secretcarousel 1.0.0

package/LICENSE

@@ -0,0 +1,29 @@
+SecretCarousel Software License
+
+Copyright (c) 2026 Tyga.Cloud Ltd
+Company number 14643275, England and Wales
+
+Permission is granted to use this software in connection with the
+SecretCarousel service (https://secretcarousel.com) subject to the
+following conditions:
+
+1. You may install, copy, and use this software solely to interact with
+   the SecretCarousel API using a valid API key (prefix: sc_).
+
+2. You may NOT modify, reverse-engineer, decompile, or create derivative
+   works of this software.
+
+3. You may NOT redistribute this software outside of the npm package
+   registry or the official SecretCarousel documentation.
+
+4. This software is provided "AS IS" without warranty of any kind,
+   express or implied, including but not limited to warranties of
+   merchantability, fitness for a particular purpose, and noninfringement.
+
+5. In no event shall Tyga.Cloud Ltd be liable for any claim, damages, or
+   other liability arising from the use of this software.
+
+Terms of Service: https://secretcarousel.com/terms
+Privacy Policy: https://secretcarousel.com/privacy
+
+"SecretCarousel" is a trademark of Tyga.Cloud Ltd.

package/README.md

@@ -0,0 +1,89 @@
+# secretcarousel
+
+The agent-native secret vault. Store, rotate, and share secrets from any AI coding agent.
+
+## Install
+
+```bash
+npm install -g secretcarousel
+```
+
+Or run directly:
+
+```bash
+npx secretcarousel signup --tenant my-project
+```
+
+## Quick Start
+
+```bash
+# Self-provision (zero friction, instant API key)
+sc signup --tenant my-project
+
+# Store a secret (AES-256-GCM encrypted at rest)
+sc secrets:create --name DB_URL --value postgres://user:pass@host/db
+
+# Retrieve (decrypted on demand, access logged)
+sc secrets:get sec-abc123
+
+# Export as .env
+sc env:export --environment production > .env
+
+# Rotate immediately
+sc rotate sec-abc123
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `signup` | Self-provision a tenant and get API key |
+| `config` | Set apiKey or baseUrl |
+| `secrets:list` | List secrets |
+| `secrets:get` | Get a secret value (decrypted) |
+| `secrets:create` | Create a secret |
+| `secrets:delete` | Delete a secret |
+| `env:export` | Export secrets as .env file |
+| `env:promote` | Promote secrets between environments |
+| `audit:export` | Export audit logs (CSV/JSON) |
+| `backup:create` | Create encrypted backup |
+| `rotate` | Rotate a secret immediately |
+
+## Configuration
+
+Environment variables (recommended for agents):
+
+```bash
+export SC_API_KEY=sc_free_my_project_a1b2c3...
+export SC_BASE_URL=https://secretcarousel.com  # optional, this is the default
+```
+
+Or save permanently:
+
+```bash
+sc config apiKey sc_free_my_project_a1b2c3...
+sc config baseUrl https://secretcarousel.com
+```
+
+Config file: `~/.secretcarousel/config.json`
+
+## Features
+
+- **Agent-native** — self-signup via API, no dashboard required
+- **AES-256-GCM** — every secret encrypted at rest with unique keys
+- **Zero dependencies** — uses Node.js 18+ built-in fetch
+- **Versioning** — automatic version history on every update
+- **Rotation** — cron-based or on-demand with webhook notifications
+- **Sharing** — time-limited, view-limited share links with passphrase protection
+- **Audit trail** — every operation logged with full context
+- **Claim tokens** — cross-agent secret exchange via Buggazi contracts
+
+## Links
+
+- Quick Start: https://secretcarousel.com/api
+- Pricing: https://secretcarousel.com/#pricing
+- Status: https://secretcarousel.com/health
+
+## License
+
+Proprietary — Tyga.Cloud Ltd. See LICENSE file.

package/bin/cli.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+const config = require('../lib/config');
+
+const COMMANDS = {
+  'signup':         '../commands/signup',
+  'config':         '../commands/config',
+  'secrets:list':   '../commands/secrets-list',
+  'secrets:get':    '../commands/secrets-get',
+  'secrets:create': '../commands/secrets-create',
+  'secrets:delete': '../commands/secrets-delete',
+  'env:export':     '../commands/env-export',
+  'env:promote':    '../commands/env-promote',
+  'audit:export':   '../commands/audit-export',
+  'backup:create':  '../commands/backup-create',
+  'rotate':         '../commands/rotate'
+};
+
+function usage() {
+  console.log(`
+SecretCarousel CLI v1.0.0 — The Agent-Native Secret Vault
+
+Usage: sc <command> [options]
+
+Getting Started:
+  signup            Self-provision a tenant (zero friction)
+  config            Set apiKey or baseUrl
+
+Secrets:
+  secrets:list      List secrets
+  secrets:get       Get a secret value (decrypted)
+  secrets:create    Create a secret (AES-256-GCM encrypted)
+  secrets:delete    Delete a secret
+
+Environment:
+  env:export        Export secrets as .env file
+  env:promote       Promote secrets between environments
+
+Operations:
+  audit:export      Export audit logs (CSV/JSON)
+  backup:create     Create encrypted backup
+  rotate            Rotate a secret immediately
+
+Options:
+  --help            Show this help message
+
+Environment Variables:
+  SC_API_KEY        API key (overrides config file)
+  SC_BASE_URL       Base URL (default: https://secretcarousel.com)
+
+Quick Start:
+  $ npx secretcarousel signup --tenant my-project
+  $ sc secrets:create --name DB_URL --value postgres://...
+  $ sc secrets:get sec-abc123
+
+Config: ${config.CONFIG_FILE}
+Docs:   https://secretcarousel.com/api
+`);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
+    usage();
+    process.exit(0);
+  }
+
+  const command = args[0];
+
+  if (!COMMANDS[command]) {
+    console.error(`Unknown command: ${command}\n`);
+    usage();
+    process.exit(1);
+  }
+
+  const handler = require(COMMANDS[command]);
+  try {
+    await handler(args.slice(1));
+  } catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+main();

package/commands/audit-export.js

@@ -0,0 +1,12 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  const query = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) query[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  const qs = new URLSearchParams({ format: 'csv', ...query }).toString();
+  const result = await request('GET', '/api/v1/audit/export?' + qs);
+  console.log(typeof result === 'string' ? result : JSON.stringify(result, null, 2));
+};

package/commands/backup-create.js

@@ -0,0 +1,13 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  const data = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) data[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  if (!data.name) data.name = `backup-${new Date().toISOString().slice(0, 10)}`;
+
+  const result = await request('POST', '/api/v1/backup', data);
+  console.log(JSON.stringify(result, null, 2));
+};

package/commands/config.js

@@ -0,0 +1,20 @@
+const config = require('../lib/config');
+
+module.exports = async function (args) {
+  if (args.length < 2) {
+    const cfg = config.load();
+    console.log(JSON.stringify({ ...cfg, apiKey: cfg.apiKey ? cfg.apiKey.slice(0, 12) + '...' : '(not set)' }, null, 2));
+    return;
+  }
+
+  const key = args[0];
+  const value = args[1];
+
+  if (!['apiKey', 'baseUrl'].includes(key)) {
+    console.error(`Unknown config key: ${key}. Valid: apiKey, baseUrl`);
+    process.exit(1);
+  }
+
+  config.set(key, value);
+  console.log(`Set ${key} = ${key === 'apiKey' ? value.slice(0, 12) + '...' : value}`);
+};

package/commands/env-export.js

@@ -0,0 +1,27 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  const query = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) query[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  if (!query.environment) {
+    console.error('Usage: sc env:export --environment <development|staging|production>');
+    process.exit(1);
+  }
+
+  const result = await request('GET', '/api/v1/secrets?environment=' + query.environment + '&limit=500');
+  const secrets = result.secrets || result;
+
+  // Output as .env format
+  for (const s of secrets) {
+    if (s.value) {
+      console.log(`${s.name}=${s.value}`);
+    } else {
+      // Need to fetch each secret value individually
+      const full = await request('GET', '/api/v1/secrets/' + (s.secretId || s._id));
+      if (full.value) console.log(`${s.name}=${full.value}`);
+    }
+  }
+};

package/commands/env-promote.js

@@ -0,0 +1,36 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  const data = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) data[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  if (!data.from || !data.to) {
+    console.error('Usage: sc env:promote --from staging --to production');
+    process.exit(1);
+  }
+
+  // List secrets from source environment, create in target
+  const source = await request('GET', '/api/v1/secrets?environment=' + data.from + '&limit=500');
+  const secrets = source.secrets || source;
+  let promoted = 0;
+
+  for (const s of secrets) {
+    try {
+      const full = await request('GET', '/api/v1/secrets/' + (s.secretId || s._id));
+      await request('POST', '/api/v1/secrets', {
+        name: s.name,
+        value: full.value,
+        secretType: s.secretType,
+        environment: data.to,
+        tags: s.tags,
+      });
+      promoted++;
+    } catch (e) {
+      console.error(`  Skip: ${s.name} — ${e.message}`);
+    }
+  }
+
+  console.log(`Promoted ${promoted}/${secrets.length} secrets from ${data.from} → ${data.to}`);
+};

package/commands/rotate.js

@@ -0,0 +1,7 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  if (!args[0]) { console.error('Usage: sc rotate <secretId>'); process.exit(1); }
+  const result = await request('POST', '/api/v1/rotation/' + args[0] + '/rotate-now');
+  console.log(JSON.stringify(result, null, 2));
+};

package/commands/secrets-create.js

@@ -0,0 +1,16 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  const data = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) data[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  if (!data.name || !data.value) {
+    console.error('Usage: sc secrets:create --name NAME --value VALUE [--secretType TYPE] [--environment ENV]');
+    process.exit(1);
+  }
+
+  const result = await request('POST', '/api/v1/secrets', data);
+  console.log(JSON.stringify(result, null, 2));
+};

package/commands/secrets-delete.js

@@ -0,0 +1,7 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  if (!args[0]) { console.error('Usage: sc secrets:delete <secretId>'); process.exit(1); }
+  const result = await request('DELETE', '/api/v1/secrets/' + args[0]);
+  console.log(JSON.stringify(result, null, 2));
+};

package/commands/secrets-get.js

@@ -0,0 +1,7 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  if (!args[0]) { console.error('Usage: sc secrets:get <secretId>'); process.exit(1); }
+  const result = await request('GET', '/api/v1/secrets/' + args[0]);
+  console.log(JSON.stringify(result, null, 2));
+};

package/commands/secrets-list.js

@@ -0,0 +1,12 @@
+const { request } = require('../lib/api');
+
+module.exports = async function (args) {
+  const query = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) query[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  const qs = new URLSearchParams(query).toString();
+  const result = await request('GET', '/api/v1/secrets' + (qs ? '?' + qs : ''));
+  console.log(JSON.stringify(result, null, 2));
+};

package/commands/signup.js

@@ -0,0 +1,32 @@
+const { signup } = require('../lib/api');
+const config = require('../lib/config');
+
+module.exports = async function (args) {
+  const data = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (args[i] && args[i + 1]) data[args[i].replace(/^--/, '')] = args[i + 1];
+  }
+
+  if (!data.tenant) {
+    console.error('Usage: sc signup --tenant <project-name>\n');
+    console.error('Example: sc signup --tenant my-backend');
+    process.exit(1);
+  }
+
+  const result = await signup(data.tenant);
+
+  if (result.error) {
+    console.error(`Error: ${result.message || result.error}`);
+    process.exit(1);
+  }
+
+  // Auto-save the API key to config
+  config.set('apiKey', result.apiKey);
+
+  console.log(`\nTenant "${result.tenantId}" created!\n`);
+  console.log(`API Key: ${result.apiKey}`);
+  console.log(`Plan:    ${result.plan}`);
+  console.log(`Limits:  ${JSON.stringify(result.limits)}\n`);
+  console.log(`Key saved to ${config.CONFIG_FILE}`);
+  console.log(`\nNext: sc secrets:create --name DB_PASSWORD --value s3cur3!`);
+};

package/lib/api.js

@@ -0,0 +1,53 @@
+/**
+ * Self-contained HTTP client for SecretCarousel API
+ * Zero dependencies — uses Node.js built-in fetch (18+)
+ */
+
+const config = require('./config');
+
+async function request(method, path, body) {
+  const cfg = config.load();
+  if (!cfg.apiKey) {
+    console.error('No API key configured.\n');
+    console.error('Set via environment variable:');
+    console.error('  export SC_API_KEY=sc_free_...\n');
+    console.error('Or configure permanently:');
+    console.error('  sc config apiKey sc_free_...\n');
+    console.error('Or self-signup for a new key:');
+    console.error('  sc signup --tenant my-project');
+    process.exit(1);
+  }
+
+  const url = cfg.baseUrl.replace(/\/+$/, '') + path;
+  const opts = {
+    method,
+    headers: {
+      'X-API-Key': cfg.apiKey,
+      'Content-Type': 'application/json',
+    },
+  };
+  if (body) opts.body = JSON.stringify(body);
+
+  const resp = await fetch(url, opts);
+  const data = await resp.json().catch(() => ({}));
+
+  if (!resp.ok) {
+    const msg = data.error || data.message || `HTTP ${resp.status}`;
+    throw new Error(msg);
+  }
+
+  return data;
+}
+
+async function signup(tenantId) {
+  const cfg = config.load();
+  const url = cfg.baseUrl.replace(/\/+$/, '') + '/api/signup';
+  const resp = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ tenantId, agent: 'sc-cli' }),
+  });
+  return resp.json();
+}
+
+module.exports = { request, signup };

package/lib/config.js

@@ -0,0 +1,49 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const CONFIG_DIR = path.join(os.homedir(), '.secretcarousel');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+
+const DEFAULTS = {
+  apiKey: '',
+  baseUrl: 'https://secretcarousel.com',
+};
+
+function load() {
+  // Environment variables take priority (agent-first: agents pass env vars, not config files)
+  const env = {
+    apiKey: process.env.SC_API_KEY || process.env.SECRETCAROUSEL_API_KEY || '',
+    baseUrl: process.env.SC_BASE_URL || process.env.SECRETCAROUSEL_BASE_URL || '',
+  };
+
+  let file = {};
+  try {
+    if (fs.existsSync(CONFIG_FILE)) {
+      file = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
+    }
+  } catch { /* ignore corrupt config */ }
+
+  return {
+    ...DEFAULTS,
+    ...file,
+    // Env vars override file config (non-empty only)
+    ...(env.apiKey ? { apiKey: env.apiKey } : {}),
+    ...(env.baseUrl ? { baseUrl: env.baseUrl } : {}),
+  };
+}
+
+function save(config) {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + '\n');
+}
+
+function get(key) { return load()[key]; }
+
+function set(key, value) {
+  const config = load();
+  config[key] = value;
+  save(config);
+}
+
+module.exports = { load, save, get, set, CONFIG_FILE, CONFIG_DIR };

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "secretcarousel",
+  "version": "1.0.0",
+  "description": "The agent-native secret vault CLI. Store, rotate, and share secrets from any AI coding agent.",
+  "bin": {
+    "sc": "bin/cli.js"
+  },
+  "files": ["bin/", "lib/", "commands/"],
+  "engines": { "node": ">=18.0.0" },
+  "keywords": [
+    "secretcarousel",
+    "secrets",
+    "vault",
+    "agent-first",
+    "cli",
+    "encryption",
+    "rotation",
+    "api-key",
+    "ai-agents",
+    "coding-agents",
+    "claim-tokens",
+    "secret-management"
+  ],
+  "author": "Joe Wee <joe@tyga.cloud>",
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://secretcarousel.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jyswee/secretcarousel"
+  }
+}