@executor-js/plugin-onepassword 0.0.1 → 0.1.0

package/README.md

@@ -1,29 +1,31 @@
-# @executor/plugin-onepassword
+# @executor-js/plugin-onepassword
 
 [1Password](https://1password.com) integration for the executor. Provides a secret source that resolves values from a 1Password vault, backed by either the desktop app (connect.sock) or a service account token.
 
 ## Install
 
 ```sh
-bun add @executor/sdk @executor/plugin-onepassword
+bun add @executor-js/sdk @executor-js/plugin-onepassword
 # or
-npm install @executor/sdk @executor/plugin-onepassword
+npm install @executor-js/sdk @executor-js/plugin-onepassword
 ```
 
 ## Usage
 
 ```ts
-import { createExecutor } from "@executor/sdk";
-import { onepasswordPlugin } from "@executor/plugin-onepassword";
+import { createExecutor } from "@executor-js/sdk";
+import { onepasswordPlugin } from "@executor-js/plugin-onepassword";
 
 const executor = await createExecutor({
-  scope: { name: "my-app" },
+  onElicitation: "accept-all",
   plugins: [onepasswordPlugin()] as const,
 });
 
 // Point the plugin at your account
 await executor.onepassword.configure({
   auth: { kind: "desktop-app", accountName: "my-account" },
+  vaultId: "my-vault-id",
+  name: "Personal",
 });
 
 // Inspect connection / list vaults
@@ -34,20 +36,38 @@ const vaults = await executor.onepassword.listVaults({
 });
 ```
 
-For CI and headless environments, use a service-account token instead of the desktop app:
+For CI and headless environments, use a service-account token instead of the desktop app. Store the token through the executor's secret store first, then reference it by id:
 
 ```ts
+import { createExecutor } from "@executor-js/sdk";
+import { onepasswordPlugin } from "@executor-js/plugin-onepassword";
+import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";
+
+const executor = await createExecutor({
+  onElicitation: "accept-all",
+  plugins: [fileSecretsPlugin(), onepasswordPlugin()] as const,
+});
+
+await executor.secrets.set({
+  id: "op-token",
+  name: "1Password service account",
+  value: process.env.OP_SERVICE_ACCOUNT_TOKEN!,
+  scope: executor.scopes[0]!.id,
+});
+
 await executor.onepassword.configure({
-  auth: { kind: "service-account", token: process.env.OP_SERVICE_ACCOUNT_TOKEN! },
+  auth: { kind: "service-account", tokenSecretId: "op-token" },
+  vaultId: "my-vault-id",
+  name: "CI",
 });
 ```
 
 ## Using with Effect
 
-If you're building on `@executor/sdk` (the raw Effect entry), import this plugin from its `/core` subpath instead:
+If you're building on `@executor-js/sdk/core` (the raw Effect entry), import this plugin from its `/core` subpath instead — it returns the Effect-shaped plugin with `Effect.Effect<...>`-returning methods rather than promisified wrappers:
 
 ```ts
-import { onepasswordPlugin } from "@executor/plugin-onepassword";
+import { onepasswordPlugin } from "@executor-js/plugin-onepassword/core";
 ```
 
 ## Status

package/dist/api/group.d.ts

@@ -1,22 +1,21 @@
-import { HttpApiEndpoint, HttpApiGroup } from "@effect/platform";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { Schema } from "effect";
+import { InternalError } from "@executor-js/api";
 import { OnePasswordError } from "../sdk/errors";
 import { OnePasswordConfig, Vault, ConnectionStatus } from "../sdk/types";
-declare const OnePasswordGroup_base: HttpApiGroup.HttpApiGroup<"onepassword", HttpApiEndpoint.HttpApiEndpoint<"getConfig", "GET", {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-}, never, never, never, OnePasswordConfig | null, never, never, never> | HttpApiEndpoint.HttpApiEndpoint<"configure", "PUT", {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-}, never, OnePasswordConfig, never, void, OnePasswordError, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeConfig", "DELETE", {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-}, never, never, never, void, never, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-}, never, never, never, ConnectionStatus, OnePasswordError, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listVaults", "GET", {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-}, {
-    readonly authKind: "desktop-app" | "service-account";
-    readonly account: string;
-}, never, never, {
-    readonly vaults: readonly Vault[];
-}, OnePasswordError, never, never>, never, never, false>;
-export declare class OnePasswordGroup extends OnePasswordGroup_base {
-}
-export {};
+export declare const OnePasswordGroup: HttpApiGroup.HttpApiGroup<"onepassword", HttpApiEndpoint.HttpApiEndpoint<"getConfig", "GET", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
+    scopeId: Schema.brand<Schema.String, "ScopeId">;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.NullOr<typeof OnePasswordConfig>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"configure", "PUT", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
+    scopeId: Schema.brand<Schema.String, "ScopeId">;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof OnePasswordConfig>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeConfig", "DELETE", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
+    scopeId: Schema.brand<Schema.String, "ScopeId">;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/scopes/:scopeId/onepassword/status", HttpApiEndpoint.StringTree<Schema.Struct<{
+    scopeId: Schema.brand<Schema.String, "ScopeId">;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof ConnectionStatus>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listVaults", "GET", "/scopes/:scopeId/onepassword/vaults", HttpApiEndpoint.StringTree<Schema.Struct<{
+    scopeId: Schema.brand<Schema.String, "ScopeId">;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authKind: Schema.Literals<readonly ["desktop-app", "service-account"]>;
+    readonly account: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly vaults: Schema.$Array<typeof Vault>;
+}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never>, false>;

package/dist/api/handlers.d.ts

@@ -1,7 +1,7 @@
 import { Context } from "effect";
 import type { OnePasswordExtension } from "../sdk/plugin";
-declare const OnePasswordExtensionService_base: Context.TagClass<OnePasswordExtensionService, "OnePasswordExtensionService", OnePasswordExtension>;
+declare const OnePasswordExtensionService_base: Context.ServiceClass<OnePasswordExtensionService, "OnePasswordExtensionService", OnePasswordExtension>;
 export declare class OnePasswordExtensionService extends OnePasswordExtensionService_base {
 }
-export declare const OnePasswordHandlers: import("effect/Layer").Layer<import("@effect/platform/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, OnePasswordExtensionService>;
+export declare const OnePasswordHandlers: import("effect/Layer").Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", OnePasswordExtensionService>>;
 export {};

package/dist/chunk-2NSVLCQP.js

@@ -0,0 +1,446 @@
+// src/sdk/errors.ts
+import { Schema } from "effect";
+var OnePasswordError = class extends Schema.TaggedErrorClass()(
+  "OnePasswordError",
+  {
+    operation: Schema.String,
+    message: Schema.String
+  },
+  { httpApiStatus: 502 }
+) {
+};
+
+// src/sdk/types.ts
+import { Schema as Schema2 } from "effect";
+var DesktopAppAuth = class extends Schema2.Class("DesktopAppAuth")({
+  kind: Schema2.Literal("desktop-app"),
+  /** 1Password account domain, e.g. "my.1password.com" */
+  accountName: Schema2.String
+}) {
+};
+var ServiceAccountAuth = class extends Schema2.Class("ServiceAccountAuth")({
+  kind: Schema2.Literal("service-account"),
+  /** The service account token (stored as a secret) */
+  tokenSecretId: Schema2.String
+}) {
+};
+var OnePasswordAuth = Schema2.Union([DesktopAppAuth, ServiceAccountAuth]);
+var OnePasswordConfig = class extends Schema2.Class("OnePasswordConfig")({
+  auth: OnePasswordAuth,
+  /** Vault to scope operations to */
+  vaultId: Schema2.String,
+  /** Human label */
+  name: Schema2.String
+}) {
+};
+var Vault = class extends Schema2.Class("Vault")({
+  id: Schema2.String,
+  name: Schema2.String
+}) {
+};
+var ConnectionStatus = class extends Schema2.Class("ConnectionStatus")({
+  connected: Schema2.Boolean,
+  vaultName: Schema2.optional(Schema2.String),
+  error: Schema2.optional(Schema2.String)
+}) {
+};
+
+// src/sdk/service.ts
+import { Context, Duration, Effect } from "effect";
+import * as op from "@1password/op-js";
+var OnePasswordServiceTag = class extends Context.Service()("@executor-js/plugin-onepassword/OnePasswordService") {
+};
+var DEFAULT_TIMEOUT_MS = 15e3;
+var loadOnePasswordSdk = () => Effect.tryPromise({
+  try: () => import("@1password/sdk"),
+  catch: (cause) => new OnePasswordError({
+    operation: "sdk module load",
+    message: cause instanceof Error ? cause.message : String(cause)
+  })
+});
+var makeTimeoutMessage = (operation, timeoutMs) => [
+  `${operation}: timed out after ${Math.floor(timeoutMs / 1e3)}s.`,
+  "Troubleshooting:",
+  "1. Make sure the 1Password desktop app is open and unlocked",
+  "2. Check for an approval prompt in the 1Password app \u2014 it may be behind other windows",
+  "3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings",
+  "4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)",
+  "5. Try quitting 1Password completely and reopening it, then retry"
+].join("\n");
+var timeoutWithOnePasswordError = (operation, timeoutMs) => Effect.timeoutOrElse({
+  duration: Duration.millis(timeoutMs),
+  orElse: () => Effect.fail(
+    new OnePasswordError({
+      operation,
+      message: makeTimeoutMessage(operation, timeoutMs)
+    })
+  )
+});
+var makeNativeSdkService = (auth, timeoutMs = DEFAULT_TIMEOUT_MS) => Effect.gen(function* () {
+  const sdk = yield* loadOnePasswordSdk().pipe(
+    timeoutWithOnePasswordError("sdk module load", timeoutMs)
+  );
+  const client = yield* Effect.tryPromise({
+    try: () => sdk.createClient({
+      auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token,
+      integrationName: "Executor",
+      integrationVersion: "0.0.0"
+    }),
+    catch: (cause) => new OnePasswordError({
+      operation: "client setup",
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  }).pipe(
+    timeoutWithOnePasswordError("client setup", timeoutMs)
+  );
+  const wrap = (fn, operation) => Effect.tryPromise({
+    try: fn,
+    catch: (cause) => new OnePasswordError({
+      operation,
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  }).pipe(
+    timeoutWithOnePasswordError(operation, timeoutMs),
+    Effect.withSpan(`onepassword.sdk.${operation}`)
+  );
+  return OnePasswordServiceTag.of({
+    resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"),
+    listVaults: () => wrap(() => client.vaults.list({ decryptDetails: true }), "vault listing").pipe(
+      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title })))
+    ),
+    listItems: (vaultId) => wrap(() => client.items.list(vaultId), "item listing").pipe(
+      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
+    )
+  });
+}).pipe(Effect.withSpan("onepassword.sdk.make_service"));
+var makeCliService = (auth) => Effect.sync(() => {
+  if (auth.kind === "service-account") {
+    op.setServiceAccount(auth.token);
+  } else {
+    op.setGlobalFlags({ account: auth.accountName });
+  }
+  const wrapSync = (fn, operation) => Effect.try({
+    try: fn,
+    catch: (cause) => new OnePasswordError({
+      operation,
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  }).pipe(Effect.withSpan(`onepassword.cli.${operation}`));
+  return OnePasswordServiceTag.of({
+    resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"),
+    listVaults: () => wrapSync(() => op.vault.list(), "vault listing").pipe(
+      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name })))
+    ),
+    listItems: (vaultId) => wrapSync(() => op.item.list({ vault: vaultId }), "item listing").pipe(
+      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
+    )
+  });
+}).pipe(Effect.withSpan("onepassword.cli.make_service"));
+var makeOnePasswordService = (auth, options) => {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (options?.preferSdk) {
+    return makeNativeSdkService(auth, timeoutMs);
+  }
+  return makeCliService(auth).pipe(
+    Effect.catch(
+      (cliError) => (
+        // CLI unavailable (e.g. `op` not installed) — fall back to SDK
+        makeNativeSdkService(auth, timeoutMs).pipe(Effect.mapError(() => cliError))
+      )
+    )
+  );
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect3, Schema as Schema4 } from "effect";
+import {
+  definePlugin,
+  StorageError
+} from "@executor-js/sdk/core";
+
+// src/api/group.ts
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { Schema as Schema3 } from "effect";
+import { ScopeId } from "@executor-js/sdk/core";
+import { InternalError } from "@executor-js/api";
+var ScopeParams = { scopeId: ScopeId };
+var ConfigurePayload = OnePasswordConfig;
+var ListVaultsParams = Schema3.Struct({
+  authKind: Schema3.Literals(["desktop-app", "service-account"]),
+  account: Schema3.String
+});
+var ListVaultsResponse = Schema3.Struct({
+  vaults: Schema3.Array(Vault)
+});
+var GetConfigResponse = Schema3.NullOr(OnePasswordConfig);
+var OnePasswordGroup = HttpApiGroup.make("onepassword").add(
+  HttpApiEndpoint.get("getConfig", "/scopes/:scopeId/onepassword/config", {
+    params: ScopeParams,
+    success: GetConfigResponse,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.put("configure", "/scopes/:scopeId/onepassword/config", {
+    params: ScopeParams,
+    payload: ConfigurePayload,
+    success: Schema3.Void,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.delete("removeConfig", "/scopes/:scopeId/onepassword/config", {
+    params: ScopeParams,
+    success: Schema3.Void,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.get("status", "/scopes/:scopeId/onepassword/status", {
+    params: ScopeParams,
+    success: ConnectionStatus,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.get("listVaults", "/scopes/:scopeId/onepassword/vaults", {
+    params: ScopeParams,
+    query: ListVaultsParams,
+    success: ListVaultsResponse,
+    error: [InternalError, OnePasswordError]
+  })
+);
+
+// src/api/handlers.ts
+import { HttpApiBuilder } from "effect/unstable/httpapi";
+import { Context as Context2, Effect as Effect2 } from "effect";
+import { addGroup, capture } from "@executor-js/api";
+var OnePasswordExtensionService = class extends Context2.Service()("OnePasswordExtensionService") {
+};
+var ExecutorApiWithOnePassword = addGroup(OnePasswordGroup);
+var OnePasswordHandlers = HttpApiBuilder.group(
+  ExecutorApiWithOnePassword,
+  "onepassword",
+  (handlers) => handlers.handle(
+    "getConfig",
+    () => capture(Effect2.gen(function* () {
+      const ext = yield* OnePasswordExtensionService;
+      return yield* ext.getConfig();
+    }))
+  ).handle(
+    "configure",
+    ({ payload }) => capture(Effect2.gen(function* () {
+      const ext = yield* OnePasswordExtensionService;
+      yield* ext.configure(payload);
+    }))
+  ).handle(
+    "removeConfig",
+    () => capture(Effect2.gen(function* () {
+      const ext = yield* OnePasswordExtensionService;
+      yield* ext.removeConfig();
+    }))
+  ).handle(
+    "status",
+    () => capture(Effect2.gen(function* () {
+      const ext = yield* OnePasswordExtensionService;
+      return yield* ext.status();
+    }))
+  ).handle(
+    "listVaults",
+    ({ query: urlParams }) => capture(Effect2.gen(function* () {
+      const ext = yield* OnePasswordExtensionService;
+      const auth = urlParams.authKind === "desktop-app" ? { kind: "desktop-app", accountName: urlParams.account } : { kind: "service-account", tokenSecretId: urlParams.account };
+      const vaults = yield* ext.listVaults(auth);
+      return { vaults: [...vaults] };
+    }))
+  )
+);
+
+// src/sdk/plugin.ts
+var CREDENTIAL_FIELD = "credential";
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+var CONFIG_KEY = "config";
+var decodeConfig = Schema4.decodeUnknownSync(OnePasswordConfig);
+var blobStorageError = (operation) => (cause) => new StorageError({
+  message: `onepassword blob ${operation}: ${cause instanceof Error ? cause.message : String(cause)}`,
+  cause
+});
+var makeOnePasswordStore = (blobs, writeScope) => ({
+  getConfig: () => blobs.get(CONFIG_KEY).pipe(
+    Effect3.mapError(blobStorageError("read")),
+    Effect3.flatMap((raw) => {
+      if (raw === null) return Effect3.succeed(null);
+      return Effect3.try({
+        try: () => decodeConfig(JSON.parse(raw)),
+        catch: (cause) => new OnePasswordError({
+          operation: "config decode",
+          message: cause instanceof Error ? cause.message : String(cause)
+        })
+      });
+    })
+  ),
+  saveConfig: (config) => blobs.put(
+    CONFIG_KEY,
+    JSON.stringify({
+      auth: config.auth,
+      vaultId: config.vaultId,
+      name: config.name
+    }),
+    { scope: writeScope }
+  ).pipe(Effect3.mapError(blobStorageError("write"))),
+  deleteConfig: () => blobs.delete(CONFIG_KEY, { scope: writeScope }).pipe(Effect3.mapError(blobStorageError("delete")))
+});
+var resolveAuth = (auth, ctx) => {
+  if (auth.kind === "desktop-app") {
+    return Effect3.succeed({
+      kind: "desktop-app",
+      accountName: auth.accountName
+    });
+  }
+  return ctx.secrets.get(auth.tokenSecretId).pipe(
+    Effect3.mapError(
+      (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? new OnePasswordError({
+        operation: "auth resolution",
+        message: `Service account token secret "${auth.tokenSecretId}" not found`
+      }) : err
+    ),
+    Effect3.flatMap((token) => {
+      if (token === null) {
+        return Effect3.fail(
+          new OnePasswordError({
+            operation: "auth resolution",
+            message: `Service account token secret "${auth.tokenSecretId}" not found`
+          })
+        );
+      }
+      return Effect3.succeed({
+        kind: "service-account",
+        token
+      });
+    })
+  );
+};
+var getServiceFromConfig = (config, ctx, timeoutMs, preferSdk) => resolveAuth(config.auth, ctx).pipe(
+  Effect3.flatMap(
+    (resolved) => makeOnePasswordService(resolved, { timeoutMs, preferSdk })
+  )
+);
+var makeProvider = (ctx, timeoutMs, preferSdk) => ({
+  key: "onepassword",
+  writable: false,
+  // 1Password vaults are named in the stored config; the executor-scope
+  // arg isn't used for routing here. A future refactor could let the
+  // plugin store per-scope vault bindings and pick based on `scope`.
+  get: (secretId, _scope) => ctx.storage.getConfig().pipe(
+    Effect3.flatMap((config) => {
+      if (!config) return Effect3.succeed(null);
+      const uri = secretId.startsWith("op://") ? secretId : `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;
+      return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe(
+        Effect3.flatMap((svc) => svc.resolveSecret(uri)),
+        Effect3.map((v) => v),
+        Effect3.orElseSucceed(() => null)
+      );
+    }),
+    Effect3.orElseSucceed(() => null)
+  ),
+  list: () => ctx.storage.getConfig().pipe(
+    Effect3.flatMap((config) => {
+      if (!config)
+        return Effect3.succeed(
+          []
+        );
+      return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe(
+        Effect3.flatMap((svc) => svc.listItems(config.vaultId)),
+        Effect3.map(
+          (items) => items.map((item2) => ({ id: item2.id, name: item2.title }))
+        )
+      );
+    }),
+    Effect3.orElseSucceed(
+      () => []
+    )
+  )
+});
+var onepasswordPlugin = definePlugin(
+  (options) => {
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+    const preferSdk = options?.preferSdk;
+    return {
+      id: "onepassword",
+      packageName: "@executor-js/plugin-onepassword",
+      storage: ({ blobs, scopes }) => makeOnePasswordStore(blobs, scopes.at(-1).id),
+      extension: (ctx) => {
+        return {
+          configure: (config) => ctx.storage.saveConfig(config),
+          getConfig: () => ctx.storage.getConfig(),
+          removeConfig: () => ctx.storage.deleteConfig(),
+          status: () => Effect3.gen(function* () {
+            const config = yield* ctx.storage.getConfig();
+            if (!config) {
+              return new ConnectionStatus({
+                connected: false,
+                error: "Not configured"
+              });
+            }
+            const svc = yield* getServiceFromConfig(
+              config,
+              ctx,
+              timeoutMs,
+              preferSdk
+            );
+            const vaults = yield* svc.listVaults();
+            const vault2 = vaults.find((v) => v.id === config.vaultId);
+            return new ConnectionStatus({
+              connected: true,
+              vaultName: vault2?.title
+            });
+          }),
+          listVaults: (auth) => Effect3.gen(function* () {
+            const resolved = yield* resolveAuth(auth, ctx);
+            const svc = yield* makeOnePasswordService(resolved, {
+              timeoutMs,
+              preferSdk
+            });
+            const vaults = yield* svc.listVaults();
+            return vaults.map((v) => new Vault({ id: v.id, name: v.title })).sort((a, b) => a.name.localeCompare(b.name));
+          }),
+          resolve: (uri) => Effect3.gen(function* () {
+            const config = yield* ctx.storage.getConfig();
+            if (!config) {
+              return yield* Effect3.fail(
+                new OnePasswordError({
+                  operation: "resolve",
+                  message: "1Password is not configured"
+                })
+              );
+            }
+            const svc = yield* getServiceFromConfig(
+              config,
+              ctx,
+              timeoutMs,
+              preferSdk
+            );
+            return yield* svc.resolveSecret(uri);
+          })
+        };
+      },
+      secretProviders: (ctx) => [makeProvider(ctx, timeoutMs, preferSdk)],
+      routes: () => OnePasswordGroup,
+      handlers: () => OnePasswordHandlers,
+      extensionService: OnePasswordExtensionService
+    };
+  }
+);
+
+export {
+  OnePasswordError,
+  DesktopAppAuth,
+  ServiceAccountAuth,
+  OnePasswordAuth,
+  OnePasswordConfig,
+  Vault,
+  ConnectionStatus,
+  OnePasswordServiceTag,
+  makeNativeSdkService,
+  makeCliService,
+  makeOnePasswordService,
+  makeOnePasswordStore,
+  onepasswordPlugin
+};
+//# sourceMappingURL=chunk-2NSVLCQP.js.map