@graphorin/secret-1password 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +17 -0
- package/README.md +8 -8
- package/dist/index.d.ts +2 -2
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/dist/op-cli.js +1 -1
- package/dist/op-cli.js.map +1 -1
- package/dist/resolver.d.ts +1 -1
- package/dist/resolver.js +1 -1
- package/dist/resolver.js.map +1 -1
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,22 @@
|
|
|
1
1
|
# @graphorin/secret-1password
|
|
2
2
|
|
|
3
|
+
## 0.6.0
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [[`32f20c1`](https://github.com/o-stepper/graphorin/commit/32f20c110f184f8cef7eec85bf39f5f07c886cb6), [`4f850d9`](https://github.com/o-stepper/graphorin/commit/4f850d9bc0a05d6256c59c5117b010336fcb41d3), [`4f850d9`](https://github.com/o-stepper/graphorin/commit/4f850d9bc0a05d6256c59c5117b010336fcb41d3), [`17a2d30`](https://github.com/o-stepper/graphorin/commit/17a2d30564154ca2ab87473335cdef43a5089c84), [`17a2d30`](https://github.com/o-stepper/graphorin/commit/17a2d30564154ca2ab87473335cdef43a5089c84), [`17a2d30`](https://github.com/o-stepper/graphorin/commit/17a2d30564154ca2ab87473335cdef43a5089c84), [`17a2d30`](https://github.com/o-stepper/graphorin/commit/17a2d30564154ca2ab87473335cdef43a5089c84), [`ce06b47`](https://github.com/o-stepper/graphorin/commit/ce06b472af9e30ac5d0792f7a8b6f42170a94627), [`ce06b47`](https://github.com/o-stepper/graphorin/commit/ce06b472af9e30ac5d0792f7a8b6f42170a94627), [`ce06b47`](https://github.com/o-stepper/graphorin/commit/ce06b472af9e30ac5d0792f7a8b6f42170a94627), [`ce06b47`](https://github.com/o-stepper/graphorin/commit/ce06b472af9e30ac5d0792f7a8b6f42170a94627), [`ce06b47`](https://github.com/o-stepper/graphorin/commit/ce06b472af9e30ac5d0792f7a8b6f42170a94627), [`ce06b47`](https://github.com/o-stepper/graphorin/commit/ce06b472af9e30ac5d0792f7a8b6f42170a94627)]:
|
|
8
|
+
- @graphorin/core@0.6.0
|
|
9
|
+
- @graphorin/security@0.6.0
|
|
10
|
+
|
|
11
|
+
## 0.5.0
|
|
12
|
+
|
|
13
|
+
First version published to the npm registry (with Sigstore build
|
|
14
|
+
provenance). The 0.2.0, 0.3.0, and 0.4.0 versions were internal lockstep
|
|
15
|
+
milestones and were never published. All `@graphorin/*` packages release
|
|
16
|
+
lockstep at the same version; the full release notes for 0.2.0-0.5.0 live
|
|
17
|
+
in the repository-level
|
|
18
|
+
[CHANGELOG](https://github.com/o-stepper/graphorin/blob/main/CHANGELOG.md).
|
|
19
|
+
|
|
3
20
|
## 0.1.0
|
|
4
21
|
|
|
5
22
|
### Minor Changes
|
package/README.md
CHANGED
|
@@ -6,15 +6,15 @@
|
|
|
6
6
|
> pluggable `SecretResolver` registry by shelling out to the official
|
|
7
7
|
> 1Password CLI (`op read 'op://<vault>/<item>/<field>'`).
|
|
8
8
|
>
|
|
9
|
-
> Project Graphorin · v0.
|
|
9
|
+
> Project Graphorin · v0.6.0 · MIT License · © 2026 Oleksiy Stepurenko ·
|
|
10
10
|
> <https://github.com/o-stepper/graphorin>
|
|
11
11
|
|
|
12
12
|
---
|
|
13
13
|
|
|
14
14
|
## Status
|
|
15
15
|
|
|
16
|
-
- **Published:** v0.
|
|
17
|
-
- Reference adapter
|
|
16
|
+
- **Published:** v0.6.0 (optional sub-pack)
|
|
17
|
+
- Reference adapter - community packages should follow this template
|
|
18
18
|
when wiring HashiCorp Vault, AWS Secrets Manager, GCP Secret
|
|
19
19
|
Manager, Azure Key Vault, Bitwarden, or Unix `pass`.
|
|
20
20
|
|
|
@@ -28,7 +28,7 @@ pnpm add @graphorin/secret-1password
|
|
|
28
28
|
|
|
29
29
|
The package shells out to the **system** `op` binary; install it from
|
|
30
30
|
[1Password's official CLI distribution](https://developer.1password.com/docs/cli/get-started/).
|
|
31
|
-
The package does NOT bundle the CLI
|
|
31
|
+
The package does NOT bundle the CLI - the operator chooses how it is
|
|
32
32
|
provisioned (homebrew, scoop, apt, official tarball, k8s init
|
|
33
33
|
container, etc.).
|
|
34
34
|
|
|
@@ -149,15 +149,15 @@ Vault, Bitwarden, or Unix `pass`:
|
|
|
149
149
|
truth for the actual lookup.
|
|
150
150
|
4. Wrap upstream errors in `SecretResolutionError` so existing `catch`
|
|
151
151
|
paths keep working.
|
|
152
|
-
5. Test with a stub `<Tool>Cli`
|
|
152
|
+
5. Test with a stub `<Tool>Cli` - never reach the network or the
|
|
153
153
|
real binary in CI.
|
|
154
154
|
|
|
155
155
|
---
|
|
156
156
|
|
|
157
157
|
## Related decisions
|
|
158
158
|
|
|
159
|
-
- ADR-026
|
|
160
|
-
- ADR-028
|
|
159
|
+
- ADR-026 - `SecretValue` and `SecretsStore` end-to-end contract.
|
|
160
|
+
- ADR-028 - `SecretRef` URI scheme (`env:` / `keyring:` / `file:` / `encrypted-file:` / `op://` / `vault://` / `ref:`).
|
|
161
161
|
|
|
162
162
|
---
|
|
163
163
|
|
|
@@ -167,4 +167,4 @@ MIT © 2026 Oleksiy Stepurenko
|
|
|
167
167
|
|
|
168
168
|
---
|
|
169
169
|
|
|
170
|
-
**Project Graphorin** · v0.
|
|
170
|
+
**Project Graphorin** · v0.6.0 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>
|
package/dist/index.d.ts
CHANGED
|
@@ -4,7 +4,7 @@ import { OnePasswordResolverOptions, createOnePasswordResolver, normalizeOpUri,
|
|
|
4
4
|
//#region src/index.d.ts
|
|
5
5
|
|
|
6
6
|
/**
|
|
7
|
-
* @graphorin/secret-1password
|
|
7
|
+
* @graphorin/secret-1password - reference 1Password secret-resolver
|
|
8
8
|
* adapter for the Graphorin framework.
|
|
9
9
|
*
|
|
10
10
|
* Registers the `op://` scheme on top of `@graphorin/security`'s
|
|
@@ -29,7 +29,7 @@ import { OnePasswordResolverOptions, createOnePasswordResolver, normalizeOpUri,
|
|
|
29
29
|
* @packageDocumentation
|
|
30
30
|
*/
|
|
31
31
|
/** Canonical version constant. Mirrors the `package.json` version. */
|
|
32
|
-
declare const VERSION = "0.
|
|
32
|
+
declare const VERSION = "0.6.0";
|
|
33
33
|
//#endregion
|
|
34
34
|
export { type OnePasswordResolverOptions, type OpCli, OpCliError, type OpCliErrorKind, type OpCliReadOptions, type OpCliReadResult, VERSION, createDefaultOpCli, createOnePasswordResolver, createOpCli, normalizeOpUri, onePasswordResolver };
|
|
35
35
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.js
CHANGED
|
@@ -3,7 +3,7 @@ import { createOnePasswordResolver, normalizeOpUri, onePasswordResolver } from "
|
|
|
3
3
|
|
|
4
4
|
//#region src/index.ts
|
|
5
5
|
/**
|
|
6
|
-
* @graphorin/secret-1password
|
|
6
|
+
* @graphorin/secret-1password - reference 1Password secret-resolver
|
|
7
7
|
* adapter for the Graphorin framework.
|
|
8
8
|
*
|
|
9
9
|
* Registers the `op://` scheme on top of `@graphorin/security`'s
|
|
@@ -28,7 +28,7 @@ import { createOnePasswordResolver, normalizeOpUri, onePasswordResolver } from "
|
|
|
28
28
|
* @packageDocumentation
|
|
29
29
|
*/
|
|
30
30
|
/** Canonical version constant. Mirrors the `package.json` version. */
|
|
31
|
-
const VERSION = "0.
|
|
31
|
+
const VERSION = "0.6.0";
|
|
32
32
|
|
|
33
33
|
//#endregion
|
|
34
34
|
export { OpCliError, VERSION, createDefaultOpCli, createOnePasswordResolver, createOpCli, normalizeOpUri, onePasswordResolver };
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @graphorin/secret-1password
|
|
1
|
+
{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @graphorin/secret-1password - reference 1Password secret-resolver\n * adapter for the Graphorin framework.\n *\n * Registers the `op://` scheme on top of `@graphorin/security`'s\n * pluggable `SecretResolver` registry by shelling out to the official\n * 1Password CLI:\n *\n * ```ts\n * import { registerResolver } from '@graphorin/security';\n * import { onePasswordResolver } from '@graphorin/secret-1password';\n *\n * registerResolver(onePasswordResolver);\n *\n * // Anywhere downstream:\n * const apiKey = await resolveSecret('op://Personal/OpenAI/api-key');\n * ```\n *\n * The adapter is also the canonical template community packages\n * should follow when wiring HashiCorp Vault, AWS Secrets Manager, GCP\n * Secret Manager, Azure Key Vault, Bitwarden, or Unix `pass` as\n * additional `SecretResolver` implementations.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant. Mirrors the `package.json` version. */\nexport const VERSION = '0.6.0';\n\nexport {\n createDefaultOpCli,\n createOpCli,\n type OpCli,\n OpCliError,\n type OpCliErrorKind,\n type OpCliReadOptions,\n type OpCliReadResult,\n} from './op-cli.js';\nexport {\n createOnePasswordResolver,\n normalizeOpUri,\n type OnePasswordResolverOptions,\n onePasswordResolver,\n} from './resolver.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,UAAU"}
|
package/dist/op-cli.js
CHANGED
|
@@ -7,7 +7,7 @@ import { spawn } from "node:child_process";
|
|
|
7
7
|
* errors for the most common operator-fixable failure modes.
|
|
8
8
|
*
|
|
9
9
|
* The wrapper is split out so the resolver can be unit-tested without
|
|
10
|
-
* touching the real `op` binary
|
|
10
|
+
* touching the real `op` binary - tests inject a stub `OpCli`
|
|
11
11
|
* implementation through {@link createOnePasswordResolver}.
|
|
12
12
|
*
|
|
13
13
|
* @packageDocumentation
|
package/dist/op-cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"op-cli.js","names":["env: Record<string, string>","proc: ReturnType<typeof spawn>","graceTimer: ReturnType<typeof setTimeout> | undefined"],"sources":["../src/op-cli.ts"],"sourcesContent":["/**\n * Thin wrapper around the 1Password CLI (`op`). Spawns `op` with the\n * canonical `read` subcommand, captures stdout, and surfaces typed\n * errors for the most common operator-fixable failure modes.\n *\n * The wrapper is split out so the resolver can be unit-tested without\n * touching the real `op` binary — tests inject a stub `OpCli`\n * implementation through {@link createOnePasswordResolver}.\n *\n * @packageDocumentation\n */\n\nimport { spawn } from 'node:child_process';\n\n/** @stable */\nexport interface OpCliReadResult {\n readonly value: string;\n readonly exitCode: number;\n readonly durationMs: number;\n}\n\n/** @stable */\nexport interface OpCli {\n /**\n * Resolve a single `op://...` reference. Returns the **trimmed**\n * stdout. Throws {@link OpCliError} when the binary is missing, the\n * user is signed out, the reference does not resolve, or the call\n * exceeds the timeout.\n */\n read(uri: string, options?: OpCliReadOptions): Promise<OpCliReadResult>;\n}\n\n/** @stable */\nexport interface OpCliReadOptions {\n /** Override the binary path. Default `'op'` (looked up on `$PATH`). */\n readonly binary?: string;\n /** Hard timeout in milliseconds. Default `15000`. */\n readonly timeoutMs?: number;\n /** Override `process.env`. Default forwards the parent process. */\n readonly env?: Readonly<Record<string, string | undefined>>;\n /** Optional 1Password Connect / Service-Account token forwarding. */\n readonly serviceAccountToken?: string;\n /**\n * Optional 1Password Connect host + token tuple. When set the\n * resolver wires them through the `OP_CONNECT_HOST` /\n * `OP_CONNECT_TOKEN` env vars (the canonical Connect-mode contract\n * documented by 1Password).\n */\n readonly connect?: { readonly host: string; readonly token: string };\n /**\n * Optional `--account` override forwarded to the CLI. Useful when\n * the operator is signed in to multiple 1Password accounts.\n */\n readonly account?: string;\n /**\n * Optional `--no-color` flag suppression. The resolver always sets\n * `--no-color` so terminal colour codes do not leak into the\n * resolved value; pass `true` to opt out.\n */\n readonly preserveColor?: boolean;\n}\n\n/**\n * Typed error raised by the CLI wrapper. Carries a `kind` so callers\n * can distinguish operator-fixable failure modes.\n *\n * @stable\n */\nexport class OpCliError extends Error {\n override readonly name = 'OpCliError';\n readonly kind: OpCliErrorKind;\n readonly exitCode?: number;\n readonly stderr?: string;\n readonly hint?: string;\n\n constructor(\n kind: OpCliErrorKind,\n message: string,\n options?: {\n cause?: unknown;\n exitCode?: number;\n stderr?: string;\n hint?: string;\n },\n ) {\n super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n this.kind = kind;\n if (options?.exitCode !== undefined) this.exitCode = options.exitCode;\n if (options?.stderr !== undefined) this.stderr = options.stderr;\n if (options?.hint !== undefined) this.hint = options.hint;\n }\n}\n\n/** @stable */\nexport type OpCliErrorKind =\n | 'binary-missing'\n | 'signed-out'\n | 'reference-not-found'\n | 'timeout'\n | 'unknown';\n\n/**\n * Default {@link OpCli} implementation. Spawns `op read --no-color\n * --reveal '<uri>'` with the configured timeout and inherits the\n * parent environment.\n *\n * @stable\n */\nexport function createDefaultOpCli(): OpCli {\n return createOpCli();\n}\n\n/**\n * Grace period after SIGTERM before escalating to SIGKILL (SPL-22). A\n * well-behaved `op` exits on SIGTERM well within this window; a wedged one\n * (ignoring SIGTERM in an uninterruptible read) is force-killed so the hard\n * timeout actually settles the promise.\n */\nconst SIGKILL_GRACE_MS = 1_000;\n\n/**\n * {@link OpCli} factory with an injectable `spawn` (for tests). Production\n * code uses {@link createDefaultOpCli}.\n *\n * @stable\n */\nexport function createOpCli(deps: { readonly spawn?: typeof spawn } = {}): OpCli {\n const spawnFn = deps.spawn ?? spawn;\n return {\n async read(uri: string, options: OpCliReadOptions = {}): Promise<OpCliReadResult> {\n const binary = options.binary ?? 'op';\n const timeoutMs = options.timeoutMs ?? 15_000;\n const args = ['read', '--reveal'];\n if (options.preserveColor !== true) args.push('--no-color');\n if (options.account !== undefined && options.account.length > 0) {\n args.push('--account', options.account);\n }\n args.push(uri);\n const env: Record<string, string> = {};\n const baseEnv = options.env ?? process.env;\n for (const [k, v] of Object.entries(baseEnv)) {\n if (typeof v === 'string') env[k] = v;\n }\n if (options.serviceAccountToken !== undefined) {\n env.OP_SERVICE_ACCOUNT_TOKEN = options.serviceAccountToken;\n }\n if (options.connect !== undefined) {\n env.OP_CONNECT_HOST = options.connect.host;\n env.OP_CONNECT_TOKEN = options.connect.token;\n }\n const started = performance.now();\n return new Promise<OpCliReadResult>((resolve, reject) => {\n let stdout = '';\n let stderr = '';\n let killedByTimeout = false;\n let proc: ReturnType<typeof spawn>;\n try {\n proc = spawnFn(binary, args, { env, stdio: ['ignore', 'pipe', 'pipe'] });\n } catch (err) {\n reject(\n new OpCliError(\n 'binary-missing',\n `'${binary}' is not installed or not on PATH. Install the 1Password CLI: https://developer.1password.com/docs/cli/get-started`,\n { cause: err, hint: 'install the 1Password CLI' },\n ),\n );\n return;\n }\n let graceTimer: ReturnType<typeof setTimeout> | undefined;\n const timer = setTimeout(() => {\n killedByTimeout = true;\n try {\n proc.kill('SIGTERM');\n } catch {\n // best-effort\n }\n // SPL-22: SIGTERM alone can hang forever if `op` ignores it. Escalate\n // to SIGKILL after a short grace AND reject from the timer, so the\n // promise settles even when `close` never fires.\n graceTimer = setTimeout(() => {\n try {\n proc.kill('SIGKILL');\n } catch {\n // best-effort\n }\n reject(\n new OpCliError(\n 'timeout',\n `op CLI timed out after ${timeoutMs} ms while resolving '${uri}' and did not exit on SIGTERM.`,\n { stderr, hint: 'increase --op-timeout-ms or check 1Password connectivity' },\n ),\n );\n }, SIGKILL_GRACE_MS);\n graceTimer.unref?.();\n }, timeoutMs);\n timer.unref?.();\n proc.stdout?.on('data', (chunk: Buffer) => {\n stdout += chunk.toString('utf8');\n });\n proc.stderr?.on('data', (chunk: Buffer) => {\n stderr += chunk.toString('utf8');\n });\n proc.on('error', (err) => {\n clearTimeout(timer);\n if (graceTimer !== undefined) clearTimeout(graceTimer);\n if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n reject(\n new OpCliError(\n 'binary-missing',\n `'${binary}' is not installed or not on PATH. Install the 1Password CLI: https://developer.1password.com/docs/cli/get-started`,\n { cause: err, hint: 'install the 1Password CLI' },\n ),\n );\n return;\n }\n reject(\n new OpCliError('unknown', `op CLI invocation failed: ${err.message}`, {\n cause: err,\n }),\n );\n });\n proc.on('close', (code) => {\n clearTimeout(timer);\n if (graceTimer !== undefined) clearTimeout(graceTimer);\n const durationMs = performance.now() - started;\n if (killedByTimeout) {\n reject(\n new OpCliError(\n 'timeout',\n `op CLI timed out after ${timeoutMs} ms while resolving '${uri}'.`,\n { stderr, hint: 'increase --op-timeout-ms or check 1Password connectivity' },\n ),\n );\n return;\n }\n if (code !== 0) {\n const kind = classifyExitError(code ?? -1, stderr);\n reject(\n new OpCliError(\n kind,\n `op CLI exited with code ${code} for '${uri}'${stderr.length > 0 ? `: ${stderr.trim()}` : ''}`,\n {\n ...(code !== null ? { exitCode: code } : {}),\n stderr,\n hint: hintForExitKind(kind),\n },\n ),\n );\n return;\n }\n resolve(Object.freeze({ value: stdout.replace(/\\r?\\n$/, ''), exitCode: 0, durationMs }));\n });\n });\n },\n };\n}\n\nfunction classifyExitError(_code: number, stderr: string): OpCliErrorKind {\n const lower = stderr.toLowerCase();\n if (\n lower.includes('not signed in') ||\n lower.includes('please sign in') ||\n lower.includes('not authenticated') ||\n lower.includes('session expired')\n ) {\n return 'signed-out';\n }\n if (\n lower.includes(\"couldn't find\") ||\n lower.includes('does not exist') ||\n lower.includes('item not found') ||\n lower.includes('field not found') ||\n lower.includes('reference not found')\n ) {\n return 'reference-not-found';\n }\n return 'unknown';\n}\n\nfunction hintForExitKind(kind: OpCliErrorKind): string {\n switch (kind) {\n case 'signed-out':\n return \"run 'eval $(op signin)' (interactive) or set OP_SERVICE_ACCOUNT_TOKEN (headless).\";\n case 'reference-not-found':\n return \"verify the reference with 'op item get <item> --vault <vault>' before retrying.\";\n case 'timeout':\n return 'check 1Password connectivity / increase --op-timeout-ms.';\n case 'binary-missing':\n return 'install the 1Password CLI: https://developer.1password.com/docs/cli/get-started';\n default:\n return 'check the op CLI stderr output for details.';\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoEA,IAAa,aAAb,cAAgC,MAAM;CACpC,AAAkB,OAAO;CACzB,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CAET,YACE,MACA,SACA,SAMA;AACA,QAAM,SAAS,SAAS,UAAU,SAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,OAAU;AACnF,OAAK,OAAO;AACZ,MAAI,SAAS,aAAa,OAAW,MAAK,WAAW,QAAQ;AAC7D,MAAI,SAAS,WAAW,OAAW,MAAK,SAAS,QAAQ;AACzD,MAAI,SAAS,SAAS,OAAW,MAAK,OAAO,QAAQ;;;;;;;;;;AAmBzD,SAAgB,qBAA4B;AAC1C,QAAO,aAAa;;;;;;;;AAStB,MAAM,mBAAmB;;;;;;;AAQzB,SAAgB,YAAY,OAA0C,EAAE,EAAS;CAC/E,MAAM,UAAU,KAAK,SAAS;AAC9B,QAAO,EACL,MAAM,KAAK,KAAa,UAA4B,EAAE,EAA4B;EAChF,MAAM,SAAS,QAAQ,UAAU;EACjC,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,OAAO,CAAC,QAAQ,WAAW;AACjC,MAAI,QAAQ,kBAAkB,KAAM,MAAK,KAAK,aAAa;AAC3D,MAAI,QAAQ,YAAY,UAAa,QAAQ,QAAQ,SAAS,EAC5D,MAAK,KAAK,aAAa,QAAQ,QAAQ;AAEzC,OAAK,KAAK,IAAI;EACd,MAAMA,MAA8B,EAAE;EACtC,MAAM,UAAU,QAAQ,OAAO,QAAQ;AACvC,OAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,CAC1C,KAAI,OAAO,MAAM,SAAU,KAAI,KAAK;AAEtC,MAAI,QAAQ,wBAAwB,OAClC,KAAI,2BAA2B,QAAQ;AAEzC,MAAI,QAAQ,YAAY,QAAW;AACjC,OAAI,kBAAkB,QAAQ,QAAQ;AACtC,OAAI,mBAAmB,QAAQ,QAAQ;;EAEzC,MAAM,UAAU,YAAY,KAAK;AACjC,SAAO,IAAI,SAA0B,SAAS,WAAW;GACvD,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,kBAAkB;GACtB,IAAIC;AACJ,OAAI;AACF,WAAO,QAAQ,QAAQ,MAAM;KAAE;KAAK,OAAO;MAAC;MAAU;MAAQ;MAAO;KAAE,CAAC;YACjE,KAAK;AACZ,WACE,IAAI,WACF,kBACA,IAAI,OAAO,qHACX;KAAE,OAAO;KAAK,MAAM;KAA6B,CAClD,CACF;AACD;;GAEF,IAAIC;GACJ,MAAM,QAAQ,iBAAiB;AAC7B,sBAAkB;AAClB,QAAI;AACF,UAAK,KAAK,UAAU;YACd;AAMR,iBAAa,iBAAiB;AAC5B,SAAI;AACF,WAAK,KAAK,UAAU;aACd;AAGR,YACE,IAAI,WACF,WACA,0BAA0B,UAAU,uBAAuB,IAAI,iCAC/D;MAAE;MAAQ,MAAM;MAA4D,CAC7E,CACF;OACA,iBAAiB;AACpB,eAAW,SAAS;MACnB,UAAU;AACb,SAAM,SAAS;AACf,QAAK,QAAQ,GAAG,SAAS,UAAkB;AACzC,cAAU,MAAM,SAAS,OAAO;KAChC;AACF,QAAK,QAAQ,GAAG,SAAS,UAAkB;AACzC,cAAU,MAAM,SAAS,OAAO;KAChC;AACF,QAAK,GAAG,UAAU,QAAQ;AACxB,iBAAa,MAAM;AACnB,QAAI,eAAe,OAAW,cAAa,WAAW;AACtD,QAAK,IAA8B,SAAS,UAAU;AACpD,YACE,IAAI,WACF,kBACA,IAAI,OAAO,qHACX;MAAE,OAAO;MAAK,MAAM;MAA6B,CAClD,CACF;AACD;;AAEF,WACE,IAAI,WAAW,WAAW,6BAA6B,IAAI,WAAW,EACpE,OAAO,KACR,CAAC,CACH;KACD;AACF,QAAK,GAAG,UAAU,SAAS;AACzB,iBAAa,MAAM;AACnB,QAAI,eAAe,OAAW,cAAa,WAAW;IACtD,MAAM,aAAa,YAAY,KAAK,GAAG;AACvC,QAAI,iBAAiB;AACnB,YACE,IAAI,WACF,WACA,0BAA0B,UAAU,uBAAuB,IAAI,KAC/D;MAAE;MAAQ,MAAM;MAA4D,CAC7E,CACF;AACD;;AAEF,QAAI,SAAS,GAAG;KACd,MAAM,OAAO,kBAAkB,QAAQ,IAAI,OAAO;AAClD,YACE,IAAI,WACF,MACA,2BAA2B,KAAK,QAAQ,IAAI,GAAG,OAAO,SAAS,IAAI,KAAK,OAAO,MAAM,KAAK,MAC1F;MACE,GAAI,SAAS,OAAO,EAAE,UAAU,MAAM,GAAG,EAAE;MAC3C;MACA,MAAM,gBAAgB,KAAK;MAC5B,CACF,CACF;AACD;;AAEF,YAAQ,OAAO,OAAO;KAAE,OAAO,OAAO,QAAQ,UAAU,GAAG;KAAE,UAAU;KAAG;KAAY,CAAC,CAAC;KACxF;IACF;IAEL;;AAGH,SAAS,kBAAkB,OAAe,QAAgC;CACxE,MAAM,QAAQ,OAAO,aAAa;AAClC,KACE,MAAM,SAAS,gBAAgB,IAC/B,MAAM,SAAS,iBAAiB,IAChC,MAAM,SAAS,oBAAoB,IACnC,MAAM,SAAS,kBAAkB,CAEjC,QAAO;AAET,KACE,MAAM,SAAS,gBAAgB,IAC/B,MAAM,SAAS,iBAAiB,IAChC,MAAM,SAAS,iBAAiB,IAChC,MAAM,SAAS,kBAAkB,IACjC,MAAM,SAAS,sBAAsB,CAErC,QAAO;AAET,QAAO;;AAGT,SAAS,gBAAgB,MAA8B;AACrD,SAAQ,MAAR;EACE,KAAK,aACH,QAAO;EACT,KAAK,sBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,QACE,QAAO"}
|
|
1
|
+
{"version":3,"file":"op-cli.js","names":["env: Record<string, string>","proc: ReturnType<typeof spawn>","graceTimer: ReturnType<typeof setTimeout> | undefined"],"sources":["../src/op-cli.ts"],"sourcesContent":["/**\n * Thin wrapper around the 1Password CLI (`op`). Spawns `op` with the\n * canonical `read` subcommand, captures stdout, and surfaces typed\n * errors for the most common operator-fixable failure modes.\n *\n * The wrapper is split out so the resolver can be unit-tested without\n * touching the real `op` binary - tests inject a stub `OpCli`\n * implementation through {@link createOnePasswordResolver}.\n *\n * @packageDocumentation\n */\n\nimport { spawn } from 'node:child_process';\n\n/** @stable */\nexport interface OpCliReadResult {\n readonly value: string;\n readonly exitCode: number;\n readonly durationMs: number;\n}\n\n/** @stable */\nexport interface OpCli {\n /**\n * Resolve a single `op://...` reference. Returns the **trimmed**\n * stdout. Throws {@link OpCliError} when the binary is missing, the\n * user is signed out, the reference does not resolve, or the call\n * exceeds the timeout.\n */\n read(uri: string, options?: OpCliReadOptions): Promise<OpCliReadResult>;\n}\n\n/** @stable */\nexport interface OpCliReadOptions {\n /** Override the binary path. Default `'op'` (looked up on `$PATH`). */\n readonly binary?: string;\n /** Hard timeout in milliseconds. Default `15000`. */\n readonly timeoutMs?: number;\n /** Override `process.env`. Default forwards the parent process. */\n readonly env?: Readonly<Record<string, string | undefined>>;\n /** Optional 1Password Connect / Service-Account token forwarding. */\n readonly serviceAccountToken?: string;\n /**\n * Optional 1Password Connect host + token tuple. When set the\n * resolver wires them through the `OP_CONNECT_HOST` /\n * `OP_CONNECT_TOKEN` env vars (the canonical Connect-mode contract\n * documented by 1Password).\n */\n readonly connect?: { readonly host: string; readonly token: string };\n /**\n * Optional `--account` override forwarded to the CLI. Useful when\n * the operator is signed in to multiple 1Password accounts.\n */\n readonly account?: string;\n /**\n * Optional `--no-color` flag suppression. The resolver always sets\n * `--no-color` so terminal colour codes do not leak into the\n * resolved value; pass `true` to opt out.\n */\n readonly preserveColor?: boolean;\n}\n\n/**\n * Typed error raised by the CLI wrapper. Carries a `kind` so callers\n * can distinguish operator-fixable failure modes.\n *\n * @stable\n */\nexport class OpCliError extends Error {\n override readonly name = 'OpCliError';\n readonly kind: OpCliErrorKind;\n readonly exitCode?: number;\n readonly stderr?: string;\n readonly hint?: string;\n\n constructor(\n kind: OpCliErrorKind,\n message: string,\n options?: {\n cause?: unknown;\n exitCode?: number;\n stderr?: string;\n hint?: string;\n },\n ) {\n super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n this.kind = kind;\n if (options?.exitCode !== undefined) this.exitCode = options.exitCode;\n if (options?.stderr !== undefined) this.stderr = options.stderr;\n if (options?.hint !== undefined) this.hint = options.hint;\n }\n}\n\n/** @stable */\nexport type OpCliErrorKind =\n | 'binary-missing'\n | 'signed-out'\n | 'reference-not-found'\n | 'timeout'\n | 'unknown';\n\n/**\n * Default {@link OpCli} implementation. Spawns `op read --no-color\n * --reveal '<uri>'` with the configured timeout and inherits the\n * parent environment.\n *\n * @stable\n */\nexport function createDefaultOpCli(): OpCli {\n return createOpCli();\n}\n\n/**\n * Grace period after SIGTERM before escalating to SIGKILL (SPL-22). A\n * well-behaved `op` exits on SIGTERM well within this window; a wedged one\n * (ignoring SIGTERM in an uninterruptible read) is force-killed so the hard\n * timeout actually settles the promise.\n */\nconst SIGKILL_GRACE_MS = 1_000;\n\n/**\n * {@link OpCli} factory with an injectable `spawn` (for tests). Production\n * code uses {@link createDefaultOpCli}.\n *\n * @stable\n */\nexport function createOpCli(deps: { readonly spawn?: typeof spawn } = {}): OpCli {\n const spawnFn = deps.spawn ?? spawn;\n return {\n async read(uri: string, options: OpCliReadOptions = {}): Promise<OpCliReadResult> {\n const binary = options.binary ?? 'op';\n const timeoutMs = options.timeoutMs ?? 15_000;\n const args = ['read', '--reveal'];\n if (options.preserveColor !== true) args.push('--no-color');\n if (options.account !== undefined && options.account.length > 0) {\n args.push('--account', options.account);\n }\n args.push(uri);\n const env: Record<string, string> = {};\n const baseEnv = options.env ?? process.env;\n for (const [k, v] of Object.entries(baseEnv)) {\n if (typeof v === 'string') env[k] = v;\n }\n if (options.serviceAccountToken !== undefined) {\n env.OP_SERVICE_ACCOUNT_TOKEN = options.serviceAccountToken;\n }\n if (options.connect !== undefined) {\n env.OP_CONNECT_HOST = options.connect.host;\n env.OP_CONNECT_TOKEN = options.connect.token;\n }\n const started = performance.now();\n return new Promise<OpCliReadResult>((resolve, reject) => {\n let stdout = '';\n let stderr = '';\n let killedByTimeout = false;\n let proc: ReturnType<typeof spawn>;\n try {\n proc = spawnFn(binary, args, { env, stdio: ['ignore', 'pipe', 'pipe'] });\n } catch (err) {\n reject(\n new OpCliError(\n 'binary-missing',\n `'${binary}' is not installed or not on PATH. Install the 1Password CLI: https://developer.1password.com/docs/cli/get-started`,\n { cause: err, hint: 'install the 1Password CLI' },\n ),\n );\n return;\n }\n let graceTimer: ReturnType<typeof setTimeout> | undefined;\n const timer = setTimeout(() => {\n killedByTimeout = true;\n try {\n proc.kill('SIGTERM');\n } catch {\n // best-effort\n }\n // SPL-22: SIGTERM alone can hang forever if `op` ignores it. Escalate\n // to SIGKILL after a short grace AND reject from the timer, so the\n // promise settles even when `close` never fires.\n graceTimer = setTimeout(() => {\n try {\n proc.kill('SIGKILL');\n } catch {\n // best-effort\n }\n reject(\n new OpCliError(\n 'timeout',\n `op CLI timed out after ${timeoutMs} ms while resolving '${uri}' and did not exit on SIGTERM.`,\n { stderr, hint: 'increase --op-timeout-ms or check 1Password connectivity' },\n ),\n );\n }, SIGKILL_GRACE_MS);\n graceTimer.unref?.();\n }, timeoutMs);\n timer.unref?.();\n proc.stdout?.on('data', (chunk: Buffer) => {\n stdout += chunk.toString('utf8');\n });\n proc.stderr?.on('data', (chunk: Buffer) => {\n stderr += chunk.toString('utf8');\n });\n proc.on('error', (err) => {\n clearTimeout(timer);\n if (graceTimer !== undefined) clearTimeout(graceTimer);\n if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n reject(\n new OpCliError(\n 'binary-missing',\n `'${binary}' is not installed or not on PATH. Install the 1Password CLI: https://developer.1password.com/docs/cli/get-started`,\n { cause: err, hint: 'install the 1Password CLI' },\n ),\n );\n return;\n }\n reject(\n new OpCliError('unknown', `op CLI invocation failed: ${err.message}`, {\n cause: err,\n }),\n );\n });\n proc.on('close', (code) => {\n clearTimeout(timer);\n if (graceTimer !== undefined) clearTimeout(graceTimer);\n const durationMs = performance.now() - started;\n if (killedByTimeout) {\n reject(\n new OpCliError(\n 'timeout',\n `op CLI timed out after ${timeoutMs} ms while resolving '${uri}'.`,\n { stderr, hint: 'increase --op-timeout-ms or check 1Password connectivity' },\n ),\n );\n return;\n }\n if (code !== 0) {\n const kind = classifyExitError(code ?? -1, stderr);\n reject(\n new OpCliError(\n kind,\n `op CLI exited with code ${code} for '${uri}'${stderr.length > 0 ? `: ${stderr.trim()}` : ''}`,\n {\n ...(code !== null ? { exitCode: code } : {}),\n stderr,\n hint: hintForExitKind(kind),\n },\n ),\n );\n return;\n }\n resolve(Object.freeze({ value: stdout.replace(/\\r?\\n$/, ''), exitCode: 0, durationMs }));\n });\n });\n },\n };\n}\n\nfunction classifyExitError(_code: number, stderr: string): OpCliErrorKind {\n const lower = stderr.toLowerCase();\n if (\n lower.includes('not signed in') ||\n lower.includes('please sign in') ||\n lower.includes('not authenticated') ||\n lower.includes('session expired')\n ) {\n return 'signed-out';\n }\n if (\n lower.includes(\"couldn't find\") ||\n lower.includes('does not exist') ||\n lower.includes('item not found') ||\n lower.includes('field not found') ||\n lower.includes('reference not found')\n ) {\n return 'reference-not-found';\n }\n return 'unknown';\n}\n\nfunction hintForExitKind(kind: OpCliErrorKind): string {\n switch (kind) {\n case 'signed-out':\n return \"run 'eval $(op signin)' (interactive) or set OP_SERVICE_ACCOUNT_TOKEN (headless).\";\n case 'reference-not-found':\n return \"verify the reference with 'op item get <item> --vault <vault>' before retrying.\";\n case 'timeout':\n return 'check 1Password connectivity / increase --op-timeout-ms.';\n case 'binary-missing':\n return 'install the 1Password CLI: https://developer.1password.com/docs/cli/get-started';\n default:\n return 'check the op CLI stderr output for details.';\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoEA,IAAa,aAAb,cAAgC,MAAM;CACpC,AAAkB,OAAO;CACzB,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CAET,YACE,MACA,SACA,SAMA;AACA,QAAM,SAAS,SAAS,UAAU,SAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,OAAU;AACnF,OAAK,OAAO;AACZ,MAAI,SAAS,aAAa,OAAW,MAAK,WAAW,QAAQ;AAC7D,MAAI,SAAS,WAAW,OAAW,MAAK,SAAS,QAAQ;AACzD,MAAI,SAAS,SAAS,OAAW,MAAK,OAAO,QAAQ;;;;;;;;;;AAmBzD,SAAgB,qBAA4B;AAC1C,QAAO,aAAa;;;;;;;;AAStB,MAAM,mBAAmB;;;;;;;AAQzB,SAAgB,YAAY,OAA0C,EAAE,EAAS;CAC/E,MAAM,UAAU,KAAK,SAAS;AAC9B,QAAO,EACL,MAAM,KAAK,KAAa,UAA4B,EAAE,EAA4B;EAChF,MAAM,SAAS,QAAQ,UAAU;EACjC,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,OAAO,CAAC,QAAQ,WAAW;AACjC,MAAI,QAAQ,kBAAkB,KAAM,MAAK,KAAK,aAAa;AAC3D,MAAI,QAAQ,YAAY,UAAa,QAAQ,QAAQ,SAAS,EAC5D,MAAK,KAAK,aAAa,QAAQ,QAAQ;AAEzC,OAAK,KAAK,IAAI;EACd,MAAMA,MAA8B,EAAE;EACtC,MAAM,UAAU,QAAQ,OAAO,QAAQ;AACvC,OAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,CAC1C,KAAI,OAAO,MAAM,SAAU,KAAI,KAAK;AAEtC,MAAI,QAAQ,wBAAwB,OAClC,KAAI,2BAA2B,QAAQ;AAEzC,MAAI,QAAQ,YAAY,QAAW;AACjC,OAAI,kBAAkB,QAAQ,QAAQ;AACtC,OAAI,mBAAmB,QAAQ,QAAQ;;EAEzC,MAAM,UAAU,YAAY,KAAK;AACjC,SAAO,IAAI,SAA0B,SAAS,WAAW;GACvD,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,kBAAkB;GACtB,IAAIC;AACJ,OAAI;AACF,WAAO,QAAQ,QAAQ,MAAM;KAAE;KAAK,OAAO;MAAC;MAAU;MAAQ;MAAO;KAAE,CAAC;YACjE,KAAK;AACZ,WACE,IAAI,WACF,kBACA,IAAI,OAAO,qHACX;KAAE,OAAO;KAAK,MAAM;KAA6B,CAClD,CACF;AACD;;GAEF,IAAIC;GACJ,MAAM,QAAQ,iBAAiB;AAC7B,sBAAkB;AAClB,QAAI;AACF,UAAK,KAAK,UAAU;YACd;AAMR,iBAAa,iBAAiB;AAC5B,SAAI;AACF,WAAK,KAAK,UAAU;aACd;AAGR,YACE,IAAI,WACF,WACA,0BAA0B,UAAU,uBAAuB,IAAI,iCAC/D;MAAE;MAAQ,MAAM;MAA4D,CAC7E,CACF;OACA,iBAAiB;AACpB,eAAW,SAAS;MACnB,UAAU;AACb,SAAM,SAAS;AACf,QAAK,QAAQ,GAAG,SAAS,UAAkB;AACzC,cAAU,MAAM,SAAS,OAAO;KAChC;AACF,QAAK,QAAQ,GAAG,SAAS,UAAkB;AACzC,cAAU,MAAM,SAAS,OAAO;KAChC;AACF,QAAK,GAAG,UAAU,QAAQ;AACxB,iBAAa,MAAM;AACnB,QAAI,eAAe,OAAW,cAAa,WAAW;AACtD,QAAK,IAA8B,SAAS,UAAU;AACpD,YACE,IAAI,WACF,kBACA,IAAI,OAAO,qHACX;MAAE,OAAO;MAAK,MAAM;MAA6B,CAClD,CACF;AACD;;AAEF,WACE,IAAI,WAAW,WAAW,6BAA6B,IAAI,WAAW,EACpE,OAAO,KACR,CAAC,CACH;KACD;AACF,QAAK,GAAG,UAAU,SAAS;AACzB,iBAAa,MAAM;AACnB,QAAI,eAAe,OAAW,cAAa,WAAW;IACtD,MAAM,aAAa,YAAY,KAAK,GAAG;AACvC,QAAI,iBAAiB;AACnB,YACE,IAAI,WACF,WACA,0BAA0B,UAAU,uBAAuB,IAAI,KAC/D;MAAE;MAAQ,MAAM;MAA4D,CAC7E,CACF;AACD;;AAEF,QAAI,SAAS,GAAG;KACd,MAAM,OAAO,kBAAkB,QAAQ,IAAI,OAAO;AAClD,YACE,IAAI,WACF,MACA,2BAA2B,KAAK,QAAQ,IAAI,GAAG,OAAO,SAAS,IAAI,KAAK,OAAO,MAAM,KAAK,MAC1F;MACE,GAAI,SAAS,OAAO,EAAE,UAAU,MAAM,GAAG,EAAE;MAC3C;MACA,MAAM,gBAAgB,KAAK;MAC5B,CACF,CACF;AACD;;AAEF,YAAQ,OAAO,OAAO;KAAE,OAAO,OAAO,QAAQ,UAAU,GAAG;KAAE,UAAU;KAAG;KAAY,CAAC,CAAC;KACxF;IACF;IAEL;;AAGH,SAAS,kBAAkB,OAAe,QAAgC;CACxE,MAAM,QAAQ,OAAO,aAAa;AAClC,KACE,MAAM,SAAS,gBAAgB,IAC/B,MAAM,SAAS,iBAAiB,IAChC,MAAM,SAAS,oBAAoB,IACnC,MAAM,SAAS,kBAAkB,CAEjC,QAAO;AAET,KACE,MAAM,SAAS,gBAAgB,IAC/B,MAAM,SAAS,iBAAiB,IAChC,MAAM,SAAS,iBAAiB,IAChC,MAAM,SAAS,kBAAkB,IACjC,MAAM,SAAS,sBAAsB,CAErC,QAAO;AAET,QAAO;;AAGT,SAAS,gBAAgB,MAA8B;AACrD,SAAQ,MAAR;EACE,KAAK,aACH,QAAO;EACT,KAAK,sBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,QACE,QAAO"}
|
package/dist/resolver.d.ts
CHANGED
|
@@ -17,7 +17,7 @@ interface OnePasswordResolverOptions {
|
|
|
17
17
|
/**
|
|
18
18
|
* Optional service-account token. When set the resolver forwards it
|
|
19
19
|
* via `OP_SERVICE_ACCOUNT_TOKEN` so the CLI runs in headless mode.
|
|
20
|
-
* The token is itself a secret
|
|
20
|
+
* The token is itself a secret - pass a previously-resolved
|
|
21
21
|
* `SecretValue` and use `.use(...)` to scope its lifetime.
|
|
22
22
|
*/
|
|
23
23
|
readonly serviceAccountToken?: string;
|
package/dist/resolver.js
CHANGED
|
@@ -31,7 +31,7 @@ function createOnePasswordResolver(options = {}) {
|
|
|
31
31
|
ref: parsed.raw
|
|
32
32
|
} });
|
|
33
33
|
} catch (err) {
|
|
34
|
-
if (err instanceof OpCliError) throw new SecretResolutionError("op", parsed.raw, `${err.message}${err.hint !== void 0 ? `
|
|
34
|
+
if (err instanceof OpCliError) throw new SecretResolutionError("op", parsed.raw, `${err.message}${err.hint !== void 0 ? ` - hint: ${err.hint}` : ""}`, { cause: err });
|
|
35
35
|
throw err;
|
|
36
36
|
}
|
|
37
37
|
}
|
package/dist/resolver.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolver.js","names":["onePasswordResolver: SecretResolver"],"sources":["../src/resolver.ts"],"sourcesContent":["/**\n * `op://`-scheme `SecretResolver` for the Graphorin framework. Wraps\n * the official 1Password CLI (`op`) per the canonical `op read` flow\n * documented at https://developer.1password.com/docs/cli/secrets-references/.\n *\n * URI shape (per 1Password): `op://<vault>/<item>/[section/]<field>`.\n * The resolver accepts any `op://` URI the CLI accepts (the CLI is\n * the source of truth
|
|
1
|
+
{"version":3,"file":"resolver.js","names":["onePasswordResolver: SecretResolver"],"sources":["../src/resolver.ts"],"sourcesContent":["/**\n * `op://`-scheme `SecretResolver` for the Graphorin framework. Wraps\n * the official 1Password CLI (`op`) per the canonical `op read` flow\n * documented at https://developer.1password.com/docs/cli/secrets-references/.\n *\n * URI shape (per 1Password): `op://<vault>/<item>/[section/]<field>`.\n * The resolver accepts any `op://` URI the CLI accepts (the CLI is\n * the source of truth - we forward verbatim) and rejects only the\n * obvious malformed cases at parse time.\n *\n * 1Password explicitly treats vault / item / field names as\n * case-insensitive; the resolver normalises the URI by lowercasing the\n * authority + path before forwarding to the CLI so two configs that\n * differ only in case resolve to the same value.\n *\n * @packageDocumentation\n */\n\nimport type { SecretResolver, SecretResolverContext } from '@graphorin/core/contracts';\nimport { type ParsedSecretRef, SecretResolutionError, SecretValue } from '@graphorin/security';\n\nimport { createDefaultOpCli, type OpCli, OpCliError } from './op-cli.js';\n\n/** @stable */\nexport interface OnePasswordResolverOptions {\n /**\n * Inject a {@link OpCli} implementation. Defaults to a wrapper that\n * spawns the system `op` binary. Tests pass a stub.\n */\n readonly cli?: OpCli;\n /** Override the CLI binary path. Default `'op'`. */\n readonly binary?: string;\n /** Hard timeout per resolve. Default `15000` ms. */\n readonly timeoutMs?: number;\n /**\n * Optional service-account token. When set the resolver forwards it\n * via `OP_SERVICE_ACCOUNT_TOKEN` so the CLI runs in headless mode.\n * The token is itself a secret - pass a previously-resolved\n * `SecretValue` and use `.use(...)` to scope its lifetime.\n */\n readonly serviceAccountToken?: string;\n /**\n * Optional 1Password Connect host + token. Mutually exclusive with\n * a service-account token at the CLI level (the CLI honours the\n * Connect env vars if both are present).\n */\n readonly connect?: { readonly host: string; readonly token: string };\n /**\n * Optional `--account` override. Useful when the operator is signed\n * in to multiple 1Password accounts.\n */\n readonly account?: string;\n /**\n * If `true`, do **not** lowercase the URI before forwarding to the\n * CLI. Default `false`. Toggle only when interoperating with a\n * deployment that intentionally relies on case-sensitive keys.\n */\n readonly preserveCase?: boolean;\n}\n\n/**\n * Build a `SecretResolver` that honours the `op://` scheme. Register\n * with `registerResolver(...)` from `@graphorin/security` at app\n * bootstrap.\n *\n * @stable\n */\nexport function createOnePasswordResolver(\n options: OnePasswordResolverOptions = {},\n): SecretResolver {\n const cli = options.cli ?? createDefaultOpCli();\n return {\n scheme: 'op',\n async resolve(ref, ctx?: SecretResolverContext): Promise<SecretValue> {\n void ctx;\n const parsed = ref as ParsedSecretRef;\n assertOpRef(parsed);\n const normalized = options.preserveCase === true ? parsed.raw : normalizeOpUri(parsed.raw);\n try {\n const result = await cli.read(normalized, {\n ...(options.binary !== undefined ? { binary: options.binary } : {}),\n ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),\n ...(options.serviceAccountToken !== undefined\n ? { serviceAccountToken: options.serviceAccountToken }\n : {}),\n ...(options.connect !== undefined ? { connect: options.connect } : {}),\n ...(options.account !== undefined ? { account: options.account } : {}),\n });\n if (result.value.length === 0) {\n throw new SecretResolutionError(\n 'op',\n parsed.raw,\n '1Password CLI returned an empty value; verify the field exists and is non-empty.',\n );\n }\n return SecretValue.fromString(result.value, {\n source: { resolver: 'op', ref: parsed.raw },\n });\n } catch (err) {\n if (err instanceof OpCliError) {\n throw new SecretResolutionError(\n 'op',\n parsed.raw,\n `${err.message}${err.hint !== undefined ? ` - hint: ${err.hint}` : ''}`,\n { cause: err },\n );\n }\n throw err;\n }\n },\n };\n}\n\n/**\n * Cache the default-options resolver so callers that just want the\n * happy-path behaviour can use a constant export.\n *\n * @stable\n */\nexport const onePasswordResolver: SecretResolver = createOnePasswordResolver();\n\nfunction assertOpRef(parsed: ParsedSecretRef): void {\n if (parsed.scheme !== 'op') {\n throw new SecretResolutionError(\n 'op',\n parsed.raw,\n `expected scheme 'op', received '${parsed.scheme}'.`,\n );\n }\n if (parsed.authority === undefined || parsed.authority.length === 0) {\n throw new SecretResolutionError(\n 'op',\n parsed.raw,\n \"op:// SecretRef must include a vault authority (e.g. 'op://Personal/Item/field').\",\n );\n }\n if (parsed.path === undefined || parsed.path.length <= 1) {\n throw new SecretResolutionError(\n 'op',\n parsed.raw,\n \"op:// SecretRef must include an item + field path segment (e.g. 'op://Vault/Item/field').\",\n );\n }\n const segments = parsed.path.split('/').filter((s) => s.length > 0);\n if (segments.length < 2) {\n throw new SecretResolutionError(\n 'op',\n parsed.raw,\n 'op:// SecretRef must reference at least an item + field (got ' +\n `${segments.length} path segment(s) after the vault).`,\n );\n }\n}\n\n/**\n * Lowercase the authority + path segments of an `op://` URI so two\n * configs that differ only in case resolve to the same value (matching\n * 1Password's case-insensitive behaviour).\n *\n * Exposed for tests.\n *\n * @stable\n */\nexport function normalizeOpUri(raw: string): string {\n // Lowercase only the part up to the first `?` or `#` so query /\n // fragment components keep their original case (the CLI does not\n // currently use them, but forward-compat matters).\n const queryIdx = raw.indexOf('?');\n const fragIdx = raw.indexOf('#');\n const cuts = [queryIdx, fragIdx].filter((i) => i >= 0);\n const split = cuts.length > 0 ? Math.min(...cuts) : raw.length;\n const head = raw.slice(0, split).toLowerCase();\n const tail = raw.slice(split);\n return head + tail;\n}\n"],"mappings":";;;;;;;;;;;AAmEA,SAAgB,0BACd,UAAsC,EAAE,EACxB;CAChB,MAAM,MAAM,QAAQ,OAAO,oBAAoB;AAC/C,QAAO;EACL,QAAQ;EACR,MAAM,QAAQ,KAAK,KAAmD;GAEpE,MAAM,SAAS;AACf,eAAY,OAAO;GACnB,MAAM,aAAa,QAAQ,iBAAiB,OAAO,OAAO,MAAM,eAAe,OAAO,IAAI;AAC1F,OAAI;IACF,MAAM,SAAS,MAAM,IAAI,KAAK,YAAY;KACxC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;KAClE,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;KAC3E,GAAI,QAAQ,wBAAwB,SAChC,EAAE,qBAAqB,QAAQ,qBAAqB,GACpD,EAAE;KACN,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,SAAS,GAAG,EAAE;KACrE,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,SAAS,GAAG,EAAE;KACtE,CAAC;AACF,QAAI,OAAO,MAAM,WAAW,EAC1B,OAAM,IAAI,sBACR,MACA,OAAO,KACP,mFACD;AAEH,WAAO,YAAY,WAAW,OAAO,OAAO,EAC1C,QAAQ;KAAE,UAAU;KAAM,KAAK,OAAO;KAAK,EAC5C,CAAC;YACK,KAAK;AACZ,QAAI,eAAe,WACjB,OAAM,IAAI,sBACR,MACA,OAAO,KACP,GAAG,IAAI,UAAU,IAAI,SAAS,SAAY,YAAY,IAAI,SAAS,MACnE,EAAE,OAAO,KAAK,CACf;AAEH,UAAM;;;EAGX;;;;;;;;AASH,MAAaA,sBAAsC,2BAA2B;AAE9E,SAAS,YAAY,QAA+B;AAClD,KAAI,OAAO,WAAW,KACpB,OAAM,IAAI,sBACR,MACA,OAAO,KACP,mCAAmC,OAAO,OAAO,IAClD;AAEH,KAAI,OAAO,cAAc,UAAa,OAAO,UAAU,WAAW,EAChE,OAAM,IAAI,sBACR,MACA,OAAO,KACP,oFACD;AAEH,KAAI,OAAO,SAAS,UAAa,OAAO,KAAK,UAAU,EACrD,OAAM,IAAI,sBACR,MACA,OAAO,KACP,4FACD;CAEH,MAAM,WAAW,OAAO,KAAK,MAAM,IAAI,CAAC,QAAQ,MAAM,EAAE,SAAS,EAAE;AACnE,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,sBACR,MACA,OAAO,KACP,gEACK,SAAS,OAAO,oCACtB;;;;;;;;;;;AAaL,SAAgB,eAAe,KAAqB;CAMlD,MAAM,OAAO,CAFI,IAAI,QAAQ,IAAI,EACjB,IAAI,QAAQ,IAAI,CACA,CAAC,QAAQ,MAAM,KAAK,EAAE;CACtD,MAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI;AAGxD,QAFa,IAAI,MAAM,GAAG,MAAM,CAAC,aAAa,GACjC,IAAI,MAAM,MAAM"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@graphorin/secret-1password",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "Reference 1Password secret-resolver adapter for the Graphorin framework. Registers the `op://` scheme on top of `@graphorin/security`'s pluggable `SecretResolver` registry by shelling out to the official 1Password CLI (`op read 'op://<vault>/<item>/<field>'`). The resolver enforces a strict timeout, validates the URI before invoking the CLI, redacts the resolved value behind a `SecretValue`, and surfaces actionable errors when the CLI is missing, the user is not signed in, or the requested field is not present. Serves as the canonical template community packages should follow when wiring HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, Bitwarden, or Unix `pass` as additional `SecretResolver` implementations. Created and maintained by Oleksiy Stepurenko.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "Oleksiy Stepurenko",
|
|
@@ -46,8 +46,8 @@
|
|
|
46
46
|
"LICENSE"
|
|
47
47
|
],
|
|
48
48
|
"dependencies": {
|
|
49
|
-
"@graphorin/core": "0.
|
|
50
|
-
"@graphorin/security": "0.
|
|
49
|
+
"@graphorin/core": "0.6.0",
|
|
50
|
+
"@graphorin/security": "0.6.0"
|
|
51
51
|
},
|
|
52
52
|
"publishConfig": {
|
|
53
53
|
"access": "public",
|