint:t,method:s.method||"GET",body:s.body,headers:s.headers})},this.timeout);this.parseRateLimitHeaders(c.headers);let w=await c.json();if(!c.ok){let h=w.data?.message||w?.message||`Request failed with status ${c.status}`;if(c.status===403&&h.includes("Origin"))throw new S(h);if(c.status===401)throw new b(h);if(c.status===429){let I=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,u=new x(h,I,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<i){n++;let f=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(f);continue}throw u}throw new o(h,c.status,w)}return w.data}catch(a){throw a instanceof o?a:a instanceof Error&&a.name==="AbortError"?new o("Request timeout",408):new o(a instanceof Error?a.message:"Unknown error occurred",500)}}async get(e,t,s){return this.call(e,t,{method:"GET",headers:s})}async post(e,t,s,n){return this.call(e,t,{method:"POST",body:s,headers:n})}async put(e,t,s,n){return this.call(e,t,{method:"PUT",body:s,headers:n})}async delete(e,t,s){return this.call(e,t,{method:"DELETE",headers:s})}async patch(e,t,s,n){return this.call(e,t,{method:"PATCH",body:s,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new o("App ID required for secrets management. Call setAppId() first.",400);let s=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!s.ok){let n=await s.json().catch(()=>({}));throw new o(n.message||`Secrets management failed: ${s.statusText}`,s.status,n)}return s.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};var d=y(l("fs")),P=y(l("path")),L=y(l("os"));function U(){let r=L.homedir(),e=P.join(r,".learn");return P.join(e,"credentials.json")}function ne(){let r=L.homedir(),e=P.join(r,".learn");d.existsSync(e)||d.mkdirSync(e,{recursive:!0,mode:448})}function v(){try{let r=U();if(!d.existsSync(r))return null;let e=d.readFileSync(r,"utf-8"),t=JSON.parse(e);return t.access_token&&!t["learn-secrets-sdk"]&&!t["learn-auth-sdk"]?{"learn-secrets-sdk":t}:t}catch{return null}}function R(r){ne();let e=U(),t=JSON.stringify(r,null,2);d.writeFileSync(e,t,{mode:384})}function k(r){let e=v();return e&&e[r]||null}function D(r,e){let t=v()||{};t[r]=e,R(t)}function H(r){let e=v();e&&(delete e[r],Object.keys(e).length===0?K():R(e))}function M(){return k("learn-secrets-sdk")}function K(){try{let r=U();d.existsSync(r)&&d.unlinkSync(r)}catch{}}function W(r){let e=k(r);return e!==null&&!!e.access_token}function G(){let r=M();return r?r.expires_at?new Date(r.expires_at)>new Date:!0:!1}var B=l("child_process"),V=l("util"),q=l("crypto"),g=y(l("os")),C=(0,V.promisify)(B.exec);async function O(){let r=process.platform;try{let e;if(r==="darwin")e=await ie();else if(r==="linux")e=await oe();else if(r==="win32")e=await ae();else throw new Error(`Unsupported platform: ${r}`);let t=(0,q.createHash)("sha256").update(e).digest("hex").substring(0,32),s=JSON.stringify({machineId:t,cpus:g.cpus().length,arch:g.arch(),platform:g.platform(),homedir:g.homedir()}),n=(0,q.createHash)("sha256").update(s).digest("hex");return{machineId:t,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function ie(){try{let{stdout:r}=await C(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await C("hostname"),t=r.trim(),s=e.trim();if(t&&s)return`${t}-${s}`;let{stdout:n}=await C(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function oe(){try{let{stdout:r}=await C("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=r.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function ae(){try{let{stdout:r}=await C("wmic csproduct get uuid"),t=r.split(`
+`).map(s=>s.trim()).find(s=>s&&s!=="UUID");if(t)return t;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var j=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:s}=await import("util"),n=s(t),i=process.platform;try{i==="darwin"?await n(`open "${e}"`):i==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(a){throw console.error("Failed to open browser:",a),new o("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
+`);let t=await O(),s=k(e);if(s&&s.access_token){let u=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:t.machineId,sdk_name:e})});if(u.ok){let f=await u.json();if(f.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${f.user_email||f.user_id}`),{success:!0,user:f.user_email||f.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new o("Failed to generate device code",n.status);let i=await n.json();console.log(`
 Log in on ${this.baseUrl}`),console.log("Login at:"),console.log(i.verification_uri_complete),console.log(`
 Press ENTER to open in the browser...`);let m=(await import("readline")).createInterface({input:process.stdin,output:process.stdout});await new Promise(u=>{m.question("",()=>{m.close(),u()})}),console.log(`Opening browser...
-`),await this.openBrowser(i.verification_uri_complete);let c=null,w=i.interval*1e3,h=Math.ceil(i.expires_in/i.interval),k=0;for(;k<h;){await this.sleep(w),k++;let u=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:i.device_code})});if(u.status===202){process.stdout.write(".");continue}if(u.ok){c=await u.json();break}}if(!c)throw new o("Device authorization timeout",408);return console.log(`
+`),await this.openBrowser(i.verification_uri_complete);let c=null,w=i.interval*1e3,h=Math.ceil(i.expires_in/i.interval),I=0;for(;I<h;){await this.sleep(w),I++;let u=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:i.device_code})});if(u.status===202){process.stdout.write(".");continue}if(u.ok){c=await u.json();break}}if(!c)throw new o("Device authorization timeout",408);return console.log(`
 
-Device authorized! Retrieving access token...`),P(e,{access_token:c.access_token,refresh_token:null,expires_at:null,user_id:c.user_id,machine_id:r.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
+Device authorized! Retrieving access token...`),D(e,{access_token:c.access_token,refresh_token:null,expires_at:null,user_id:c.user_id,machine_id:t.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
 Authentication successful!`),console.log(`Logged in as: ${c.user_email||c.user_id}`),console.log(`This machine is now permanently authorized.
-`),{success:!0,user:c.user_email||c.user_id}}catch(r){throw r instanceof o?r:new o(r.message||"Login failed",r.status||500)}}async isAuthenticated(){return W()}logout(){K(),console.log("Logged out successfully")}getAccessToken(){let e=j();if(!e)throw new o("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new o("Token expired. Run login() again.",401);return e.access_token}async request(e,r,s){let n=this.getAccessToken(),i={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};s&&(i.body=JSON.stringify(s));let a=await fetch(`${this.baseUrl}${r}`,i);if(!a.ok){let m=await a.json().catch(()=>({}));throw new o(m.message||`Request failed: ${a.statusText}`,a.status,m)}return a.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,r){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:r?.deleteMissing??!1,dryRun:r?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:r}=await Promise.resolve().then(()=>(N(),V)),s=r(e);return this.importSecrets(s)}};N();return re(ae);})();
+`),{success:!0,user:c.user_email||c.user_id}}catch(t){throw t instanceof o?t:new o(t.message||"Login failed",t.status||500)}}async isAuthenticated(){return G()}logout(){K(),console.log("Logged out successfully")}getAccessToken(){let e=M();if(!e)throw new o("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new o("Token expired. Run login() again.",401);return e.access_token}async request(e,t,s){let n=this.getAccessToken(),i={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};s&&(i.body=JSON.stringify(s));let a=await fetch(`${this.baseUrl}${t}`,i);if(!a.ok){let m=await a.json().catch(()=>({}));throw new o(m.message||`Request failed: ${a.statusText}`,a.status,m)}return a.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await Promise.resolve().then(()=>(J(),X)),s=t(e);return this.importSecrets(s)}};var A=class{constructor(e){this.workerUrl=e.workerUrl.replace(/\/$/,"")}async getConfig(){let e=await fetch(`${this.workerUrl}/config`,{method:"GET",credentials:"include"});if(!e.ok)throw new Error(`Failed to get config: ${e.status} ${e.statusText}`);return(await e.json()).public||{}}async proxy(e){let t=await fetch(`${this.workerUrl}/proxy`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let s=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(s.error||`Proxy request failed: ${t.status}`)}return t.json()}async generateAppleJwt(e){let t=await fetch(`${this.workerUrl}/auth/apple-jwt`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let n=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(n.error||`Apple JWT generation failed: ${t.status}`)}return(await t.json()).token}async exchangeOAuthCode(e){let t=await fetch(`${this.workerUrl}/auth/oauth`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let s=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(s.error||`OAuth exchange failed: ${t.status}`)}return t.json()}async health(){let e=await fetch(`${this.workerUrl}/health`,{method:"GET"});if(!e.ok)throw new Error(`Health check failed: ${e.status}`);return e.json()}};J();return se(ce);})();

package/dist/index.mjs

@@ -1,10 +1,10 @@
-import{a as K,b as $,c as A,d as U}from"./chunk-AS6G7JYX.mjs";var i=class extends Error{constructor(t,r,n){super(t);this.status=r;this.response=n;this.name="SecretsSDKError"}},f=class extends i{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},y=class extends i{constructor(e="Rate limit exceeded",t=60,r=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=n}},w=class extends i{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var v=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&r&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let n=new AbortController,c=setTimeout(()=>n.abort(),r);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(c)}}async call(e,t,r={}){let n=0,c=this.retryOn429?3:0;for(;;)try{let o=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,u={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(u.Authorization=`Bearer ${this.token}`);let a=await this.fetchWithTimeout(o,{method:"POST",headers:u,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(a.headers);let h=await a.json();if(!a.ok){let m=h.data?.message||h?.message||`Request failed with status ${a.status}`;if(a.status===403&&m.includes("Origin"))throw new f(m);if(a.status===401)throw new w(m);if(a.status===429){let x=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,l=new y(m,x,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<c){n++;let g=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(g);continue}throw l}throw new i(m,a.status,h)}return h.data}catch(o){throw o instanceof i?o:o instanceof Error&&o.name==="AbortError"?new i("Request timeout",408):new i(o instanceof Error?o.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,n){return this.call(e,t,{method:"POST",body:r,headers:n})}async put(e,t,r,n){return this.call(e,t,{method:"PUT",body:r,headers:n})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,n){return this.call(e,t,{method:"PATCH",body:r,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new i("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let n=await r.json().catch(()=>({}));throw new i(n.message||`Secrets management failed: ${r.statusText}`,r.status,n)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};import*as d from"fs";import*as I from"path";import*as C from"os";function T(){let s=C.homedir(),e=I.join(s,".learn");return I.join(e,"credentials.json")}function j(){let s=C.homedir(),e=I.join(s,".learn");d.existsSync(e)||d.mkdirSync(e,{recursive:!0,mode:448})}function k(){try{let s=T();if(!d.existsSync(s))return null;let e=d.readFileSync(s,"utf-8"),t=JSON.parse(e);return t.access_token&&!t["learn-secrets-sdk"]&&!t["learn-auth-sdk"]?{"learn-secrets-sdk":t}:t}catch{return null}}function _(s){j();let e=T(),t=JSON.stringify(s,null,2);d.writeFileSync(e,t,{mode:384})}function S(s){let e=k();return e&&e[s]||null}function D(s,e){let t=k()||{};t[s]=e,_(t)}function q(s){let e=k();e&&(delete e[s],Object.keys(e).length===0?P():_(e))}function R(){return S("learn-secrets-sdk")}function P(){try{let s=T();d.existsSync(s)&&d.unlinkSync(s)}catch{}}function N(s){let e=S(s);return e!==null&&!!e.access_token}function E(){let s=R();return s?s.expires_at?new Date(s.expires_at)>new Date:!0:!1}import{exec as z}from"child_process";import{promisify as F}from"util";import{createHash as M}from"crypto";import*as p from"os";var b=F(z);async function O(){let s=process.platform;try{let e;if(s==="darwin")e=await J();else if(s==="linux")e=await H();else if(s==="win32")e=await W();else throw new Error(`Unsupported platform: ${s}`);let t=M("sha256").update(e).digest("hex").substring(0,32),r=JSON.stringify({machineId:t,cpus:p.cpus().length,arch:p.arch(),platform:p.platform(),homedir:p.homedir()}),n=M("sha256").update(r).digest("hex");return{machineId:t,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function J(){try{let{stdout:s}=await b(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await b("hostname"),t=s.trim(),r=e.trim();if(t&&r)return`${t}-${r}`;let{stdout:n}=await b(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function H(){try{let{stdout:s}=await b("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=s.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function W(){try{let{stdout:s}=await b("wmic csproduct get uuid"),t=s.split(`
-`).map(r=>r.trim()).find(r=>r&&r!=="UUID");if(t)return t;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var L=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:r}=await import("util"),n=r(t),c=process.platform;try{c==="darwin"?await n(`open "${e}"`):c==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(o){throw console.error("Failed to open browser:",o),new i("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
+import{a as j,b as A,c as M,d as K}from"./chunk-AS6G7JYX.mjs";var i=class extends Error{constructor(t,r,n){super(t);this.status=r;this.response=n;this.name="SecretsSDKError"}},f=class extends i{constructor(e="Origin not allowed for this token"){super(e,403),this.name="OriginMismatchError"}},y=class extends i{constructor(e="Rate limit exceeded",t=60,r=0,n=100){super(e,429),this.name="RateLimitError",this.retryAfter=t,this.remaining=r,this.limit=n}},w=class extends i{constructor(e="Invalid or expired token"){super(e,401),this.name="InvalidTokenError"}};var T=class{constructor(e={}){this.rateLimitInfo=null;this.appId=e.appId||null,this.token=e.token||e.sessionToken||null,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4,this.retryOn429=e.retryOn429!==void 0?e.retryOn429:!0,this.zeroConfigMode=!this.appId&&!this.token}getUsage(){return this.rateLimitInfo}parseRateLimitHeaders(e){let t=e.get("X-RateLimit-Limit"),r=e.get("X-RateLimit-Remaining"),n=e.get("X-RateLimit-Reset");t&&r&&n&&(this.rateLimitInfo={limit:parseInt(t),remaining:parseInt(r),reset:parseInt(n)})}sleep(e){return new Promise(t=>setTimeout(t,e))}async fetchWithTimeout(e,t,r){let n=new AbortController,c=setTimeout(()=>n.abort(),r);try{return await fetch(e,{...t,signal:n.signal})}finally{clearTimeout(c)}}async call(e,t,r={}){let n=0,c=this.retryOn429?3:0;for(;;)try{let o=this.zeroConfigMode?`${this.baseUrl}/api/sdk/proxy`:`${this.baseUrl}/api/sdk/${this.appId}/proxy`,u={"Content-Type":"application/json"};!this.zeroConfigMode&&this.token&&(u.Authorization=`Bearer ${this.token}`);let a=await this.fetchWithTimeout(o,{method:"POST",headers:u,body:JSON.stringify({keyName:e,endpoint:t,method:r.method||"GET",body:r.body,headers:r.headers})},this.timeout);this.parseRateLimitHeaders(a.headers);let h=await a.json();if(!a.ok){let m=h.data?.message||h?.message||`Request failed with status ${a.status}`;if(a.status===403&&m.includes("Origin"))throw new f(m);if(a.status===401)throw new w(m);if(a.status===429){let b=this.rateLimitInfo?this.rateLimitInfo.reset-Math.floor(Date.now()/1e3):60,l=new y(m,b,this.rateLimitInfo?.remaining||0,this.rateLimitInfo?.limit||100);if(this.retryOn429&&n<c){n++;let g=Math.min(1e3*Math.pow(2,n-1),8e3);await this.sleep(g);continue}throw l}throw new i(m,a.status,h)}return h.data}catch(o){throw o instanceof i?o:o instanceof Error&&o.name==="AbortError"?new i("Request timeout",408):new i(o instanceof Error?o.message:"Unknown error occurred",500)}}async get(e,t,r){return this.call(e,t,{method:"GET",headers:r})}async post(e,t,r,n){return this.call(e,t,{method:"POST",body:r,headers:n})}async put(e,t,r,n){return this.call(e,t,{method:"PUT",body:r,headers:n})}async delete(e,t,r){return this.call(e,t,{method:"DELETE",headers:r})}async patch(e,t,r,n){return this.call(e,t,{method:"PATCH",body:r,headers:n})}setAppId(e){this.appId=e}async secretsRequest(e,t){if(!this.appId)throw new i("App ID required for secrets management. Call setAppId() first.",400);let r=await this.fetchWithTimeout(`${this.baseUrl}/api/projects/${this.appId}/secrets/manage?action=${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:t?JSON.stringify(t):void 0},this.timeout);if(!r.ok){let n=await r.json().catch(()=>({}));throw new i(n.message||`Secrets management failed: ${r.statusText}`,r.status,n)}return r.json()}async listSecrets(){return this.secretsRequest("list")}async createSecret(e){return this.secretsRequest("create",e)}async updateSecret(e){return this.secretsRequest("update",e)}async deleteSecret(e){return this.secretsRequest("delete",{name:e})}async syncEnv(e,t){return this.secretsRequest("sync",{secrets:e,provider:t})}};import*as d from"fs";import*as k from"path";import*as C from"os";function v(){let s=C.homedir(),e=k.join(s,".learn");return k.join(e,"credentials.json")}function q(){let s=C.homedir(),e=k.join(s,".learn");d.existsSync(e)||d.mkdirSync(e,{recursive:!0,mode:448})}function I(){try{let s=v();if(!d.existsSync(s))return null;let e=d.readFileSync(s,"utf-8"),t=JSON.parse(e);return t.access_token&&!t["learn-secrets-sdk"]&&!t["learn-auth-sdk"]?{"learn-secrets-sdk":t}:t}catch{return null}}function P(s){q();let e=v(),t=JSON.stringify(s,null,2);d.writeFileSync(e,t,{mode:384})}function S(s){let e=I();return e&&e[s]||null}function R(s,e){let t=I()||{};t[s]=e,P(t)}function N(s){let e=I();e&&(delete e[s],Object.keys(e).length===0?D():P(e))}function _(){return S("learn-secrets-sdk")}function D(){try{let s=v();d.existsSync(s)&&d.unlinkSync(s)}catch{}}function J(s){let e=S(s);return e!==null&&!!e.access_token}function L(){let s=_();return s?s.expires_at?new Date(s.expires_at)>new Date:!0:!1}import{exec as z}from"child_process";import{promisify as F}from"util";import{createHash as U}from"crypto";import*as p from"os";var x=F(z);async function O(){let s=process.platform;try{let e;if(s==="darwin")e=await H();else if(s==="linux")e=await W();else if(s==="win32")e=await G();else throw new Error(`Unsupported platform: ${s}`);let t=U("sha256").update(e).digest("hex").substring(0,32),r=JSON.stringify({machineId:t,cpus:p.cpus().length,arch:p.arch(),platform:p.platform(),homedir:p.homedir()}),n=U("sha256").update(r).digest("hex");return{machineId:t,fingerprint:n}}catch(e){throw new Error(`Failed to get machine ID: ${e.message}`)}}async function H(){try{let{stdout:s}=await x(`ioreg -l | grep IOPlatformSerialNumber | awk '{print $4}' | sed 's/"//g'`),{stdout:e}=await x("hostname"),t=s.trim(),r=e.trim();if(t&&r)return`${t}-${r}`;let{stdout:n}=await x(`ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID | awk '{print $3}' | sed 's/"//g'`);return n.trim()}catch{throw new Error("Failed to get macOS machine ID")}}async function W(){try{let{stdout:s}=await x("cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null"),e=s.trim();if(e)return e;throw new Error("Machine ID file not found")}catch{throw new Error("Failed to get Linux machine ID")}}async function G(){try{let{stdout:s}=await x("wmic csproduct get uuid"),t=s.split(`
+`).map(r=>r.trim()).find(r=>r&&r!=="UUID");if(t)return t;throw new Error("Failed to parse machine UUID from WMIC")}catch{throw new Error("Failed to get Windows machine ID")}}var E=class{constructor(e){this.appId=e.appId,this.baseUrl=e.baseUrl||"https://cloudprototype.org",this.timeout=e.timeout||3e4}async openBrowser(e){let{exec:t}=await import("child_process"),{promisify:r}=await import("util"),n=r(t),c=process.platform;try{c==="darwin"?await n(`open "${e}"`):c==="win32"?await n(`start "${e}"`):await n(`xdg-open "${e}"`)}catch(o){throw console.error("Failed to open browser:",o),new i("Failed to open browser",500)}}sleep(e){return new Promise(t=>setTimeout(t,e))}async login(){let e="learn-secrets-sdk";try{console.log(`Authenticating with Learn (${e})...
 `);let t=await O(),r=S(e);if(r&&r.access_token){let l=await fetch(`${this.baseUrl}/api/auth/cli/check-authorization`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({machine_id:t.machineId,sdk_name:e})});if(l.ok){let g=await l.json();if(g.authorized)return console.log("This machine is already authorized."),console.log(`Logged in as: ${g.user_email||g.user_id}`),{success:!0,user:g.user_email||g.user_id}}}let n=await fetch(`${this.baseUrl}/api/auth/cli/device`,{method:"POST",headers:{"Content-Type":"application/json"}});if(!n.ok)throw new i("Failed to generate device code",n.status);let c=await n.json();console.log(`
 Log in on ${this.baseUrl}`),console.log("Login at:"),console.log(c.verification_uri_complete),console.log(`
 Press ENTER to open in the browser...`);let u=(await import("readline")).createInterface({input:process.stdin,output:process.stdout});await new Promise(l=>{u.question("",()=>{u.close(),l()})}),console.log(`Opening browser...
-`),await this.openBrowser(c.verification_uri_complete);let a=null,h=c.interval*1e3,m=Math.ceil(c.expires_in/c.interval),x=0;for(;x<m;){await this.sleep(h),x++;let l=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:c.device_code})});if(l.status===202){process.stdout.write(".");continue}if(l.ok){a=await l.json();break}}if(!a)throw new i("Device authorization timeout",408);return console.log(`
+`),await this.openBrowser(c.verification_uri_complete);let a=null,h=c.interval*1e3,m=Math.ceil(c.expires_in/c.interval),b=0;for(;b<m;){await this.sleep(h),b++;let l=await fetch(`${this.baseUrl}/api/auth/cli/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device_code:c.device_code})});if(l.status===202){process.stdout.write(".");continue}if(l.ok){a=await l.json();break}}if(!a)throw new i("Device authorization timeout",408);return console.log(`
 
-Device authorized! Retrieving access token...`),D(e,{access_token:a.access_token,refresh_token:null,expires_at:null,user_id:a.user_id,machine_id:t.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
+Device authorized! Retrieving access token...`),R(e,{access_token:a.access_token,refresh_token:null,expires_at:null,user_id:a.user_id,machine_id:t.machineId,sdk_name:e,authorized_at:new Date().toISOString()}),console.log(`
 Authentication successful!`),console.log(`Logged in as: ${a.user_email||a.user_id}`),console.log(`This machine is now permanently authorized.
-`),{success:!0,user:a.user_email||a.user_id}}catch(t){throw t instanceof i?t:new i(t.message||"Login failed",t.status||500)}}async isAuthenticated(){return E()}logout(){P(),console.log("Logged out successfully")}getAccessToken(){let e=R();if(!e)throw new i("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new i("Token expired. Run login() again.",401);return e.access_token}async request(e,t,r){let n=this.getAccessToken(),c={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};r&&(c.body=JSON.stringify(r));let o=await fetch(`${this.baseUrl}${t}`,c);if(!o.ok){let u=await o.json().catch(()=>({}));throw new i(u.message||`Request failed: ${o.statusText}`,o.status,u)}return o.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await import("./env-resolver-Y4SFGOKB.mjs"),r=t(e);return this.importSecrets(r)}};export{w as InvalidTokenError,f as OriginMismatchError,y as RateLimitError,L as SecretsManagement,v as SecretsSDK,i as SecretsSDKError,q as deleteSDKCredentials,O as getMachineId,N as hasSDKCredentials,U as loadSecretsConfig,k as readAllCredentials,S as readSDKCredentials,$ as resolveEnvInSecret,A as resolveEnvInSecrets,K as resolveEnvString,_ as writeAllCredentials,D as writeSDKCredentials};
+`),{success:!0,user:a.user_email||a.user_id}}catch(t){throw t instanceof i?t:new i(t.message||"Login failed",t.status||500)}}async isAuthenticated(){return L()}logout(){D(),console.log("Logged out successfully")}getAccessToken(){let e=_();if(!e)throw new i("Not authenticated. Run login() first.",401);if(e.expires_at&&new Date(e.expires_at)<=new Date)throw new i("Token expired. Run login() again.",401);return e.access_token}async request(e,t,r){let n=this.getAccessToken(),c={method:e,headers:{"Content-Type":"application/json",Authorization:`Bearer ${n}`}};r&&(c.body=JSON.stringify(r));let o=await fetch(`${this.baseUrl}${t}`,c);if(!o.ok){let u=await o.json().catch(()=>({}));throw new i(u.message||`Request failed: ${o.statusText}`,o.status,u)}return o.json()}async list(){return(await this.request("GET",`/api/projects/${this.appId}/secrets`)).secrets}async sync(e,t){return await this.request("POST",`/api/projects/${this.appId}/secrets/sync`,{secrets:e,options:{deleteMissing:t?.deleteMissing??!1,dryRun:t?.dryRun??!1}})}async importSecrets(e){return this.request("POST",`/api/projects/${this.appId}/import-secrets`,{version:e.version||"1.0",origins:e.origins,secrets:e.secrets})}async importFromFile(e){let{loadSecretsConfig:t}=await import("./env-resolver-Y4SFGOKB.mjs"),r=t(e);return this.importSecrets(r)}};var $=class{constructor(e){this.workerUrl=e.workerUrl.replace(/\/$/,"")}async getConfig(){let e=await fetch(`${this.workerUrl}/config`,{method:"GET",credentials:"include"});if(!e.ok)throw new Error(`Failed to get config: ${e.status} ${e.statusText}`);return(await e.json()).public||{}}async proxy(e){let t=await fetch(`${this.workerUrl}/proxy`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let r=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(r.error||`Proxy request failed: ${t.status}`)}return t.json()}async generateAppleJwt(e){let t=await fetch(`${this.workerUrl}/auth/apple-jwt`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let n=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(n.error||`Apple JWT generation failed: ${t.status}`)}return(await t.json()).token}async exchangeOAuthCode(e){let t=await fetch(`${this.workerUrl}/auth/oauth`,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify(e)});if(!t.ok){let r=await t.json().catch(()=>({error:"Unknown error"}));throw new Error(r.error||`OAuth exchange failed: ${t.status}`)}return t.json()}async health(){let e=await fetch(`${this.workerUrl}/health`,{method:"GET"});if(!e.ok)throw new Error(`Health check failed: ${e.status}`);return e.json()}};export{w as InvalidTokenError,f as OriginMismatchError,y as RateLimitError,E as SecretsManagement,T as SecretsSDK,i as SecretsSDKError,$ as WorkerClient,N as deleteSDKCredentials,O as getMachineId,J as hasSDKCredentials,K as loadSecretsConfig,I as readAllCredentials,S as readSDKCredentials,A as resolveEnvInSecret,M as resolveEnvInSecrets,j as resolveEnvString,P as writeAllCredentials,R as writeSDKCredentials};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "learn-secrets-sdk",
-	"version": "1.6.9",
-	"description": "Secure API proxy SDK for static sites with domain-scoped tokens",
+	"version": "1.9.0",
+	"description": "Secure API proxy SDK with Cloudflare Worker deployment for static sites",
 	"main": "dist/index.js",
 	"module": "dist/index.esm.js",
 	"types": "dist/index.d.ts",