@executor-js/plugin-onepassword 0.0.1-beta.4 → 0.0.1-beta.6

package/README.md

@@ -2,8 +2,6 @@
 
 [1Password](https://1password.com) integration for the executor. Provides a secret source that resolves values from a 1Password vault, backed by either the desktop app (connect.sock) or a service account token.
 
-Pairs with [`@executor/sdk`](https://www.npmjs.com/package/@executor/sdk) (promise-based) or [`@executor/core`](https://www.npmjs.com/package/@executor/core) (Effect-based).
-
 ## Install
 
 ```sh
@@ -16,7 +14,7 @@ npm install @executor/sdk @executor/plugin-onepassword
 
 ```ts
 import { createExecutor } from "@executor/sdk";
-import { onepasswordPlugin } from "@executor/plugin-onepassword/core";
+import { onepasswordPlugin } from "@executor/plugin-onepassword";
 
 const executor = await createExecutor({
   scope: { name: "my-app" },
@@ -44,9 +42,13 @@ await executor.onepassword.configure({
 });
 ```
 
-## Effect entry point
+## Using with Effect
+
+If you're building on `@executor/sdk` (the raw Effect entry), import this plugin from its `/core` subpath instead:
 
-If you're using `@executor/core` directly, the same import path works — this plugin does not ship a separate promise entry.
+```ts
+import { onepasswordPlugin } from "@executor/plugin-onepassword";
+```
 
 ## Status
 

package/dist/chunk-57NB4OW6.js

@@ -0,0 +1,311 @@
+// src/sdk/types.ts
+import { Schema } from "effect";
+var DesktopAppAuth = class extends Schema.Class("DesktopAppAuth")({
+  kind: Schema.Literal("desktop-app"),
+  /** 1Password account domain, e.g. "my.1password.com" */
+  accountName: Schema.String
+}) {
+};
+var ServiceAccountAuth = class extends Schema.Class("ServiceAccountAuth")({
+  kind: Schema.Literal("service-account"),
+  /** The service account token (stored as a secret) */
+  tokenSecretId: Schema.String
+}) {
+};
+var OnePasswordAuth = Schema.Union(DesktopAppAuth, ServiceAccountAuth);
+var OnePasswordConfig = class extends Schema.Class("OnePasswordConfig")({
+  auth: OnePasswordAuth,
+  /** Vault to scope operations to */
+  vaultId: Schema.String,
+  /** Human label */
+  name: Schema.String
+}) {
+};
+var Vault = class extends Schema.Class("Vault")({
+  id: Schema.String,
+  name: Schema.String
+}) {
+};
+var ConnectionStatus = class extends Schema.Class("ConnectionStatus")({
+  connected: Schema.Boolean,
+  vaultName: Schema.optional(Schema.String),
+  error: Schema.optional(Schema.String)
+}) {
+};
+
+// src/sdk/errors.ts
+import { Schema as Schema2 } from "effect";
+var OnePasswordError = class extends Schema2.TaggedError()("OnePasswordError", {
+  operation: Schema2.String,
+  message: Schema2.String
+}) {
+};
+
+// src/sdk/service.ts
+import { Context, Duration, Effect } from "effect";
+import * as op from "@1password/op-js";
+var OnePasswordServiceTag = class extends Context.Tag(
+  "@executor-js/plugin-onepassword/OnePasswordService"
+)() {
+};
+var DEFAULT_TIMEOUT_MS = 15e3;
+var loadOnePasswordSdk = () => Effect.tryPromise({
+  try: () => import("@1password/sdk"),
+  catch: (cause) => new OnePasswordError({
+    operation: "sdk module load",
+    message: cause instanceof Error ? cause.message : String(cause)
+  })
+});
+var makeTimeoutMessage = (operation, timeoutMs) => [
+  `${operation}: timed out after ${Math.floor(timeoutMs / 1e3)}s.`,
+  "Troubleshooting:",
+  "1. Make sure the 1Password desktop app is open and unlocked",
+  "2. Check for an approval prompt in the 1Password app \u2014 it may be behind other windows",
+  "3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings",
+  "4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)",
+  "5. Try quitting 1Password completely and reopening it, then retry"
+].join("\n");
+var makeNativeSdkService = (auth, timeoutMs = DEFAULT_TIMEOUT_MS) => Effect.gen(function* () {
+  const timeout = Duration.millis(timeoutMs);
+  const sdk = yield* loadOnePasswordSdk().pipe(
+    Effect.timeoutFail({
+      duration: timeout,
+      onTimeout: () => new OnePasswordError({
+        operation: "sdk module load",
+        message: makeTimeoutMessage("sdk module load", timeoutMs)
+      })
+    })
+  );
+  const client = yield* Effect.tryPromise({
+    try: () => sdk.createClient({
+      auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token,
+      integrationName: "Executor",
+      integrationVersion: "0.0.0"
+    }),
+    catch: (cause) => new OnePasswordError({
+      operation: "client setup",
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  }).pipe(
+    Effect.timeoutFail({
+      duration: timeout,
+      onTimeout: () => new OnePasswordError({
+        operation: "client setup",
+        message: makeTimeoutMessage("client setup", timeoutMs)
+      })
+    })
+  );
+  const wrap = (fn, operation) => Effect.tryPromise({
+    try: fn,
+    catch: (cause) => new OnePasswordError({
+      operation,
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  }).pipe(
+    Effect.timeoutFail({
+      duration: timeout,
+      onTimeout: () => new OnePasswordError({
+        operation,
+        message: makeTimeoutMessage(operation, timeoutMs)
+      })
+    }),
+    Effect.withSpan(`onepassword.sdk.${operation}`)
+  );
+  return OnePasswordServiceTag.of({
+    resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"),
+    listVaults: () => wrap(() => client.vaults.list({ decryptDetails: true }), "vault listing").pipe(
+      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title })))
+    ),
+    listItems: (vaultId) => wrap(() => client.items.list(vaultId), "item listing").pipe(
+      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
+    )
+  });
+}).pipe(Effect.withSpan("onepassword.sdk.make_service"));
+var makeCliService = (auth) => Effect.sync(() => {
+  if (auth.kind === "service-account") {
+    op.setServiceAccount(auth.token);
+  } else {
+    op.setGlobalFlags({ account: auth.accountName });
+  }
+  const wrapSync = (fn, operation) => Effect.try({
+    try: fn,
+    catch: (cause) => new OnePasswordError({
+      operation,
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  }).pipe(Effect.withSpan(`onepassword.cli.${operation}`));
+  return OnePasswordServiceTag.of({
+    resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"),
+    listVaults: () => wrapSync(() => op.vault.list(), "vault listing").pipe(
+      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name })))
+    ),
+    listItems: (vaultId) => wrapSync(() => op.item.list({ vault: vaultId }), "item listing").pipe(
+      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
+    )
+  });
+}).pipe(Effect.withSpan("onepassword.cli.make_service"));
+var makeOnePasswordService = (auth, options) => {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (options?.preferSdk) {
+    return makeNativeSdkService(auth, timeoutMs);
+  }
+  return makeCliService(auth).pipe(
+    Effect.catchAll(
+      (cliError) => (
+        // CLI unavailable (e.g. `op` not installed) — fall back to SDK
+        makeNativeSdkService(auth, timeoutMs).pipe(Effect.mapError(() => cliError))
+      )
+    )
+  );
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect2, Schema as Schema3 } from "effect";
+import {
+  definePlugin,
+  SecretId
+} from "@executor-js/sdk";
+var PLUGIN_KEY = "onepassword";
+var CREDENTIAL_FIELD = "credential";
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+var CONFIG_KEY = "config";
+var resolveAuth = (auth, ctx) => {
+  if (auth.kind === "desktop-app") {
+    return Effect2.succeed({
+      kind: "desktop-app",
+      accountName: auth.accountName
+    });
+  }
+  return ctx.secrets.resolve(SecretId.make(auth.tokenSecretId), ctx.scope.id).pipe(
+    Effect2.map((token) => ({ kind: "service-account", token })),
+    Effect2.mapError(
+      (e) => new OnePasswordError({
+        operation: "auth resolution",
+        message: `Failed to resolve service account token secret "${auth.tokenSecretId}": ${e._tag}`
+      })
+    )
+  );
+};
+var getServiceFromConfig = (config, ctx, timeoutMs) => resolveAuth(config.auth, ctx).pipe(
+  Effect2.flatMap((resolved) => makeOnePasswordService(resolved, { timeoutMs }))
+);
+var makeProvider = (getConfig, ctx, timeoutMs) => ({
+  key: "onepassword",
+  writable: false,
+  get: (secretId) => getConfig().pipe(
+    Effect2.flatMap((config) => {
+      if (!config) return Effect2.succeed(null);
+      const uri = secretId.startsWith("op://") ? secretId : `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;
+      return getServiceFromConfig(config, ctx, timeoutMs).pipe(
+        Effect2.flatMap((svc) => svc.resolveSecret(uri)),
+        Effect2.map((v) => v),
+        Effect2.orElseSucceed(() => null)
+      );
+    }),
+    Effect2.orElseSucceed(() => null)
+  ),
+  list: () => getConfig().pipe(
+    Effect2.flatMap((config) => {
+      if (!config) return Effect2.succeed([]);
+      return getServiceFromConfig(config, ctx, timeoutMs).pipe(
+        Effect2.flatMap((svc) => svc.listItems(config.vaultId)),
+        Effect2.map((items) => items.map((item2) => ({ id: item2.id, name: item2.title })))
+      );
+    }),
+    Effect2.orElseSucceed(() => [])
+  )
+});
+var decodeConfig = Schema3.decodeUnknownSync(OnePasswordConfig);
+var loadConfig = (kv) => kv.get(CONFIG_KEY).pipe(
+  Effect2.flatMap((v) => {
+    if (v === null) return Effect2.succeed(null);
+    return Effect2.try(() => decodeConfig(JSON.parse(v))).pipe(
+      Effect2.mapError(
+        (cause) => new OnePasswordError({
+          operation: "config decode",
+          message: cause instanceof Error ? cause.message : String(cause)
+        })
+      )
+    );
+  })
+);
+var saveConfig = (kv, config) => kv.set([
+  {
+    key: CONFIG_KEY,
+    value: JSON.stringify({
+      auth: config.auth,
+      vaultId: config.vaultId,
+      name: config.name
+    })
+  }
+]);
+var deleteConfig = (kv) => kv.delete([CONFIG_KEY]).pipe(Effect2.asVoid);
+var onepasswordPlugin = (options) => {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const kv = options.kv;
+  return definePlugin({
+    key: PLUGIN_KEY,
+    init: (ctx) => Effect2.gen(function* () {
+      const getConfig = () => loadConfig(kv);
+      yield* ctx.secrets.addProvider(makeProvider(getConfig, ctx, timeoutMs));
+      const extension = {
+        configure: (config) => saveConfig(kv, config),
+        getConfig: () => getConfig(),
+        removeConfig: () => deleteConfig(kv),
+        status: () => Effect2.gen(function* () {
+          const config = yield* getConfig();
+          if (!config) {
+            return new ConnectionStatus({
+              connected: false,
+              error: "Not configured"
+            });
+          }
+          const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);
+          const vaults = yield* svc.listVaults();
+          const vault2 = vaults.find((v) => v.id === config.vaultId);
+          return new ConnectionStatus({
+            connected: true,
+            vaultName: vault2?.title
+          });
+        }),
+        listVaults: (auth) => Effect2.gen(function* () {
+          const resolved = yield* resolveAuth(auth, ctx);
+          const svc = yield* makeOnePasswordService(resolved, {
+            timeoutMs,
+            preferSdk: options.preferSdk
+          });
+          const vaults = yield* svc.listVaults();
+          return vaults.map((v) => new Vault({ id: v.id, name: v.title })).sort((a, b) => a.name.localeCompare(b.name));
+        }),
+        resolve: (uri) => Effect2.gen(function* () {
+          const config = yield* getConfig();
+          if (!config) {
+            return yield* new OnePasswordError({
+              operation: "resolve",
+              message: "1Password is not configured"
+            });
+          }
+          const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);
+          return yield* svc.resolveSecret(uri);
+        })
+      };
+      return { extension };
+    })
+  });
+};
+
+export {
+  DesktopAppAuth,
+  ServiceAccountAuth,
+  OnePasswordAuth,
+  OnePasswordConfig,
+  Vault,
+  ConnectionStatus,
+  OnePasswordError,
+  OnePasswordServiceTag,
+  makeNativeSdkService,
+  makeCliService,
+  makeOnePasswordService,
+  onepasswordPlugin
+};
+//# sourceMappingURL=chunk-57NB4OW6.js.map

package/dist/chunk-57NB4OW6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/types.ts","../src/sdk/errors.ts","../src/sdk/service.ts","../src/sdk/plugin.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n// ---------------------------------------------------------------------------\n// Auth — how to talk to 1Password\n// ---------------------------------------------------------------------------\n\nexport class DesktopAppAuth extends Schema.Class<DesktopAppAuth>(\"DesktopAppAuth\")({\n  kind: Schema.Literal(\"desktop-app\"),\n  /** 1Password account domain, e.g. \"my.1password.com\" */\n  accountName: Schema.String,\n}) {}\n\nexport class ServiceAccountAuth extends Schema.Class<ServiceAccountAuth>(\"ServiceAccountAuth\")({\n  kind: Schema.Literal(\"service-account\"),\n  /** The service account token (stored as a secret) */\n  tokenSecretId: Schema.String,\n}) {}\n\nexport const OnePasswordAuth = Schema.Union(DesktopAppAuth, ServiceAccountAuth);\nexport type OnePasswordAuth = typeof OnePasswordAuth.Type;\n\n// ---------------------------------------------------------------------------\n// Stored config — persisted via KV\n// ---------------------------------------------------------------------------\n\nexport class OnePasswordConfig extends Schema.Class<OnePasswordConfig>(\"OnePasswordConfig\")({\n  auth: OnePasswordAuth,\n  /** Vault to scope operations to */\n  vaultId: Schema.String,\n  /** Human label */\n  name: Schema.String,\n}) {}\n\n// ---------------------------------------------------------------------------\n// Vault\n// ---------------------------------------------------------------------------\n\nexport class Vault extends Schema.Class<Vault>(\"Vault\")({\n  id: Schema.String,\n  name: Schema.String,\n}) {}\n\n// ---------------------------------------------------------------------------\n// Connection status\n// ---------------------------------------------------------------------------\n\nexport class ConnectionStatus extends Schema.Class<ConnectionStatus>(\"ConnectionStatus\")({\n  connected: Schema.Boolean,\n  vaultName: Schema.optional(Schema.String),\n  error: Schema.optional(Schema.String),\n}) {}\n","import { Schema } from \"effect\";\n\nexport class OnePasswordError extends Schema.TaggedError<OnePasswordError>()(\"OnePasswordError\", {\n  operation: Schema.String,\n  message: Schema.String,\n}) {}\n","import { Context, Duration, Effect } from \"effect\";\nimport * as op from \"@1password/op-js\";\n\nimport { OnePasswordError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Canonical service interface — all backends (SDK, CLI) implement this\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordVault {\n  readonly id: string;\n  readonly title: string;\n}\n\nexport interface OnePasswordItem {\n  readonly id: string;\n  readonly title: string;\n}\n\nexport interface OnePasswordService {\n  /** Resolve a secret by op:// URI */\n  readonly resolveSecret: (uri: string) => Effect.Effect<string, OnePasswordError>;\n\n  /** List accessible vaults */\n  readonly listVaults: () => Effect.Effect<ReadonlyArray<OnePasswordVault>, OnePasswordError>;\n\n  /** List items in a vault */\n  readonly listItems: (\n    vaultId: string,\n  ) => Effect.Effect<ReadonlyArray<OnePasswordItem>, OnePasswordError>;\n}\n\nexport class OnePasswordServiceTag extends Context.Tag(\n  \"@executor/plugin-onepassword/OnePasswordService\",\n)<OnePasswordServiceTag, OnePasswordService>() {}\n\n// ---------------------------------------------------------------------------\n// Resolved auth — raw credentials ready for any backend\n// ---------------------------------------------------------------------------\n\nexport type ResolvedAuth =\n  | { readonly kind: \"desktop-app\"; readonly accountName: string }\n  | { readonly kind: \"service-account\"; readonly token: string };\n\n// ---------------------------------------------------------------------------\n// SDK backend — uses @1password/sdk native IPC\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_TIMEOUT_MS = 15_000;\ntype OnePasswordSdkModule = typeof import(\"@1password/sdk\");\n\nconst loadOnePasswordSdk = (): Effect.Effect<OnePasswordSdkModule, OnePasswordError> =>\n  Effect.tryPromise({\n    try: () => import(\"@1password/sdk\"),\n    catch: (cause) =>\n      new OnePasswordError({\n        operation: \"sdk module load\",\n        message: cause instanceof Error ? cause.message : String(cause),\n      }),\n  });\n\nconst makeTimeoutMessage = (operation: string, timeoutMs: number): string =>\n  [\n    `${operation}: timed out after ${Math.floor(timeoutMs / 1000)}s.`,\n    \"Troubleshooting:\",\n    \"1. Make sure the 1Password desktop app is open and unlocked\",\n    \"2. Check for an approval prompt in the 1Password app — it may be behind other windows\",\n    \"3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings\",\n    \"4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)\",\n    \"5. Try quitting 1Password completely and reopening it, then retry\",\n  ].join(\"\\n\");\n\nexport const makeNativeSdkService = (\n  auth: ResolvedAuth,\n  timeoutMs: number = DEFAULT_TIMEOUT_MS,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  Effect.gen(function* () {\n    const timeout = Duration.millis(timeoutMs);\n    const sdk = yield* loadOnePasswordSdk().pipe(\n      Effect.timeoutFail({\n        duration: timeout,\n        onTimeout: () =>\n          new OnePasswordError({\n            operation: \"sdk module load\",\n            message: makeTimeoutMessage(\"sdk module load\", timeoutMs),\n          }),\n      }),\n    );\n\n    const client = yield* Effect.tryPromise({\n      try: () =>\n        sdk.createClient({\n          auth: auth.kind === \"desktop-app\" ? new sdk.DesktopAuth(auth.accountName) : auth.token,\n          integrationName: \"Executor\",\n          integrationVersion: \"0.0.0\",\n        }),\n      catch: (cause) =>\n        new OnePasswordError({\n          operation: \"client setup\",\n          message: cause instanceof Error ? cause.message : String(cause),\n        }),\n    }).pipe(\n      Effect.timeoutFail({\n        duration: timeout,\n        onTimeout: () =>\n          new OnePasswordError({\n            operation: \"client setup\",\n            message: makeTimeoutMessage(\"client setup\", timeoutMs),\n          }),\n      }),\n    );\n\n    const wrap = <A>(fn: () => Promise<A>, operation: string): Effect.Effect<A, OnePasswordError> =>\n      Effect.tryPromise({\n        try: fn,\n        catch: (cause) =>\n          new OnePasswordError({\n            operation,\n            message: cause instanceof Error ? cause.message : String(cause),\n          }),\n      }).pipe(\n        Effect.timeoutFail({\n          duration: timeout,\n          onTimeout: () =>\n            new OnePasswordError({\n              operation,\n              message: makeTimeoutMessage(operation, timeoutMs),\n            }),\n        }),\n        Effect.withSpan(`onepassword.sdk.${operation}`),\n      );\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), \"secret resolution\"),\n\n      listVaults: () =>\n        wrap(() => client.vaults.list({ decryptDetails: true }), \"vault listing\").pipe(\n          Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title }))),\n        ),\n\n      listItems: (vaultId) =>\n        wrap(() => client.items.list(vaultId), \"item listing\").pipe(\n          Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))),\n        ),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.sdk.make_service\"));\n\n// ---------------------------------------------------------------------------\n// CLI backend — uses @1password/op-js (shells out to `op` CLI)\n// ---------------------------------------------------------------------------\n\nexport const makeCliService = (\n  auth: ResolvedAuth,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  Effect.sync(() => {\n    // Configure auth\n    if (auth.kind === \"service-account\") {\n      op.setServiceAccount(auth.token);\n    } else {\n      op.setGlobalFlags({ account: auth.accountName });\n    }\n\n    const wrapSync = <A>(fn: () => A, operation: string): Effect.Effect<A, OnePasswordError> =>\n      Effect.try({\n        try: fn,\n        catch: (cause) =>\n          new OnePasswordError({\n            operation,\n            message: cause instanceof Error ? cause.message : String(cause),\n          }),\n      }).pipe(Effect.withSpan(`onepassword.cli.${operation}`));\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), \"secret resolution\"),\n\n      listVaults: () =>\n        wrapSync(() => op.vault.list(), \"vault listing\").pipe(\n          Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name }))),\n        ),\n\n      listItems: (vaultId) =>\n        wrapSync(() => op.item.list({ vault: vaultId }), \"item listing\").pipe(\n          Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))),\n        ),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.cli.make_service\"));\n\n// ---------------------------------------------------------------------------\n// Smart factory — tries CLI first (avoids IPC hang), falls back to SDK\n// ---------------------------------------------------------------------------\n\nexport const makeOnePasswordService = (\n  auth: ResolvedAuth,\n  options?: { readonly preferSdk?: boolean; readonly timeoutMs?: number },\n): Effect.Effect<OnePasswordService, OnePasswordError> => {\n  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  if (options?.preferSdk) {\n    return makeNativeSdkService(auth, timeoutMs);\n  }\n\n  // Default: prefer CLI to avoid the IPC hang bug\n  return makeCliService(auth).pipe(\n    Effect.catchAll((cliError) =>\n      // CLI unavailable (e.g. `op` not installed) — fall back to SDK\n      makeNativeSdkService(auth, timeoutMs).pipe(Effect.mapError(() => cliError)),\n    ),\n  );\n};\n","import { Effect, Schema } from \"effect\";\n\nimport {\n  definePlugin,\n  type ExecutorPlugin,\n  type PluginContext,\n  type SecretProvider,\n  type ScopedKv,\n  SecretId,\n} from \"@executor/sdk\";\n\nimport { OnePasswordConfig, Vault, ConnectionStatus } from \"./types\";\nimport type { OnePasswordAuth } from \"./types\";\nimport { OnePasswordError } from \"./errors\";\nimport { makeOnePasswordService, type ResolvedAuth, type OnePasswordService } from \"./service\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst PLUGIN_KEY = \"onepassword\";\nconst CREDENTIAL_FIELD = \"credential\";\nconst DEFAULT_TIMEOUT_MS = 15_000;\nconst CONFIG_KEY = \"config\";\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.onepassword\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordExtension {\n  /** Configure the 1Password connection */\n  readonly configure: (config: OnePasswordConfig) => Effect.Effect<void, OnePasswordError>;\n\n  /** Get current configuration (if any) */\n  readonly getConfig: () => Effect.Effect<OnePasswordConfig | null, OnePasswordError>;\n\n  /** Remove the 1Password configuration */\n  readonly removeConfig: () => Effect.Effect<void>;\n\n  /** Check connection status */\n  readonly status: () => Effect.Effect<ConnectionStatus, OnePasswordError>;\n\n  /** List accessible vaults (requires auth) */\n  readonly listVaults: (\n    auth: OnePasswordAuth,\n  ) => Effect.Effect<ReadonlyArray<Vault>, OnePasswordError>;\n\n  /** Resolve a secret directly by op:// URI */\n  readonly resolve: (uri: string) => Effect.Effect<string, OnePasswordError>;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst resolveAuth = (\n  auth: OnePasswordAuth,\n  ctx: PluginContext,\n): Effect.Effect<ResolvedAuth, OnePasswordError> => {\n  if (auth.kind === \"desktop-app\") {\n    return Effect.succeed({\n      kind: \"desktop-app\" as const,\n      accountName: auth.accountName,\n    });\n  }\n  return ctx.secrets.resolve(SecretId.make(auth.tokenSecretId), ctx.scope.id).pipe(\n    Effect.map((token): ResolvedAuth => ({ kind: \"service-account\", token })),\n    Effect.mapError(\n      (e) =>\n        new OnePasswordError({\n          operation: \"auth resolution\",\n          message: `Failed to resolve service account token secret \"${auth.tokenSecretId}\": ${e._tag}`,\n        }),\n    ),\n  );\n};\n\nconst getServiceFromConfig = (\n  config: OnePasswordConfig,\n  ctx: PluginContext,\n  timeoutMs: number,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  resolveAuth(config.auth, ctx).pipe(\n    Effect.flatMap((resolved) => makeOnePasswordService(resolved, { timeoutMs })),\n  );\n\n// ---------------------------------------------------------------------------\n// SecretProvider — read-only, resolves op:// URIs or vaultId-based lookups\n// ---------------------------------------------------------------------------\n\nconst makeProvider = (\n  getConfig: () => Effect.Effect<OnePasswordConfig | null, OnePasswordError>,\n  ctx: PluginContext,\n  timeoutMs: number,\n): SecretProvider => ({\n  key: \"onepassword\",\n  writable: false,\n\n  get: (secretId) =>\n    getConfig().pipe(\n      Effect.flatMap((config) => {\n        if (!config) return Effect.succeed(null);\n\n        const uri = secretId.startsWith(\"op://\")\n          ? secretId\n          : `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;\n\n        return getServiceFromConfig(config, ctx, timeoutMs).pipe(\n          Effect.flatMap((svc) => svc.resolveSecret(uri)),\n          Effect.map((v): string | null => v),\n          Effect.orElseSucceed(() => null),\n        );\n      }),\n      Effect.orElseSucceed(() => null),\n    ),\n\n  list: () =>\n    getConfig().pipe(\n      Effect.flatMap((config) => {\n        if (!config) return Effect.succeed([] as { id: string; name: string }[]);\n        return getServiceFromConfig(config, ctx, timeoutMs).pipe(\n          Effect.flatMap((svc) => svc.listItems(config.vaultId)),\n          Effect.map((items) => items.map((item) => ({ id: item.id, name: item.title }))),\n        );\n      }),\n      Effect.orElseSucceed(() => [] as { id: string; name: string }[]),\n    ),\n});\n\n// ---------------------------------------------------------------------------\n// Config persistence via ScopedKv\n// ---------------------------------------------------------------------------\n\nconst decodeConfig = Schema.decodeUnknownSync(OnePasswordConfig);\n\nconst loadConfig = (kv: ScopedKv): Effect.Effect<OnePasswordConfig | null, OnePasswordError> =>\n  kv.get(CONFIG_KEY).pipe(\n    Effect.flatMap((v) => {\n      if (v === null) return Effect.succeed(null);\n      return Effect.try(() => decodeConfig(JSON.parse(v))).pipe(\n        Effect.mapError(\n          (cause) =>\n            new OnePasswordError({\n              operation: \"config decode\",\n              message: cause instanceof Error ? cause.message : String(cause),\n            }),\n        ),\n      );\n    }),\n  );\n\nconst saveConfig = (kv: ScopedKv, config: OnePasswordConfig): Effect.Effect<void> =>\n  kv.set([\n    {\n      key: CONFIG_KEY,\n      value: JSON.stringify({\n        auth: config.auth,\n        vaultId: config.vaultId,\n        name: config.name,\n      }),\n    },\n  ]);\n\nconst deleteConfig = (kv: ScopedKv): Effect.Effect<void> =>\n  kv.delete([CONFIG_KEY]).pipe(Effect.asVoid);\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordPluginOptions {\n  /** Scoped KV for persisting config (provided by server) */\n  readonly kv: ScopedKv;\n  /** Request timeout in ms (default: 15000) */\n  readonly timeoutMs?: number;\n  /** Force use of the native SDK instead of the CLI (default: false) */\n  readonly preferSdk?: boolean;\n}\n\nexport const onepasswordPlugin = (\n  options: OnePasswordPluginOptions,\n): ExecutorPlugin<typeof PLUGIN_KEY, OnePasswordExtension> => {\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const kv = options.kv;\n\n  return definePlugin({\n    key: PLUGIN_KEY,\n    init: (ctx) =>\n      Effect.gen(function* () {\n        const getConfig = () => loadConfig(kv);\n\n        yield* ctx.secrets.addProvider(makeProvider(getConfig, ctx, timeoutMs));\n\n        const extension: OnePasswordExtension = {\n          configure: (config) => saveConfig(kv, config),\n\n          getConfig: () => getConfig(),\n\n          removeConfig: () => deleteConfig(kv),\n\n          status: () =>\n            Effect.gen(function* () {\n              const config = yield* getConfig();\n              if (!config) {\n                return new ConnectionStatus({\n                  connected: false,\n                  error: \"Not configured\",\n                });\n              }\n              const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);\n              const vaults = yield* svc.listVaults();\n              const vault = vaults.find((v) => v.id === config.vaultId);\n              return new ConnectionStatus({\n                connected: true,\n                vaultName: vault?.title,\n              });\n            }),\n\n          listVaults: (auth) =>\n            Effect.gen(function* () {\n              const resolved = yield* resolveAuth(auth, ctx);\n              const svc = yield* makeOnePasswordService(resolved, {\n                timeoutMs,\n                preferSdk: options.preferSdk,\n              });\n              const vaults = yield* svc.listVaults();\n              return vaults\n                .map((v) => new Vault({ id: v.id, name: v.title }))\n                .sort((a, b) => a.name.localeCompare(b.name));\n            }),\n\n          resolve: (uri) =>\n            Effect.gen(function* () {\n              const config = yield* getConfig();\n              if (!config) {\n                return yield* new OnePasswordError({\n                  operation: \"resolve\",\n                  message: \"1Password is not configured\",\n                });\n              }\n              const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);\n              return yield* svc.resolveSecret(uri);\n            }),\n        };\n\n        return { extension };\n      }),\n  });\n};\n"],"mappings":";AAAA,SAAS,cAAc;AAMhB,IAAM,iBAAN,cAA6B,OAAO,MAAsB,gBAAgB,EAAE;AAAA,EACjF,MAAM,OAAO,QAAQ,aAAa;AAAA;AAAA,EAElC,aAAa,OAAO;AACtB,CAAC,EAAE;AAAC;AAEG,IAAM,qBAAN,cAAiC,OAAO,MAA0B,oBAAoB,EAAE;AAAA,EAC7F,MAAM,OAAO,QAAQ,iBAAiB;AAAA;AAAA,EAEtC,eAAe,OAAO;AACxB,CAAC,EAAE;AAAC;AAEG,IAAM,kBAAkB,OAAO,MAAM,gBAAgB,kBAAkB;AAOvE,IAAM,oBAAN,cAAgC,OAAO,MAAyB,mBAAmB,EAAE;AAAA,EAC1F,MAAM;AAAA;AAAA,EAEN,SAAS,OAAO;AAAA;AAAA,EAEhB,MAAM,OAAO;AACf,CAAC,EAAE;AAAC;AAMG,IAAM,QAAN,cAAoB,OAAO,MAAa,OAAO,EAAE;AAAA,EACtD,IAAI,OAAO;AAAA,EACX,MAAM,OAAO;AACf,CAAC,EAAE;AAAC;AAMG,IAAM,mBAAN,cAA+B,OAAO,MAAwB,kBAAkB,EAAE;AAAA,EACvF,WAAW,OAAO;AAAA,EAClB,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,OAAO,OAAO,SAAS,OAAO,MAAM;AACtC,CAAC,EAAE;AAAC;;;AClDJ,SAAS,UAAAA,eAAc;AAEhB,IAAM,mBAAN,cAA+BA,QAAO,YAA8B,EAAE,oBAAoB;AAAA,EAC/F,WAAWA,QAAO;AAAA,EAClB,SAASA,QAAO;AAClB,CAAC,EAAE;AAAC;;;ACLJ,SAAS,SAAS,UAAU,cAAc;AAC1C,YAAY,QAAQ;AA+Bb,IAAM,wBAAN,cAAoC,QAAQ;AAAA,EACjD;AACF,EAA6C,EAAE;AAAC;AAchD,IAAM,qBAAqB;AAG3B,IAAM,qBAAqB,MACzB,OAAO,WAAW;AAAA,EAChB,KAAK,MAAM,OAAO,gBAAgB;AAAA,EAClC,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,IACnB,WAAW;AAAA,IACX,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAChE,CAAC;AACL,CAAC;AAEH,IAAM,qBAAqB,CAAC,WAAmB,cAC7C;AAAA,EACE,GAAG,SAAS,qBAAqB,KAAK,MAAM,YAAY,GAAI,CAAC;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEN,IAAM,uBAAuB,CAClC,MACA,YAAoB,uBAEpB,OAAO,IAAI,aAAa;AACtB,QAAM,UAAU,SAAS,OAAO,SAAS;AACzC,QAAM,MAAM,OAAO,mBAAmB,EAAE;AAAA,IACtC,OAAO,YAAY;AAAA,MACjB,UAAU;AAAA,MACV,WAAW,MACT,IAAI,iBAAiB;AAAA,QACnB,WAAW;AAAA,QACX,SAAS,mBAAmB,mBAAmB,SAAS;AAAA,MAC1D,CAAC;AAAA,IACL,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,OAAO,WAAW;AAAA,IACtC,KAAK,MACH,IAAI,aAAa;AAAA,MACf,MAAM,KAAK,SAAS,gBAAgB,IAAI,IAAI,YAAY,KAAK,WAAW,IAAI,KAAK;AAAA,MACjF,iBAAiB;AAAA,MACjB,oBAAoB;AAAA,IACtB,CAAC;AAAA,IACH,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB,WAAW;AAAA,MACX,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,OAAO,YAAY;AAAA,MACjB,UAAU;AAAA,MACV,WAAW,MACT,IAAI,iBAAiB;AAAA,QACnB,WAAW;AAAA,QACX,SAAS,mBAAmB,gBAAgB,SAAS;AAAA,MACvD,CAAC;AAAA,IACL,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAI,IAAsB,cACrC,OAAO,WAAW;AAAA,IAChB,KAAK;AAAA,IACL,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,OAAO,YAAY;AAAA,MACjB,UAAU;AAAA,MACV,WAAW,MACT,IAAI,iBAAiB;AAAA,QACnB;AAAA,QACA,SAAS,mBAAmB,WAAW,SAAS;AAAA,MAClD,CAAC;AAAA,IACL,CAAC;AAAA,IACD,OAAO,SAAS,mBAAmB,SAAS,EAAE;AAAA,EAChD;AAEF,SAAO,sBAAsB,GAAG;AAAA,IAC9B,eAAe,CAAC,QAAQ,KAAK,MAAM,OAAO,QAAQ,QAAQ,GAAG,GAAG,mBAAmB;AAAA,IAEnF,YAAY,MACV,KAAK,MAAM,OAAO,OAAO,KAAK,EAAE,gBAAgB,KAAK,CAAC,GAAG,eAAe,EAAE;AAAA,MACxE,OAAO,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,IAC1E;AAAA,IAEF,WAAW,CAAC,YACV,KAAK,MAAM,OAAO,MAAM,KAAK,OAAO,GAAG,cAAc,EAAE;AAAA,MACrD,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,IACxE;AAAA,EACJ,CAAC;AACH,CAAC,EAAE,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAMlD,IAAM,iBAAiB,CAC5B,SAEA,OAAO,KAAK,MAAM;AAEhB,MAAI,KAAK,SAAS,mBAAmB;AACnC,IAAG,qBAAkB,KAAK,KAAK;AAAA,EACjC,OAAO;AACL,IAAG,kBAAe,EAAE,SAAS,KAAK,YAAY,CAAC;AAAA,EACjD;AAEA,QAAM,WAAW,CAAI,IAAa,cAChC,OAAO,IAAI;AAAA,IACT,KAAK;AAAA,IACL,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,SAAS,mBAAmB,SAAS,EAAE,CAAC;AAEzD,SAAO,sBAAsB,GAAG;AAAA,IAC9B,eAAe,CAAC,QAAQ,SAAS,MAAS,QAAK,MAAM,GAAG,GAAG,mBAAmB;AAAA,IAE9E,YAAY,MACV,SAAS,MAAS,SAAM,KAAK,GAAG,eAAe,EAAE;AAAA,MAC/C,OAAO,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IACzE;AAAA,IAEF,WAAW,CAAC,YACV,SAAS,MAAS,QAAK,KAAK,EAAE,OAAO,QAAQ,CAAC,GAAG,cAAc,EAAE;AAAA,MAC/D,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,IACxE;AAAA,EACJ,CAAC;AACH,CAAC,EAAE,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAMlD,IAAM,yBAAyB,CACpC,MACA,YACwD;AACxD,QAAM,YAAY,SAAS,aAAa;AAExC,MAAI,SAAS,WAAW;AACtB,WAAO,qBAAqB,MAAM,SAAS;AAAA,EAC7C;AAGA,SAAO,eAAe,IAAI,EAAE;AAAA,IAC1B,OAAO;AAAA,MAAS,CAAC;AAAA;AAAA,QAEf,qBAAqB,MAAM,SAAS,EAAE,KAAK,OAAO,SAAS,MAAM,QAAQ,CAAC;AAAA;AAAA,IAC5E;AAAA,EACF;AACF;;;AChNA,SAAS,UAAAC,SAAQ,UAAAC,eAAc;AAE/B;AAAA,EACE;AAAA,EAKA;AAAA,OACK;AAWP,IAAM,aAAa;AACnB,IAAM,mBAAmB;AACzB,IAAMC,sBAAqB;AAC3B,IAAM,aAAa;AAgCnB,IAAM,cAAc,CAClB,MACA,QACkD;AAClD,MAAI,KAAK,SAAS,eAAe;AAC/B,WAAOC,QAAO,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,IAAI,QAAQ,QAAQ,SAAS,KAAK,KAAK,aAAa,GAAG,IAAI,MAAM,EAAE,EAAE;AAAA,IAC1EA,QAAO,IAAI,CAAC,WAAyB,EAAE,MAAM,mBAAmB,MAAM,EAAE;AAAA,IACxEA,QAAO;AAAA,MACL,CAAC,MACC,IAAI,iBAAiB;AAAA,QACnB,WAAW;AAAA,QACX,SAAS,mDAAmD,KAAK,aAAa,MAAM,EAAE,IAAI;AAAA,MAC5F,CAAC;AAAA,IACL;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,CAC3B,QACA,KACA,cAEA,YAAY,OAAO,MAAM,GAAG,EAAE;AAAA,EAC5BA,QAAO,QAAQ,CAAC,aAAa,uBAAuB,UAAU,EAAE,UAAU,CAAC,CAAC;AAC9E;AAMF,IAAM,eAAe,CACnB,WACA,KACA,eACoB;AAAA,EACpB,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,aACJ,UAAU,EAAE;AAAA,IACVA,QAAO,QAAQ,CAAC,WAAW;AACzB,UAAI,CAAC,OAAQ,QAAOA,QAAO,QAAQ,IAAI;AAEvC,YAAM,MAAM,SAAS,WAAW,OAAO,IACnC,WACA,QAAQ,OAAO,OAAO,IAAI,QAAQ,IAAI,gBAAgB;AAE1D,aAAO,qBAAqB,QAAQ,KAAK,SAAS,EAAE;AAAA,QAClDA,QAAO,QAAQ,CAAC,QAAQ,IAAI,cAAc,GAAG,CAAC;AAAA,QAC9CA,QAAO,IAAI,CAAC,MAAqB,CAAC;AAAA,QAClCA,QAAO,cAAc,MAAM,IAAI;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,IACDA,QAAO,cAAc,MAAM,IAAI;AAAA,EACjC;AAAA,EAEF,MAAM,MACJ,UAAU,EAAE;AAAA,IACVA,QAAO,QAAQ,CAAC,WAAW;AACzB,UAAI,CAAC,OAAQ,QAAOA,QAAO,QAAQ,CAAC,CAAmC;AACvE,aAAO,qBAAqB,QAAQ,KAAK,SAAS,EAAE;AAAA,QAClDA,QAAO,QAAQ,CAAC,QAAQ,IAAI,UAAU,OAAO,OAAO,CAAC;AAAA,QACrDA,QAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAACC,WAAU,EAAE,IAAIA,MAAK,IAAI,MAAMA,MAAK,MAAM,EAAE,CAAC;AAAA,MAChF;AAAA,IACF,CAAC;AAAA,IACDD,QAAO,cAAc,MAAM,CAAC,CAAmC;AAAA,EACjE;AACJ;AAMA,IAAM,eAAeE,QAAO,kBAAkB,iBAAiB;AAE/D,IAAM,aAAa,CAAC,OAClB,GAAG,IAAI,UAAU,EAAE;AAAA,EACjBF,QAAO,QAAQ,CAAC,MAAM;AACpB,QAAI,MAAM,KAAM,QAAOA,QAAO,QAAQ,IAAI;AAC1C,WAAOA,QAAO,IAAI,MAAM,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE;AAAA,MACnDA,QAAO;AAAA,QACL,CAAC,UACC,IAAI,iBAAiB;AAAA,UACnB,WAAW;AAAA,UACX,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAChE,CAAC;AAAA,MACL;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEF,IAAM,aAAa,CAAC,IAAc,WAChC,GAAG,IAAI;AAAA,EACL;AAAA,IACE,KAAK;AAAA,IACL,OAAO,KAAK,UAAU;AAAA,MACpB,MAAM,OAAO;AAAA,MACb,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,IACf,CAAC;AAAA,EACH;AACF,CAAC;AAEH,IAAM,eAAe,CAAC,OACpB,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,KAAKA,QAAO,MAAM;AAerC,IAAM,oBAAoB,CAC/B,YAC4D;AAC5D,QAAM,YAAY,QAAQ,aAAaD;AACvC,QAAM,KAAK,QAAQ;AAEnB,SAAO,aAAa;AAAA,IAClB,KAAK;AAAA,IACL,MAAM,CAAC,QACLC,QAAO,IAAI,aAAa;AACtB,YAAM,YAAY,MAAM,WAAW,EAAE;AAErC,aAAO,IAAI,QAAQ,YAAY,aAAa,WAAW,KAAK,SAAS,CAAC;AAEtE,YAAM,YAAkC;AAAA,QACtC,WAAW,CAAC,WAAW,WAAW,IAAI,MAAM;AAAA,QAE5C,WAAW,MAAM,UAAU;AAAA,QAE3B,cAAc,MAAM,aAAa,EAAE;AAAA,QAEnC,QAAQ,MACNA,QAAO,IAAI,aAAa;AACtB,gBAAM,SAAS,OAAO,UAAU;AAChC,cAAI,CAAC,QAAQ;AACX,mBAAO,IAAI,iBAAiB;AAAA,cAC1B,WAAW;AAAA,cACX,OAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM,MAAM,OAAO,qBAAqB,QAAQ,KAAK,SAAS;AAC9D,gBAAM,SAAS,OAAO,IAAI,WAAW;AACrC,gBAAMG,SAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,OAAO;AACxD,iBAAO,IAAI,iBAAiB;AAAA,YAC1B,WAAW;AAAA,YACX,WAAWA,QAAO;AAAA,UACpB,CAAC;AAAA,QACH,CAAC;AAAA,QAEH,YAAY,CAAC,SACXH,QAAO,IAAI,aAAa;AACtB,gBAAM,WAAW,OAAO,YAAY,MAAM,GAAG;AAC7C,gBAAM,MAAM,OAAO,uBAAuB,UAAU;AAAA,YAClD;AAAA,YACA,WAAW,QAAQ;AAAA,UACrB,CAAC;AACD,gBAAM,SAAS,OAAO,IAAI,WAAW;AACrC,iBAAO,OACJ,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,QAChD,CAAC;AAAA,QAEH,SAAS,CAAC,QACRA,QAAO,IAAI,aAAa;AACtB,gBAAM,SAAS,OAAO,UAAU;AAChC,cAAI,CAAC,QAAQ;AACX,mBAAO,OAAO,IAAI,iBAAiB;AAAA,cACjC,WAAW;AAAA,cACX,SAAS;AAAA,YACX,CAAC;AAAA,UACH;AACA,gBAAM,MAAM,OAAO,qBAAqB,QAAQ,KAAK,SAAS;AAC9D,iBAAO,OAAO,IAAI,cAAc,GAAG;AAAA,QACrC,CAAC;AAAA,MACL;AAEA,aAAO,EAAE,UAAU;AAAA,IACrB,CAAC;AAAA,EACL,CAAC;AACH;","names":["Schema","Effect","Schema","DEFAULT_TIMEOUT_MS","Effect","item","Schema","vault"]}

package/dist/core.js

@@ -4,281 +4,14 @@ import {
   OnePasswordAuth,
   OnePasswordConfig,
   OnePasswordError,
+  OnePasswordServiceTag,
   ServiceAccountAuth,
-  Vault
-} from "./chunk-FNUS7GBT.js";
-
-// src/sdk/plugin.ts
-import { Effect as Effect2, Schema } from "effect";
-import {
-  definePlugin,
-  SecretId
-} from "@executor-js/sdk/core";
-
-// src/sdk/service.ts
-import { Context, Duration, Effect } from "effect";
-import * as op from "@1password/op-js";
-var OnePasswordServiceTag = class extends Context.Tag(
-  "@executor-js/plugin-onepassword/OnePasswordService"
-)() {
-};
-var DEFAULT_TIMEOUT_MS = 15e3;
-var loadOnePasswordSdk = () => Effect.tryPromise({
-  try: () => import("@1password/sdk"),
-  catch: (cause) => new OnePasswordError({
-    operation: "sdk module load",
-    message: cause instanceof Error ? cause.message : String(cause)
-  })
-});
-var makeTimeoutMessage = (operation, timeoutMs) => [
-  `${operation}: timed out after ${Math.floor(timeoutMs / 1e3)}s.`,
-  "Troubleshooting:",
-  "1. Make sure the 1Password desktop app is open and unlocked",
-  "2. Check for an approval prompt in the 1Password app \u2014 it may be behind other windows",
-  "3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings",
-  "4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)",
-  "5. Try quitting 1Password completely and reopening it, then retry"
-].join("\n");
-var makeNativeSdkService = (auth, timeoutMs = DEFAULT_TIMEOUT_MS) => Effect.gen(function* () {
-  const timeout = Duration.millis(timeoutMs);
-  const sdk = yield* loadOnePasswordSdk().pipe(
-    Effect.timeoutFail({
-      duration: timeout,
-      onTimeout: () => new OnePasswordError({
-        operation: "sdk module load",
-        message: makeTimeoutMessage("sdk module load", timeoutMs)
-      })
-    })
-  );
-  const client = yield* Effect.tryPromise({
-    try: () => sdk.createClient({
-      auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token,
-      integrationName: "Executor",
-      integrationVersion: "0.0.0"
-    }),
-    catch: (cause) => new OnePasswordError({
-      operation: "client setup",
-      message: cause instanceof Error ? cause.message : String(cause)
-    })
-  }).pipe(
-    Effect.timeoutFail({
-      duration: timeout,
-      onTimeout: () => new OnePasswordError({
-        operation: "client setup",
-        message: makeTimeoutMessage("client setup", timeoutMs)
-      })
-    })
-  );
-  const wrap = (fn, operation) => Effect.tryPromise({
-    try: fn,
-    catch: (cause) => new OnePasswordError({
-      operation,
-      message: cause instanceof Error ? cause.message : String(cause)
-    })
-  }).pipe(
-    Effect.timeoutFail({
-      duration: timeout,
-      onTimeout: () => new OnePasswordError({
-        operation,
-        message: makeTimeoutMessage(operation, timeoutMs)
-      })
-    }),
-    Effect.withSpan(`onepassword.sdk.${operation}`)
-  );
-  return OnePasswordServiceTag.of({
-    resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"),
-    listVaults: () => wrap(
-      () => client.vaults.list({ decryptDetails: true }),
-      "vault listing"
-    ).pipe(
-      Effect.map(
-        (vaults) => vaults.map((v) => ({ id: v.id, title: v.title }))
-      )
-    ),
-    listItems: (vaultId) => wrap(() => client.items.list(vaultId), "item listing").pipe(
-      Effect.map(
-        (items) => items.map((i) => ({ id: i.id, title: i.title }))
-      )
-    )
-  });
-}).pipe(Effect.withSpan("onepassword.sdk.make_service"));
-var makeCliService = (auth) => Effect.gen(function* () {
-  if (auth.kind === "service-account") {
-    op.setServiceAccount(auth.token);
-  } else {
-    op.setGlobalFlags({ account: auth.accountName });
-  }
-  const wrapSync = (fn, operation) => Effect.try({
-    try: fn,
-    catch: (cause) => new OnePasswordError({
-      operation,
-      message: cause instanceof Error ? cause.message : String(cause)
-    })
-  }).pipe(Effect.withSpan(`onepassword.cli.${operation}`));
-  return OnePasswordServiceTag.of({
-    resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"),
-    listVaults: () => wrapSync(() => op.vault.list(), "vault listing").pipe(
-      Effect.map(
-        (vaults) => vaults.map((v) => ({ id: v.id, title: v.name }))
-      )
-    ),
-    listItems: (vaultId) => wrapSync(
-      () => op.item.list({ vault: vaultId }),
-      "item listing"
-    ).pipe(
-      Effect.map(
-        (items) => items.map((i) => ({ id: i.id, title: i.title }))
-      )
-    )
-  });
-}).pipe(Effect.withSpan("onepassword.cli.make_service"));
-var makeOnePasswordService = (auth, options) => {
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  if (options?.preferSdk) {
-    return makeNativeSdkService(auth, timeoutMs);
-  }
-  return makeCliService(auth).pipe(
-    Effect.catchAll(
-      (cliError) => (
-        // CLI unavailable (e.g. `op` not installed) — fall back to SDK
-        makeNativeSdkService(auth, timeoutMs).pipe(
-          Effect.mapError(() => cliError)
-        )
-      )
-    )
-  );
-};
-
-// src/sdk/plugin.ts
-var PLUGIN_KEY = "onepassword";
-var CREDENTIAL_FIELD = "credential";
-var DEFAULT_TIMEOUT_MS2 = 15e3;
-var CONFIG_KEY = "config";
-var resolveAuth = (auth, ctx) => {
-  if (auth.kind === "desktop-app") {
-    return Effect2.succeed({
-      kind: "desktop-app",
-      accountName: auth.accountName
-    });
-  }
-  return ctx.secrets.resolve(SecretId.make(auth.tokenSecretId), ctx.scope.id).pipe(
-    Effect2.map(
-      (token) => ({ kind: "service-account", token })
-    ),
-    Effect2.mapError(
-      (e) => new OnePasswordError({
-        operation: "auth resolution",
-        message: `Failed to resolve service account token secret "${auth.tokenSecretId}": ${e._tag}`
-      })
-    )
-  );
-};
-var getServiceFromConfig = (config, ctx, timeoutMs) => resolveAuth(config.auth, ctx).pipe(
-  Effect2.flatMap((resolved) => makeOnePasswordService(resolved, { timeoutMs }))
-);
-var makeProvider = (getConfig, ctx, timeoutMs) => ({
-  key: "onepassword",
-  writable: false,
-  get: (secretId) => getConfig().pipe(
-    Effect2.flatMap((config) => {
-      if (!config) return Effect2.succeed(null);
-      const uri = secretId.startsWith("op://") ? secretId : `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;
-      return getServiceFromConfig(config, ctx, timeoutMs).pipe(
-        Effect2.flatMap((svc) => svc.resolveSecret(uri)),
-        Effect2.map((v) => v),
-        Effect2.orElseSucceed(() => null)
-      );
-    }),
-    Effect2.orElseSucceed(() => null)
-  ),
-  list: () => getConfig().pipe(
-    Effect2.flatMap((config) => {
-      if (!config) return Effect2.succeed([]);
-      return getServiceFromConfig(config, ctx, timeoutMs).pipe(
-        Effect2.flatMap((svc) => svc.listItems(config.vaultId)),
-        Effect2.map(
-          (items) => items.map((item2) => ({ id: item2.id, name: item2.title }))
-        )
-      );
-    }),
-    Effect2.orElseSucceed(() => [])
-  )
-});
-var decodeConfig = Schema.decodeUnknownSync(OnePasswordConfig);
-var loadConfig = (kv) => kv.get(CONFIG_KEY).pipe(
-  Effect2.flatMap((v) => {
-    if (v === null) return Effect2.succeed(null);
-    return Effect2.try(() => decodeConfig(JSON.parse(v))).pipe(
-      Effect2.mapError(
-        (cause) => new OnePasswordError({
-          operation: "config decode",
-          message: cause instanceof Error ? cause.message : String(cause)
-        })
-      )
-    );
-  })
-);
-var saveConfig = (kv, config) => kv.set(CONFIG_KEY, JSON.stringify({
-  auth: config.auth,
-  vaultId: config.vaultId,
-  name: config.name
-}));
-var deleteConfig = (kv) => kv.delete(CONFIG_KEY);
-var onepasswordPlugin = (options) => {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-  const kv = options.kv;
-  return definePlugin({
-    key: PLUGIN_KEY,
-    init: (ctx) => Effect2.gen(function* () {
-      const getConfig = () => loadConfig(kv);
-      yield* ctx.secrets.addProvider(
-        makeProvider(getConfig, ctx, timeoutMs)
-      );
-      const extension = {
-        configure: (config) => saveConfig(kv, config),
-        getConfig: () => getConfig(),
-        removeConfig: () => deleteConfig(kv),
-        status: () => Effect2.gen(function* () {
-          const config = yield* getConfig();
-          if (!config) {
-            return new ConnectionStatus({
-              connected: false,
-              error: "Not configured"
-            });
-          }
-          const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);
-          const vaults = yield* svc.listVaults();
-          const vault2 = vaults.find((v) => v.id === config.vaultId);
-          return new ConnectionStatus({
-            connected: true,
-            vaultName: vault2?.title
-          });
-        }),
-        listVaults: (auth) => Effect2.gen(function* () {
-          const resolved = yield* resolveAuth(auth, ctx);
-          const svc = yield* makeOnePasswordService(resolved, {
-            timeoutMs,
-            preferSdk: options.preferSdk
-          });
-          const vaults = yield* svc.listVaults();
-          return vaults.map((v) => new Vault({ id: v.id, name: v.title })).sort((a, b) => a.name.localeCompare(b.name));
-        }),
-        resolve: (uri) => Effect2.gen(function* () {
-          const config = yield* getConfig();
-          if (!config) {
-            return yield* new OnePasswordError({
-              operation: "resolve",
-              message: "1Password is not configured"
-            });
-          }
-          const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);
-          return yield* svc.resolveSecret(uri);
-        })
-      };
-      return { extension };
-    })
-  });
-};
+  Vault,
+  makeCliService,
+  makeNativeSdkService,
+  makeOnePasswordService,
+  onepasswordPlugin
+} from "./chunk-57NB4OW6.js";
 export {
   ConnectionStatus,
   DesktopAppAuth,

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/sdk/plugin.ts","../src/sdk/service.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport {\n  definePlugin,\n  type ExecutorPlugin,\n  type PluginContext,\n  type SecretProvider,\n  type ScopedKv,\n  SecretId,\n} from \"@executor/sdk/core\";\n\nimport { OnePasswordConfig, Vault, ConnectionStatus } from \"./types\";\nimport type { OnePasswordAuth } from \"./types\";\nimport { OnePasswordError } from \"./errors\";\nimport {\n  makeOnePasswordService,\n  type ResolvedAuth,\n  type OnePasswordService,\n} from \"./service\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst PLUGIN_KEY = \"onepassword\";\nconst CREDENTIAL_FIELD = \"credential\";\nconst DEFAULT_TIMEOUT_MS = 15_000;\nconst CONFIG_KEY = \"config\";\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.onepassword\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordExtension {\n  /** Configure the 1Password connection */\n  readonly configure: (\n    config: OnePasswordConfig,\n  ) => Effect.Effect<void, OnePasswordError>;\n\n  /** Get current configuration (if any) */\n  readonly getConfig: () => Effect.Effect<OnePasswordConfig | null, OnePasswordError>;\n\n  /** Remove the 1Password configuration */\n  readonly removeConfig: () => Effect.Effect<void>;\n\n  /** Check connection status */\n  readonly status: () => Effect.Effect<ConnectionStatus, OnePasswordError>;\n\n  /** List accessible vaults (requires auth) */\n  readonly listVaults: (\n    auth: OnePasswordAuth,\n  ) => Effect.Effect<ReadonlyArray<Vault>, OnePasswordError>;\n\n  /** Resolve a secret directly by op:// URI */\n  readonly resolve: (uri: string) => Effect.Effect<string, OnePasswordError>;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst resolveAuth = (\n  auth: OnePasswordAuth,\n  ctx: PluginContext,\n): Effect.Effect<ResolvedAuth, OnePasswordError> => {\n  if (auth.kind === \"desktop-app\") {\n    return Effect.succeed({\n      kind: \"desktop-app\" as const,\n      accountName: auth.accountName,\n    });\n  }\n  return ctx.secrets.resolve(SecretId.make(auth.tokenSecretId), ctx.scope.id).pipe(\n    Effect.map(\n      (token): ResolvedAuth => ({ kind: \"service-account\", token }),\n    ),\n    Effect.mapError(\n      (e) =>\n        new OnePasswordError({\n          operation: \"auth resolution\",\n          message: `Failed to resolve service account token secret \"${auth.tokenSecretId}\": ${e._tag}`,\n        }),\n    ),\n  );\n};\n\nconst getServiceFromConfig = (\n  config: OnePasswordConfig,\n  ctx: PluginContext,\n  timeoutMs: number,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  resolveAuth(config.auth, ctx).pipe(\n    Effect.flatMap((resolved) => makeOnePasswordService(resolved, { timeoutMs })),\n  );\n\n// ---------------------------------------------------------------------------\n// SecretProvider — read-only, resolves op:// URIs or vaultId-based lookups\n// ---------------------------------------------------------------------------\n\nconst makeProvider = (\n  getConfig: () => Effect.Effect<OnePasswordConfig | null, OnePasswordError>,\n  ctx: PluginContext,\n  timeoutMs: number,\n): SecretProvider => ({\n  key: \"onepassword\",\n  writable: false,\n\n  get: (secretId) =>\n    getConfig().pipe(\n      Effect.flatMap((config) => {\n        if (!config) return Effect.succeed(null);\n\n        const uri = secretId.startsWith(\"op://\")\n          ? secretId\n          : `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;\n\n        return getServiceFromConfig(config, ctx, timeoutMs).pipe(\n          Effect.flatMap((svc) => svc.resolveSecret(uri)),\n          Effect.map((v): string | null => v),\n          Effect.orElseSucceed(() => null),\n        );\n      }),\n      Effect.orElseSucceed(() => null),\n    ),\n\n  list: () =>\n    getConfig().pipe(\n      Effect.flatMap((config) => {\n        if (!config) return Effect.succeed([] as { id: string; name: string }[]);\n        return getServiceFromConfig(config, ctx, timeoutMs).pipe(\n          Effect.flatMap((svc) => svc.listItems(config.vaultId)),\n          Effect.map((items) =>\n            items.map((item) => ({ id: item.id, name: item.title })),\n          ),\n        );\n      }),\n      Effect.orElseSucceed(() => [] as { id: string; name: string }[]),\n    ),\n});\n\n// ---------------------------------------------------------------------------\n// Config persistence via ScopedKv\n// ---------------------------------------------------------------------------\n\nconst decodeConfig = Schema.decodeUnknownSync(OnePasswordConfig);\n\nconst loadConfig = (kv: ScopedKv): Effect.Effect<OnePasswordConfig | null, OnePasswordError> =>\n  kv.get(CONFIG_KEY).pipe(\n    Effect.flatMap((v) => {\n      if (v === null) return Effect.succeed(null);\n      return Effect.try(() => decodeConfig(JSON.parse(v))).pipe(\n        Effect.mapError(\n          (cause) =>\n            new OnePasswordError({\n              operation: \"config decode\",\n              message:\n                cause instanceof Error ? cause.message : String(cause),\n            }),\n        ),\n      );\n    }),\n  );\n\nconst saveConfig = (\n  kv: ScopedKv,\n  config: OnePasswordConfig,\n): Effect.Effect<void> =>\n  kv.set(CONFIG_KEY, JSON.stringify({\n    auth: config.auth,\n    vaultId: config.vaultId,\n    name: config.name,\n  }));\n\nconst deleteConfig = (kv: ScopedKv): Effect.Effect<void> => kv.delete(CONFIG_KEY);\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordPluginOptions {\n  /** Scoped KV for persisting config (provided by server) */\n  readonly kv: ScopedKv;\n  /** Request timeout in ms (default: 15000) */\n  readonly timeoutMs?: number;\n  /** Force use of the native SDK instead of the CLI (default: false) */\n  readonly preferSdk?: boolean;\n}\n\nexport const onepasswordPlugin = (\n  options: OnePasswordPluginOptions,\n): ExecutorPlugin<typeof PLUGIN_KEY, OnePasswordExtension> => {\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const kv = options.kv;\n\n  return definePlugin({\n    key: PLUGIN_KEY,\n    init: (ctx) =>\n      Effect.gen(function* () {\n        const getConfig = () => loadConfig(kv);\n\n        yield* ctx.secrets.addProvider(\n          makeProvider(getConfig, ctx, timeoutMs),\n        );\n\n        const extension: OnePasswordExtension = {\n          configure: (config) =>\n            saveConfig(kv, config),\n\n          getConfig: () => getConfig(),\n\n          removeConfig: () => deleteConfig(kv),\n\n          status: () =>\n            Effect.gen(function* () {\n              const config = yield* getConfig();\n              if (!config) {\n                return new ConnectionStatus({\n                  connected: false,\n                  error: \"Not configured\",\n                });\n              }\n              const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);\n              const vaults = yield* svc.listVaults();\n              const vault = vaults.find((v) => v.id === config.vaultId);\n              return new ConnectionStatus({\n                connected: true,\n                vaultName: vault?.title,\n              });\n            }),\n\n          listVaults: (auth) =>\n            Effect.gen(function* () {\n              const resolved = yield* resolveAuth(auth, ctx);\n              const svc = yield* makeOnePasswordService(resolved, {\n                timeoutMs,\n                preferSdk: options.preferSdk,\n              });\n              const vaults = yield* svc.listVaults();\n              return vaults\n                .map((v) => new Vault({ id: v.id, name: v.title }))\n                .sort((a, b) => a.name.localeCompare(b.name));\n            }),\n\n          resolve: (uri) =>\n            Effect.gen(function* () {\n              const config = yield* getConfig();\n              if (!config) {\n                return yield* new OnePasswordError({\n                  operation: \"resolve\",\n                  message: \"1Password is not configured\",\n                });\n              }\n              const svc = yield* getServiceFromConfig(config, ctx, timeoutMs);\n              return yield* svc.resolveSecret(uri);\n            }),\n        };\n\n        return { extension };\n      }),\n  });\n};\n","import { Context, Duration, Effect } from \"effect\";\nimport * as op from \"@1password/op-js\";\n\nimport { OnePasswordError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Canonical service interface — all backends (SDK, CLI) implement this\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordVault {\n  readonly id: string;\n  readonly title: string;\n}\n\nexport interface OnePasswordItem {\n  readonly id: string;\n  readonly title: string;\n}\n\nexport interface OnePasswordService {\n  /** Resolve a secret by op:// URI */\n  readonly resolveSecret: (\n    uri: string,\n  ) => Effect.Effect<string, OnePasswordError>;\n\n  /** List accessible vaults */\n  readonly listVaults: () => Effect.Effect<\n    ReadonlyArray<OnePasswordVault>,\n    OnePasswordError\n  >;\n\n  /** List items in a vault */\n  readonly listItems: (\n    vaultId: string,\n  ) => Effect.Effect<ReadonlyArray<OnePasswordItem>, OnePasswordError>;\n}\n\nexport class OnePasswordServiceTag extends Context.Tag(\n  \"@executor/plugin-onepassword/OnePasswordService\",\n)<OnePasswordServiceTag, OnePasswordService>() {}\n\n// ---------------------------------------------------------------------------\n// Resolved auth — raw credentials ready for any backend\n// ---------------------------------------------------------------------------\n\nexport type ResolvedAuth =\n  | { readonly kind: \"desktop-app\"; readonly accountName: string }\n  | { readonly kind: \"service-account\"; readonly token: string };\n\n// ---------------------------------------------------------------------------\n// SDK backend — uses @1password/sdk native IPC\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_TIMEOUT_MS = 15_000;\ntype OnePasswordSdkModule = typeof import(\"@1password/sdk\");\n\nconst loadOnePasswordSdk = (): Effect.Effect<OnePasswordSdkModule, OnePasswordError> =>\n  Effect.tryPromise({\n    try: () => import(\"@1password/sdk\"),\n    catch: (cause) =>\n      new OnePasswordError({\n        operation: \"sdk module load\",\n        message: cause instanceof Error ? cause.message : String(cause),\n      }),\n  });\n\nconst makeTimeoutMessage = (operation: string, timeoutMs: number): string =>\n  [\n    `${operation}: timed out after ${Math.floor(timeoutMs / 1000)}s.`,\n    \"Troubleshooting:\",\n    \"1. Make sure the 1Password desktop app is open and unlocked\",\n    \"2. Check for an approval prompt in the 1Password app — it may be behind other windows\",\n    \"3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings\",\n    \"4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)\",\n    \"5. Try quitting 1Password completely and reopening it, then retry\",\n  ].join(\"\\n\");\n\nexport const makeNativeSdkService = (\n  auth: ResolvedAuth,\n  timeoutMs: number = DEFAULT_TIMEOUT_MS,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  Effect.gen(function* () {\n    const timeout = Duration.millis(timeoutMs);\n    const sdk = yield* loadOnePasswordSdk().pipe(\n      Effect.timeoutFail({\n        duration: timeout,\n        onTimeout: () =>\n          new OnePasswordError({\n            operation: \"sdk module load\",\n            message: makeTimeoutMessage(\"sdk module load\", timeoutMs),\n          }),\n      }),\n    );\n\n    const client = yield* Effect.tryPromise({\n      try: () =>\n        sdk.createClient({\n          auth:\n            auth.kind === \"desktop-app\"\n              ? new sdk.DesktopAuth(auth.accountName)\n              : auth.token,\n          integrationName: \"Executor\",\n          integrationVersion: \"0.0.0\",\n        }),\n      catch: (cause) =>\n        new OnePasswordError({\n          operation: \"client setup\",\n          message: cause instanceof Error ? cause.message : String(cause),\n        }),\n    }).pipe(\n      Effect.timeoutFail({\n        duration: timeout,\n        onTimeout: () =>\n          new OnePasswordError({\n            operation: \"client setup\",\n            message: makeTimeoutMessage(\"client setup\", timeoutMs),\n          }),\n      }),\n    );\n\n    const wrap = <A>(\n      fn: () => Promise<A>,\n      operation: string,\n    ): Effect.Effect<A, OnePasswordError> =>\n      Effect.tryPromise({\n        try: fn,\n        catch: (cause) =>\n          new OnePasswordError({\n            operation,\n            message: cause instanceof Error ? cause.message : String(cause),\n          }),\n      }).pipe(\n        Effect.timeoutFail({\n          duration: timeout,\n          onTimeout: () =>\n            new OnePasswordError({\n              operation,\n              message: makeTimeoutMessage(operation, timeoutMs),\n            }),\n        }),\n        Effect.withSpan(`onepassword.sdk.${operation}`),\n      );\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) =>\n        wrap(() => client.secrets.resolve(uri), \"secret resolution\"),\n\n      listVaults: () =>\n        wrap(\n          () => client.vaults.list({ decryptDetails: true }),\n          \"vault listing\",\n        ).pipe(\n          Effect.map((vaults) =>\n            vaults.map((v) => ({ id: v.id, title: v.title })),\n          ),\n        ),\n\n      listItems: (vaultId) =>\n        wrap(() => client.items.list(vaultId), \"item listing\").pipe(\n          Effect.map((items) =>\n            items.map((i) => ({ id: i.id, title: i.title })),\n          ),\n        ),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.sdk.make_service\"));\n\n// ---------------------------------------------------------------------------\n// CLI backend — uses @1password/op-js (shells out to `op` CLI)\n// ---------------------------------------------------------------------------\n\nexport const makeCliService = (\n  auth: ResolvedAuth,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  Effect.gen(function* () {\n    // Configure auth\n    if (auth.kind === \"service-account\") {\n      op.setServiceAccount(auth.token);\n    } else {\n      op.setGlobalFlags({ account: auth.accountName });\n    }\n\n    const wrapSync = <A>(\n      fn: () => A,\n      operation: string,\n    ): Effect.Effect<A, OnePasswordError> =>\n      Effect.try({\n        try: fn,\n        catch: (cause) =>\n          new OnePasswordError({\n            operation,\n            message: cause instanceof Error ? cause.message : String(cause),\n          }),\n      }).pipe(Effect.withSpan(`onepassword.cli.${operation}`));\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) =>\n        wrapSync(() => op.read.parse(uri), \"secret resolution\"),\n\n      listVaults: () =>\n        wrapSync(() => op.vault.list(), \"vault listing\").pipe(\n          Effect.map((vaults) =>\n            vaults.map((v) => ({ id: v.id, title: v.name })),\n          ),\n        ),\n\n      listItems: (vaultId) =>\n        wrapSync(\n          () => op.item.list({ vault: vaultId }),\n          \"item listing\",\n        ).pipe(\n          Effect.map((items) =>\n            items.map((i) => ({ id: i.id, title: i.title })),\n          ),\n        ),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.cli.make_service\"));\n\n// ---------------------------------------------------------------------------\n// Smart factory — tries CLI first (avoids IPC hang), falls back to SDK\n// ---------------------------------------------------------------------------\n\nexport const makeOnePasswordService = (\n  auth: ResolvedAuth,\n  options?: { readonly preferSdk?: boolean; readonly timeoutMs?: number },\n): Effect.Effect<OnePasswordService, OnePasswordError> => {\n  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  if (options?.preferSdk) {\n    return makeNativeSdkService(auth, timeoutMs);\n  }\n\n  // Default: prefer CLI to avoid the IPC hang bug\n  return makeCliService(auth).pipe(\n    Effect.catchAll((cliError) =>\n      // CLI unavailable (e.g. `op` not installed) — fall back to SDK\n      makeNativeSdkService(auth, timeoutMs).pipe(\n        Effect.mapError(() => cliError),\n      ),\n    ),\n  );\n};\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,UAAAA,SAAQ,cAAc;AAE/B;AAAA,EACE;AAAA,EAKA;AAAA,OACK;;;ACTP,SAAS,SAAS,UAAU,cAAc;AAC1C,YAAY,QAAQ;AAoCb,IAAM,wBAAN,cAAoC,QAAQ;AAAA,EACjD;AACF,EAA6C,EAAE;AAAC;AAchD,IAAM,qBAAqB;AAG3B,IAAM,qBAAqB,MACzB,OAAO,WAAW;AAAA,EAChB,KAAK,MAAM,OAAO,gBAAgB;AAAA,EAClC,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,IACnB,WAAW;AAAA,IACX,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAChE,CAAC;AACL,CAAC;AAEH,IAAM,qBAAqB,CAAC,WAAmB,cAC7C;AAAA,EACE,GAAG,SAAS,qBAAqB,KAAK,MAAM,YAAY,GAAI,CAAC;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEN,IAAM,uBAAuB,CAClC,MACA,YAAoB,uBAEpB,OAAO,IAAI,aAAa;AACtB,QAAM,UAAU,SAAS,OAAO,SAAS;AACzC,QAAM,MAAM,OAAO,mBAAmB,EAAE;AAAA,IACtC,OAAO,YAAY;AAAA,MACjB,UAAU;AAAA,MACV,WAAW,MACT,IAAI,iBAAiB;AAAA,QACnB,WAAW;AAAA,QACX,SAAS,mBAAmB,mBAAmB,SAAS;AAAA,MAC1D,CAAC;AAAA,IACL,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,OAAO,WAAW;AAAA,IACtC,KAAK,MACH,IAAI,aAAa;AAAA,MACf,MACE,KAAK,SAAS,gBACV,IAAI,IAAI,YAAY,KAAK,WAAW,IACpC,KAAK;AAAA,MACX,iBAAiB;AAAA,MACjB,oBAAoB;AAAA,IACtB,CAAC;AAAA,IACH,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB,WAAW;AAAA,MACX,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,OAAO,YAAY;AAAA,MACjB,UAAU;AAAA,MACV,WAAW,MACT,IAAI,iBAAiB;AAAA,QACnB,WAAW;AAAA,QACX,SAAS,mBAAmB,gBAAgB,SAAS;AAAA,MACvD,CAAC;AAAA,IACL,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CACX,IACA,cAEA,OAAO,WAAW;AAAA,IAChB,KAAK;AAAA,IACL,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,OAAO,YAAY;AAAA,MACjB,UAAU;AAAA,MACV,WAAW,MACT,IAAI,iBAAiB;AAAA,QACnB;AAAA,QACA,SAAS,mBAAmB,WAAW,SAAS;AAAA,MAClD,CAAC;AAAA,IACL,CAAC;AAAA,IACD,OAAO,SAAS,mBAAmB,SAAS,EAAE;AAAA,EAChD;AAEF,SAAO,sBAAsB,GAAG;AAAA,IAC9B,eAAe,CAAC,QACd,KAAK,MAAM,OAAO,QAAQ,QAAQ,GAAG,GAAG,mBAAmB;AAAA,IAE7D,YAAY,MACV;AAAA,MACE,MAAM,OAAO,OAAO,KAAK,EAAE,gBAAgB,KAAK,CAAC;AAAA,MACjD;AAAA,IACF,EAAE;AAAA,MACA,OAAO;AAAA,QAAI,CAAC,WACV,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE;AAAA,MAClD;AAAA,IACF;AAAA,IAEF,WAAW,CAAC,YACV,KAAK,MAAM,OAAO,MAAM,KAAK,OAAO,GAAG,cAAc,EAAE;AAAA,MACrD,OAAO;AAAA,QAAI,CAAC,UACV,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE;AAAA,MACjD;AAAA,IACF;AAAA,EACJ,CAAC;AACH,CAAC,EAAE,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAMlD,IAAM,iBAAiB,CAC5B,SAEA,OAAO,IAAI,aAAa;AAEtB,MAAI,KAAK,SAAS,mBAAmB;AACnC,IAAG,qBAAkB,KAAK,KAAK;AAAA,EACjC,OAAO;AACL,IAAG,kBAAe,EAAE,SAAS,KAAK,YAAY,CAAC;AAAA,EACjD;AAEA,QAAM,WAAW,CACf,IACA,cAEA,OAAO,IAAI;AAAA,IACT,KAAK;AAAA,IACL,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,SAAS,mBAAmB,SAAS,EAAE,CAAC;AAEzD,SAAO,sBAAsB,GAAG;AAAA,IAC9B,eAAe,CAAC,QACd,SAAS,MAAS,QAAK,MAAM,GAAG,GAAG,mBAAmB;AAAA,IAExD,YAAY,MACV,SAAS,MAAS,SAAM,KAAK,GAAG,eAAe,EAAE;AAAA,MAC/C,OAAO;AAAA,QAAI,CAAC,WACV,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAAA,IAEF,WAAW,CAAC,YACV;AAAA,MACE,MAAS,QAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MACrC;AAAA,IACF,EAAE;AAAA,MACA,OAAO;AAAA,QAAI,CAAC,UACV,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE;AAAA,MACjD;AAAA,IACF;AAAA,EACJ,CAAC;AACH,CAAC,EAAE,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAMlD,IAAM,yBAAyB,CACpC,MACA,YACwD;AACxD,QAAM,YAAY,SAAS,aAAa;AAExC,MAAI,SAAS,WAAW;AACtB,WAAO,qBAAqB,MAAM,SAAS;AAAA,EAC7C;AAGA,SAAO,eAAe,IAAI,EAAE;AAAA,IAC1B,OAAO;AAAA,MAAS,CAAC;AAAA;AAAA,QAEf,qBAAqB,MAAM,SAAS,EAAE;AAAA,UACpC,OAAO,SAAS,MAAM,QAAQ;AAAA,QAChC;AAAA;AAAA,IACF;AAAA,EACF;AACF;;;ADxNA,IAAM,aAAa;AACnB,IAAM,mBAAmB;AACzB,IAAMC,sBAAqB;AAC3B,IAAM,aAAa;AAkCnB,IAAM,cAAc,CAClB,MACA,QACkD;AAClD,MAAI,KAAK,SAAS,eAAe;AAC/B,WAAOC,QAAO,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,IAAI,QAAQ,QAAQ,SAAS,KAAK,KAAK,aAAa,GAAG,IAAI,MAAM,EAAE,EAAE;AAAA,IAC1EA,QAAO;AAAA,MACL,CAAC,WAAyB,EAAE,MAAM,mBAAmB,MAAM;AAAA,IAC7D;AAAA,IACAA,QAAO;AAAA,MACL,CAAC,MACC,IAAI,iBAAiB;AAAA,QACnB,WAAW;AAAA,QACX,SAAS,mDAAmD,KAAK,aAAa,MAAM,EAAE,IAAI;AAAA,MAC5F,CAAC;AAAA,IACL;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,CAC3B,QACA,KACA,cAEA,YAAY,OAAO,MAAM,GAAG,EAAE;AAAA,EAC5BA,QAAO,QAAQ,CAAC,aAAa,uBAAuB,UAAU,EAAE,UAAU,CAAC,CAAC;AAC9E;AAMF,IAAM,eAAe,CACnB,WACA,KACA,eACoB;AAAA,EACpB,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,aACJ,UAAU,EAAE;AAAA,IACVA,QAAO,QAAQ,CAAC,WAAW;AACzB,UAAI,CAAC,OAAQ,QAAOA,QAAO,QAAQ,IAAI;AAEvC,YAAM,MAAM,SAAS,WAAW,OAAO,IACnC,WACA,QAAQ,OAAO,OAAO,IAAI,QAAQ,IAAI,gBAAgB;AAE1D,aAAO,qBAAqB,QAAQ,KAAK,SAAS,EAAE;AAAA,QAClDA,QAAO,QAAQ,CAAC,QAAQ,IAAI,cAAc,GAAG,CAAC;AAAA,QAC9CA,QAAO,IAAI,CAAC,MAAqB,CAAC;AAAA,QAClCA,QAAO,cAAc,MAAM,IAAI;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,IACDA,QAAO,cAAc,MAAM,IAAI;AAAA,EACjC;AAAA,EAEF,MAAM,MACJ,UAAU,EAAE;AAAA,IACVA,QAAO,QAAQ,CAAC,WAAW;AACzB,UAAI,CAAC,OAAQ,QAAOA,QAAO,QAAQ,CAAC,CAAmC;AACvE,aAAO,qBAAqB,QAAQ,KAAK,SAAS,EAAE;AAAA,QAClDA,QAAO,QAAQ,CAAC,QAAQ,IAAI,UAAU,OAAO,OAAO,CAAC;AAAA,QACrDA,QAAO;AAAA,UAAI,CAAC,UACV,MAAM,IAAI,CAACC,WAAU,EAAE,IAAIA,MAAK,IAAI,MAAMA,MAAK,MAAM,EAAE;AAAA,QACzD;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACDD,QAAO,cAAc,MAAM,CAAC,CAAmC;AAAA,EACjE;AACJ;AAMA,IAAM,eAAe,OAAO,kBAAkB,iBAAiB;AAE/D,IAAM,aAAa,CAAC,OAClB,GAAG,IAAI,UAAU,EAAE;AAAA,EACjBA,QAAO,QAAQ,CAAC,MAAM;AACpB,QAAI,MAAM,KAAM,QAAOA,QAAO,QAAQ,IAAI;AAC1C,WAAOA,QAAO,IAAI,MAAM,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE;AAAA,MACnDA,QAAO;AAAA,QACL,CAAC,UACC,IAAI,iBAAiB;AAAA,UACnB,WAAW;AAAA,UACX,SACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QACzD,CAAC;AAAA,MACL;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEF,IAAM,aAAa,CACjB,IACA,WAEA,GAAG,IAAI,YAAY,KAAK,UAAU;AAAA,EAChC,MAAM,OAAO;AAAA,EACb,SAAS,OAAO;AAAA,EAChB,MAAM,OAAO;AACf,CAAC,CAAC;AAEJ,IAAM,eAAe,CAAC,OAAsC,GAAG,OAAO,UAAU;AAezE,IAAM,oBAAoB,CAC/B,YAC4D;AAC5D,QAAM,YAAY,QAAQ,aAAaD;AACvC,QAAM,KAAK,QAAQ;AAEnB,SAAO,aAAa;AAAA,IAClB,KAAK;AAAA,IACL,MAAM,CAAC,QACLC,QAAO,IAAI,aAAa;AACtB,YAAM,YAAY,MAAM,WAAW,EAAE;AAErC,aAAO,IAAI,QAAQ;AAAA,QACjB,aAAa,WAAW,KAAK,SAAS;AAAA,MACxC;AAEA,YAAM,YAAkC;AAAA,QACtC,WAAW,CAAC,WACV,WAAW,IAAI,MAAM;AAAA,QAEvB,WAAW,MAAM,UAAU;AAAA,QAE3B,cAAc,MAAM,aAAa,EAAE;AAAA,QAEnC,QAAQ,MACNA,QAAO,IAAI,aAAa;AACtB,gBAAM,SAAS,OAAO,UAAU;AAChC,cAAI,CAAC,QAAQ;AACX,mBAAO,IAAI,iBAAiB;AAAA,cAC1B,WAAW;AAAA,cACX,OAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM,MAAM,OAAO,qBAAqB,QAAQ,KAAK,SAAS;AAC9D,gBAAM,SAAS,OAAO,IAAI,WAAW;AACrC,gBAAME,SAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,OAAO;AACxD,iBAAO,IAAI,iBAAiB;AAAA,YAC1B,WAAW;AAAA,YACX,WAAWA,QAAO;AAAA,UACpB,CAAC;AAAA,QACH,CAAC;AAAA,QAEH,YAAY,CAAC,SACXF,QAAO,IAAI,aAAa;AACtB,gBAAM,WAAW,OAAO,YAAY,MAAM,GAAG;AAC7C,gBAAM,MAAM,OAAO,uBAAuB,UAAU;AAAA,YAClD;AAAA,YACA,WAAW,QAAQ;AAAA,UACrB,CAAC;AACD,gBAAM,SAAS,OAAO,IAAI,WAAW;AACrC,iBAAO,OACJ,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,QAChD,CAAC;AAAA,QAEH,SAAS,CAAC,QACRA,QAAO,IAAI,aAAa;AACtB,gBAAM,SAAS,OAAO,UAAU;AAChC,cAAI,CAAC,QAAQ;AACX,mBAAO,OAAO,IAAI,iBAAiB;AAAA,cACjC,WAAW;AAAA,cACX,SAAS;AAAA,YACX,CAAC;AAAA,UACH;AACA,gBAAM,MAAM,OAAO,qBAAqB,QAAQ,KAAK,SAAS;AAC9D,iBAAO,OAAO,IAAI,cAAc,GAAG;AAAA,QACrC,CAAC;AAAA,MACL;AAEA,aAAO,EAAE,UAAU;AAAA,IACrB,CAAC;AAAA,EACL,CAAC;AACH;","names":["Effect","DEFAULT_TIMEOUT_MS","Effect","item","vault"]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.js

@@ -5,8 +5,9 @@ import {
   OnePasswordConfig,
   OnePasswordError,
   ServiceAccountAuth,
-  Vault
-} from "./chunk-FNUS7GBT.js";
+  Vault,
+  onepasswordPlugin
+} from "./chunk-57NB4OW6.js";
 export {
   ConnectionStatus,
   DesktopAppAuth,
@@ -14,6 +15,7 @@ export {
   OnePasswordConfig,
   OnePasswordError,
   ServiceAccountAuth,
-  Vault
+  Vault,
+  onepasswordPlugin
 };
 //# sourceMappingURL=index.js.map

package/dist/sdk/index.d.ts

@@ -1,4 +1,4 @@
-export { onepasswordPlugin, type OnePasswordExtension, type OnePasswordPluginOptions } from "./plugin";
-export { OnePasswordConfig, Vault, ConnectionStatus, OnePasswordAuth, DesktopAppAuth, ServiceAccountAuth } from "./types";
+export { onepasswordPlugin, type OnePasswordExtension, type OnePasswordPluginOptions, } from "./plugin";
+export { OnePasswordConfig, Vault, ConnectionStatus, OnePasswordAuth, DesktopAppAuth, ServiceAccountAuth, } from "./types";
 export { OnePasswordError } from "./errors";
 export { makeOnePasswordService, makeNativeSdkService, makeCliService, OnePasswordServiceTag, type OnePasswordService, type ResolvedAuth, } from "./service";

package/dist/sdk/plugin.d.ts

@@ -1,5 +1,5 @@
 import { Effect } from "effect";
-import { type ExecutorPlugin, type ScopedKv } from "@executor-js/sdk/core";
+import { type ExecutorPlugin, type ScopedKv } from "@executor-js/sdk";
 import { OnePasswordConfig, Vault, ConnectionStatus } from "./types";
 import type { OnePasswordAuth } from "./types";
 import { OnePasswordError } from "./errors";

package/package.json

@@ -1,17 +1,20 @@
 {
   "name": "@executor-js/plugin-onepassword",
-  "type": "module",
-  "version": "0.0.1-beta.4",
+  "version": "0.0.1-beta.6",
+  "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/onepassword",
+  "bugs": {
+    "url": "https://github.com/RhysSullivan/executor/issues"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/RhysSullivan/executor.git",
     "directory": "packages/plugins/onepassword"
   },
-  "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/onepassword",
-  "bugs": {
-    "url": "https://github.com/RhysSullivan/executor/issues"
-  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
   "exports": {
     ".": {
       "import": {
@@ -26,19 +29,23 @@
       }
     }
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsup && (tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src || true)",
-    "typecheck": "bunx tsc --noEmit -p tsconfig.json",
+    "typecheck": "tsgo --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
     "@1password/op-js": "^0.1.13",
     "@1password/sdk": "^0.4.1-beta.1",
     "@effect-atom/atom-react": "^0.5.0",
     "@effect/platform": "^0.96.0",
-    "@executor/api": "1.4.2",
-    "@executor-js/sdk": "0.0.1-beta.4",
+    "@executor/api": "1.4.3-beta.0",
+    "@executor-js/sdk": "0.0.1-beta.6",
     "effect": "^3.21.0"
   },
   "devDependencies": {
@@ -46,13 +53,13 @@
     "@types/react": "^19.1.0",
     "bun-types": "^1.2.22",
     "react": "^19.1.0",
-    "vitest": "^4.1.3",
-    "tsup": "^8.5.0"
+    "tsup": "^8.5.0",
+    "vitest": "^4.1.3"
   },
   "peerDependencies": {
-    "react": ">=18",
     "@effect-atom/atom-react": "^0.5.0",
-    "@executor/react": "1.4.2"
+    "@executor/react": "1.4.3-beta.0",
+    "react": ">=18"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -64,11 +71,5 @@
     "@executor/react": {
       "optional": true
     }
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "files": [
-    "dist"
-  ]
+  }
 }

package/dist/chunk-FNUS7GBT.js

@@ -1,56 +0,0 @@
-// src/sdk/types.ts
-import { Schema } from "effect";
-var DesktopAppAuth = class extends Schema.Class("DesktopAppAuth")({
-  kind: Schema.Literal("desktop-app"),
-  /** 1Password account domain, e.g. "my.1password.com" */
-  accountName: Schema.String
-}) {
-};
-var ServiceAccountAuth = class extends Schema.Class("ServiceAccountAuth")({
-  kind: Schema.Literal("service-account"),
-  /** The service account token (stored as a secret) */
-  tokenSecretId: Schema.String
-}) {
-};
-var OnePasswordAuth = Schema.Union(DesktopAppAuth, ServiceAccountAuth);
-var OnePasswordConfig = class extends Schema.Class("OnePasswordConfig")({
-  auth: OnePasswordAuth,
-  /** Vault to scope operations to */
-  vaultId: Schema.String,
-  /** Human label */
-  name: Schema.String
-}) {
-};
-var Vault = class extends Schema.Class("Vault")({
-  id: Schema.String,
-  name: Schema.String
-}) {
-};
-var ConnectionStatus = class extends Schema.Class("ConnectionStatus")({
-  connected: Schema.Boolean,
-  vaultName: Schema.optional(Schema.String),
-  error: Schema.optional(Schema.String)
-}) {
-};
-
-// src/sdk/errors.ts
-import { Schema as Schema2 } from "effect";
-var OnePasswordError = class extends Schema2.TaggedError()(
-  "OnePasswordError",
-  {
-    operation: Schema2.String,
-    message: Schema2.String
-  }
-) {
-};
-
-export {
-  DesktopAppAuth,
-  ServiceAccountAuth,
-  OnePasswordAuth,
-  OnePasswordConfig,
-  Vault,
-  ConnectionStatus,
-  OnePasswordError
-};
-//# sourceMappingURL=chunk-FNUS7GBT.js.map

package/dist/chunk-FNUS7GBT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sdk/types.ts","../src/sdk/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n// ---------------------------------------------------------------------------\n// Auth — how to talk to 1Password\n// ---------------------------------------------------------------------------\n\nexport class DesktopAppAuth extends Schema.Class<DesktopAppAuth>(\"DesktopAppAuth\")({\n  kind: Schema.Literal(\"desktop-app\"),\n  /** 1Password account domain, e.g. \"my.1password.com\" */\n  accountName: Schema.String,\n}) {}\n\nexport class ServiceAccountAuth extends Schema.Class<ServiceAccountAuth>(\"ServiceAccountAuth\")({\n  kind: Schema.Literal(\"service-account\"),\n  /** The service account token (stored as a secret) */\n  tokenSecretId: Schema.String,\n}) {}\n\nexport const OnePasswordAuth = Schema.Union(DesktopAppAuth, ServiceAccountAuth);\nexport type OnePasswordAuth = typeof OnePasswordAuth.Type;\n\n// ---------------------------------------------------------------------------\n// Stored config — persisted via KV\n// ---------------------------------------------------------------------------\n\nexport class OnePasswordConfig extends Schema.Class<OnePasswordConfig>(\"OnePasswordConfig\")({\n  auth: OnePasswordAuth,\n  /** Vault to scope operations to */\n  vaultId: Schema.String,\n  /** Human label */\n  name: Schema.String,\n}) {}\n\n// ---------------------------------------------------------------------------\n// Vault\n// ---------------------------------------------------------------------------\n\nexport class Vault extends Schema.Class<Vault>(\"Vault\")({\n  id: Schema.String,\n  name: Schema.String,\n}) {}\n\n// ---------------------------------------------------------------------------\n// Connection status\n// ---------------------------------------------------------------------------\n\nexport class ConnectionStatus extends Schema.Class<ConnectionStatus>(\"ConnectionStatus\")({\n  connected: Schema.Boolean,\n  vaultName: Schema.optional(Schema.String),\n  error: Schema.optional(Schema.String),\n}) {}\n","import { Schema } from \"effect\";\n\nexport class OnePasswordError extends Schema.TaggedError<OnePasswordError>()(\n  \"OnePasswordError\",\n  {\n    operation: Schema.String,\n    message: Schema.String,\n  },\n) {}\n"],"mappings":";AAAA,SAAS,cAAc;AAMhB,IAAM,iBAAN,cAA6B,OAAO,MAAsB,gBAAgB,EAAE;AAAA,EACjF,MAAM,OAAO,QAAQ,aAAa;AAAA;AAAA,EAElC,aAAa,OAAO;AACtB,CAAC,EAAE;AAAC;AAEG,IAAM,qBAAN,cAAiC,OAAO,MAA0B,oBAAoB,EAAE;AAAA,EAC7F,MAAM,OAAO,QAAQ,iBAAiB;AAAA;AAAA,EAEtC,eAAe,OAAO;AACxB,CAAC,EAAE;AAAC;AAEG,IAAM,kBAAkB,OAAO,MAAM,gBAAgB,kBAAkB;AAOvE,IAAM,oBAAN,cAAgC,OAAO,MAAyB,mBAAmB,EAAE;AAAA,EAC1F,MAAM;AAAA;AAAA,EAEN,SAAS,OAAO;AAAA;AAAA,EAEhB,MAAM,OAAO;AACf,CAAC,EAAE;AAAC;AAMG,IAAM,QAAN,cAAoB,OAAO,MAAa,OAAO,EAAE;AAAA,EACtD,IAAI,OAAO;AAAA,EACX,MAAM,OAAO;AACf,CAAC,EAAE;AAAC;AAMG,IAAM,mBAAN,cAA+B,OAAO,MAAwB,kBAAkB,EAAE;AAAA,EACvF,WAAW,OAAO;AAAA,EAClB,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,OAAO,OAAO,SAAS,OAAO,MAAM;AACtC,CAAC,EAAE;AAAC;;;AClDJ,SAAS,UAAAA,eAAc;AAEhB,IAAM,mBAAN,cAA+BA,QAAO,YAA8B;AAAA,EACzE;AAAA,EACA;AAAA,IACE,WAAWA,QAAO;AAAA,IAClB,SAASA,QAAO;AAAA,EAClB;AACF,EAAE;AAAC;","names":["Schema"]}