@executor-js/plugin-onepassword 0.1.0 → 1.4.20

package/dist/sdk/plugin.d.ts

@@ -1,34 +1,41 @@
-import { Effect, Schema } from "effect";
-import { StorageError, type PluginBlobStore, type StorageFailure } from "@executor-js/sdk/core";
-import { OnePasswordExtensionService } from "../api/handlers";
-import { OnePasswordConfig, Vault, ConnectionStatus } from "./types";
+import { Effect } from "effect";
+import { StorageError, type PluginCtx, type PluginBlobStore, type StorageFailure } from "@executor-js/sdk/core";
+import { OnePasswordConfig } from "./types";
 import type { OnePasswordAuth } from "./types";
 import { OnePasswordError } from "./errors";
 export type OnePasswordExtensionFailure = OnePasswordError | StorageFailure;
-export interface OnePasswordExtension {
-    /** Configure the 1Password connection */
-    readonly configure: (config: OnePasswordConfig) => Effect.Effect<void, StorageFailure>;
-    /** Get current configuration (if any) */
-    readonly getConfig: () => Effect.Effect<OnePasswordConfig | null, OnePasswordExtensionFailure>;
-    /** Remove the 1Password configuration */
-    readonly removeConfig: () => Effect.Effect<void, StorageFailure>;
-    /** Check connection status */
-    readonly status: () => Effect.Effect<ConnectionStatus, OnePasswordExtensionFailure>;
-    /** List accessible vaults (requires auth) */
-    readonly listVaults: (auth: OnePasswordAuth) => Effect.Effect<ReadonlyArray<Vault>, OnePasswordExtensionFailure>;
-    /** Resolve a secret directly by op:// URI */
-    readonly resolve: (uri: string) => Effect.Effect<string, OnePasswordExtensionFailure>;
-}
 export interface OnePasswordStore {
     readonly getConfig: () => Effect.Effect<OnePasswordConfig | null, StorageError | OnePasswordError>;
-    readonly saveConfig: (config: OnePasswordConfig) => Effect.Effect<void, StorageError>;
-    readonly deleteConfig: () => Effect.Effect<void, StorageError>;
+    readonly saveConfig: (config: OnePasswordConfig, targetScope: string) => Effect.Effect<void, StorageError>;
+    readonly deleteConfig: (targetScope: string) => Effect.Effect<void, StorageError>;
 }
-export declare const makeOnePasswordStore: (blobs: PluginBlobStore, 
-/** Scope id that owns the single 1Password config blob. Default is the
- *  outermost scope (org/workspace) so the config is visible across
- *  every per-user scope via the blob store's fall-through read. */
-writeScope: string) => OnePasswordStore;
+export declare const makeOnePasswordStore: (blobs: PluginBlobStore) => OnePasswordStore;
+declare const makeOnePasswordExtension: (ctx: PluginCtx<OnePasswordStore>, timeoutMs: number, preferSdk: boolean | undefined) => {
+    configure: (config: OnePasswordConfig, targetScope: string) => Effect.Effect<void, StorageError, never>;
+    getConfig: () => Effect.Effect<{
+        readonly name: string;
+        readonly auth: {
+            readonly kind: "desktop-app";
+            readonly accountName: string;
+        } | {
+            readonly kind: "service-account";
+            readonly tokenSecretId: string;
+        };
+        readonly vaultId: string;
+    } | null, StorageError | OnePasswordError, never>;
+    removeConfig: (targetScope: string) => Effect.Effect<void, StorageError, never>;
+    status: () => Effect.Effect<{
+        readonly connected: boolean;
+        readonly error?: string | undefined;
+        readonly vaultName?: string | undefined;
+    }, StorageFailure | OnePasswordError, never>;
+    listVaults: (auth: OnePasswordAuth) => Effect.Effect<{
+        readonly id: string;
+        readonly name: string;
+    }[], StorageFailure | OnePasswordError, never>;
+    resolve: (uri: string) => Effect.Effect<string, StorageFailure | OnePasswordError, never>;
+};
+export type OnePasswordExtension = ReturnType<typeof makeOnePasswordExtension>;
 export interface OnePasswordPluginOptions {
     /** Request timeout in ms (default: 15000) */
     readonly timeoutMs?: number;
@@ -36,25 +43,28 @@ export interface OnePasswordPluginOptions {
     readonly preferSdk?: boolean;
 }
 export declare const onepasswordPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"onepassword", {
-    configure: (config: OnePasswordConfig) => Effect.Effect<void, StorageError, never>;
-    getConfig: () => Effect.Effect<OnePasswordConfig | null, StorageError | OnePasswordError, never>;
-    removeConfig: () => Effect.Effect<void, StorageError, never>;
-    status: () => Effect.Effect<ConnectionStatus, StorageFailure | OnePasswordError, never>;
-    listVaults: (auth: import("./types").DesktopAppAuth | import("./types").ServiceAccountAuth) => Effect.Effect<Vault[], StorageFailure | OnePasswordError, never>;
+    configure: (config: OnePasswordConfig, targetScope: string) => Effect.Effect<void, StorageError, never>;
+    getConfig: () => Effect.Effect<{
+        readonly name: string;
+        readonly auth: {
+            readonly kind: "desktop-app";
+            readonly accountName: string;
+        } | {
+            readonly kind: "service-account";
+            readonly tokenSecretId: string;
+        };
+        readonly vaultId: string;
+    } | null, StorageError | OnePasswordError, never>;
+    removeConfig: (targetScope: string) => Effect.Effect<void, StorageError, never>;
+    status: () => Effect.Effect<{
+        readonly connected: boolean;
+        readonly error?: string | undefined;
+        readonly vaultName?: string | undefined;
+    }, StorageFailure | OnePasswordError, never>;
+    listVaults: (auth: OnePasswordAuth) => Effect.Effect<{
+        readonly id: string;
+        readonly name: string;
+    }[], StorageFailure | OnePasswordError, never>;
     resolve: (uri: string) => Effect.Effect<string, StorageFailure | OnePasswordError, never>;
-}, OnePasswordStore, OnePasswordPluginOptions, undefined, typeof OnePasswordExtensionService, import("effect/Layer").Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", OnePasswordExtensionService>>, import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"onepassword", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getConfig", "GET", "/scopes/:scopeId/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.NullOr<typeof OnePasswordConfig>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"configure", "PUT", "/scopes/:scopeId/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof OnePasswordConfig>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Void>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"removeConfig", "DELETE", "/scopes/:scopeId/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Void>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "GET", "/scopes/:scopeId/onepassword/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof ConnectionStatus>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listVaults", "GET", "/scopes/:scopeId/onepassword/vaults", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<Schema.Struct<{
-    readonly authKind: Schema.Literals<readonly ["desktop-app", "service-account"]>;
-    readonly account: Schema.String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<Schema.Struct<{
-    readonly vaults: Schema.$Array<typeof Vault>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | typeof OnePasswordError>, never, never>, false>>;
+}, OnePasswordStore, OnePasswordPluginOptions, undefined, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
+export {};

package/dist/sdk/types.d.ts

@@ -1,40 +1,50 @@
 import { Schema } from "effect";
-declare const DesktopAppAuth_base: Schema.Class<DesktopAppAuth, Schema.Struct<{
+export declare const DesktopAppAuth: Schema.Struct<{
     readonly kind: Schema.Literal<"desktop-app">;
     /** 1Password account domain, e.g. "my.1password.com" */
     readonly accountName: Schema.String;
-}>, {}>;
-export declare class DesktopAppAuth extends DesktopAppAuth_base {
-}
-declare const ServiceAccountAuth_base: Schema.Class<ServiceAccountAuth, Schema.Struct<{
+}>;
+export type DesktopAppAuth = typeof DesktopAppAuth.Type;
+export declare const ServiceAccountAuth: Schema.Struct<{
     readonly kind: Schema.Literal<"service-account">;
     /** The service account token (stored as a secret) */
     readonly tokenSecretId: Schema.String;
-}>, {}>;
-export declare class ServiceAccountAuth extends ServiceAccountAuth_base {
-}
-export declare const OnePasswordAuth: Schema.Union<readonly [typeof DesktopAppAuth, typeof ServiceAccountAuth]>;
+}>;
+export type ServiceAccountAuth = typeof ServiceAccountAuth.Type;
+export declare const OnePasswordAuth: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"desktop-app">;
+    /** 1Password account domain, e.g. "my.1password.com" */
+    readonly accountName: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"service-account">;
+    /** The service account token (stored as a secret) */
+    readonly tokenSecretId: Schema.String;
+}>]>;
 export type OnePasswordAuth = typeof OnePasswordAuth.Type;
-declare const OnePasswordConfig_base: Schema.Class<OnePasswordConfig, Schema.Struct<{
-    readonly auth: Schema.Union<readonly [typeof DesktopAppAuth, typeof ServiceAccountAuth]>;
+export declare const OnePasswordConfig: Schema.Struct<{
+    readonly auth: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"desktop-app">;
+        /** 1Password account domain, e.g. "my.1password.com" */
+        readonly accountName: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"service-account">;
+        /** The service account token (stored as a secret) */
+        readonly tokenSecretId: Schema.String;
+    }>]>;
     /** Vault to scope operations to */
     readonly vaultId: Schema.String;
     /** Human label */
     readonly name: Schema.String;
-}>, {}>;
-export declare class OnePasswordConfig extends OnePasswordConfig_base {
-}
-declare const Vault_base: Schema.Class<Vault, Schema.Struct<{
+}>;
+export type OnePasswordConfig = typeof OnePasswordConfig.Type;
+export declare const Vault: Schema.Struct<{
     readonly id: Schema.String;
     readonly name: Schema.String;
-}>, {}>;
-export declare class Vault extends Vault_base {
-}
-declare const ConnectionStatus_base: Schema.Class<ConnectionStatus, Schema.Struct<{
+}>;
+export type Vault = typeof Vault.Type;
+export declare const ConnectionStatus: Schema.Struct<{
     readonly connected: Schema.Boolean;
     readonly vaultName: Schema.optional<Schema.String>;
     readonly error: Schema.optional<Schema.String>;
-}>, {}>;
-export declare class ConnectionStatus extends ConnectionStatus_base {
-}
-export {};
+}>;
+export type ConnectionStatus = typeof ConnectionStatus.Type;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-onepassword",
-  "version": "0.1.0",
+  "version": "1.4.20",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/onepassword",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -27,6 +27,12 @@
         "types": "./dist/sdk/index.d.ts",
         "default": "./dist/core.js"
       }
+    },
+    "./client": {
+      "import": {
+        "types": "./dist/react/plugin-client.d.ts",
+        "default": "./dist/client.js"
+      }
     }
   },
   "publishConfig": {
@@ -43,7 +49,7 @@
     "@1password/op-js": "^0.1.13",
     "@1password/sdk": "^0.4.1-beta.1",
     "@effect/atom-react": "4.0.0-beta.59",
-    "@executor-js/sdk": "0.1.0",
+    "@executor-js/sdk": "1.4.20",
     "effect": "4.0.0-beta.59"
   },
   "devDependencies": {

package/dist/chunk-2NSVLCQP.js

@@ -1,446 +0,0 @@
-// src/sdk/errors.ts
-import { Schema } from "effect";
-var OnePasswordError = class extends Schema.TaggedErrorClass()(
-  "OnePasswordError",
-  {
-    operation: Schema.String,
-    message: Schema.String
-  },
-  { httpApiStatus: 502 }
-) {
-};
-
-// src/sdk/types.ts
-import { Schema as Schema2 } from "effect";
-var DesktopAppAuth = class extends Schema2.Class("DesktopAppAuth")({
-  kind: Schema2.Literal("desktop-app"),
-  /** 1Password account domain, e.g. "my.1password.com" */
-  accountName: Schema2.String
-}) {
-};
-var ServiceAccountAuth = class extends Schema2.Class("ServiceAccountAuth")({
-  kind: Schema2.Literal("service-account"),
-  /** The service account token (stored as a secret) */
-  tokenSecretId: Schema2.String
-}) {
-};
-var OnePasswordAuth = Schema2.Union([DesktopAppAuth, ServiceAccountAuth]);
-var OnePasswordConfig = class extends Schema2.Class("OnePasswordConfig")({
-  auth: OnePasswordAuth,
-  /** Vault to scope operations to */
-  vaultId: Schema2.String,
-  /** Human label */
-  name: Schema2.String
-}) {
-};
-var Vault = class extends Schema2.Class("Vault")({
-  id: Schema2.String,
-  name: Schema2.String
-}) {
-};
-var ConnectionStatus = class extends Schema2.Class("ConnectionStatus")({
-  connected: Schema2.Boolean,
-  vaultName: Schema2.optional(Schema2.String),
-  error: Schema2.optional(Schema2.String)
-}) {
-};
-
-// src/sdk/service.ts
-import { Context, Duration, Effect } from "effect";
-import * as op from "@1password/op-js";
-var OnePasswordServiceTag = class extends Context.Service()("@executor-js/plugin-onepassword/OnePasswordService") {
-};
-var DEFAULT_TIMEOUT_MS = 15e3;
-var loadOnePasswordSdk = () => Effect.tryPromise({
-  try: () => import("@1password/sdk"),
-  catch: (cause) => new OnePasswordError({
-    operation: "sdk module load",
-    message: cause instanceof Error ? cause.message : String(cause)
-  })
-});
-var makeTimeoutMessage = (operation, timeoutMs) => [
-  `${operation}: timed out after ${Math.floor(timeoutMs / 1e3)}s.`,
-  "Troubleshooting:",
-  "1. Make sure the 1Password desktop app is open and unlocked",
-  "2. Check for an approval prompt in the 1Password app \u2014 it may be behind other windows",
-  "3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings",
-  "4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)",
-  "5. Try quitting 1Password completely and reopening it, then retry"
-].join("\n");
-var timeoutWithOnePasswordError = (operation, timeoutMs) => Effect.timeoutOrElse({
-  duration: Duration.millis(timeoutMs),
-  orElse: () => Effect.fail(
-    new OnePasswordError({
-      operation,
-      message: makeTimeoutMessage(operation, timeoutMs)
-    })
-  )
-});
-var makeNativeSdkService = (auth, timeoutMs = DEFAULT_TIMEOUT_MS) => Effect.gen(function* () {
-  const sdk = yield* loadOnePasswordSdk().pipe(
-    timeoutWithOnePasswordError("sdk module load", timeoutMs)
-  );
-  const client = yield* Effect.tryPromise({
-    try: () => sdk.createClient({
-      auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token,
-      integrationName: "Executor",
-      integrationVersion: "0.0.0"
-    }),
-    catch: (cause) => new OnePasswordError({
-      operation: "client setup",
-      message: cause instanceof Error ? cause.message : String(cause)
-    })
-  }).pipe(
-    timeoutWithOnePasswordError("client setup", timeoutMs)
-  );
-  const wrap = (fn, operation) => Effect.tryPromise({
-    try: fn,
-    catch: (cause) => new OnePasswordError({
-      operation,
-      message: cause instanceof Error ? cause.message : String(cause)
-    })
-  }).pipe(
-    timeoutWithOnePasswordError(operation, timeoutMs),
-    Effect.withSpan(`onepassword.sdk.${operation}`)
-  );
-  return OnePasswordServiceTag.of({
-    resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"),
-    listVaults: () => wrap(() => client.vaults.list({ decryptDetails: true }), "vault listing").pipe(
-      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title })))
-    ),
-    listItems: (vaultId) => wrap(() => client.items.list(vaultId), "item listing").pipe(
-      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
-    )
-  });
-}).pipe(Effect.withSpan("onepassword.sdk.make_service"));
-var makeCliService = (auth) => Effect.sync(() => {
-  if (auth.kind === "service-account") {
-    op.setServiceAccount(auth.token);
-  } else {
-    op.setGlobalFlags({ account: auth.accountName });
-  }
-  const wrapSync = (fn, operation) => Effect.try({
-    try: fn,
-    catch: (cause) => new OnePasswordError({
-      operation,
-      message: cause instanceof Error ? cause.message : String(cause)
-    })
-  }).pipe(Effect.withSpan(`onepassword.cli.${operation}`));
-  return OnePasswordServiceTag.of({
-    resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"),
-    listVaults: () => wrapSync(() => op.vault.list(), "vault listing").pipe(
-      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name })))
-    ),
-    listItems: (vaultId) => wrapSync(() => op.item.list({ vault: vaultId }), "item listing").pipe(
-      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
-    )
-  });
-}).pipe(Effect.withSpan("onepassword.cli.make_service"));
-var makeOnePasswordService = (auth, options) => {
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  if (options?.preferSdk) {
-    return makeNativeSdkService(auth, timeoutMs);
-  }
-  return makeCliService(auth).pipe(
-    Effect.catch(
-      (cliError) => (
-        // CLI unavailable (e.g. `op` not installed) — fall back to SDK
-        makeNativeSdkService(auth, timeoutMs).pipe(Effect.mapError(() => cliError))
-      )
-    )
-  );
-};
-
-// src/sdk/plugin.ts
-import { Effect as Effect3, Schema as Schema4 } from "effect";
-import {
-  definePlugin,
-  StorageError
-} from "@executor-js/sdk/core";
-
-// src/api/group.ts
-import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
-import { Schema as Schema3 } from "effect";
-import { ScopeId } from "@executor-js/sdk/core";
-import { InternalError } from "@executor-js/api";
-var ScopeParams = { scopeId: ScopeId };
-var ConfigurePayload = OnePasswordConfig;
-var ListVaultsParams = Schema3.Struct({
-  authKind: Schema3.Literals(["desktop-app", "service-account"]),
-  account: Schema3.String
-});
-var ListVaultsResponse = Schema3.Struct({
-  vaults: Schema3.Array(Vault)
-});
-var GetConfigResponse = Schema3.NullOr(OnePasswordConfig);
-var OnePasswordGroup = HttpApiGroup.make("onepassword").add(
-  HttpApiEndpoint.get("getConfig", "/scopes/:scopeId/onepassword/config", {
-    params: ScopeParams,
-    success: GetConfigResponse,
-    error: [InternalError, OnePasswordError]
-  })
-).add(
-  HttpApiEndpoint.put("configure", "/scopes/:scopeId/onepassword/config", {
-    params: ScopeParams,
-    payload: ConfigurePayload,
-    success: Schema3.Void,
-    error: [InternalError, OnePasswordError]
-  })
-).add(
-  HttpApiEndpoint.delete("removeConfig", "/scopes/:scopeId/onepassword/config", {
-    params: ScopeParams,
-    success: Schema3.Void,
-    error: [InternalError, OnePasswordError]
-  })
-).add(
-  HttpApiEndpoint.get("status", "/scopes/:scopeId/onepassword/status", {
-    params: ScopeParams,
-    success: ConnectionStatus,
-    error: [InternalError, OnePasswordError]
-  })
-).add(
-  HttpApiEndpoint.get("listVaults", "/scopes/:scopeId/onepassword/vaults", {
-    params: ScopeParams,
-    query: ListVaultsParams,
-    success: ListVaultsResponse,
-    error: [InternalError, OnePasswordError]
-  })
-);
-
-// src/api/handlers.ts
-import { HttpApiBuilder } from "effect/unstable/httpapi";
-import { Context as Context2, Effect as Effect2 } from "effect";
-import { addGroup, capture } from "@executor-js/api";
-var OnePasswordExtensionService = class extends Context2.Service()("OnePasswordExtensionService") {
-};
-var ExecutorApiWithOnePassword = addGroup(OnePasswordGroup);
-var OnePasswordHandlers = HttpApiBuilder.group(
-  ExecutorApiWithOnePassword,
-  "onepassword",
-  (handlers) => handlers.handle(
-    "getConfig",
-    () => capture(Effect2.gen(function* () {
-      const ext = yield* OnePasswordExtensionService;
-      return yield* ext.getConfig();
-    }))
-  ).handle(
-    "configure",
-    ({ payload }) => capture(Effect2.gen(function* () {
-      const ext = yield* OnePasswordExtensionService;
-      yield* ext.configure(payload);
-    }))
-  ).handle(
-    "removeConfig",
-    () => capture(Effect2.gen(function* () {
-      const ext = yield* OnePasswordExtensionService;
-      yield* ext.removeConfig();
-    }))
-  ).handle(
-    "status",
-    () => capture(Effect2.gen(function* () {
-      const ext = yield* OnePasswordExtensionService;
-      return yield* ext.status();
-    }))
-  ).handle(
-    "listVaults",
-    ({ query: urlParams }) => capture(Effect2.gen(function* () {
-      const ext = yield* OnePasswordExtensionService;
-      const auth = urlParams.authKind === "desktop-app" ? { kind: "desktop-app", accountName: urlParams.account } : { kind: "service-account", tokenSecretId: urlParams.account };
-      const vaults = yield* ext.listVaults(auth);
-      return { vaults: [...vaults] };
-    }))
-  )
-);
-
-// src/sdk/plugin.ts
-var CREDENTIAL_FIELD = "credential";
-var DEFAULT_TIMEOUT_MS2 = 15e3;
-var CONFIG_KEY = "config";
-var decodeConfig = Schema4.decodeUnknownSync(OnePasswordConfig);
-var blobStorageError = (operation) => (cause) => new StorageError({
-  message: `onepassword blob ${operation}: ${cause instanceof Error ? cause.message : String(cause)}`,
-  cause
-});
-var makeOnePasswordStore = (blobs, writeScope) => ({
-  getConfig: () => blobs.get(CONFIG_KEY).pipe(
-    Effect3.mapError(blobStorageError("read")),
-    Effect3.flatMap((raw) => {
-      if (raw === null) return Effect3.succeed(null);
-      return Effect3.try({
-        try: () => decodeConfig(JSON.parse(raw)),
-        catch: (cause) => new OnePasswordError({
-          operation: "config decode",
-          message: cause instanceof Error ? cause.message : String(cause)
-        })
-      });
-    })
-  ),
-  saveConfig: (config) => blobs.put(
-    CONFIG_KEY,
-    JSON.stringify({
-      auth: config.auth,
-      vaultId: config.vaultId,
-      name: config.name
-    }),
-    { scope: writeScope }
-  ).pipe(Effect3.mapError(blobStorageError("write"))),
-  deleteConfig: () => blobs.delete(CONFIG_KEY, { scope: writeScope }).pipe(Effect3.mapError(blobStorageError("delete")))
-});
-var resolveAuth = (auth, ctx) => {
-  if (auth.kind === "desktop-app") {
-    return Effect3.succeed({
-      kind: "desktop-app",
-      accountName: auth.accountName
-    });
-  }
-  return ctx.secrets.get(auth.tokenSecretId).pipe(
-    Effect3.mapError(
-      (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? new OnePasswordError({
-        operation: "auth resolution",
-        message: `Service account token secret "${auth.tokenSecretId}" not found`
-      }) : err
-    ),
-    Effect3.flatMap((token) => {
-      if (token === null) {
-        return Effect3.fail(
-          new OnePasswordError({
-            operation: "auth resolution",
-            message: `Service account token secret "${auth.tokenSecretId}" not found`
-          })
-        );
-      }
-      return Effect3.succeed({
-        kind: "service-account",
-        token
-      });
-    })
-  );
-};
-var getServiceFromConfig = (config, ctx, timeoutMs, preferSdk) => resolveAuth(config.auth, ctx).pipe(
-  Effect3.flatMap(
-    (resolved) => makeOnePasswordService(resolved, { timeoutMs, preferSdk })
-  )
-);
-var makeProvider = (ctx, timeoutMs, preferSdk) => ({
-  key: "onepassword",
-  writable: false,
-  // 1Password vaults are named in the stored config; the executor-scope
-  // arg isn't used for routing here. A future refactor could let the
-  // plugin store per-scope vault bindings and pick based on `scope`.
-  get: (secretId, _scope) => ctx.storage.getConfig().pipe(
-    Effect3.flatMap((config) => {
-      if (!config) return Effect3.succeed(null);
-      const uri = secretId.startsWith("op://") ? secretId : `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;
-      return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe(
-        Effect3.flatMap((svc) => svc.resolveSecret(uri)),
-        Effect3.map((v) => v),
-        Effect3.orElseSucceed(() => null)
-      );
-    }),
-    Effect3.orElseSucceed(() => null)
-  ),
-  list: () => ctx.storage.getConfig().pipe(
-    Effect3.flatMap((config) => {
-      if (!config)
-        return Effect3.succeed(
-          []
-        );
-      return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe(
-        Effect3.flatMap((svc) => svc.listItems(config.vaultId)),
-        Effect3.map(
-          (items) => items.map((item2) => ({ id: item2.id, name: item2.title }))
-        )
-      );
-    }),
-    Effect3.orElseSucceed(
-      () => []
-    )
-  )
-});
-var onepasswordPlugin = definePlugin(
-  (options) => {
-    const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-    const preferSdk = options?.preferSdk;
-    return {
-      id: "onepassword",
-      packageName: "@executor-js/plugin-onepassword",
-      storage: ({ blobs, scopes }) => makeOnePasswordStore(blobs, scopes.at(-1).id),
-      extension: (ctx) => {
-        return {
-          configure: (config) => ctx.storage.saveConfig(config),
-          getConfig: () => ctx.storage.getConfig(),
-          removeConfig: () => ctx.storage.deleteConfig(),
-          status: () => Effect3.gen(function* () {
-            const config = yield* ctx.storage.getConfig();
-            if (!config) {
-              return new ConnectionStatus({
-                connected: false,
-                error: "Not configured"
-              });
-            }
-            const svc = yield* getServiceFromConfig(
-              config,
-              ctx,
-              timeoutMs,
-              preferSdk
-            );
-            const vaults = yield* svc.listVaults();
-            const vault2 = vaults.find((v) => v.id === config.vaultId);
-            return new ConnectionStatus({
-              connected: true,
-              vaultName: vault2?.title
-            });
-          }),
-          listVaults: (auth) => Effect3.gen(function* () {
-            const resolved = yield* resolveAuth(auth, ctx);
-            const svc = yield* makeOnePasswordService(resolved, {
-              timeoutMs,
-              preferSdk
-            });
-            const vaults = yield* svc.listVaults();
-            return vaults.map((v) => new Vault({ id: v.id, name: v.title })).sort((a, b) => a.name.localeCompare(b.name));
-          }),
-          resolve: (uri) => Effect3.gen(function* () {
-            const config = yield* ctx.storage.getConfig();
-            if (!config) {
-              return yield* Effect3.fail(
-                new OnePasswordError({
-                  operation: "resolve",
-                  message: "1Password is not configured"
-                })
-              );
-            }
-            const svc = yield* getServiceFromConfig(
-              config,
-              ctx,
-              timeoutMs,
-              preferSdk
-            );
-            return yield* svc.resolveSecret(uri);
-          })
-        };
-      },
-      secretProviders: (ctx) => [makeProvider(ctx, timeoutMs, preferSdk)],
-      routes: () => OnePasswordGroup,
-      handlers: () => OnePasswordHandlers,
-      extensionService: OnePasswordExtensionService
-    };
-  }
-);
-
-export {
-  OnePasswordError,
-  DesktopAppAuth,
-  ServiceAccountAuth,
-  OnePasswordAuth,
-  OnePasswordConfig,
-  Vault,
-  ConnectionStatus,
-  OnePasswordServiceTag,
-  makeNativeSdkService,
-  makeCliService,
-  makeOnePasswordService,
-  makeOnePasswordStore,
-  onepasswordPlugin
-};
-//# sourceMappingURL=chunk-2NSVLCQP.js.map