sanctum-sdk 0.1.0

package/dist/approvals.d.ts

@@ -0,0 +1,97 @@
+import type { MrSecretClient, QueryValue } from './client.js';
+export type ApprovalStatus = 'pending' | 'approved' | 'rejected';
+export type ApprovalAction = 'write' | 'delete';
+export interface ApprovalRequester {
+    id: string;
+    email: string;
+}
+export interface SecretApproval {
+    id: string;
+    status: ApprovalStatus;
+    projectId: string;
+    environmentId: string;
+    folderId?: string | null;
+    secretId?: string | null;
+    fileSecretId?: string | null;
+    proposedKey?: string | null;
+    action: ApprovalAction;
+    requestedBy: string;
+    requester?: ApprovalRequester;
+    reviewedBy?: string | null;
+    comment?: string | null;
+    createdAt: string;
+    updatedAt: string;
+    votes?: {
+        user: ApprovalRequester;
+    }[];
+    _count?: {
+        votes: number;
+    };
+}
+export interface ApprovalVote {
+    user: ApprovalRequester;
+}
+export interface ApprovalDetail extends SecretApproval {
+    reviewer?: ApprovalRequester | null;
+    votes: ApprovalVote[];
+}
+export interface CreateSecretApprovalInput {
+    environmentId: string;
+    folderId?: string;
+    secretId?: string;
+    action: ApprovalAction;
+    key?: string;
+    value?: string;
+    comment?: string;
+}
+export interface CreateFileApprovalInput {
+    environmentId: string;
+    folderId?: string;
+    fileSecretId?: string;
+    action: ApprovalAction;
+    key?: string;
+    file?: Blob | Buffer | Uint8Array | string;
+    filename?: string;
+    contentType?: string;
+    comment?: string;
+}
+export type CreateApprovalInput = CreateSecretApprovalInput | CreateFileApprovalInput;
+export interface ApproveOutput {
+    id: string;
+    status: ApprovalStatus;
+    votes?: number;
+    minApprovals?: number;
+}
+export interface RejectOutput {
+    id: string;
+    status: ApprovalStatus;
+}
+export interface ApprovalPolicy {
+    id: string;
+    environmentId: string;
+    minApprovals: number;
+    requireForReads: boolean;
+    requireForWrites: boolean;
+    requireForDeletes: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SetApprovalPolicyInput {
+    minApprovals?: number;
+    requireForReads?: boolean;
+    requireForWrites?: boolean;
+    requireForDeletes?: boolean;
+}
+export interface ListApprovalsOptions extends Record<string, QueryValue> {
+    status?: 'pending' | 'approved' | 'rejected';
+}
+export interface ApprovalsApi {
+    listApprovals(projectId: string, options?: ListApprovalsOptions): Promise<SecretApproval[]>;
+    createApproval(projectId: string, input: CreateApprovalInput): Promise<SecretApproval>;
+    getApproval(projectId: string, id: string): Promise<ApprovalDetail>;
+    approve(projectId: string, id: string): Promise<ApproveOutput>;
+    reject(projectId: string, id: string): Promise<RejectOutput>;
+    getApprovalPolicy(projectId: string, envId: string): Promise<ApprovalPolicy>;
+    setApprovalPolicy(projectId: string, envId: string, input: SetApprovalPolicyInput): Promise<ApprovalPolicy>;
+}
+export declare const createApprovals: (client: MrSecretClient) => ApprovalsApi;

package/dist/approvals.js

@@ -0,0 +1,38 @@
+const toBlob = (value, contentType) => {
+    if (value instanceof Blob)
+        return value;
+    return new Blob([value], { type: contentType ?? 'application/octet-stream' });
+};
+const buildApprovalBody = (input) => {
+    if ('file' in input) {
+        const form = new FormData();
+        if (input.file !== undefined) {
+            const filename = input.filename ?? input.key ?? 'file';
+            form.append('file', toBlob(input.file, input.contentType), filename);
+        }
+        form.append('environmentId', input.environmentId);
+        form.append('action', input.action);
+        if (input.folderId)
+            form.append('folderId', input.folderId);
+        if (input.fileSecretId)
+            form.append('fileSecretId', input.fileSecretId);
+        if (input.key)
+            form.append('key', input.key);
+        if (input.comment)
+            form.append('comment', input.comment);
+        return form;
+    }
+    return input;
+};
+export const createApprovals = (client) => ({
+    listApprovals: (projectId, options) => client.get(`/api/v1/projects/${projectId}/approvals`, { query: options }),
+    createApproval: (projectId, input) => {
+        const body = buildApprovalBody(input);
+        return client.post(`/api/v1/projects/${projectId}/approvals`, body);
+    },
+    getApproval: (projectId, id) => client.get(`/api/v1/projects/${projectId}/approvals/${id}`),
+    approve: (projectId, id) => client.post(`/api/v1/projects/${projectId}/approvals/${id}/approve`),
+    reject: (projectId, id) => client.post(`/api/v1/projects/${projectId}/approvals/${id}/reject`),
+    getApprovalPolicy: (projectId, envId) => client.get(`/api/v1/projects/${projectId}/environments/${envId}/approval-policies`),
+    setApprovalPolicy: (projectId, envId, input) => client.post(`/api/v1/projects/${projectId}/environments/${envId}/approval-policies`, input),
+});

package/dist/audit.d.ts

@@ -0,0 +1,28 @@
+import type { MrSecretClient, QueryValue } from './client.js';
+export interface AuditLog {
+    id: string;
+    actorType: string;
+    actorId: string;
+    action: string;
+    resourceType: string;
+    resourceId?: string | null;
+    organizationId?: string | null;
+    projectId?: string | null;
+    environmentId?: string | null;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    metadata: unknown;
+    createdAt: string;
+}
+export interface ListAuditLogsOptions extends Record<string, QueryValue> {
+    action?: string;
+    resourceType?: string;
+    actorId?: string;
+    from?: string;
+    to?: string;
+}
+export interface AuditApi {
+    listProjectAuditLogs(projectId: string, options?: ListAuditLogsOptions): Promise<AuditLog[]>;
+    listOrganizationAuditLogs(orgId: string, options?: ListAuditLogsOptions): Promise<AuditLog[]>;
+}
+export declare const createAudit: (client: MrSecretClient) => AuditApi;

package/dist/audit.js

@@ -0,0 +1,4 @@
+export const createAudit = (client) => ({
+    listProjectAuditLogs: (projectId, options) => client.get(`/api/v1/projects/${projectId}/audit-logs`, { query: options }),
+    listOrganizationAuditLogs: (orgId, options) => client.get(`/api/v1/organizations/${orgId}/audit-logs`, { query: options }),
+});

package/dist/auth.d.ts

@@ -0,0 +1,19 @@
+import type { SanctumClient } from "./client.js";
+export interface UniversalAuthTokens {
+    accessToken: string;
+    expiresIn: number;
+    accessTokenMaxTTL: number;
+    tokenType: "Bearer";
+}
+export interface UniversalAuthLoginInput {
+    clientId: string;
+    clientSecret: string;
+    organizationSlug?: string;
+}
+export interface AuthApi {
+    universalAuthLogin(input: UniversalAuthLoginInput): Promise<UniversalAuthTokens>;
+    renewAccessToken(): Promise<{
+        token: string;
+    }>;
+}
+export declare const createAuth: (client: SanctumClient) => AuthApi;

package/dist/auth.js

@@ -0,0 +1,8 @@
+export const createAuth = (client) => ({
+    universalAuthLogin: async (input) => {
+        const tokens = await client.post("/api/v1/auth/universal-auth/login", input);
+        client.setToken(tokens.accessToken);
+        return tokens;
+    },
+    renewAccessToken: () => client.post("/api/v1/auth/token")
+});

package/dist/client.d.ts

@@ -0,0 +1,44 @@
+export interface ClientOptions {
+    baseUrl?: string;
+    accessToken?: string;
+    clientId?: string;
+    clientSecret?: string;
+    timeout?: number;
+}
+export type HttpMethod = "GET" | "POST" | "PATCH" | "DELETE" | "PUT";
+export type QueryValue = string | number | boolean | undefined | null;
+export interface RequestOptions {
+    method?: HttpMethod;
+    body?: unknown;
+    headers?: Record<string, string>;
+    query?: Record<string, QueryValue>;
+    raw?: boolean;
+    timeout?: number;
+}
+export declare class SanctumApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly response?: unknown | undefined;
+    constructor(message: string, code: string, status: number, response?: unknown | undefined);
+}
+export declare class SanctumClient {
+    baseUrl: string;
+    accessToken?: string;
+    clientId?: string;
+    clientSecret?: string;
+    timeout: number;
+    constructor(options?: ClientOptions);
+    setToken(token: string): void;
+    clearToken(): void;
+    buildUrl(path: string, query?: Record<string, QueryValue>): string;
+    private buildHeaders;
+    private prepareBody;
+    requestRaw(path: string, options?: RequestOptions): Promise<Response>;
+    request<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
+    get<T = unknown>(path: string, options?: Omit<RequestOptions, "method" | "body">): Promise<T>;
+    post<T = unknown>(path: string, body?: unknown, options?: Omit<RequestOptions, "method" | "body">): Promise<T>;
+    patch<T = unknown>(path: string, body?: unknown, options?: Omit<RequestOptions, "method" | "body">): Promise<T>;
+    del<T = unknown>(path: string, options?: Omit<RequestOptions, "method">): Promise<T>;
+    authenticate(): Promise<import("./auth.js").UniversalAuthTokens>;
+    private throwError;
+}

package/dist/client.js

@@ -0,0 +1,145 @@
+const DEFAULT_BASE_URL = "http://localhost:4000";
+export class SanctumApiError extends Error {
+    code;
+    status;
+    response;
+    constructor(message, code, status, response) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.response = response;
+        this.name = "SanctumApiError";
+    }
+}
+export class SanctumClient {
+    baseUrl;
+    accessToken;
+    clientId;
+    clientSecret;
+    timeout;
+    constructor(options = {}) {
+        this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+        this.accessToken = options.accessToken;
+        this.clientId = options.clientId;
+        this.clientSecret = options.clientSecret;
+        this.timeout = options.timeout ?? 30000;
+    }
+    setToken(token) {
+        this.accessToken = token;
+    }
+    clearToken() {
+        this.accessToken = undefined;
+    }
+    buildUrl(path, query) {
+        const normalized = path.startsWith("/") ? path : `/${path}`;
+        let url = `${this.baseUrl}${normalized}`;
+        if (query) {
+            const params = new URLSearchParams();
+            for (const [key, value] of Object.entries(query)) {
+                if (value === undefined || value === null)
+                    continue;
+                params.append(key, String(value));
+            }
+            const queryString = params.toString();
+            if (queryString)
+                url += `?${queryString}`;
+        }
+        return url;
+    }
+    buildHeaders(init) {
+        const headers = new Headers(init);
+        headers.set("Accept", "application/json");
+        if (this.accessToken) {
+            headers.set("Authorization", `Bearer ${this.accessToken}`);
+        }
+        return headers;
+    }
+    prepareBody(body) {
+        if (body instanceof FormData ||
+            body instanceof Blob ||
+            body instanceof URLSearchParams ||
+            typeof body === "string") {
+            return { body, headers: this.buildHeaders() };
+        }
+        const headers = this.buildHeaders({ "Content-Type": "application/json" });
+        return { body: JSON.stringify(body), headers };
+    }
+    async requestRaw(path, options = {}) {
+        const url = this.buildUrl(path, options.query);
+        const controller = new AbortController();
+        const timeout = options.timeout ?? this.timeout;
+        const timer = setTimeout(() => controller.abort(), timeout);
+        const init = {
+            method: options.method ?? "GET",
+            headers: this.buildHeaders(options.headers),
+            signal: controller.signal
+        };
+        if (options.body !== undefined) {
+            const prepared = this.prepareBody(options.body);
+            init.body = prepared.body;
+            init.headers = prepared.headers;
+        }
+        try {
+            const response = await fetch(url, init);
+            if (!response.ok) {
+                await this.throwError(response);
+            }
+            return response;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async request(path, options = {}) {
+        if (options.raw) {
+            return (await this.requestRaw(path, options));
+        }
+        const response = await this.requestRaw(path, options);
+        if (response.status === 204)
+            return undefined;
+        const contentType = response.headers.get("content-type") ?? "";
+        if (contentType.includes("text/plain")) {
+            return (await response.text());
+        }
+        return (await response.json());
+    }
+    async get(path, options) {
+        return this.request(path, { ...options, method: "GET" });
+    }
+    async post(path, body, options) {
+        return this.request(path, { ...options, method: "POST", body });
+    }
+    async patch(path, body, options) {
+        return this.request(path, { ...options, method: "PATCH", body });
+    }
+    async del(path, options) {
+        return this.request(path, { ...options, method: "DELETE" });
+    }
+    async authenticate() {
+        if (!this.clientId || !this.clientSecret) {
+            throw new Error("clientId and clientSecret are required to authenticate");
+        }
+        const tokens = await this.post("/api/v1/auth/universal-auth/login", { clientId: this.clientId, clientSecret: this.clientSecret });
+        this.setToken(tokens.accessToken);
+        return tokens;
+    }
+    async throwError(response) {
+        let payload;
+        const contentType = response.headers.get("content-type") ?? "";
+        try {
+            payload = contentType.includes("application/json") ? await response.json() : await response.text();
+        }
+        catch {
+            payload = response.statusText;
+        }
+        const message = typeof payload === "object" && payload !== null && "message" in payload
+            ? String(payload.message)
+            : typeof payload === "string"
+                ? payload
+                : response.statusText;
+        const code = typeof payload === "object" && payload !== null && "code" in payload
+            ? String(payload.code)
+            : `HTTP_${response.status}`;
+        throw new SanctumApiError(message, code, response.status, payload);
+    }
+}

package/dist/dotenv.d.ts

@@ -0,0 +1,14 @@
+export interface DotenvApi {
+    parseDotenv(text: string): Record<string, string>;
+    renderDotenv(values: Record<string, string | undefined>): string;
+    resolveReferences(values: Record<string, string>, options?: ResolveReferencesOptions): Record<string, string>;
+}
+export interface ResolveReferencesOptions {
+    prefix?: string;
+    suffix?: string;
+    maxDepth?: number;
+}
+export declare const parseDotenv: (text: string) => Record<string, string>;
+export declare const renderDotenv: (values: Record<string, string | undefined>) => string;
+export declare const resolveReferences: (values: Record<string, string>, options?: ResolveReferencesOptions) => Record<string, string>;
+export declare const createDotenv: () => DotenvApi;

package/dist/dotenv.js

@@ -0,0 +1,91 @@
+const MOBILE_FILE_KEYS = [
+    'GOOGLE_SERVICES_JSON',
+    'GOOGLE_SERVICE_INFO_PLIST',
+    'RELEASE_KEYSTORE',
+];
+const isMobileFileKey = (key) => MOBILE_FILE_KEYS.includes(key) ||
+    key.toLowerCase().endsWith('_base64') ||
+    /google-services|googleservice-info|keystore|plist/i.test(key);
+export const parseDotenv = (text) => {
+    const result = {};
+    for (let line of text.split('\n')) {
+        line = line.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const index = line.indexOf('=');
+        if (index === -1)
+            continue;
+        const key = line.slice(0, index).trim();
+        let value = line.slice(index + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        result[key] = value;
+    }
+    return result;
+};
+export const renderDotenv = (values) => {
+    const lines = [];
+    for (const [key, value] of Object.entries(values)) {
+        if (value === undefined)
+            continue;
+        if (isMobileFileKey(key) || value === '') {
+            lines.push(`${key}=${value}`);
+            continue;
+        }
+        const needsQuotes = value.includes(' ') ||
+            value.includes('#') ||
+            value.includes('\n') ||
+            value.includes('"') ||
+            value.includes("'");
+        if (needsQuotes) {
+            lines.push(`${key}="${value.replace(/"/g, '\\"')}"`);
+        }
+        else {
+            lines.push(`${key}=${value}`);
+        }
+    }
+    return lines.join('\n');
+};
+export const resolveReferences = (values, options = {}) => {
+    const prefix = options.prefix ?? '${';
+    const suffix = options.suffix ?? '}';
+    const maxDepth = options.maxDepth ?? 10;
+    const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const pattern = new RegExp(`${escapeRegex(prefix)}(.*?)${escapeRegex(suffix)}`, 'g');
+    const resolved = { ...values };
+    const resolveOne = (value, stack) => {
+        return value.replace(pattern, (match, refKey) => {
+            const trimmed = refKey.trim();
+            if (stack.has(trimmed))
+                return match;
+            const refValue = resolved[trimmed];
+            if (refValue === undefined)
+                return match;
+            stack.add(trimmed);
+            const inner = resolveOne(refValue, stack);
+            stack.delete(trimmed);
+            return inner;
+        });
+    };
+    for (let i = 0; i < maxDepth; i++) {
+        let changed = false;
+        for (const [key, value] of Object.entries(resolved)) {
+            const stack = new Set([key]);
+            const next = resolveOne(value, stack);
+            if (next !== resolved[key]) {
+                resolved[key] = next;
+                changed = true;
+            }
+        }
+        if (!changed)
+            break;
+    }
+    return resolved;
+};
+export const createDotenv = () => ({
+    parseDotenv,
+    renderDotenv,
+    resolveReferences,
+});

package/dist/files.d.ts

@@ -0,0 +1,59 @@
+import type { MrSecretClient, QueryValue } from './client.js';
+export interface FileSecret {
+    id: string;
+    name: string;
+    storageKey?: string;
+    contentType?: string | null;
+    size: number;
+    version: number;
+    folderId?: string;
+    environmentId: string;
+    projectId: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface FileSecretVersion {
+    id: string;
+    versionNumber: number;
+    storageKey: string;
+    contentType?: string | null;
+    size: number;
+    createdAt: string;
+    comment?: string | null;
+}
+export interface FileUploadInput {
+    name?: string;
+    folderId?: string;
+    contentType?: string;
+    file: Blob | Buffer | Uint8Array | string;
+    filename?: string;
+}
+export interface FileMetadataInput {
+    name?: string;
+    folderId?: string;
+}
+export interface PresignedDownload {
+    url: string;
+    expiresIn: number;
+}
+export interface StreamedDownload {
+    name: string;
+    contentType: string;
+    size?: number;
+    buffer: Buffer;
+}
+export interface ListFilesOptions extends Record<string, QueryValue> {
+    folderId?: string;
+}
+export interface FilesApi {
+    listFiles(projectId: string, envId: string, options?: ListFilesOptions): Promise<FileSecret[]>;
+    uploadFile(projectId: string, envId: string, input: FileUploadInput): Promise<Omit<FileSecret, 'projectId' | 'environmentId' | 'updatedAt'>>;
+    getFile(projectId: string, envId: string, id: string): Promise<FileSecret>;
+    downloadFile(projectId: string, envId: string, id: string, mode?: 'presigned' | 'stream'): Promise<PresignedDownload | StreamedDownload>;
+    updateFile(projectId: string, envId: string, id: string, input: FileUploadInput | FileMetadataInput): Promise<Omit<FileSecret, 'projectId' | 'environmentId'>>;
+    deleteFile(projectId: string, envId: string, id: string): Promise<{
+        success: true;
+    }>;
+    listFileVersions(projectId: string, envId: string, id: string): Promise<FileSecretVersion[]>;
+}
+export declare const createFiles: (client: MrSecretClient) => FilesApi;

package/dist/files.js

@@ -0,0 +1,52 @@
+const toBlob = (input, contentType) => {
+    if (input instanceof Blob)
+        return input;
+    return new Blob([input], { type: contentType ?? 'application/octet-stream' });
+};
+const buildFormData = (input, hasFile) => {
+    const form = new FormData();
+    if ('file' in input && input.file !== undefined && hasFile) {
+        const filename = input.filename ?? input.name ?? 'file';
+        const blob = toBlob(input.file, input.contentType);
+        form.append('file', blob, filename);
+    }
+    if (input.name)
+        form.append('name', input.name);
+    if (input.folderId)
+        form.append('folderId', input.folderId);
+    return form;
+};
+export const createFiles = (client) => ({
+    listFiles: (projectId, envId, options) => client.get(`/api/v1/projects/${projectId}/environments/${envId}/files`, { query: options }),
+    uploadFile: (projectId, envId, input) => {
+        const body = buildFormData(input, true);
+        return client.post(`/api/v1/projects/${projectId}/environments/${envId}/files`, body);
+    },
+    getFile: (projectId, envId, id) => client.get(`/api/v1/projects/${projectId}/environments/${envId}/files/${id}`),
+    downloadFile: async (projectId, envId, id, mode) => {
+        const query = { mode: mode ?? 'stream' };
+        if (mode === 'presigned') {
+            return client.get(`/api/v1/projects/${projectId}/environments/${envId}/files/${id}/download`, { query });
+        }
+        const response = await client.requestRaw(`/api/v1/projects/${projectId}/environments/${envId}/files/${id}/download`, { query });
+        const contentType = response.headers.get('content-type') ?? 'application/octet-stream';
+        const contentLength = response.headers.get('content-length');
+        const disposition = response.headers.get('content-disposition');
+        const nameMatch = disposition?.match(/filename="([^"]+)"/);
+        const name = nameMatch?.[1] ?? id;
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return {
+            name,
+            contentType,
+            size: contentLength ? Number(contentLength) : undefined,
+            buffer,
+        };
+    },
+    updateFile: (projectId, envId, id, input) => {
+        const hasFile = 'file' in input && input.file !== undefined;
+        const body = hasFile ? buildFormData(input, true) : input;
+        return client.patch(`/api/v1/projects/${projectId}/environments/${envId}/files/${id}`, body);
+    },
+    deleteFile: (projectId, envId, id) => client.del(`/api/v1/projects/${projectId}/environments/${envId}/files/${id}`),
+    listFileVersions: (projectId, envId, id) => client.get(`/api/v1/projects/${projectId}/environments/${envId}/files/${id}/versions`),
+});

package/dist/identities.d.ts

@@ -0,0 +1,24 @@
+import type { MrSecretClient } from './client.js';
+export interface Identity {
+    id: string;
+    name: string;
+    clientId: string;
+    projectId: string;
+    isActive: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface IdentityWithSecret extends Identity {
+    clientSecret?: string;
+}
+export interface CreateIdentityInput {
+    name: string;
+}
+export interface IdentitiesApi {
+    listIdentities(projectId: string): Promise<Identity[]>;
+    createIdentity(projectId: string, input: CreateIdentityInput): Promise<IdentityWithSecret>;
+    deleteIdentity(projectId: string, id: string): Promise<{
+        success: true;
+    }>;
+}
+export declare const createIdentities: (client: MrSecretClient) => IdentitiesApi;

package/dist/identities.js

@@ -0,0 +1,5 @@
+export const createIdentities = (client) => ({
+    listIdentities: (projectId) => client.get(`/api/v1/projects/${projectId}/identities`),
+    createIdentity: (projectId, input) => client.post(`/api/v1/projects/${projectId}/identities`, input),
+    deleteIdentity: (projectId, id) => client.del(`/api/v1/projects/${projectId}/identities/${id}`),
+});

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+import { SanctumClient, type ClientOptions } from "./client.js";
+import { type AuthApi } from "./auth.js";
+import { type ProjectsApi } from "./projects.js";
+import { type SecretsApi } from "./secrets.js";
+import { type DotenvApi } from "./dotenv.js";
+export * from "./client.js";
+export * from "./auth.js";
+export * from "./projects.js";
+export * from "./secrets.js";
+export * from "./dotenv.js";
+export interface SanctumSdk extends SanctumClient {
+    auth: AuthApi;
+    projects: ProjectsApi;
+    secrets: SecretsApi;
+    dotenv: DotenvApi;
+}
+export declare class SanctumSdk extends SanctumClient {
+    auth: AuthApi;
+    projects: ProjectsApi;
+    secrets: SecretsApi;
+    dotenv: DotenvApi;
+    constructor(options?: ClientOptions);
+}
+export declare const createClient: (options?: ClientOptions) => SanctumSdk;
+export default createClient;

package/dist/index.js

@@ -0,0 +1,27 @@
+import { SanctumClient } from "./client.js";
+import { createAuth } from "./auth.js";
+import { createProjects } from "./projects.js";
+import { createSecrets } from "./secrets.js";
+import { createDotenv } from "./dotenv.js";
+export * from "./client.js";
+export * from "./auth.js";
+export * from "./projects.js";
+export * from "./secrets.js";
+export * from "./dotenv.js";
+export class SanctumSdk extends SanctumClient {
+    auth;
+    projects;
+    secrets;
+    dotenv;
+    constructor(options = {}) {
+        super(options);
+        this.auth = createAuth(this);
+        this.projects = createProjects(this);
+        this.secrets = createSecrets(this);
+        this.dotenv = createDotenv();
+    }
+}
+export const createClient = (options = {}) => {
+    return new SanctumSdk(options);
+};
+export default createClient;

package/dist/permissions.d.ts

@@ -0,0 +1,31 @@
+import type { MrSecretClient } from './client.js';
+export type Action = 'read' | 'write' | 'delete' | 'admin' | 'manage_permissions';
+export interface Permission {
+    id: string;
+    subjectType: 'User' | 'Identity';
+    subjectId: string;
+    resourceType: 'Project' | 'ProjectGroup';
+    resourceId: string;
+    action: Action;
+    grantedBy?: string | null;
+    createdAt: string;
+}
+export interface CreatePermissionInput {
+    subjectType: 'User' | 'Identity';
+    subjectId: string;
+    action: Action;
+}
+export interface PermissionsApi {
+    listProjectPermissions(projectId: string): Promise<Permission[]>;
+    createProjectPermission(projectId: string, input: CreatePermissionInput): Promise<Permission>;
+    deleteProjectPermission(projectId: string, id: string): Promise<{
+        success: true;
+    }>;
+    listGroupPermissions(groupId: string): Promise<Permission[]>;
+    createGroupPermission(groupId: string, input: CreatePermissionInput): Promise<Permission>;
+    deleteGroupPermission(groupId: string, id: string): Promise<{
+        success: true;
+    }>;
+    listMyPermissions(): Promise<Permission[]>;
+}
+export declare const createPermissions: (client: MrSecretClient) => PermissionsApi;

package/dist/permissions.js

@@ -0,0 +1,9 @@
+export const createPermissions = (client) => ({
+    listProjectPermissions: (projectId) => client.get(`/api/v1/projects/${projectId}/permissions`),
+    createProjectPermission: (projectId, input) => client.post(`/api/v1/projects/${projectId}/permissions`, input),
+    deleteProjectPermission: (projectId, id) => client.del(`/api/v1/projects/${projectId}/permissions/${id}`),
+    listGroupPermissions: (groupId) => client.get(`/api/v1/groups/${groupId}/permissions`),
+    createGroupPermission: (groupId, input) => client.post(`/api/v1/groups/${groupId}/permissions`, input),
+    deleteGroupPermission: (groupId, id) => client.del(`/api/v1/groups/${groupId}/permissions/${id}`),
+    listMyPermissions: () => client.get('/api/v1/users/me/permissions'),
+});

package/dist/projects.d.ts

@@ -0,0 +1,44 @@
+import type { SanctumClient } from "./client.js";
+export interface Project {
+    id: string;
+    name: string;
+    slug: string;
+    orgId: string;
+    version?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ProjectEnvironment {
+    id: string;
+    name: string;
+    slug: string;
+    position: number;
+    projectId: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreateProjectInput {
+    projectName: string;
+    slug?: string;
+    type?: "secret-manager" | "cert-manager" | "kms" | "secret-scanning" | "pam";
+    shouldCreateDefaultEnvs?: boolean;
+}
+export interface ProjectsApi {
+    list(): Promise<{
+        projects: Project[];
+    }>;
+    get(projectId: string): Promise<{
+        project: Project;
+    }>;
+    getBySlug(slug: string): Promise<Project>;
+    create(input: CreateProjectInput): Promise<{
+        project: Project;
+    }>;
+    listEnvironments(projectId: string): Promise<{
+        environments: ProjectEnvironment[];
+    }>;
+    getEnvironmentBySlug(projectId: string, envSlug: string): Promise<{
+        environment: ProjectEnvironment;
+    }>;
+}
+export declare const createProjects: (client: SanctumClient) => ProjectsApi;

package/dist/projects.js

@@ -0,0 +1,11 @@
+export const createProjects = (client) => ({
+    list: () => client.get("/api/v1/projects"),
+    get: (projectId) => client.get(`/api/v1/projects/${projectId}`),
+    getBySlug: (slug) => client.get(`/api/v1/projects/slug/${encodeURIComponent(slug)}`),
+    create: (input) => client.post("/api/v1/projects", input),
+    listEnvironments: async (projectId) => {
+        const { project } = await client.get(`/api/v1/projects/${projectId}`);
+        return { environments: project.environments ?? [] };
+    },
+    getEnvironmentBySlug: (projectId, envSlug) => client.get(`/api/v1/projects/${projectId}/environments/slug/${encodeURIComponent(envSlug)}`)
+});

package/dist/secrets.d.ts

@@ -0,0 +1,92 @@
+import type { QueryValue, SanctumClient } from "./client.js";
+export interface Secret {
+    id: string;
+    secretKey: string;
+    secretValue?: string;
+    secretComment?: string;
+    version: number;
+    type: "shared" | "personal";
+    secretPath?: string;
+    secretValueHidden: boolean;
+    tags?: {
+        id: string;
+        slug: string;
+        name?: string;
+        color?: string;
+    }[];
+    secretMetadata?: {
+        key: string;
+        value: string;
+    }[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ListSecretsOptions extends Record<string, QueryValue> {
+    workspaceId?: string;
+    workspaceSlug?: string;
+    environment?: string;
+    secretPath?: string;
+    viewSecretValue?: boolean;
+    expandSecretReferences?: boolean;
+    recursive?: boolean;
+    include_imports?: boolean;
+    tagSlugs?: string;
+}
+export interface ListSecretsOutput {
+    secrets: Secret[];
+    imports?: {
+        secretPath: string;
+        environment: string;
+        folderId?: string;
+        secrets: Secret[];
+    }[];
+}
+export interface SecretScopeInput {
+    workspaceId?: string;
+    workspaceSlug?: string;
+    projectSlug?: string;
+    environment: string;
+    secretPath?: string;
+    type?: "shared" | "personal";
+}
+export interface CreateSecretInput extends SecretScopeInput {
+    secretValue: string;
+    secretComment?: string;
+    skipMultilineEncoding?: boolean;
+}
+export interface UpdateSecretInput extends SecretScopeInput {
+    secretValue?: string;
+    secretComment?: string;
+    tags?: string[];
+    skipMultilineEncoding?: boolean;
+}
+export interface BatchSecretOperation {
+    type: "create" | "update" | "delete";
+    secretName: string;
+    secretValue?: string;
+    secretComment?: string;
+    tags?: string[];
+}
+export interface SecretWriteResult {
+    secret?: Secret;
+    /** present when a change-approval policy intercepted the write instead */
+    approval?: {
+        id: string;
+        slug?: string;
+        status?: string;
+    };
+}
+export interface SecretsApi {
+    list(options: ListSecretsOptions): Promise<ListSecretsOutput>;
+    get(secretName: string, scope: SecretScopeInput & {
+        expandSecretReferences?: boolean;
+        version?: number;
+    }): Promise<{
+        secret: Secret;
+    }>;
+    create(secretName: string, input: CreateSecretInput): Promise<SecretWriteResult>;
+    update(secretName: string, input: UpdateSecretInput): Promise<SecretWriteResult>;
+    delete(secretName: string, scope: SecretScopeInput): Promise<SecretWriteResult>;
+    batch(scope: SecretScopeInput, operations: BatchSecretOperation[]): Promise<unknown>;
+}
+export declare const createSecrets: (client: SanctumClient) => SecretsApi;

package/dist/secrets.js

@@ -0,0 +1,28 @@
+export const createSecrets = (client) => ({
+    list: (options) => client.get("/api/v3/secrets/raw", {
+        query: options
+    }),
+    get: (secretName, scope) => client.get(`/api/v3/secrets/raw/${encodeURIComponent(secretName)}`, {
+        query: scope
+    }),
+    create: (secretName, input) => client.post(`/api/v3/secrets/raw/${encodeURIComponent(secretName)}`, {
+        type: "shared",
+        secretPath: "/",
+        ...input
+    }),
+    update: (secretName, input) => client.patch(`/api/v3/secrets/raw/${encodeURIComponent(secretName)}`, {
+        type: "shared",
+        secretPath: "/",
+        ...input
+    }),
+    delete: (secretName, scope) => client.request(`/api/v3/secrets/raw/${encodeURIComponent(secretName)}`, {
+        method: "DELETE",
+        body: { type: "shared", secretPath: "/", ...scope }
+    }),
+    batch: (scope, operations) => client.post("/api/v3/secrets/batch/raw", {
+        secretPath: "/",
+        type: "shared",
+        ...scope,
+        secrets: operations
+    })
+});

package/dist/webhooks.d.ts

@@ -0,0 +1,55 @@
+import type { MrSecretClient } from './client.js';
+export type DeliveryStatus = 'pending' | 'delivered' | 'failed' | 'retrying';
+export interface Webhook {
+    id: string;
+    name: string;
+    url: string;
+    events: string[];
+    active: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface WebhookWithSecret extends Webhook {
+    secret?: string;
+}
+export interface WebhookDelivery {
+    id: string;
+    webhookId: string;
+    event: string;
+    payload: unknown;
+    responseBody?: string | null;
+    httpStatus?: number | null;
+    status: DeliveryStatus;
+    attempts: number;
+    nextRetryAt?: string | null;
+    deliveredAt?: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreateWebhookInput {
+    name: string;
+    url: string;
+    events: string[];
+    active?: boolean;
+}
+export interface UpdateWebhookInput {
+    name?: string;
+    url?: string;
+    events?: string[];
+    active?: boolean;
+}
+export interface WebhooksApi {
+    listWebhooks(projectId: string): Promise<Webhook[]>;
+    createWebhook(projectId: string, input: CreateWebhookInput): Promise<WebhookWithSecret>;
+    getWebhook(projectId: string, id: string): Promise<Webhook>;
+    updateWebhook(projectId: string, id: string, input: UpdateWebhookInput): Promise<Webhook>;
+    deleteWebhook(projectId: string, id: string): Promise<{
+        success: true;
+    }>;
+    listDeliveries(projectId: string, id: string): Promise<WebhookDelivery[]>;
+    testWebhook(projectId: string, id: string): Promise<{
+        success: true;
+        deliveryId?: string;
+    }>;
+}
+export declare const createWebhooks: (client: MrSecretClient) => WebhooksApi;

package/dist/webhooks.js

@@ -0,0 +1,9 @@
+export const createWebhooks = (client) => ({
+    listWebhooks: (projectId) => client.get(`/api/v1/projects/${projectId}/webhooks`),
+    createWebhook: (projectId, input) => client.post(`/api/v1/projects/${projectId}/webhooks`, input),
+    getWebhook: (projectId, id) => client.get(`/api/v1/projects/${projectId}/webhooks/${id}`),
+    updateWebhook: (projectId, id, input) => client.patch(`/api/v1/projects/${projectId}/webhooks/${id}`, input),
+    deleteWebhook: (projectId, id) => client.del(`/api/v1/projects/${projectId}/webhooks/${id}`),
+    listDeliveries: (projectId, id) => client.get(`/api/v1/projects/${projectId}/webhooks/${id}/deliveries`),
+    testWebhook: (projectId, id) => client.post(`/api/v1/projects/${projectId}/webhooks/${id}/test`),
+});

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "sanctum-sdk",
+  "version": "0.1.0",
+  "description": "TypeScript SDK for the Sanctum secrets platform",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/neang-mengseang/sanctum.git",
+    "directory": "packages/sdk"
+  },
+  "files": [
+    "dist"
+  ],
+  "prepublishOnly": "npm run build",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "lint": "tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\""
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}