@executor-js/plugin-onepassword 0.0.2 → 0.2.1

package/dist/OnePasswordSettings-NUPVIEGH.js

@@ -0,0 +1,392 @@
+import {
+  ConnectionStatus,
+  OnePasswordConfig,
+  OnePasswordConfigSchema,
+  OnePasswordError,
+  Vault
+} from "./chunk-NRYSRUWU.js";
+
+// src/react/OnePasswordSettings.tsx
+import { useState } from "react";
+import { useAtomSet, useAtomValue } from "@effect/atom-react";
+import * as Exit from "effect/Exit";
+import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
+import { ReactivityKey as ReactivityKey2 } from "@executor-js/react/api/reactivity-keys";
+import { useScope } from "@executor-js/react/api/scope-context";
+import { Button } from "@executor-js/react/components/button";
+import { Input } from "@executor-js/react/components/input";
+import { Label } from "@executor-js/react/components/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue
+} from "@executor-js/react/components/select";
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+  DialogFooter,
+  DialogClose
+} from "@executor-js/react/components/dialog";
+import {
+  CardStackEntry,
+  CardStackEntryActions,
+  CardStackEntryContent,
+  CardStackEntryDescription
+} from "@executor-js/react/components/card-stack";
+
+// src/react/atoms.ts
+import { ReactivityKey } from "@executor-js/react/api/reactivity-keys";
+
+// src/react/client.ts
+import { createPluginAtomClient } from "@executor-js/sdk/client";
+import { getBaseUrl } from "@executor-js/react/api/base-url";
+
+// src/api/group.ts
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { Schema } from "effect";
+import { InternalError, ScopeId } from "@executor-js/sdk/core";
+var ScopeParams = { scopeId: ScopeId };
+var ConfigurePayload = OnePasswordConfigSchema;
+var ListVaultsParams = Schema.Struct({
+  authKind: Schema.Literals(["desktop-app", "service-account"]),
+  account: Schema.String
+});
+var ListVaultsResponse = Schema.Struct({
+  vaults: Schema.Array(Vault)
+});
+var GetConfigResponse = Schema.NullOr(OnePasswordConfig);
+var OnePasswordGroup = HttpApiGroup.make("onepassword").add(
+  HttpApiEndpoint.get("getConfig", "/scopes/:scopeId/onepassword/config", {
+    params: ScopeParams,
+    success: GetConfigResponse,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.put("configure", "/scopes/:scopeId/onepassword/config", {
+    params: ScopeParams,
+    payload: ConfigurePayload,
+    success: Schema.Void,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.delete("removeConfig", "/scopes/:scopeId/onepassword/config", {
+    params: ScopeParams,
+    success: Schema.Void,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.get("status", "/scopes/:scopeId/onepassword/status", {
+    params: ScopeParams,
+    success: ConnectionStatus,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.get("listVaults", "/scopes/:scopeId/onepassword/vaults", {
+    params: ScopeParams,
+    query: ListVaultsParams,
+    success: ListVaultsResponse,
+    error: [InternalError, OnePasswordError]
+  })
+);
+
+// src/react/client.ts
+var OnePasswordClient = createPluginAtomClient(OnePasswordGroup, {
+  baseUrl: getBaseUrl
+});
+
+// src/react/atoms.ts
+var onepasswordWriteKeys = [ReactivityKey.secrets];
+var onepasswordConfigAtom = (scopeId) => OnePasswordClient.query("onepassword", "getConfig", {
+  params: { scopeId },
+  timeToLive: "30 seconds",
+  reactivityKeys: [ReactivityKey.secrets]
+});
+var onepasswordVaultsAtom = (authKind, account, scopeId) => OnePasswordClient.query("onepassword", "listVaults", {
+  params: { scopeId },
+  query: { authKind, account },
+  timeToLive: "30 seconds",
+  reactivityKeys: [ReactivityKey.secrets]
+});
+var configureOnePassword = OnePasswordClient.mutation("onepassword", "configure");
+var removeOnePasswordConfig = OnePasswordClient.mutation("onepassword", "removeConfig");
+
+// src/react/OnePasswordSettings.tsx
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function VaultPicker(props) {
+  const account = props.accountName.trim();
+  const scopeId = useScope();
+  const vaultsResult = useAtomValue(onepasswordVaultsAtom(props.authKind, account, scopeId));
+  const { vaults, isLoading, error } = AsyncResult.matchWithError(
+    vaultsResult,
+    {
+      onInitial: () => ({
+        vaults: [],
+        isLoading: true,
+        error: null
+      }),
+      onError: () => ({
+        vaults: [],
+        isLoading: false,
+        error: "Failed to list vaults"
+      }),
+      onDefect: () => ({
+        vaults: [],
+        isLoading: false,
+        error: "Failed to list vaults"
+      }),
+      onSuccess: ({ value }) => {
+        const v = value.vaults;
+        if (v.length > 0 && !props.vaultId) {
+          queueMicrotask(() => props.onVaultSelect(v[0].id, v[0].name));
+        }
+        return { vaults: [...v], isLoading: false, error: null };
+      }
+    }
+  );
+  if (!account) {
+    return /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground/50 py-1", children: "Enter account details to load vaults." });
+  }
+  return /* @__PURE__ */ jsxs("div", { className: "grid gap-2", children: [
+    /* @__PURE__ */ jsxs(
+      Select,
+      {
+        disabled: isLoading || vaults.length === 0,
+        value: props.vaultId,
+        onValueChange: (id) => {
+          const v = vaults.find((vault) => vault.id === id);
+          if (v) props.onVaultSelect(v.id, v.name);
+        },
+        children: [
+          /* @__PURE__ */ jsx(SelectTrigger, { className: "h-9 text-[13px]", children: /* @__PURE__ */ jsx(SelectValue, { placeholder: isLoading ? "Loading\u2026" : "Select a vault" }) }),
+          /* @__PURE__ */ jsx(SelectContent, { children: vaults.map((v) => /* @__PURE__ */ jsx(SelectItem, { value: v.id, children: v.name }, v.id)) })
+        ]
+      }
+    ),
+    error && /* @__PURE__ */ jsx("div", { className: "rounded-md border border-destructive/20 bg-destructive/5 px-2.5 py-1.5", children: /* @__PURE__ */ jsx("p", { className: "text-[11px] text-destructive leading-relaxed whitespace-pre-line", children: error }) })
+  ] });
+}
+function ConfigDialog(props) {
+  const isEdit = !!props.initial;
+  const [authKind, setAuthKind] = useState(
+    props.initial?.authKind ?? "desktop-app"
+  );
+  const [accountName, setAccountName] = useState(props.initial?.accountName ?? "my.1password.com");
+  const [vaultId, setVaultId] = useState(props.initial?.vaultId ?? "");
+  const [vaultName, setVaultName] = useState(props.initial?.name ?? "");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState(null);
+  const scopeId = useScope();
+  const doConfigure = useAtomSet(configureOnePassword, { mode: "promiseExit" });
+  const reset = () => {
+    if (!isEdit) {
+      setAuthKind("desktop-app");
+      setAccountName("my.1password.com");
+      setVaultId("");
+      setVaultName("");
+    }
+    setError(null);
+    setSaving(false);
+  };
+  const handleSave = async () => {
+    if (!accountName.trim() || !vaultId.trim()) return;
+    setSaving(true);
+    setError(null);
+    const auth = authKind === "desktop-app" ? { kind: "desktop-app", accountName: accountName.trim() } : { kind: "service-account", tokenSecretId: accountName.trim() };
+    const exit = await doConfigure({
+      params: { scopeId },
+      payload: { auth, vaultId: vaultId.trim(), name: vaultName.trim() || "1Password" },
+      reactivityKeys: [ReactivityKey2.secrets]
+    });
+    if (Exit.isFailure(exit)) {
+      setError("Failed to save configuration");
+      setSaving(false);
+      return;
+    }
+    props.onOpenChange(false);
+    reset();
+  };
+  return /* @__PURE__ */ jsx(
+    Dialog,
+    {
+      open: props.open,
+      onOpenChange: (v) => {
+        if (!v) reset();
+        props.onOpenChange(v);
+      },
+      children: /* @__PURE__ */ jsxs(DialogContent, { className: "sm:max-w-[420px]", children: [
+        /* @__PURE__ */ jsxs(DialogHeader, { children: [
+          /* @__PURE__ */ jsx(DialogTitle, { className: "font-display text-xl", children: isEdit ? "Edit 1Password" : "Connect 1Password" }),
+          /* @__PURE__ */ jsx(DialogDescription, { className: "text-[13px] leading-relaxed", children: "Link a vault to resolve secrets via the 1Password desktop app or a service account." })
+        ] }),
+        /* @__PURE__ */ jsxs("div", { className: "grid gap-5 py-3", children: [
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: "Auth method" }),
+            /* @__PURE__ */ jsxs(
+              Select,
+              {
+                value: authKind,
+                onValueChange: (v) => setAuthKind(v),
+                children: [
+                  /* @__PURE__ */ jsx(SelectTrigger, { className: "h-9 text-[13px]", children: /* @__PURE__ */ jsx(SelectValue, {}) }),
+                  /* @__PURE__ */ jsxs(SelectContent, { children: [
+                    /* @__PURE__ */ jsx(SelectItem, { value: "desktop-app", children: "Desktop App (biometric)" }),
+                    /* @__PURE__ */ jsx(SelectItem, { value: "service-account", children: "Service Account" })
+                  ] })
+                ]
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: authKind === "desktop-app" ? "Account domain" : "Token secret ID" }),
+            /* @__PURE__ */ jsx(
+              Input,
+              {
+                placeholder: authKind === "desktop-app" ? "my.1password.com" : "op-service-token",
+                value: accountName,
+                onChange: (e) => setAccountName(e.target.value),
+                className: "font-mono text-[13px] h-9"
+              }
+            ),
+            /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground/60 leading-relaxed", children: authKind === "desktop-app" ? "Requires the 1Password desktop app with biometric unlock." : "Reference an executor secret that holds the service account token." })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: "Vault" }),
+            /* @__PURE__ */ jsx(
+              VaultPicker,
+              {
+                authKind,
+                accountName,
+                vaultId,
+                onVaultSelect: (id, name) => {
+                  setVaultId(id);
+                  setVaultName(name);
+                }
+              }
+            ),
+            vaultId && /* @__PURE__ */ jsx("p", { className: "font-mono text-[10px] text-muted-foreground/50", children: vaultId })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: "Display name" }),
+            /* @__PURE__ */ jsx(
+              Input,
+              {
+                placeholder: "1Password",
+                value: vaultName,
+                onChange: (e) => setVaultName(e.target.value),
+                className: "text-[13px] h-9"
+              }
+            )
+          ] }),
+          error && /* @__PURE__ */ jsx("div", { className: "rounded-md border border-destructive/20 bg-destructive/5 px-3 py-2", children: /* @__PURE__ */ jsx("p", { className: "text-[12px] text-destructive whitespace-pre-line", children: error }) })
+        ] }),
+        /* @__PURE__ */ jsxs(DialogFooter, { children: [
+          /* @__PURE__ */ jsx(DialogClose, { asChild: true, children: /* @__PURE__ */ jsx(Button, { variant: "ghost", size: "sm", children: "Cancel" }) }),
+          /* @__PURE__ */ jsx(
+            Button,
+            {
+              size: "sm",
+              onClick: handleSave,
+              disabled: !accountName.trim() || !vaultId.trim() || saving,
+              children: saving ? "Saving\u2026" : isEdit ? "Update" : "Connect"
+            }
+          )
+        ] })
+      ] })
+    }
+  );
+}
+function OnePasswordSettings() {
+  const [configOpen, setConfigOpen] = useState(false);
+  const scopeId = useScope();
+  const configResult = useAtomValue(onepasswordConfigAtom(scopeId));
+  const doRemove = useAtomSet(removeOnePasswordConfig, { mode: "promiseExit" });
+  const handleRemove = async () => {
+    await doRemove({ params: { scopeId }, reactivityKeys: [ReactivityKey2.secrets] });
+  };
+  const config = AsyncResult.match(
+    configResult,
+    { onInitial: () => null, onFailure: () => null, onSuccess: ({ value }) => value }
+  );
+  const isLoading = AsyncResult.match(
+    configResult,
+    {
+      onInitial: () => true,
+      onFailure: () => false,
+      onSuccess: () => false
+    }
+  );
+  const isError = AsyncResult.match(
+    configResult,
+    {
+      onInitial: () => false,
+      onFailure: () => true,
+      onSuccess: () => false
+    }
+  );
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsxs(CardStackEntry, { children: [
+      /* @__PURE__ */ jsx(CardStackEntryContent, { children: isLoading ? /* @__PURE__ */ jsx(CardStackEntryDescription, { children: "Loading\u2026" }) : isError ? /* @__PURE__ */ jsx(CardStackEntryDescription, { className: "text-destructive", children: "Failed to load configuration" }) : config ? /* @__PURE__ */ jsxs("div", { className: "grid grid-cols-[auto_1fr] gap-x-6 gap-y-1 text-[12px]", children: [
+        /* @__PURE__ */ jsx("span", { className: "text-muted-foreground/60", children: "Auth" }),
+        /* @__PURE__ */ jsx("span", { className: "font-mono text-foreground/80 truncate", children: config.auth.kind === "desktop-app" ? config.auth.accountName : "service-account" }),
+        /* @__PURE__ */ jsx("span", { className: "text-muted-foreground/60", children: "Vault" }),
+        /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 min-w-0", children: [
+          /* @__PURE__ */ jsx("span", { className: "text-foreground/80 truncate", children: config.name }),
+          /* @__PURE__ */ jsx("span", { className: "font-mono text-[10px] text-muted-foreground/40 truncate", children: config.vaultId })
+        ] })
+      ] }) : /* @__PURE__ */ jsx(CardStackEntryDescription, { children: "Resolve secrets from your 1Password vault." }) }),
+      /* @__PURE__ */ jsx(CardStackEntryActions, { children: config ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            variant: "ghost",
+            size: "sm",
+            className: "h-7 px-2.5 text-[12px]",
+            onClick: () => setConfigOpen(true),
+            children: "Edit"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            variant: "ghost",
+            size: "sm",
+            className: "h-7 px-2.5 text-[12px] text-destructive/70 hover:text-destructive",
+            onClick: handleRemove,
+            children: "Disconnect"
+          }
+        )
+      ] }) : !isLoading && !isError && /* @__PURE__ */ jsx(
+        Button,
+        {
+          variant: "link",
+          size: "sm",
+          className: "h-7 px-0 text-[12px] shrink-0",
+          onClick: () => setConfigOpen(true),
+          children: "Add 1Password"
+        }
+      ) })
+    ] }),
+    configOpen && /* @__PURE__ */ jsx(
+      ConfigDialog,
+      {
+        open: configOpen,
+        onOpenChange: setConfigOpen,
+        initial: config ? {
+          authKind: config.auth.kind,
+          accountName: config.auth.kind === "desktop-app" ? config.auth.accountName : config.auth.tokenSecretId,
+          vaultId: config.vaultId,
+          name: config.name
+        } : void 0
+      }
+    )
+  ] });
+}
+export {
+  OnePasswordSettings as default
+};
+//# sourceMappingURL=OnePasswordSettings-NUPVIEGH.js.map

package/dist/OnePasswordSettings-NUPVIEGH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/OnePasswordSettings.tsx","../src/react/atoms.ts","../src/react/client.ts","../src/api/group.ts"],"sourcesContent":["import { useState } from \"react\";\nimport { useAtomSet, useAtomValue } from \"@effect/atom-react\";\nimport * as Exit from \"effect/Exit\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\nimport { ReactivityKey } from \"@executor-js/react/api/reactivity-keys\";\nimport { useScope } from \"@executor-js/react/api/scope-context\";\nimport { Button } from \"@executor-js/react/components/button\";\nimport { Input } from \"@executor-js/react/components/input\";\nimport { Label } from \"@executor-js/react/components/label\";\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from \"@executor-js/react/components/select\";\nimport {\n  Dialog,\n  DialogContent,\n  DialogHeader,\n  DialogTitle,\n  DialogDescription,\n  DialogFooter,\n  DialogClose,\n} from \"@executor-js/react/components/dialog\";\nimport {\n  CardStackEntry,\n  CardStackEntryActions,\n  CardStackEntryContent,\n  CardStackEntryDescription,\n} from \"@executor-js/react/components/card-stack\";\n\nimport {\n  onepasswordConfigAtom,\n  onepasswordVaultsAtom,\n  configureOnePassword,\n  removeOnePasswordConfig,\n} from \"./atoms\";\nimport type { OnePasswordConfig } from \"../sdk/types\";\n\n// ---------------------------------------------------------------------------\n// Vault picker\n// ---------------------------------------------------------------------------\n\nfunction VaultPicker(props: {\n  authKind: \"desktop-app\" | \"service-account\";\n  accountName: string;\n  vaultId: string;\n  onVaultSelect: (id: string, name: string) => void;\n}) {\n  const account = props.accountName.trim();\n  const scopeId = useScope();\n  const vaultsResult = useAtomValue(onepasswordVaultsAtom(props.authKind, account, scopeId));\n\n  const { vaults, isLoading, error } = AsyncResult.matchWithError(\n    vaultsResult as AsyncResult.AsyncResult<\n      { vaults: ReadonlyArray<{ id: string; name: string }> },\n      Error\n    >,\n    {\n      onInitial: () => ({\n        vaults: [] as { id: string; name: string }[],\n        isLoading: true,\n        error: null,\n      }),\n      onError: () => ({\n        vaults: [] as { id: string; name: string }[],\n        isLoading: false,\n        error: \"Failed to list vaults\",\n      }),\n      onDefect: () => ({\n        vaults: [] as { id: string; name: string }[],\n        isLoading: false,\n        error: \"Failed to list vaults\",\n      }),\n      onSuccess: ({ value }) => {\n        const v = value.vaults;\n        if (v.length > 0 && !props.vaultId) {\n          queueMicrotask(() => props.onVaultSelect(v[0].id, v[0].name));\n        }\n        return { vaults: [...v], isLoading: false, error: null };\n      },\n    },\n  );\n\n  if (!account) {\n    return (\n      <p className=\"text-[11px] text-muted-foreground/50 py-1\">\n        Enter account details to load vaults.\n      </p>\n    );\n  }\n\n  return (\n    <div className=\"grid gap-2\">\n      <Select\n        disabled={isLoading || vaults.length === 0}\n        value={props.vaultId}\n        onValueChange={(id) => {\n          const v = vaults.find((vault) => vault.id === id);\n          if (v) props.onVaultSelect(v.id, v.name);\n        }}\n      >\n        <SelectTrigger className=\"h-9 text-[13px]\">\n          <SelectValue placeholder={isLoading ? \"Loading…\" : \"Select a vault\"} />\n        </SelectTrigger>\n        <SelectContent>\n          {vaults.map((v) => (\n            <SelectItem key={v.id} value={v.id}>\n              {v.name}\n            </SelectItem>\n          ))}\n        </SelectContent>\n      </Select>\n      {error && (\n        <div className=\"rounded-md border border-destructive/20 bg-destructive/5 px-2.5 py-1.5\">\n          <p className=\"text-[11px] text-destructive leading-relaxed whitespace-pre-line\">\n            {error}\n          </p>\n        </div>\n      )}\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Config dialog\n// ---------------------------------------------------------------------------\n\nfunction ConfigDialog(props: {\n  open: boolean;\n  onOpenChange: (v: boolean) => void;\n  initial?: { authKind: string; accountName: string; vaultId: string; name: string };\n}) {\n  const isEdit = !!props.initial;\n  const [authKind, setAuthKind] = useState<\"desktop-app\" | \"service-account\">(\n    (props.initial?.authKind as \"desktop-app\" | \"service-account\") ?? \"desktop-app\",\n  );\n  const [accountName, setAccountName] = useState(props.initial?.accountName ?? \"my.1password.com\");\n  const [vaultId, setVaultId] = useState(props.initial?.vaultId ?? \"\");\n  const [vaultName, setVaultName] = useState(props.initial?.name ?? \"\");\n  const [saving, setSaving] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const scopeId = useScope();\n  const doConfigure = useAtomSet(configureOnePassword, { mode: \"promiseExit\" });\n\n  const reset = () => {\n    if (!isEdit) {\n      setAuthKind(\"desktop-app\");\n      setAccountName(\"my.1password.com\");\n      setVaultId(\"\");\n      setVaultName(\"\");\n    }\n    setError(null);\n    setSaving(false);\n  };\n\n  const handleSave = async () => {\n    if (!accountName.trim() || !vaultId.trim()) return;\n    setSaving(true);\n    setError(null);\n\n    const auth =\n      authKind === \"desktop-app\"\n        ? { kind: \"desktop-app\" as const, accountName: accountName.trim() }\n        : { kind: \"service-account\" as const, tokenSecretId: accountName.trim() };\n\n    const exit = await doConfigure({\n      params: { scopeId },\n      payload: { auth, vaultId: vaultId.trim(), name: vaultName.trim() || \"1Password\" },\n      reactivityKeys: [ReactivityKey.secrets],\n    });\n    if (Exit.isFailure(exit)) {\n      setError(\"Failed to save configuration\");\n      setSaving(false);\n      return;\n    }\n\n    props.onOpenChange(false);\n    reset();\n  };\n\n  return (\n    <Dialog\n      open={props.open}\n      onOpenChange={(v) => {\n        if (!v) reset();\n        props.onOpenChange(v);\n      }}\n    >\n      <DialogContent className=\"sm:max-w-[420px]\">\n        <DialogHeader>\n          <DialogTitle className=\"font-display text-xl\">\n            {isEdit ? \"Edit 1Password\" : \"Connect 1Password\"}\n          </DialogTitle>\n          <DialogDescription className=\"text-[13px] leading-relaxed\">\n            Link a vault to resolve secrets via the 1Password desktop app or a service account.\n          </DialogDescription>\n        </DialogHeader>\n\n        <div className=\"grid gap-5 py-3\">\n          {/* Auth method */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              Auth method\n            </Label>\n            <Select\n              value={authKind}\n              onValueChange={(v) => setAuthKind(v as \"desktop-app\" | \"service-account\")}\n            >\n              <SelectTrigger className=\"h-9 text-[13px]\">\n                <SelectValue />\n              </SelectTrigger>\n              <SelectContent>\n                <SelectItem value=\"desktop-app\">Desktop App (biometric)</SelectItem>\n                <SelectItem value=\"service-account\">Service Account</SelectItem>\n              </SelectContent>\n            </Select>\n          </div>\n\n          {/* Account / token */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              {authKind === \"desktop-app\" ? \"Account domain\" : \"Token secret ID\"}\n            </Label>\n            <Input\n              placeholder={authKind === \"desktop-app\" ? \"my.1password.com\" : \"op-service-token\"}\n              value={accountName}\n              onChange={(e) => setAccountName((e.target as HTMLInputElement).value)}\n              className=\"font-mono text-[13px] h-9\"\n            />\n            <p className=\"text-[11px] text-muted-foreground/60 leading-relaxed\">\n              {authKind === \"desktop-app\"\n                ? \"Requires the 1Password desktop app with biometric unlock.\"\n                : \"Reference an executor secret that holds the service account token.\"}\n            </p>\n          </div>\n\n          {/* Vault */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              Vault\n            </Label>\n            <VaultPicker\n              authKind={authKind}\n              accountName={accountName}\n              vaultId={vaultId}\n              onVaultSelect={(id, name) => {\n                setVaultId(id);\n                setVaultName(name);\n              }}\n            />\n            {vaultId && <p className=\"font-mono text-[10px] text-muted-foreground/50\">{vaultId}</p>}\n          </div>\n\n          {/* Display name */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              Display name\n            </Label>\n            <Input\n              placeholder=\"1Password\"\n              value={vaultName}\n              onChange={(e) => setVaultName((e.target as HTMLInputElement).value)}\n              className=\"text-[13px] h-9\"\n            />\n          </div>\n\n          {error && (\n            <div className=\"rounded-md border border-destructive/20 bg-destructive/5 px-3 py-2\">\n              <p className=\"text-[12px] text-destructive whitespace-pre-line\">{error}</p>\n            </div>\n          )}\n        </div>\n\n        <DialogFooter>\n          <DialogClose asChild>\n            <Button variant=\"ghost\" size=\"sm\">\n              Cancel\n            </Button>\n          </DialogClose>\n          <Button\n            size=\"sm\"\n            onClick={handleSave}\n            disabled={!accountName.trim() || !vaultId.trim() || saving}\n          >\n            {saving ? \"Saving…\" : isEdit ? \"Update\" : \"Connect\"}\n          </Button>\n        </DialogFooter>\n      </DialogContent>\n    </Dialog>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Settings card\n// ---------------------------------------------------------------------------\n\nexport default function OnePasswordSettings() {\n  const [configOpen, setConfigOpen] = useState(false);\n  const scopeId = useScope();\n  const configResult = useAtomValue(onepasswordConfigAtom(scopeId));\n  const doRemove = useAtomSet(removeOnePasswordConfig, { mode: \"promiseExit\" });\n\n  const handleRemove = async () => {\n    await doRemove({ params: { scopeId }, reactivityKeys: [ReactivityKey.secrets] });\n  };\n\n  const config: OnePasswordConfig | null = AsyncResult.match(\n    configResult as AsyncResult.AsyncResult<OnePasswordConfig | null, unknown>,\n    { onInitial: () => null, onFailure: () => null, onSuccess: ({ value }) => value },\n  );\n  const isLoading = AsyncResult.match(\n    configResult as AsyncResult.AsyncResult<OnePasswordConfig | null, unknown>,\n    {\n      onInitial: () => true,\n      onFailure: () => false,\n      onSuccess: () => false,\n    },\n  );\n  const isError = AsyncResult.match(\n    configResult as AsyncResult.AsyncResult<OnePasswordConfig | null, unknown>,\n    {\n      onInitial: () => false,\n      onFailure: () => true,\n      onSuccess: () => false,\n    },\n  );\n\n  return (\n    <>\n      <CardStackEntry>\n        <CardStackEntryContent>\n          {isLoading ? (\n            <CardStackEntryDescription>Loading…</CardStackEntryDescription>\n          ) : isError ? (\n            <CardStackEntryDescription className=\"text-destructive\">\n              Failed to load configuration\n            </CardStackEntryDescription>\n          ) : config ? (\n            <div className=\"grid grid-cols-[auto_1fr] gap-x-6 gap-y-1 text-[12px]\">\n              <span className=\"text-muted-foreground/60\">Auth</span>\n              <span className=\"font-mono text-foreground/80 truncate\">\n                {config.auth.kind === \"desktop-app\" ? config.auth.accountName : \"service-account\"}\n              </span>\n              <span className=\"text-muted-foreground/60\">Vault</span>\n              <div className=\"flex items-center gap-2 min-w-0\">\n                <span className=\"text-foreground/80 truncate\">{config.name}</span>\n                <span className=\"font-mono text-[10px] text-muted-foreground/40 truncate\">\n                  {config.vaultId}\n                </span>\n              </div>\n            </div>\n          ) : (\n            <CardStackEntryDescription>\n              Resolve secrets from your 1Password vault.\n            </CardStackEntryDescription>\n          )}\n        </CardStackEntryContent>\n        <CardStackEntryActions>\n          {config ? (\n            <>\n              <Button\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"h-7 px-2.5 text-[12px]\"\n                onClick={() => setConfigOpen(true)}\n              >\n                Edit\n              </Button>\n              <Button\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"h-7 px-2.5 text-[12px] text-destructive/70 hover:text-destructive\"\n                onClick={handleRemove}\n              >\n                Disconnect\n              </Button>\n            </>\n          ) : (\n            !isLoading &&\n            !isError && (\n              <Button\n                variant=\"link\"\n                size=\"sm\"\n                className=\"h-7 px-0 text-[12px] shrink-0\"\n                onClick={() => setConfigOpen(true)}\n              >\n                Add 1Password\n              </Button>\n            )\n          )}\n        </CardStackEntryActions>\n      </CardStackEntry>\n\n      {configOpen && (\n        <ConfigDialog\n          open={configOpen}\n          onOpenChange={setConfigOpen}\n          initial={\n            config\n              ? {\n                  authKind: config.auth.kind,\n                  accountName:\n                    config.auth.kind === \"desktop-app\"\n                      ? config.auth.accountName\n                      : config.auth.tokenSecretId,\n                  vaultId: config.vaultId,\n                  name: config.name,\n                }\n              : undefined\n          }\n        />\n      )}\n    </>\n  );\n}\n","import type { ScopeId } from \"@executor-js/sdk/core\";\nimport { ReactivityKey } from \"@executor-js/react/api/reactivity-keys\";\nimport { OnePasswordClient } from \"./client\";\n\nexport const onepasswordWriteKeys = [ReactivityKey.secrets] as const;\n\n// ---------------------------------------------------------------------------\n// Query atoms\n// ---------------------------------------------------------------------------\n\nexport const onepasswordConfigAtom = (scopeId: ScopeId) =>\n  OnePasswordClient.query(\"onepassword\", \"getConfig\", {\n    params: { scopeId },\n    timeToLive: \"30 seconds\",\n    reactivityKeys: [ReactivityKey.secrets],\n  });\n\nexport const onepasswordStatusAtom = (scopeId: ScopeId) =>\n  OnePasswordClient.query(\"onepassword\", \"status\", {\n    params: { scopeId },\n    timeToLive: \"15 seconds\",\n    reactivityKeys: [ReactivityKey.secrets],\n  });\n\n// ---------------------------------------------------------------------------\n// Query atoms — vaults\n// ---------------------------------------------------------------------------\n\nexport const onepasswordVaultsAtom = (\n  authKind: \"desktop-app\" | \"service-account\",\n  account: string,\n  scopeId: ScopeId,\n) =>\n  OnePasswordClient.query(\"onepassword\", \"listVaults\", {\n    params: { scopeId },\n    query: { authKind, account },\n    timeToLive: \"30 seconds\",\n    reactivityKeys: [ReactivityKey.secrets],\n  });\n\n// ---------------------------------------------------------------------------\n// Mutation atoms\n// ---------------------------------------------------------------------------\n\nexport const configureOnePassword = OnePasswordClient.mutation(\"onepassword\", \"configure\");\n\nexport const removeOnePasswordConfig = OnePasswordClient.mutation(\"onepassword\", \"removeConfig\");\n","import { createPluginAtomClient } from \"@executor-js/sdk/client\";\nimport { getBaseUrl } from \"@executor-js/react/api/base-url\";\nimport { OnePasswordGroup } from \"../api/group\";\n\nexport const OnePasswordClient = createPluginAtomClient(OnePasswordGroup, {\n  baseUrl: getBaseUrl,\n});\n","import { HttpApiEndpoint, HttpApiGroup } from \"effect/unstable/httpapi\";\nimport { Schema } from \"effect\";\nimport { InternalError, ScopeId } from \"@executor-js/sdk/core\";\n\nimport { OnePasswordError } from \"../sdk/errors\";\nimport { OnePasswordConfig, OnePasswordConfigSchema, Vault, ConnectionStatus } from \"../sdk/types\";\n\n// ---------------------------------------------------------------------------\n// Params\n// ---------------------------------------------------------------------------\n\nconst ScopeParams = { scopeId: ScopeId };\n\n// ---------------------------------------------------------------------------\n// Payloads\n// ---------------------------------------------------------------------------\n\nconst ConfigurePayload = OnePasswordConfigSchema;\n\nconst ListVaultsParams = Schema.Struct({\n  authKind: Schema.Literals([\"desktop-app\", \"service-account\"]),\n  account: Schema.String,\n});\n\n// ---------------------------------------------------------------------------\n// Responses\n// ---------------------------------------------------------------------------\n\nconst ListVaultsResponse = Schema.Struct({\n  vaults: Schema.Array(Vault),\n});\n\nconst GetConfigResponse = Schema.NullOr(OnePasswordConfig);\n\n// ---------------------------------------------------------------------------\n// Group\n//\n// Plugin SDK errors (OnePasswordError) are declared once at the group level\n// via `.addError(...)` — every endpoint inherits. The error carries its own\n// 502 status via `HttpApiSchema.annotations` in errors.ts.\n//\n// `InternalError` is the shared opaque 500 schema translated at the HTTP\n// edge by `withCapture` (see observability.ts). Storage failures on\n// `ctx.storage`/`ctx.secrets` flow through as `StorageFailure` in the\n// typed channel and are captured + downgraded to `InternalError({ traceId })`\n// at Layer composition. No per-handler translation.\n// ---------------------------------------------------------------------------\n\nexport const OnePasswordGroup = HttpApiGroup.make(\"onepassword\")\n  .add(\n    HttpApiEndpoint.get(\"getConfig\", \"/scopes/:scopeId/onepassword/config\", {\n      params: ScopeParams,\n      success: GetConfigResponse,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.put(\"configure\", \"/scopes/:scopeId/onepassword/config\", {\n      params: ScopeParams,\n      payload: ConfigurePayload,\n      success: Schema.Void,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"removeConfig\", \"/scopes/:scopeId/onepassword/config\", {\n      params: ScopeParams,\n      success: Schema.Void,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"status\", \"/scopes/:scopeId/onepassword/status\", {\n      params: ScopeParams,\n      success: ConnectionStatus,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"listVaults\", \"/scopes/:scopeId/onepassword/vaults\", {\n      params: ScopeParams,\n      query: ListVaultsParams,\n      success: ListVaultsResponse,\n      error: [InternalError, OnePasswordError],\n    }),\n  );\n"],"mappings":";;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,oBAAoB;AACzC,YAAY,UAAU;AACtB,YAAY,iBAAiB;AAC7B,SAAS,iBAAAA,sBAAqB;AAC9B,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AC7BP,SAAS,qBAAqB;;;ACD9B,SAAS,8BAA8B;AACvC,SAAS,kBAAkB;;;ACD3B,SAAS,iBAAiB,oBAAoB;AAC9C,SAAS,cAAc;AACvB,SAAS,eAAe,eAAe;AASvC,IAAM,cAAc,EAAE,SAAS,QAAQ;AAMvC,IAAM,mBAAmB;AAEzB,IAAM,mBAAmB,OAAO,OAAO;AAAA,EACrC,UAAU,OAAO,SAAS,CAAC,eAAe,iBAAiB,CAAC;AAAA,EAC5D,SAAS,OAAO;AAClB,CAAC;AAMD,IAAM,qBAAqB,OAAO,OAAO;AAAA,EACvC,QAAQ,OAAO,MAAM,KAAK;AAC5B,CAAC;AAED,IAAM,oBAAoB,OAAO,OAAO,iBAAiB;AAgBlD,IAAM,mBAAmB,aAAa,KAAK,aAAa,EAC5D;AAAA,EACC,gBAAgB,IAAI,aAAa,uCAAuC;AAAA,IACtE,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,aAAa,uCAAuC;AAAA,IACtE,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS,OAAO;AAAA,IAChB,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,OAAO,gBAAgB,uCAAuC;AAAA,IAC5E,QAAQ;AAAA,IACR,SAAS,OAAO;AAAA,IAChB,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,UAAU,uCAAuC;AAAA,IACnE,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,cAAc,uCAAuC;AAAA,IACvE,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH;;;ADjFK,IAAM,oBAAoB,uBAAuB,kBAAkB;AAAA,EACxE,SAAS;AACX,CAAC;;;ADFM,IAAM,uBAAuB,CAAC,cAAc,OAAO;AAMnD,IAAM,wBAAwB,CAAC,YACpC,kBAAkB,MAAM,eAAe,aAAa;AAAA,EAClD,QAAQ,EAAE,QAAQ;AAAA,EAClB,YAAY;AAAA,EACZ,gBAAgB,CAAC,cAAc,OAAO;AACxC,CAAC;AAaI,IAAM,wBAAwB,CACnC,UACA,SACA,YAEA,kBAAkB,MAAM,eAAe,cAAc;AAAA,EACnD,QAAQ,EAAE,QAAQ;AAAA,EAClB,OAAO,EAAE,UAAU,QAAQ;AAAA,EAC3B,YAAY;AAAA,EACZ,gBAAgB,CAAC,cAAc,OAAO;AACxC,CAAC;AAMI,IAAM,uBAAuB,kBAAkB,SAAS,eAAe,WAAW;AAElF,IAAM,0BAA0B,kBAAkB,SAAS,eAAe,cAAc;;;ADyCzF,SAmRM,UAnRN,KAQA,YARA;AA3CN,SAAS,YAAY,OAKlB;AACD,QAAM,UAAU,MAAM,YAAY,KAAK;AACvC,QAAM,UAAU,SAAS;AACzB,QAAM,eAAe,aAAa,sBAAsB,MAAM,UAAU,SAAS,OAAO,CAAC;AAEzF,QAAM,EAAE,QAAQ,WAAW,MAAM,IAAgB;AAAA,IAC/C;AAAA,IAIA;AAAA,MACE,WAAW,OAAO;AAAA,QAChB,QAAQ,CAAC;AAAA,QACT,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,SAAS,OAAO;AAAA,QACd,QAAQ,CAAC;AAAA,QACT,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO;AAAA,QACf,QAAQ,CAAC;AAAA,QACT,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,WAAW,CAAC,EAAE,MAAM,MAAM;AACxB,cAAM,IAAI,MAAM;AAChB,YAAI,EAAE,SAAS,KAAK,CAAC,MAAM,SAAS;AAClC,yBAAe,MAAM,MAAM,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC;AAAA,QAC9D;AACA,eAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,OAAO,OAAO,KAAK;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WACE,oBAAC,OAAE,WAAU,6CAA4C,mDAEzD;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,cACb;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,UAAU,aAAa,OAAO,WAAW;AAAA,QACzC,OAAO,MAAM;AAAA,QACb,eAAe,CAAC,OAAO;AACrB,gBAAM,IAAI,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,EAAE;AAChD,cAAI,EAAG,OAAM,cAAc,EAAE,IAAI,EAAE,IAAI;AAAA,QACzC;AAAA,QAEA;AAAA,8BAAC,iBAAc,WAAU,mBACvB,8BAAC,eAAY,aAAa,YAAY,kBAAa,kBAAkB,GACvE;AAAA,UACA,oBAAC,iBACE,iBAAO,IAAI,CAAC,MACX,oBAAC,cAAsB,OAAO,EAAE,IAC7B,YAAE,QADY,EAAE,EAEnB,CACD,GACH;AAAA;AAAA;AAAA,IACF;AAAA,IACC,SACC,oBAAC,SAAI,WAAU,0EACb,8BAAC,OAAE,WAAU,oEACV,iBACH,GACF;AAAA,KAEJ;AAEJ;AAMA,SAAS,aAAa,OAInB;AACD,QAAM,SAAS,CAAC,CAAC,MAAM;AACvB,QAAM,CAAC,UAAU,WAAW,IAAI;AAAA,IAC7B,MAAM,SAAS,YAAkD;AAAA,EACpE;AACA,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,MAAM,SAAS,eAAe,kBAAkB;AAC/F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM,SAAS,WAAW,EAAE;AACnE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,MAAM,SAAS,QAAQ,EAAE;AACpE,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AAEtD,QAAM,UAAU,SAAS;AACzB,QAAM,cAAc,WAAW,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE5E,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,QAAQ;AACX,kBAAY,aAAa;AACzB,qBAAe,kBAAkB;AACjC,iBAAW,EAAE;AACb,mBAAa,EAAE;AAAA,IACjB;AACA,aAAS,IAAI;AACb,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,YAAY,KAAK,KAAK,CAAC,QAAQ,KAAK,EAAG;AAC5C,cAAU,IAAI;AACd,aAAS,IAAI;AAEb,UAAM,OACJ,aAAa,gBACT,EAAE,MAAM,eAAwB,aAAa,YAAY,KAAK,EAAE,IAChE,EAAE,MAAM,mBAA4B,eAAe,YAAY,KAAK,EAAE;AAE5E,UAAM,OAAO,MAAM,YAAY;AAAA,MAC7B,QAAQ,EAAE,QAAQ;AAAA,MAClB,SAAS,EAAE,MAAM,SAAS,QAAQ,KAAK,GAAG,MAAM,UAAU,KAAK,KAAK,YAAY;AAAA,MAChF,gBAAgB,CAACC,eAAc,OAAO;AAAA,IACxC,CAAC;AACD,QAAS,eAAU,IAAI,GAAG;AACxB,eAAS,8BAA8B;AACvC,gBAAU,KAAK;AACf;AAAA,IACF;AAEA,UAAM,aAAa,KAAK;AACxB,UAAM;AAAA,EACR;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAM,MAAM;AAAA,MACZ,cAAc,CAAC,MAAM;AACnB,YAAI,CAAC,EAAG,OAAM;AACd,cAAM,aAAa,CAAC;AAAA,MACtB;AAAA,MAEA,+BAAC,iBAAc,WAAU,oBACvB;AAAA,6BAAC,gBACC;AAAA,8BAAC,eAAY,WAAU,wBACpB,mBAAS,mBAAmB,qBAC/B;AAAA,UACA,oBAAC,qBAAkB,WAAU,+BAA8B,iGAE3D;AAAA,WACF;AAAA,QAEA,qBAAC,SAAI,WAAU,mBAEb;AAAA,+BAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EAA4E,yBAE7F;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAO;AAAA,gBACP,eAAe,CAAC,MAAM,YAAY,CAAsC;AAAA,gBAExE;AAAA,sCAAC,iBAAc,WAAU,mBACvB,8BAAC,eAAY,GACf;AAAA,kBACA,qBAAC,iBACC;AAAA,wCAAC,cAAW,OAAM,eAAc,qCAAuB;AAAA,oBACvD,oBAAC,cAAW,OAAM,mBAAkB,6BAAe;AAAA,qBACrD;AAAA;AAAA;AAAA,YACF;AAAA,aACF;AAAA,UAGA,qBAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EACd,uBAAa,gBAAgB,mBAAmB,mBACnD;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,aAAa,aAAa,gBAAgB,qBAAqB;AAAA,gBAC/D,OAAO;AAAA,gBACP,UAAU,CAAC,MAAM,eAAgB,EAAE,OAA4B,KAAK;AAAA,gBACpE,WAAU;AAAA;AAAA,YACZ;AAAA,YACA,oBAAC,OAAE,WAAU,wDACV,uBAAa,gBACV,8DACA,sEACN;AAAA,aACF;AAAA,UAGA,qBAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EAA4E,mBAE7F;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,eAAe,CAAC,IAAI,SAAS;AAC3B,6BAAW,EAAE;AACb,+BAAa,IAAI;AAAA,gBACnB;AAAA;AAAA,YACF;AAAA,YACC,WAAW,oBAAC,OAAE,WAAU,kDAAkD,mBAAQ;AAAA,aACrF;AAAA,UAGA,qBAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EAA4E,0BAE7F;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,aAAY;AAAA,gBACZ,OAAO;AAAA,gBACP,UAAU,CAAC,MAAM,aAAc,EAAE,OAA4B,KAAK;AAAA,gBAClE,WAAU;AAAA;AAAA,YACZ;AAAA,aACF;AAAA,UAEC,SACC,oBAAC,SAAI,WAAU,sEACb,8BAAC,OAAE,WAAU,oDAAoD,iBAAM,GACzE;AAAA,WAEJ;AAAA,QAEA,qBAAC,gBACC;AAAA,8BAAC,eAAY,SAAO,MAClB,8BAAC,UAAO,SAAQ,SAAQ,MAAK,MAAK,oBAElC,GACF;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS;AAAA,cACT,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK;AAAA,cAEnD,mBAAS,iBAAY,SAAS,WAAW;AAAA;AAAA,UAC5C;AAAA,WACF;AAAA,SACF;AAAA;AAAA,EACF;AAEJ;AAMe,SAAR,sBAAuC;AAC5C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,UAAU,SAAS;AACzB,QAAM,eAAe,aAAa,sBAAsB,OAAO,CAAC;AAChE,QAAM,WAAW,WAAW,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAE5E,QAAM,eAAe,YAAY;AAC/B,UAAM,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,gBAAgB,CAACA,eAAc,OAAO,EAAE,CAAC;AAAA,EACjF;AAEA,QAAM,SAA+C;AAAA,IACnD;AAAA,IACA,EAAE,WAAW,MAAM,MAAM,WAAW,MAAM,MAAM,WAAW,CAAC,EAAE,MAAM,MAAM,MAAM;AAAA,EAClF;AACA,QAAM,YAAwB;AAAA,IAC5B;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACA,QAAM,UAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AAEA,SACE,iCACE;AAAA,yBAAC,kBACC;AAAA,0BAAC,yBACE,sBACC,oBAAC,6BAA0B,2BAAQ,IACjC,UACF,oBAAC,6BAA0B,WAAU,oBAAmB,0CAExD,IACE,SACF,qBAAC,SAAI,WAAU,yDACb;AAAA,4BAAC,UAAK,WAAU,4BAA2B,kBAAI;AAAA,QAC/C,oBAAC,UAAK,WAAU,yCACb,iBAAO,KAAK,SAAS,gBAAgB,OAAO,KAAK,cAAc,mBAClE;AAAA,QACA,oBAAC,UAAK,WAAU,4BAA2B,mBAAK;AAAA,QAChD,qBAAC,SAAI,WAAU,mCACb;AAAA,8BAAC,UAAK,WAAU,+BAA+B,iBAAO,MAAK;AAAA,UAC3D,oBAAC,UAAK,WAAU,2DACb,iBAAO,SACV;AAAA,WACF;AAAA,SACF,IAEA,oBAAC,6BAA0B,wDAE3B,GAEJ;AAAA,MACA,oBAAC,yBACE,mBACC,iCACE;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,cAAc,IAAI;AAAA,YAClC;AAAA;AAAA,QAED;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACV;AAAA;AAAA,QAED;AAAA,SACF,IAEA,CAAC,aACD,CAAC,WACC;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS,MAAM,cAAc,IAAI;AAAA,UAClC;AAAA;AAAA,MAED,GAGN;AAAA,OACF;AAAA,IAEC,cACC;AAAA,MAAC;AAAA;AAAA,QACC,MAAM;AAAA,QACN,cAAc;AAAA,QACd,SACE,SACI;AAAA,UACE,UAAU,OAAO,KAAK;AAAA,UACtB,aACE,OAAO,KAAK,SAAS,gBACjB,OAAO,KAAK,cACZ,OAAO,KAAK;AAAA,UAClB,SAAS,OAAO;AAAA,UAChB,MAAM,OAAO;AAAA,QACf,IACA;AAAA;AAAA,IAER;AAAA,KAEJ;AAEJ;","names":["ReactivityKey","ReactivityKey"]}

package/dist/api/group.d.ts

@@ -1,21 +1,31 @@
 import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
 import { Schema } from "effect";
-import { InternalError } from "@executor-js/api";
+import { InternalError } from "@executor-js/sdk/core";
 import { OnePasswordError } from "../sdk/errors";
 import { OnePasswordConfig, Vault, ConnectionStatus } from "../sdk/types";
 export declare const OnePasswordGroup: HttpApiGroup.HttpApiGroup<"onepassword", HttpApiEndpoint.HttpApiEndpoint<"getConfig", "GET", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.NullOr<typeof OnePasswordConfig>>, HttpApiEndpoint.Json<typeof OnePasswordError | typeof InternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"configure", "PUT", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.NullOr<typeof OnePasswordConfig>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"configure", "PUT", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof OnePasswordConfig>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof OnePasswordError | typeof InternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeConfig", "DELETE", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly auth: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"desktop-app">;
+        readonly accountName: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"service-account">;
+        readonly tokenSecretId: Schema.String;
+    }>]>;
+    readonly vaultId: Schema.String;
+    readonly name: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeConfig", "DELETE", "/scopes/:scopeId/onepassword/config", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof OnePasswordError | typeof InternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/scopes/:scopeId/onepassword/status", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/scopes/:scopeId/onepassword/status", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof ConnectionStatus>, HttpApiEndpoint.Json<typeof OnePasswordError | typeof InternalError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listVaults", "GET", "/scopes/:scopeId/onepassword/vaults", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof ConnectionStatus>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listVaults", "GET", "/scopes/:scopeId/onepassword/vaults", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
 }>>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authKind: Schema.Literals<readonly ["desktop-app", "service-account"]>;
     readonly account: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly vaults: Schema.$Array<typeof Vault>;
-}>>, HttpApiEndpoint.Json<typeof OnePasswordError | typeof InternalError>, never, never>, false>;
+}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never>, false>;

package/dist/api/handlers.d.ts

@@ -1,6 +1,12 @@
-import { Context } from "effect";
-import type { OnePasswordExtension } from "../sdk/plugin";
-declare const OnePasswordExtensionService_base: Context.ServiceClass<OnePasswordExtensionService, "OnePasswordExtensionService", OnePasswordExtension>;
+import { Context, Effect } from "effect";
+declare const OnePasswordExtensionService_base: Context.ServiceClass<OnePasswordExtensionService, "OnePasswordExtensionService", {
+    configure: (config: import("../promise").OnePasswordConfig, targetScope: string) => Effect.Effect<void, import("@executor-js/storage-core").StorageError, never>;
+    getConfig: () => Effect.Effect<import("../promise").OnePasswordConfig | null, import("@executor-js/storage-core").StorageError | import("../promise").OnePasswordError, never>;
+    removeConfig: (targetScope: string) => Effect.Effect<void, import("@executor-js/storage-core").StorageError, never>;
+    status: () => Effect.Effect<import("../promise").ConnectionStatus, import("@executor-js/storage-core").StorageFailure | import("../promise").OnePasswordError, never>;
+    listVaults: (auth: import("../promise").OnePasswordAuth) => Effect.Effect<import("../promise").Vault[], import("@executor-js/storage-core").StorageFailure | import("../promise").OnePasswordError, never>;
+    resolve: (uri: string) => Effect.Effect<string, import("@executor-js/storage-core").StorageFailure | import("../promise").OnePasswordError, never>;
+}>;
 export declare class OnePasswordExtensionService extends OnePasswordExtensionService_base {
 }
 export declare const OnePasswordHandlers: import("effect/Layer").Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", OnePasswordExtensionService>>;

package/dist/api/index.d.ts

@@ -1,2 +1,37 @@
+import { type OnePasswordPluginOptions } from "../sdk/plugin";
+import { OnePasswordExtensionService } from "./handlers";
 export { OnePasswordGroup } from "./group";
 export { OnePasswordHandlers, OnePasswordExtensionService } from "./handlers";
+export declare const onepasswordHttpPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"onepassword", {
+    configure: (config: import("../promise").OnePasswordConfig, targetScope: string) => import("effect/Effect").Effect<void, import("@executor-js/storage-core").StorageError, never>;
+    getConfig: () => import("effect/Effect").Effect<import("../promise").OnePasswordConfig | null, import("@executor-js/storage-core").StorageError | import("../promise").OnePasswordError, never>;
+    removeConfig: (targetScope: string) => import("effect/Effect").Effect<void, import("@executor-js/storage-core").StorageError, never>;
+    status: () => import("effect/Effect").Effect<import("../promise").ConnectionStatus, import("@executor-js/storage-core").StorageFailure | import("../promise").OnePasswordError, never>;
+    listVaults: (auth: import("../promise").OnePasswordAuth) => import("effect/Effect").Effect<import("../promise").Vault[], import("@executor-js/storage-core").StorageFailure | import("../promise").OnePasswordError, never>;
+    resolve: (uri: string) => import("effect/Effect").Effect<string, import("@executor-js/storage-core").StorageFailure | import("../promise").OnePasswordError, never>;
+}, import("../sdk").OnePasswordStore, OnePasswordPluginOptions, undefined, typeof OnePasswordExtensionService, import("effect/Layer").Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", OnePasswordExtensionService>>, import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"onepassword", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getConfig", "GET", "/scopes/:scopeId/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").NullOr<typeof import("../promise").OnePasswordConfig>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"configure", "PUT", "/scopes/:scopeId/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly auth: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literal<"desktop-app">;
+        readonly accountName: import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literal<"service-account">;
+        readonly tokenSecretId: import("effect/Schema").String;
+    }>]>;
+    readonly vaultId: import("effect/Schema").String;
+    readonly name: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Void>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"removeConfig", "DELETE", "/scopes/:scopeId/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Void>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "GET", "/scopes/:scopeId/onepassword/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("../promise").ConnectionStatus>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listVaults", "GET", "/scopes/:scopeId/onepassword/vaults", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    readonly authKind: import("effect/Schema").Literals<readonly ["desktop-app", "service-account"]>;
+    readonly account: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly vaults: import("effect/Schema").$Array<typeof import("../promise").Vault>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof import("../promise").OnePasswordError>, never, never>, false>>;

package/dist/chunk-NRYSRUWU.js

@@ -0,0 +1,68 @@
+// src/sdk/types.ts
+import { Schema } from "effect";
+var DesktopAppAuthSchema = Schema.Struct({
+  kind: Schema.Literal("desktop-app"),
+  /** 1Password account domain, e.g. "my.1password.com" */
+  accountName: Schema.String
+});
+var DesktopAppAuth = class extends Schema.Class("DesktopAppAuth")(
+  DesktopAppAuthSchema.fields
+) {
+};
+var ServiceAccountAuthSchema = Schema.Struct({
+  kind: Schema.Literal("service-account"),
+  /** The service account token (stored as a secret) */
+  tokenSecretId: Schema.String
+});
+var ServiceAccountAuth = class extends Schema.Class("ServiceAccountAuth")(
+  ServiceAccountAuthSchema.fields
+) {
+};
+var OnePasswordAuthSchema = Schema.Union([DesktopAppAuthSchema, ServiceAccountAuthSchema]);
+var OnePasswordAuth = Schema.Union([DesktopAppAuth, ServiceAccountAuth]);
+var OnePasswordConfigSchema = Schema.Struct({
+  auth: OnePasswordAuthSchema,
+  /** Vault to scope operations to */
+  vaultId: Schema.String,
+  /** Human label */
+  name: Schema.String
+});
+var OnePasswordConfig = class extends Schema.Class("OnePasswordConfig")(
+  OnePasswordConfigSchema.fields
+) {
+};
+var Vault = class extends Schema.Class("Vault")({
+  id: Schema.String,
+  name: Schema.String
+}) {
+};
+var ConnectionStatus = class extends Schema.Class("ConnectionStatus")({
+  connected: Schema.Boolean,
+  vaultName: Schema.optional(Schema.String),
+  error: Schema.optional(Schema.String)
+}) {
+};
+
+// src/sdk/errors.ts
+import { Schema as Schema2 } from "effect";
+var OnePasswordError = class extends Schema2.TaggedErrorClass()(
+  "OnePasswordError",
+  {
+    operation: Schema2.String,
+    message: Schema2.String
+  },
+  { httpApiStatus: 502 }
+) {
+};
+
+export {
+  DesktopAppAuth,
+  ServiceAccountAuth,
+  OnePasswordAuth,
+  OnePasswordConfigSchema,
+  OnePasswordConfig,
+  Vault,
+  ConnectionStatus,
+  OnePasswordError
+};
+//# sourceMappingURL=chunk-NRYSRUWU.js.map