@1password/sdk 0.0.0-credential-broker-dev-preview

package/dist/core.js

@@ -0,0 +1,154 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StandardClient = exports.InnerClient = exports.SharedCore = exports.WasmCore = void 0;
+const sdk_core_1 = require("@1password/sdk-core");
+const types_1 = require("./types");
+const errors_1 = require("./errors");
+// In empirical tests, we determined that maximum message size that can cross the FFI boundary
+// is ~64MB. Past this limit, the wasm-bingen FFI will throw an error and the program will crash.
+// We set the limit to 50MB to be safe, to be reconsidered upon further testing.
+const messageLimit = 50 * 1024 * 1024;
+class WasmCore {
+    initClient(config) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield (0, sdk_core_1.init_client)(config);
+            }
+            catch (e) {
+                (0, errors_1.throwError)(e);
+            }
+        });
+    }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield (0, sdk_core_1.init_client_oidc)(config, fetcher);
+            }
+            catch (e) {
+                (0, errors_1.throwError)(e);
+            }
+        });
+    }
+    invoke(config) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield (0, sdk_core_1.invoke)(config);
+            }
+            catch (e) {
+                (0, errors_1.throwError)(e);
+            }
+        });
+    }
+    releaseClient(clientId) {
+        try {
+            (0, sdk_core_1.release_client)(clientId);
+        }
+        catch (e) {
+            console.warn("failed to release client:", e);
+        }
+    }
+}
+exports.WasmCore = WasmCore;
+/**
+ *  An implementation of the `Core` interface that shares resources across all clients.
+ */
+class SharedCore {
+    constructor() {
+        this.inner = new WasmCore();
+    }
+    setInner(core) {
+        this.inner = core;
+    }
+    initClient(config) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serializedConfig = JSON.stringify(config);
+            return this.inner.initClient(serializedConfig);
+        });
+    }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // The oidcFetcher is passed separately and dropped by JSON serialization.
+            const serializedConfig = JSON.stringify(config);
+            return this.inner.initClientOidc(serializedConfig, fetcher);
+        });
+    }
+    invoke(config) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serializedConfig = JSON.stringify(config, types_1.ReplacerFunc);
+            // Encoding to bytes as JS uses UTF-16 under the hood, but the messages
+            // that are sent across the FFI boundary are encoded in UTF-8.
+            if (new TextEncoder().encode(serializedConfig).length > messageLimit) {
+                (0, errors_1.throwError)(`message size exceeds the limit of ${messageLimit} bytes, please contact 1Password at support@1password.com or https://developer.1password.com/joinslack if you need help."`);
+            }
+            return this.inner.invoke(serializedConfig);
+        });
+    }
+    invoke_sync(config) {
+        const serializedConfig = JSON.stringify(config, types_1.ReplacerFunc);
+        // Encoding to bytes as JS uses UTF-16 under the hood, but the messages
+        // that are sent across the FFI boundary are encoded in UTF-8.
+        if (new TextEncoder().encode(serializedConfig).length > messageLimit) {
+            (0, errors_1.throwError)(`message size exceeds the limit of ${messageLimit} bytes, please contact 1Password at support@1password.com or https://developer.1password.com/joinslack if you need help.`);
+        }
+        return (0, sdk_core_1.invoke_sync)(serializedConfig);
+    }
+    releaseClient(clientId) {
+        const serializedId = JSON.stringify(clientId);
+        this.inner.releaseClient(serializedId);
+    }
+}
+exports.SharedCore = SharedCore;
+/**
+ *  Represents the client instance on which a call is made.
+ */
+class InnerClient {
+    constructor(id, core) {
+        this.id = id;
+        this.core = core;
+    }
+    invoke(config) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.core.invoke(config);
+        });
+    }
+}
+exports.InnerClient = InnerClient;
+/**
+ *  A token- or desktop-authenticated client. It retains the auth config so it can
+ *  transparently re-initialize after a desktop session expires.
+ */
+class StandardClient extends InnerClient {
+    constructor(id, core, config) {
+        super(id, core);
+        this.config = config;
+    }
+    invoke(config) {
+        const _super = Object.create(null, {
+            invoke: { get: () => super.invoke }
+        });
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield _super.invoke.call(this, config);
+            }
+            catch (err) {
+                if (err instanceof errors_1.DesktopSessionExpiredError) {
+                    const newId = yield this.core.initClient(this.config);
+                    this.id = parseInt(newId, 10);
+                    config.invocation.clientId = this.id;
+                    return yield _super.invoke.call(this, config);
+                }
+                throw err;
+            }
+        });
+    }
+}
+exports.StandardClient = StandardClient;

package/dist/credential_broker.d.ts

@@ -0,0 +1,28 @@
+import { InnerClient } from "./core.js";
+import { CredentialBrokerEnvironmentVariablesApi } from "./credential_broker_environment_variables.js";
+import { CredentialBrokerLoginsApi } from "./credential_broker_logins.js";
+import { CredentialBrokerAccessRequestsApi } from "./credential_broker_access_requests.js";
+/**
+ * Root namespace for the 1Password Credential Broker.
+ *
+ * Marker trait — no methods of its own. Each supported credential kind is a
+ * nested API accessed as `client.credential_broker.<kind>`
+ * ([`EnvironmentVariables`] and [`Logins`] today; `ApiKey`, ... as they land).
+ */
+export interface CredentialBrokerApi {
+    environmentVariables: CredentialBrokerEnvironmentVariablesApi;
+    logins: CredentialBrokerLoginsApi;
+}
+export declare class CredentialBroker implements CredentialBrokerApi {
+    #private;
+    environmentVariables: CredentialBrokerEnvironmentVariablesApi;
+    logins: CredentialBrokerLoginsApi;
+    constructor(inner: InnerClient);
+}
+export interface OAuthCredentialBrokerApi extends CredentialBrokerApi {
+    accessRequests: CredentialBrokerAccessRequestsApi;
+}
+export declare class OAuthCredentialBroker extends CredentialBroker implements OAuthCredentialBrokerApi {
+    accessRequests: CredentialBrokerAccessRequestsApi;
+    constructor(inner: InnerClient);
+}

package/dist/credential_broker.js

@@ -0,0 +1,31 @@
+"use strict";
+// Code generated by op-codegen - DO NOT EDIT MANUALLY
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _CredentialBroker_inner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthCredentialBroker = exports.CredentialBroker = void 0;
+const credential_broker_environment_variables_js_1 = require("./credential_broker_environment_variables.js");
+const credential_broker_logins_js_1 = require("./credential_broker_logins.js");
+const credential_broker_access_requests_js_1 = require("./credential_broker_access_requests.js");
+class CredentialBroker {
+    constructor(inner) {
+        _CredentialBroker_inner.set(this, void 0);
+        __classPrivateFieldSet(this, _CredentialBroker_inner, inner, "f");
+        this.environmentVariables = new credential_broker_environment_variables_js_1.CredentialBrokerEnvironmentVariables(inner);
+        this.logins = new credential_broker_logins_js_1.CredentialBrokerLogins(inner);
+    }
+}
+exports.CredentialBroker = CredentialBroker;
+_CredentialBroker_inner = new WeakMap();
+class OAuthCredentialBroker extends CredentialBroker {
+    constructor(inner) {
+        super(inner);
+        this.accessRequests = new credential_broker_access_requests_js_1.CredentialBrokerAccessRequests(inner);
+    }
+}
+exports.OAuthCredentialBroker = OAuthCredentialBroker;

package/dist/credential_broker_access_requests.d.ts

@@ -0,0 +1,43 @@
+import { InnerClient } from "./core.js";
+import { AccessRequest, AccessRequestCreateParams, AccessRequestStatus } from "./types.js";
+/**
+ * Create and poll credential-broker access requests: asking a target
+ * identity to grant this workload access to one or more credentials.
+ *
+ * Accessed as `client.credential_broker.access_requests` in the generated
+ * SDK bindings.
+ */
+export interface CredentialBrokerAccessRequestsApi {
+    /**
+     * Register a new access request. The SDK mints the request id and
+     * per-entry ids, and derives the target identity from the
+     * authenticated workload.
+     *
+     * Only the non-sensitive half is registered server-side; the returned
+     * request is the full object with the presentation fields re-attached.
+     */
+    create(params: AccessRequestCreateParams): Promise<AccessRequest>;
+    /**
+     * Get the current status of an access request created by
+     * [`AccessRequests::create`].
+     */
+    getStatus(accessRequestId: string): Promise<AccessRequestStatus>;
+}
+export declare class CredentialBrokerAccessRequests implements CredentialBrokerAccessRequestsApi {
+    #private;
+    constructor(inner: InnerClient);
+    /**
+     * Register a new access request. The SDK mints the request id and
+     * per-entry ids, and derives the target identity from the
+     * authenticated workload.
+     *
+     * Only the non-sensitive half is registered server-side; the returned
+     * request is the full object with the presentation fields re-attached.
+     */
+    create(params: AccessRequestCreateParams): Promise<AccessRequest>;
+    /**
+     * Get the current status of an access request created by
+     * [`AccessRequests::create`].
+     */
+    getStatus(accessRequestId: string): Promise<AccessRequestStatus>;
+}

package/dist/credential_broker_access_requests.js

@@ -0,0 +1,78 @@
+"use strict";
+// Code generated by op-codegen - DO NOT EDIT MANUALLY
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _CredentialBrokerAccessRequests_inner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialBrokerAccessRequests = void 0;
+const types_js_1 = require("./types.js");
+class CredentialBrokerAccessRequests {
+    constructor(inner) {
+        _CredentialBrokerAccessRequests_inner.set(this, void 0);
+        __classPrivateFieldSet(this, _CredentialBrokerAccessRequests_inner, inner, "f");
+    }
+    /**
+     * Register a new access request. The SDK mints the request id and
+     * per-entry ids, and derives the target identity from the
+     * authenticated workload.
+     *
+     * Only the non-sensitive half is registered server-side; the returned
+     * request is the full object with the presentation fields re-attached.
+     */
+    create(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const invocationConfig = {
+                invocation: {
+                    clientId: __classPrivateFieldGet(this, _CredentialBrokerAccessRequests_inner, "f").id,
+                    parameters: {
+                        name: "CredentialBrokerAccessRequestsCreate",
+                        parameters: {
+                            params,
+                        },
+                    },
+                },
+            };
+            return JSON.parse(yield __classPrivateFieldGet(this, _CredentialBrokerAccessRequests_inner, "f").invoke(invocationConfig), types_js_1.ReviverFunc);
+        });
+    }
+    /**
+     * Get the current status of an access request created by
+     * [`AccessRequests::create`].
+     */
+    getStatus(accessRequestId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const invocationConfig = {
+                invocation: {
+                    clientId: __classPrivateFieldGet(this, _CredentialBrokerAccessRequests_inner, "f").id,
+                    parameters: {
+                        name: "CredentialBrokerAccessRequestsGetStatus",
+                        parameters: {
+                            access_request_id: accessRequestId,
+                        },
+                    },
+                },
+            };
+            return JSON.parse(yield __classPrivateFieldGet(this, _CredentialBrokerAccessRequests_inner, "f").invoke(invocationConfig), types_js_1.ReviverFunc);
+        });
+    }
+}
+exports.CredentialBrokerAccessRequests = CredentialBrokerAccessRequests;
+_CredentialBrokerAccessRequests_inner = new WeakMap();

package/dist/credential_broker_environment_variables.d.ts

@@ -0,0 +1,33 @@
+import { InnerClient } from "./core.js";
+import { CredentialReference, EnvironmentCredential } from "./types.js";
+/**
+ * Read environment credentials — a bundle of environment variables — from
+ * the 1Password Credential Broker.
+ *
+ * Accessed as `client.credential_broker.environment_variables` in the generated SDK
+ * bindings.
+ */
+export interface CredentialBrokerEnvironmentVariablesApi {
+    /**
+     * Fetch the environment credential identified by `credential_reference`.
+     *
+     * In addition to transport, keyset-decryption, and enclave errors surfaced as [Error::Internal],
+     * fails with [Error::InvalidCredentialReference] if the reference is malformed
+     * or does not name an environment credential, or with [Error::CredentialReferenceAccountMismatch]
+     * if it belongs to a different account than the authenticated client.
+     */
+    read(credentialReference: CredentialReference): Promise<EnvironmentCredential>;
+}
+export declare class CredentialBrokerEnvironmentVariables implements CredentialBrokerEnvironmentVariablesApi {
+    #private;
+    constructor(inner: InnerClient);
+    /**
+     * Fetch the environment credential identified by `credential_reference`.
+     *
+     * In addition to transport, keyset-decryption, and enclave errors surfaced as [Error::Internal],
+     * fails with [Error::InvalidCredentialReference] if the reference is malformed
+     * or does not name an environment credential, or with [Error::CredentialReferenceAccountMismatch]
+     * if it belongs to a different account than the authenticated client.
+     */
+    read(credentialReference: CredentialReference): Promise<EnvironmentCredential>;
+}

package/dist/credential_broker_environment_variables.js

@@ -0,0 +1,58 @@
+"use strict";
+// Code generated by op-codegen - DO NOT EDIT MANUALLY
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _CredentialBrokerEnvironmentVariables_inner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialBrokerEnvironmentVariables = void 0;
+const types_js_1 = require("./types.js");
+class CredentialBrokerEnvironmentVariables {
+    constructor(inner) {
+        _CredentialBrokerEnvironmentVariables_inner.set(this, void 0);
+        __classPrivateFieldSet(this, _CredentialBrokerEnvironmentVariables_inner, inner, "f");
+    }
+    /**
+     * Fetch the environment credential identified by `credential_reference`.
+     *
+     * In addition to transport, keyset-decryption, and enclave errors surfaced as [Error::Internal],
+     * fails with [Error::InvalidCredentialReference] if the reference is malformed
+     * or does not name an environment credential, or with [Error::CredentialReferenceAccountMismatch]
+     * if it belongs to a different account than the authenticated client.
+     */
+    read(credentialReference) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const invocationConfig = {
+                invocation: {
+                    clientId: __classPrivateFieldGet(this, _CredentialBrokerEnvironmentVariables_inner, "f").id,
+                    parameters: {
+                        name: "CredentialBrokerEnvironmentVariablesRead",
+                        parameters: {
+                            credential_reference: credentialReference,
+                        },
+                    },
+                },
+            };
+            return JSON.parse(yield __classPrivateFieldGet(this, _CredentialBrokerEnvironmentVariables_inner, "f").invoke(invocationConfig), types_js_1.ReviverFunc);
+        });
+    }
+}
+exports.CredentialBrokerEnvironmentVariables = CredentialBrokerEnvironmentVariables;
+_CredentialBrokerEnvironmentVariables_inner = new WeakMap();

package/dist/credential_broker_logins.d.ts

@@ -0,0 +1,38 @@
+import { InnerClient } from "./core.js";
+import { CredentialReference, LoginCredential, LoginDetails } from "./types.js";
+/**
+ * Read login credentials from the 1Password Credential Broker.
+ * Accessed as `client.credential_broker.logins` in the generated SDK bindings.
+ */
+export interface CredentialBrokerLoginsApi {
+    /**
+     * Fetch the login credential identified by `credential_reference`.
+     *
+     * In addition to transport, keyset-decryption, and enclave errors surfaced as [Error::Internal],
+     * fails with [Error::InvalidCredentialReference] if the reference is malformed
+     * or does not name a login credential, or with [Error::CredentialReferenceAccountMismatch]
+     * if it belongs to a different account than the authenticated client.
+     */
+    read(credentialReference: CredentialReference): Promise<LoginCredential>;
+    /**
+     * Fetch non-secret details for the login identified by `credential_reference`.
+     */
+    getDetails(credentialReference: CredentialReference): Promise<LoginDetails>;
+}
+export declare class CredentialBrokerLogins implements CredentialBrokerLoginsApi {
+    #private;
+    constructor(inner: InnerClient);
+    /**
+     * Fetch the login credential identified by `credential_reference`.
+     *
+     * In addition to transport, keyset-decryption, and enclave errors surfaced as [Error::Internal],
+     * fails with [Error::InvalidCredentialReference] if the reference is malformed
+     * or does not name a login credential, or with [Error::CredentialReferenceAccountMismatch]
+     * if it belongs to a different account than the authenticated client.
+     */
+    read(credentialReference: CredentialReference): Promise<LoginCredential>;
+    /**
+     * Fetch non-secret details for the login identified by `credential_reference`.
+     */
+    getDetails(credentialReference: CredentialReference): Promise<LoginDetails>;
+}

package/dist/credential_broker_logins.js

@@ -0,0 +1,77 @@
+"use strict";
+// Code generated by op-codegen - DO NOT EDIT MANUALLY
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _CredentialBrokerLogins_inner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialBrokerLogins = void 0;
+const types_js_1 = require("./types.js");
+class CredentialBrokerLogins {
+    constructor(inner) {
+        _CredentialBrokerLogins_inner.set(this, void 0);
+        __classPrivateFieldSet(this, _CredentialBrokerLogins_inner, inner, "f");
+    }
+    /**
+     * Fetch the login credential identified by `credential_reference`.
+     *
+     * In addition to transport, keyset-decryption, and enclave errors surfaced as [Error::Internal],
+     * fails with [Error::InvalidCredentialReference] if the reference is malformed
+     * or does not name a login credential, or with [Error::CredentialReferenceAccountMismatch]
+     * if it belongs to a different account than the authenticated client.
+     */
+    read(credentialReference) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const invocationConfig = {
+                invocation: {
+                    clientId: __classPrivateFieldGet(this, _CredentialBrokerLogins_inner, "f").id,
+                    parameters: {
+                        name: "CredentialBrokerLoginsRead",
+                        parameters: {
+                            credential_reference: credentialReference,
+                        },
+                    },
+                },
+            };
+            return JSON.parse(yield __classPrivateFieldGet(this, _CredentialBrokerLogins_inner, "f").invoke(invocationConfig), types_js_1.ReviverFunc);
+        });
+    }
+    /**
+     * Fetch non-secret details for the login identified by `credential_reference`.
+     */
+    getDetails(credentialReference) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const invocationConfig = {
+                invocation: {
+                    clientId: __classPrivateFieldGet(this, _CredentialBrokerLogins_inner, "f").id,
+                    parameters: {
+                        name: "CredentialBrokerLoginsGetDetails",
+                        parameters: {
+                            credential_reference: credentialReference,
+                        },
+                    },
+                },
+            };
+            return JSON.parse(yield __classPrivateFieldGet(this, _CredentialBrokerLogins_inner, "f").invoke(invocationConfig), types_js_1.ReviverFunc);
+        });
+    }
+}
+exports.CredentialBrokerLogins = CredentialBrokerLogins;
+_CredentialBrokerLogins_inner = new WeakMap();

package/dist/environments.d.ts

@@ -0,0 +1,82 @@
+import { InnerClient } from "./core.js";
+import { Environment, EnvironmentSecret, GetVariablesResponse } from "./types.js";
+/**
+ * The Environments API holds all the operations the SDK client can perform
+ * on 1Password Environments and the secrets inside them.
+ */
+export interface EnvironmentsApi {
+    /**
+     * Get environment variables belonging to an Environment.
+     */
+    getVariables(environmentId: string): Promise<GetVariablesResponse>;
+    /**
+     * Get a single secret from an Environment.
+     *
+     * `environment_name_id` accepts either the Environment's name or its
+     * ID; a name that matches more than one Environment is an error.
+     *
+     * `secret_name` is the name of the secret to get, matched
+     * case-insensitively; a name that matches more than one secret in the
+     * Environment is an error.
+     *
+     * `reveal` controls whether a concealed secret's value is returned;
+     * when `reveal` is `false`, a concealed value is withheld.
+     */
+    getSecret(environmentNameId: string, secretName: string, reveal: boolean): Promise<EnvironmentSecret>;
+    /**
+     * List all secrets in an Environment.
+     *
+     * `environment_name_id` accepts either the Environment's name or its
+     * ID; a name that matches more than one Environment is an error.
+     *
+     * `reveal` controls whether concealed secrets' values are returned;
+     * when `reveal` is `false`, concealed values are withheld.
+     */
+    listSecrets(environmentNameId: string, reveal: boolean): Promise<EnvironmentSecret[]>;
+    /**
+     * Create a new Environment.
+     *
+     * `environment_name` accepts a name for the new Environment. The name is
+     * trimmed. A name that is empty after trimming is an error.
+     */
+    create(environmentName: string): Promise<Environment>;
+}
+export declare class Environments implements EnvironmentsApi {
+    #private;
+    constructor(inner: InnerClient);
+    /**
+     * Get environment variables belonging to an Environment.
+     */
+    getVariables(environmentId: string): Promise<GetVariablesResponse>;
+    /**
+     * Get a single secret from an Environment.
+     *
+     * `environment_name_id` accepts either the Environment's name or its
+     * ID; a name that matches more than one Environment is an error.
+     *
+     * `secret_name` is the name of the secret to get, matched
+     * case-insensitively; a name that matches more than one secret in the
+     * Environment is an error.
+     *
+     * `reveal` controls whether a concealed secret's value is returned;
+     * when `reveal` is `false`, a concealed value is withheld.
+     */
+    getSecret(environmentNameId: string, secretName: string, reveal: boolean): Promise<EnvironmentSecret>;
+    /**
+     * List all secrets in an Environment.
+     *
+     * `environment_name_id` accepts either the Environment's name or its
+     * ID; a name that matches more than one Environment is an error.
+     *
+     * `reveal` controls whether concealed secrets' values are returned;
+     * when `reveal` is `false`, concealed values are withheld.
+     */
+    listSecrets(environmentNameId: string, reveal: boolean): Promise<EnvironmentSecret[]>;
+    /**
+     * Create a new Environment.
+     *
+     * `environment_name` accepts a name for the new Environment. The name is
+     * trimmed. A name that is empty after trimming is an error.
+     */
+    create(environmentName: string): Promise<Environment>;
+}