@milkenjoyer/secrets-client 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,74 @@
-# Temporary Holding Version
+# @birbprophet/secrets-client
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The one 1Password Connect client for siglata, vibebattler and optionhouse. It replaces siglata's `packages/edge/scripts/connect-secrets.ts`, vibebattler's `scripts/connect-secret.ts` and optionhouse's `scripts/secrets-vault.ts`.
+
+```ts
+import { Secrets, live } from "@birbprophet/secrets-client";
+import * as Effect from "effect/Effect";
+
+const program = Effect.gen(function* () {
+  const secrets = yield* Secrets;
+  const apiKey = yield* secrets.read({ vault: "shared-infra", item: "boat", field: "credential" });
+  const deploy = yield* secrets.readItem({ vault: "vibebattler-infra", item: "deploy" });
+  return { apiKey, deploy };
+});
+
+program.pipe(Effect.provide(live("vibebattler")));
+```
+
+```ts
+import { Secrets, live } from "@birbprophet/secrets-client";
+import * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+
+export const rotate = (apiKey: Redacted.Redacted) =>
+  Effect.gen(function* () {
+    const secrets = yield* Secrets;
+    return yield* secrets.write({
+      vault: "vibebattler-infra",
+      item: "deploy",
+      fields: { API_KEY: apiKey },
+    });
+  }).pipe(Effect.provide(live("vibebattler", { token: "connect-write" })));
+```
+
+- `read({ vault, item, field })` returns one field as a `Redacted`. A missing or empty field is refused.
+- `readItem({ vault, item })` returns every field with a label and a value, keyed by label, each a `Redacted` labelled `vault/item/field`.
+- `write({ vault, item, fields })` takes each value as a `Redacted`. If no item in the vault has that title, it creates one and answers `"created"`. The new item is an API Credential, and each field is concealed. If one item has that title, it replaces the value of each field it names, adds each field the item lacks, keeps every other field, and answers `"updated"`.
+- A write needs a token that may write, such as `connect-write`. Connect refuses a read token's write with 403.
+- A vault name, item title or field label that two entries share is refused, so the client never guesses. A write checks every label it names before it sends anything.
+- One layer reads the token once, lists `/v1/vaults` once and each vault's items once, then reuses those lists. The door allows 60 calls a minute per IP. A failed read or list is not kept, so a later call tries again. A write drops its vault's item list, so the next call lists that vault again and sees the write.
+
+## Connect
+
+The client calls Connect through `@distilled.cloud/onepassword`'s Connect operations, on Effect's `HttpClient`. It sends only routes the door forwards, with no trailing slash and no query:
+
+- `GET /v1/vaults`, `GET /v1/vaults/<id>/items` and `GET /v1/vaults/<id>/items/<id>` to read.
+- `POST /v1/vaults/<id>/items` to create an item.
+- `PATCH /v1/vaults/<id>/items/<id>` to replace or add fields.
+
+It never sends PUT. A PUT sends the whole item back, and it would drop any property that distilled's schema does not model. A PATCH changes only the fields it names. Answers are checked against the Connect schema, calls are not retried, and tracing is off inside each call, because distilled's spans hold the answer and the request.
+
+## The Keychain token
+
+`live(repo)` reads the token from the macOS login Keychain, as service `<repo>-connect-read` and account `connect`. `live(repo, { token: "connect-write" })` reads Keychain service `connect-write` instead, which holds the owner's write token. `live(repo, { url })` calls another Connect URL. `bun:ffi` calls `SecKeychainFindGenericPassword` in Security.framework, so no process starts and the token never sits in argv, env, a pipe or a file. The bytes go straight into a `Redacted`, then Security's buffer is zeroed and freed.
+
+- The read needs bun on macOS. Elsewhere it is refused with status -4.
+- bun isn't on the item's access list, so the first read asks whether bun may use the token. Answer Always Allow, once per token. macOS asks again after bun changes.
+- Status -25300 means the token is missing, and -128 means the prompt was denied.
+
+## Refusals
+
+Every failure is a `ConnectRefused` holding only a `route` and a `status`, and its message is built from those two. The original error is dropped. A route is a Connect call (`GET /v1/vaults`, `POST /v1/vaults/<id>/items`), a lookup (`vault shared-infra`, `item shared-infra/boat`, `field shared-infra/boat/credential`) or the Keychain (`keychain vibebattler-connect-read`). Status 0 means Connect gave no answer, from a network failure or after 60 seconds, 200 means its answer had the wrong shape, 403 means the door refused the call or Connect refused it for the token's access, 404 means a name was not found or a field is empty, and 409 means a name matched more than one entry. `test/redaction.test.ts` checks over generated values and tokens, for reads and for writes, that neither ever appears in a refusal, `String`, JSON, `inspect`, `Cause.pretty`, a log line or a span.
+
+## Readback
+
+`bun scripts/readback.ts <repo>` prints the vault names and item titles the repo's token can read, and how many fields `readItem` returns for the first item in each vault. It prints no value.
+
+## Writeback
+
+`bun scripts/writeback.ts <vault> <read-repo>` checks writes through the live door. With the `connect-write` token, it creates an item titled `secrets#6 writeback <time>` with a random `probe` field, then adds a `probe-2` field. It prints `created`, `updated` and the item's field labels. Then it tries a write to that item with `<read-repo>`'s read token and prints the refusal's route and status. If that write is not refused, it says so loudly. It prints the item's vault and title last, so you can delete the item by hand. It prints no value and no token.
+
+## Install
+
+The package is on GitHub Packages, published by `.github/workflows/publish-client.yml` when a version not yet published lands on main. A product repo reads it with `AGENT_KIT_PACKAGE_READ_TOKEN`.

package/dist/connect.d.ts

@@ -0,0 +1,34 @@
+import * as Effect from "effect/Effect";
+import { HttpClient } from "effect/http";
+import * as Redacted from "effect/Redacted";
+import { type ConnectRefused } from "./refused.ts";
+export type Listed = {
+    readonly id: string;
+    readonly name: string;
+};
+export type Field = {
+    readonly id: string;
+    readonly label: string;
+    readonly value?: string;
+};
+export type NewField = {
+    readonly label: string;
+    readonly value: Redacted.Redacted;
+};
+export type FieldPatch = {
+    readonly op: "add";
+    readonly label: string;
+    readonly value: Redacted.Redacted;
+} | {
+    readonly op: "replace";
+    readonly fieldId: string;
+    readonly value: Redacted.Redacted;
+};
+export type ConnectRoutes = {
+    readonly vaults: Effect.Effect<ReadonlyArray<Listed>, ConnectRefused>;
+    readonly items: (vaultId: string) => Effect.Effect<ReadonlyArray<Listed>, ConnectRefused>;
+    readonly fields: (vaultId: string, itemId: string) => Effect.Effect<ReadonlyArray<Field>, ConnectRefused>;
+    readonly create: (vaultId: string, title: string, fields: ReadonlyArray<NewField>) => Effect.Effect<void, ConnectRefused>;
+    readonly patch: (vaultId: string, itemId: string, patches: ReadonlyArray<FieldPatch>) => Effect.Effect<void, ConnectRefused>;
+};
+export declare const connectRoutes: (client: HttpClient.HttpClient, url: string, token: Effect.Effect<Redacted.Redacted, ConnectRefused>) => ConnectRoutes;

package/dist/connect.js

@@ -0,0 +1,53 @@
+import * as ResponseValidation from "@distilled.cloud/core/response-validation";
+import * as Connect from "@distilled.cloud/onepassword/connect";
+import { ConnectCredentials } from "@distilled.cloud/onepassword/Credentials";
+import * as Retry from "@distilled.cloud/onepassword/Retry";
+import * as Effect from "effect/Effect";
+import { HttpClient } from "effect/http";
+import * as Redacted from "effect/Redacted";
+import * as Ref from "effect/Ref";
+import { NO_ANSWER, refused } from "./refused.js";
+const ANSWER_TIMEOUT = "60 seconds";
+const ID_CHARACTERS = "abcdefghijklmnopqrstuvwxyz0123456789";
+const newFieldId = () => Array.from(crypto.getRandomValues(new Uint8Array(26)), (byte) => ID_CHARACTERS[byte % ID_CHARACTERS.length]).join("");
+const concealed = ({ label, value }) => ({
+    id: newFieldId(),
+    type: "CONCEALED",
+    label,
+    value: Redacted.value(value),
+});
+const pointerToken = (token) => token.replaceAll("~", "~0").replaceAll("/", "~1");
+const patchItem = (patch) => patch.op === "add"
+    ? { op: "add", path: "/fields", value: concealed(patch) }
+    : {
+        op: "replace",
+        path: `/fields/${pointerToken(patch.fieldId)}/value`,
+        value: Redacted.value(patch.value),
+    };
+const listed = (id, name) => id === undefined || name === undefined ? [] : [{ id, name }];
+export const connectRoutes = (client, url, token) => {
+    const apiBaseUrl = `${url.replace(/\/+$/u, "")}/v1`;
+    const call = (route, operation, picked) => Effect.gen(function* callRoute() {
+        const credentials = { token: yield* token, apiBaseUrl };
+        const status = yield* Ref.make(NO_ANSWER);
+        const refuse = Effect.flatMap(Ref.get(status), (answered) => Effect.fail(refused(route, answered)));
+        return yield* Effect.suspend(operation).pipe(Effect.map(picked), Effect.provide(ResponseValidation.additionalProperties), Retry.none, Effect.provideService(ConnectCredentials, Effect.succeed(credentials)), Effect.provideService(HttpClient.HttpClient, HttpClient.tap(client, (response) => Ref.set(status, response.status))), Effect.withTracerEnabled(false), Effect.timeout(ANSWER_TIMEOUT), Effect.catch(() => refuse), Effect.catchDefect(() => refuse));
+    });
+    return {
+        vaults: call("GET /v1/vaults", () => Connect.getVaults({}), (vaults) => vaults.flatMap(({ id, name }) => listed(id, name))),
+        items: (vaultId) => call(`GET /v1/vaults/${vaultId}/items`, () => Connect.getVaultItems({ vaultUuid: vaultId }), (items) => items.flatMap(({ id, title }) => listed(id, title))),
+        fields: (vaultId, itemId) => call(`GET /v1/vaults/${vaultId}/items/${itemId}`, () => Connect.getVaultItemById({ vaultUuid: vaultId, itemUuid: itemId }), ({ fields = [] }) => fields.flatMap(({ id, label, value }) => label === undefined ? [] : [{ id, label, value }])),
+        create: (vaultId, title, fields) => call(`POST /v1/vaults/${vaultId}/items`, () => Connect.createVaultItem({
+            vaultUuid: vaultId,
+            vault: { id: vaultId },
+            title,
+            category: "API_CREDENTIAL",
+            fields: fields.map(concealed),
+        }), () => undefined),
+        patch: (vaultId, itemId, patches) => call(`PATCH /v1/vaults/${vaultId}/items/${itemId}`, () => Connect.updateVaultItemByItemUuid({
+            vaultUuid: vaultId,
+            itemUuid: itemId,
+            body: patches.map(patchItem),
+        }), () => undefined),
+    };
+};

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { HttpClient } from "effect/http";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { type ConnectRefused } from "./refused.ts";
+export { ConnectRefused, KEYCHAIN_DENIED, KEYCHAIN_MISSING, NEEDS_BUN, NO_ANSWER, } from "./refused.ts";
+export { keychainService, readKeychainToken } from "./keychain.ts";
+export declare const CONNECT_URL = "https://secrets-connect-prod.benjamin-tang-hz.workers.dev";
+export type ItemName = {
+    readonly vault: string;
+    readonly item: string;
+};
+export type FieldName = ItemName & {
+    readonly field: string;
+};
+export type ItemWrite = ItemName & {
+    readonly fields: Readonly<Record<string, Redacted.Redacted>>;
+};
+export type Written = "created" | "updated";
+export type SecretsClient = {
+    readonly read: (wanted: FieldName) => Effect.Effect<Redacted.Redacted, ConnectRefused>;
+    readonly readItem: (wanted: ItemName) => Effect.Effect<Readonly<Record<string, Redacted.Redacted>>, ConnectRefused>;
+    readonly write: (wanted: ItemWrite) => Effect.Effect<Written, ConnectRefused>;
+};
+declare const ConnectToken_base: Context.ServiceClass<ConnectToken, "@birbprophet/secrets-client/ConnectToken", Effect.Effect<Redacted.Redacted<string>, ConnectRefused, never>>;
+export declare class ConnectToken extends ConnectToken_base {
+}
+declare const Secrets_base: Context.ServiceClass<Secrets, "@birbprophet/secrets-client/Secrets", SecretsClient>;
+export declare class Secrets extends Secrets_base {
+}
+export declare const make: (url?: string) => Effect.Effect<SecretsClient, never, HttpClient.HttpClient | ConnectToken>;
+export declare const layer: (url?: string) => Layer.Layer<Secrets, never, HttpClient.HttpClient | ConnectToken>;
+export declare const keychainToken: (service: string) => Layer.Layer<ConnectToken>;
+export declare const live: (repo: string, { token, url, }?: {
+    readonly token?: string;
+    readonly url?: string;
+}) => Layer.Layer<Secrets>;

package/dist/index.js

@@ -0,0 +1,102 @@
+import * as Cache from "effect/Cache";
+import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { FetchHttpClient, HttpClient } from "effect/http";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { connectRoutes, } from "./connect.js";
+import { keychainService, readKeychainToken } from "./keychain.js";
+import { AMBIGUOUS, NOT_FOUND, refused, } from "./refused.js";
+export { ConnectRefused, KEYCHAIN_DENIED, KEYCHAIN_MISSING, NEEDS_BUN, NO_ANSWER, } from "./refused.js";
+export { keychainService, readKeychainToken } from "./keychain.js";
+export const CONNECT_URL = "https://secrets-connect-prod.benjamin-tang-hz.workers.dev";
+const VAULT_CAPACITY = 64;
+export class ConnectToken extends Context.Service()("@birbprophet/secrets-client/ConnectToken") {
+}
+export class Secrets extends Context.Service()("@birbprophet/secrets-client/Secrets") {
+}
+const only = (matching, route) => {
+    const [first, ...others] = matching;
+    if (first === undefined) {
+        return Effect.fail(refused(route, NOT_FOUND));
+    }
+    return others.length === 0
+        ? Effect.succeed(first)
+        : Effect.fail(refused(route, AMBIGUOUS));
+};
+const onlyId = (listed, name, route) => Effect.map(only(listed.filter((entry) => entry.name === name), route), ({ id }) => id);
+const valued = (fields) => fields.flatMap(({ label, value }) => value === undefined ? [] : [{ label, value }]);
+const fieldRoute = (wanted) => `field ${wanted.vault}/${wanted.item}/${wanted.field}`;
+const fieldPatches = (wanted, fields) => Effect.forEach(Object.entries(wanted.fields), ([label, value]) => {
+    const [first, ...others] = fields.filter((field) => field.label === label);
+    if (first === undefined) {
+        return Effect.succeed({ op: "add", label, value });
+    }
+    return others.length === 0
+        ? Effect.succeed({ op: "replace", fieldId: first.id, value })
+        : Effect.fail(refused(fieldRoute({ ...wanted, field: label }), AMBIGUOUS));
+});
+const keptOnSuccess = (exit) => Exit.isSuccess(exit) ? Duration.infinity : Duration.zero;
+export const make = (url = CONNECT_URL) => Effect.gen(function* makeSecrets() {
+    const client = yield* HttpClient.HttpClient;
+    const token = yield* Effect.cachedWithTTL(yield* ConnectToken, keptOnSuccess);
+    const routes = connectRoutes(client, url, token);
+    const vaults = yield* Effect.cachedWithTTL(routes.vaults, keptOnSuccess);
+    const items = yield* Cache.makeWith(routes.items, {
+        capacity: VAULT_CAPACITY,
+        timeToLive: keptOnSuccess,
+    });
+    const vaultId = (wanted) => Effect.flatMap(vaults, (listed) => onlyId(listed, wanted.vault, `vault ${wanted.vault}`));
+    const itemRoute = (wanted) => `item ${wanted.vault}/${wanted.item}`;
+    const itemFields = (wanted) => Effect.gen(function* itemFields() {
+        const inVault = yield* vaultId(wanted);
+        const itemId = yield* onlyId(yield* Cache.get(items, inVault), wanted.item, itemRoute(wanted));
+        return yield* routes.fields(inVault, itemId);
+    });
+    const redacted = (wanted, value) => Redacted.make(value, {
+        label: `${wanted.vault}/${wanted.item}/${wanted.field}`,
+    });
+    const readItem = Effect.fn("Secrets.readItem")(function* readItem(wanted) {
+        const fields = valued(yield* itemFields(wanted));
+        const repeated = fields.find(({ label }, index) => fields.findIndex((other) => other.label === label) !== index);
+        if (repeated !== undefined) {
+            return yield* refused(fieldRoute({ ...wanted, field: repeated.label }), AMBIGUOUS);
+        }
+        return Object.fromEntries(fields.map(({ label, value }) => [
+            label,
+            redacted({ ...wanted, field: label }, value),
+        ]));
+    });
+    const read = Effect.fn("Secrets.read")(function* read(wanted) {
+        const { value } = yield* only(valued(yield* itemFields(wanted)).filter(({ label }) => label === wanted.field), fieldRoute(wanted));
+        return value === ""
+            ? yield* refused(fieldRoute(wanted), NOT_FOUND)
+            : redacted(wanted, value);
+    });
+    const writeIn = (inVault, wanted) => Effect.gen(function* writeIn() {
+        const [first, ...others] = (yield* routes.items(inVault)).filter(({ name }) => name === wanted.item);
+        if (first === undefined) {
+            yield* routes.create(inVault, wanted.item, Object.entries(wanted.fields).map(([label, value]) => ({
+                label,
+                value,
+            })));
+            return "created";
+        }
+        if (others.length > 0) {
+            return yield* refused(itemRoute(wanted), AMBIGUOUS);
+        }
+        const patches = yield* fieldPatches(wanted, yield* routes.fields(inVault, first.id));
+        yield* routes.patch(inVault, first.id, patches);
+        return "updated";
+    });
+    const write = Effect.fn("Secrets.write")(function* write(wanted) {
+        const inVault = yield* vaultId(wanted);
+        return yield* Effect.ensuring(writeIn(inVault, wanted), Cache.invalidate(items, inVault));
+    });
+    return Secrets.of({ read, readItem, write });
+});
+export const layer = (url = CONNECT_URL) => Layer.effect(Secrets, make(url));
+export const keychainToken = (service) => Layer.succeed(ConnectToken, readKeychainToken(service));
+export const live = (repo, { token = keychainService(repo), url = CONNECT_URL, } = {}) => layer(url).pipe(Layer.provide([keychainToken(token), FetchHttpClient.layer]));

package/dist/keychain.d.ts

@@ -0,0 +1,6 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+export declare const SECURITY_FRAMEWORK = "/System/Library/Frameworks/Security.framework/Security";
+export declare const KEYCHAIN_ACCOUNT = "connect";
+export declare const keychainService: (repo: string) => string;
+export declare const readKeychainToken: (service: string) => Effect.Effect<Redacted.Redacted<string>, import("./refused.ts").ConnectRefused, never>;

package/dist/keychain.js

@@ -0,0 +1,58 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { KEYCHAIN_MISSING, NEEDS_BUN, refused } from "./refused.js";
+export const SECURITY_FRAMEWORK = "/System/Library/Frameworks/Security.framework/Security";
+export const KEYCHAIN_ACCOUNT = "connect";
+export const keychainService = (repo) => `${repo}-connect-read`;
+const security = (route) => Effect.tryPromise({
+    try: () => import("bun:ffi"),
+    catch: () => refused(route, NEEDS_BUN),
+}).pipe(Effect.flatMap((ffi) => Effect.acquireRelease(Effect.try({
+    try: () => ({
+        ffi,
+        library: ffi.dlopen(SECURITY_FRAMEWORK, {
+            SecKeychainFindGenericPassword: {
+                args: [
+                    ffi.FFIType.ptr,
+                    ffi.FFIType.u32,
+                    ffi.FFIType.ptr,
+                    ffi.FFIType.u32,
+                    ffi.FFIType.ptr,
+                    ffi.FFIType.ptr,
+                    ffi.FFIType.ptr,
+                    ffi.FFIType.ptr,
+                ],
+                returns: ffi.FFIType.i32,
+            },
+            SecKeychainItemFreeContent: {
+                args: [ffi.FFIType.ptr, ffi.FFIType.ptr],
+                returns: ffi.FFIType.i32,
+            },
+        }),
+    }),
+    catch: () => refused(route, NEEDS_BUN),
+}), ({ library }) => Effect.sync(() => library.close()))));
+export const readKeychainToken = Effect.fn("Keychain.readToken")(function* readToken(service) {
+    const route = `keychain ${service}`;
+    const { ffi, library } = yield* security(route);
+    const serviceName = new TextEncoder().encode(service);
+    const accountName = new TextEncoder().encode(KEYCHAIN_ACCOUNT);
+    const length = new Uint32Array(1);
+    const data = new BigUint64Array(1);
+    const status = library.symbols.SecKeychainFindGenericPassword(null, serviceName.length, ffi.ptr(serviceName), accountName.length, ffi.ptr(accountName), ffi.ptr(length), ffi.ptr(data), null);
+    if (status !== 0) {
+        return yield* refused(route, status);
+    }
+    const address = ffi.read.ptr(ffi.ptr(data), 0);
+    const [size = 0] = length;
+    const copied = () => {
+        const bytes = new Uint8Array(ffi.toArrayBuffer(address, 0, size));
+        const text = new TextDecoder().decode(bytes).trim();
+        bytes.fill(0);
+        return text;
+    };
+    const token = yield* Effect.ensuring(Effect.sync(() => (size === 0 ? "" : copied())), Effect.sync(() => library.symbols.SecKeychainItemFreeContent(null, address)));
+    return token === ""
+        ? yield* refused(route, KEYCHAIN_MISSING)
+        : Redacted.make(token, { label: service });
+}, Effect.scoped);

package/dist/refused.d.ts

@@ -0,0 +1,16 @@
+import * as Schema from "effect/Schema";
+export declare const NO_ANSWER = 0;
+export declare const NOT_FOUND = 404;
+export declare const AMBIGUOUS = 409;
+export declare const NEEDS_BUN = -4;
+export declare const KEYCHAIN_DENIED = -128;
+export declare const KEYCHAIN_MISSING = -25300;
+declare const ConnectRefused_base: Schema.Class<ConnectRefused, Schema.TaggedStruct<"ConnectRefused", {
+    readonly route: Schema.String;
+    readonly status: Schema.Number;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConnectRefused extends ConnectRefused_base {
+}
+export declare const refused: (route: string, status: number) => ConnectRefused;
+export {};

package/dist/refused.js

@@ -0,0 +1,35 @@
+import * as Schema from "effect/Schema";
+export const NO_ANSWER = 0;
+export const NOT_FOUND = 404;
+export const AMBIGUOUS = 409;
+export const NEEDS_BUN = -4;
+export const KEYCHAIN_DENIED = -128;
+export const KEYCHAIN_MISSING = -25_300;
+const MEANINGS = {
+    [NO_ANSWER]: "no answer from Connect",
+    200: "an answer Connect does not send",
+    401: "the token was refused",
+    403: "the door refused it, or Connect did for the token's access",
+    [NOT_FOUND]: "not found",
+    [AMBIGUOUS]: "more than one entry has this name",
+    429: "over the door's 60 calls a minute",
+    [NEEDS_BUN]: "reading the Keychain needs bun on macOS",
+    [KEYCHAIN_DENIED]: "the Keychain prompt was denied",
+    [KEYCHAIN_MISSING]: "no token in the Keychain",
+};
+export class ConnectRefused extends Schema.TaggedError()("ConnectRefused", {
+    route: Schema.String,
+    status: Schema.Number,
+    message: Schema.String,
+}) {
+}
+export const refused = (route, status) => {
+    const meaning = MEANINGS[status];
+    return new ConnectRefused({
+        route,
+        status,
+        message: meaning === undefined
+            ? `${route} failed with status ${status}`
+            : `${route} failed with status ${status}: ${meaning}`,
+    });
+};

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@milkenjoyer/secrets-client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "The one 1Password Connect client for birbprophet's repos",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/birbprophet/secrets.git",
+    "directory": "client"
+  },
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json",
+    "prepack": "bun run build"
+  },
+  "dependencies": {
+    "@distilled.cloud/core": "1.0.0-rc.18",
+    "@distilled.cloud/onepassword": "1.0.0-rc.18"
+  },
+  "peerDependencies": {
+    "effect": "^4.1.0"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "4.1.0",
+    "@effect/vitest": "4.1.0",
+    "@types/bun": "1.3.1",
+    "effect": "4.1.0",
+    "typescript": "6.0.3"
+  }
+}