Add bool.secrets — call external APIs with a server-side secret

[HomemadeToast57]

What & why

Adds the client half of the gateway "escape hatch": a way for a Bool app to call an external API that needs a secret key without the key ever reaching the client.

const res = await bool.secrets.fetch("OPENAI_KEY", "/v1/chat/completions", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ model: "gpt-4o-mini", messages }),
});
const data = await res.json();

fetch(name, path, init) routes the call to the gateway secret plane (/_bool/v1/secret/<name>/*), which resolves the named secret, injects the real value server-side, and forwards to the destination the secret is bound to. The value is never in the bundle. name is the secret's name (configured in the app's Secrets dashboard); path is the sub-path under the bound destination; init is a normal fetch init. Returns the destination's raw Response.

Mirrors the existing db/users planes: credentials: "include" so the same-origin live-gate cookie flows when deployed, and the viewer / eu-session identity headers are replayed for the cross-origin preview.

Changes

• src/client.ts: BoolSecrets type, secrets on BoolClient, and the implementation (uses the existing runtime-resolved gateway base, so it's same-origin when deployed and cross-origin in preview automatically).
• src/client.test.ts: routing (cross-origin + same-origin), leading-slash normalization, name URL-encoding, and identity-header replay.
• README.md + CHANGELOG.md; version bumped to 0.2.0-next.10 (additive → minor; on the canary channel).

Testing

• bun test (66 pass), bun run typecheck, and bun run build all green.

Notes

Publishing is tag-driven/manual (OIDC trusted publishing) per the README, so this PR only prepares the version + changelog — it does not publish. Pairs with the platform PR (codehs/bool) that adds the /_bool/v1/secret plane, the encrypted store, and the Secrets dashboard.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HA2XB7REb3M4PxrJmj8GPp

---

Generated by Claude Code