@opengeni/contracts 3.1.2 → 3.2.2

package/dist/chunk-C6HESWDB.js

@@ -0,0 +1,1384 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/vault-provider-wire.ts
+import { z as z3 } from "zod";
+
+// src/vaults.ts
+import { z as z2 } from "zod";
+
+// src/secret-generator.ts
+import { z } from "zod";
+var SECRET_GENERATOR_DEFAULT_SYMBOLS = "!#%+-.:=?@_";
+var SECRET_GENERATOR_AMBIGUOUS_CHARACTERS = "0O1lI|";
+var LOWERCASE = "abcdefghijklmnopqrstuvwxyz";
+var UPPERCASE = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var DIGITS = "0123456789";
+function isPrintableAscii(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 33 || code > 126) return false;
+  }
+  return true;
+}
+var GeneratePasswordSpec = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    length: z.number().int().min(8).max(128).default(24),
+    lowercase: z.boolean().default(true),
+    uppercase: z.boolean().default(true),
+    digits: z.boolean().default(true),
+    symbols: z.boolean().default(true),
+    // No quotes, $, `, \, braces, /, &, ; or | by default: generated values
+    // stay safe to paste into shells, URLs and config files.
+    symbolSet: z.string().min(1).max(64).refine(isPrintableAscii, "symbolSet must be printable ASCII without spaces").default(SECRET_GENERATOR_DEFAULT_SYMBOLS),
+    excludeAmbiguous: z.boolean().default(true),
+    requireEachClass: z.boolean().default(true)
+  }).strict().refine(
+    (spec) => spec.lowercase || spec.uppercase || spec.digits || spec.symbols,
+    "at least one character class must be enabled"
+  )
+);
+var PasswordGeneratorError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PasswordGeneratorError";
+  }
+};
+function defaultRandom(n) {
+  const bytes = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function uniqueCharacters(value) {
+  return [...new Set(value)].join("");
+}
+function passwordCharacterClasses(spec) {
+  const ambiguous = spec.excludeAmbiguous ? new Set(SECRET_GENERATOR_AMBIGUOUS_CHARACTERS) : null;
+  const strip = (alphabet) => uniqueCharacters(alphabet).split("").filter((character) => !ambiguous?.has(character)).join("");
+  const classes = [];
+  if (spec.lowercase) classes.push(strip(LOWERCASE));
+  if (spec.uppercase) classes.push(strip(UPPERCASE));
+  if (spec.digits) classes.push(strip(DIGITS));
+  if (spec.symbols) classes.push(strip(spec.symbolSet));
+  return classes.filter((characters) => characters.length > 0);
+}
+function uniformIndexes(count, size, random) {
+  if (size < 1 || size > 256) throw new PasswordGeneratorError("alphabet size out of range");
+  const limit = 256 - 256 % size;
+  const out = [];
+  let guard = 0;
+  while (out.length < count) {
+    const bytes = random(Math.max(16, (count - out.length) * 2));
+    for (const byte of bytes) {
+      if (byte < limit) out.push(byte % size);
+      if (out.length === count) break;
+    }
+    guard += 1;
+    if (guard > 1e4) throw new PasswordGeneratorError("random source is not producing entropy");
+  }
+  return out;
+}
+function generatePassword(spec, random = defaultRandom) {
+  const parsed = GeneratePasswordSpec.parse(spec ?? {});
+  const classes = passwordCharacterClasses(parsed);
+  if (classes.length === 0) throw new PasswordGeneratorError("no characters available");
+  const alphabet = uniqueCharacters(classes.join(""));
+  const requireClasses = parsed.requireEachClass ? classes : [];
+  if (requireClasses.length > parsed.length) {
+    throw new PasswordGeneratorError("length is shorter than the number of required classes");
+  }
+  for (let attempt = 0; attempt < 1e3; attempt += 1) {
+    const password = uniformIndexes(parsed.length, alphabet.length, random).map((index) => alphabet[index]).join("");
+    if (requireClasses.every((characters) => [...password].some((c) => characters.includes(c)))) {
+      return password;
+    }
+  }
+  throw new PasswordGeneratorError("could not satisfy the character class requirements");
+}
+function passwordStrength(password) {
+  let pool = 0;
+  if (/[a-z]/.test(password)) pool += 26;
+  if (/[A-Z]/.test(password)) pool += 26;
+  if (/[0-9]/.test(password)) pool += 10;
+  if (/[^a-zA-Z0-9]/.test(password)) pool += 33;
+  const length = [...password].length;
+  const bits = pool === 0 ? 0 : Math.round(length * Math.log2(pool) * 10) / 10;
+  const label = bits < 40 ? "weak" : bits < 60 ? "fair" : bits < 100 ? "strong" : "very_strong";
+  return { bits, label };
+}
+
+// src/vaults.ts
+var VaultOwnerKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["user", "workspace", "organization", "task"])
+);
+var VaultSource = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["opengeni", "onepassword", "host", "external", "protonpass", "keeper", "bitwarden"])
+);
+var VaultMode = /* @__PURE__ */ defineSchema(() => z2.enum(["read_write", "read_only"]));
+var VaultSyncStatus = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["ok", "syncing", "error", "auth_expired", "rate_limited"])
+);
+var VaultItemType = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["login", "api_key", "note", "file", "passkey"])
+);
+var VaultFieldKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["text", "concealed", "totp", "file"])
+);
+var VaultProviderOperations = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    createItemTypes: z2.array(VaultItemType).max(5),
+    updateItem: z2.boolean(),
+    removeField: z2.boolean(),
+    archiveItem: z2.boolean(),
+    archiveKind: z2.enum(["archive", "trash", "none"]),
+    /** Permanent provider deletion is deliberately not exposed. */
+    deleteItem: z2.literal(false),
+    restoreItem: z2.boolean(),
+    readFiles: z2.boolean(),
+    writeFiles: z2.boolean(),
+    createTotp: z2.boolean(),
+    updateTotp: z2.boolean(),
+    createVault: z2.boolean(),
+    restoreFieldHistory: z2.boolean()
+  }).strict()
+);
+var VaultProviderFreshness = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    state: z2.enum(["current", "stale", "refreshing", "unavailable"]),
+    lastCheckedAt: z2.string().datetime().nullable(),
+    sourceSyncedAt: z2.string().datetime().nullable(),
+    source: z2.enum(["live", "cache", "unknown"]),
+    errorCode: z2.string().max(100).nullable(),
+    retryAt: z2.string().datetime().nullable()
+  }).strict()
+);
+var VAULT_LOOKUP_TIERS = ["task", "user", "workspace", "organization"];
+var VAULT_LIMITS = {
+  vaultsPerOwnerScope: 200,
+  itemsPerVault: 2e3,
+  fieldsPerItem: 50,
+  versionsPerField: 10,
+  nameMaxChars: 120,
+  descriptionMaxChars: 2e3,
+  websitesPerItem: 20,
+  websiteMaxChars: 2048,
+  textValueMaxBytes: 65536,
+  fileValueMaxBytes: 262144,
+  referenceMaxChars: 300,
+  execEnvMaxBytes: 262144,
+  execValueMaxBytes: 102400,
+  policyVaultIdsMax: 200,
+  searchResultsMax: 50,
+  /** Items one agent search call examines before it returns a cursor. */
+  searchScanMax: 1e3,
+  searchCursorMaxChars: 1024,
+  providerReadsPerAttempt: 50,
+  providerValueCacheMs: 6e4
+};
+var DEFAULT_VAULT_NAMES = {
+  user: "Private",
+  workspace: "Shared",
+  task: "Task"
+};
+var VAULT_DEFAULT_PRIMARY_FIELD = {
+  login: "password",
+  api_key: "value",
+  note: "note",
+  file: "file",
+  passkey: null
+};
+var PASSKEY_FIELD_NAMES = [
+  "rpId",
+  "credentialId",
+  "userHandle",
+  "userName",
+  "privateKey"
+];
+var FORBIDDEN_NAME_CHARACTERS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/;
+function isValidSecretName(name) {
+  if (typeof name !== "string") return false;
+  const length = [...name].length;
+  if (length < 1 || length > VAULT_LIMITS.nameMaxChars) return false;
+  if (FORBIDDEN_NAME_CHARACTERS.test(name)) return false;
+  if (name.trim() !== name) return false;
+  if (name.toLowerCase().startsWith("id:")) return false;
+  return true;
+}
+function isReservedVaultFieldName(name) {
+  return name.normalize("NFC").trim().toLowerCase() === "otp";
+}
+var VaultName = /* @__PURE__ */ defineSchema(
+  () => z2.string().min(1).max(VAULT_LIMITS.nameMaxChars).refine(isValidSecretName, "invalid_secret_name")
+);
+var VaultFieldName = /* @__PURE__ */ defineSchema(
+  () => VaultName.refine((name) => !isReservedVaultFieldName(name), "invalid_secret_name")
+);
+var VaultPolicy = /* @__PURE__ */ defineSchema(
+  () => z2.discriminatedUnion("mode", [
+    z2.object({ mode: z2.literal("all") }).strict(),
+    z2.object({
+      mode: z2.literal("selected"),
+      vaultIds: z2.array(z2.string().uuid()).max(VAULT_LIMITS.policyVaultIdsMax)
+    }).strict()
+  ])
+);
+var VAULT_POLICY_ALL = Object.freeze({ mode: "all" });
+function intersectVaultPolicies(a, b) {
+  if (a.mode === "all")
+    return b.mode === "all" ? VAULT_POLICY_ALL : { mode: "selected", vaultIds: [...b.vaultIds] };
+  if (b.mode === "all") return { mode: "selected", vaultIds: [...a.vaultIds] };
+  const allowed = new Set(b.vaultIds);
+  return { mode: "selected", vaultIds: a.vaultIds.filter((id) => allowed.has(id)) };
+}
+var VaultAvailability = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    allowedWorkspaceIds: z2.array(z2.string().uuid()).max(500).nullable(),
+    // null = every workspace
+    allowPersonalWorkspaces: z2.boolean()
+  }).strict()
+);
+var VaultSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: z2.string().uuid(),
+    workspaceId: z2.string().uuid(),
+    ownerKind: VaultOwnerKind,
+    /** "Only me" | workspace name | organization name | "This task" */
+    ownerLabel: z2.string(),
+    rootSessionId: z2.string().uuid().nullable(),
+    name: z2.string(),
+    description: z2.string().nullable(),
+    source: VaultSource,
+    mode: VaultMode,
+    syncStatus: VaultSyncStatus,
+    syncErrorCode: z2.string().nullable(),
+    syncErrorMessage: z2.string().nullable(),
+    lastSyncedAt: z2.string().nullable(),
+    rateLimitedUntil: z2.string().nullable(),
+    providerConnectionId: z2.string().uuid().nullable(),
+    providerOperations: VaultProviderOperations.optional(),
+    freshness: VaultProviderFreshness.optional(),
+    /** Organization and Only-me vaults; null for workspace and task vaults. */
+    availability: VaultAvailability.nullable(),
+    isDefault: z2.boolean(),
+    itemCount: z2.number().int(),
+    canWrite: z2.boolean(),
+    canManage: z2.boolean(),
+    generation: z2.number().int(),
+    createdAt: z2.string(),
+    updatedAt: z2.string()
+  })
+);
+var VaultItemReferences = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    primary: z2.string().nullable(),
+    otp: z2.string().nullable(),
+    byField: z2.record(z2.string(), z2.string())
+  })
+);
+var VaultItemSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: z2.string().uuid(),
+    vaultId: z2.string().uuid(),
+    type: VaultItemType,
+    name: z2.string(),
+    websites: z2.array(z2.string()),
+    /** Value of a text field named "username". */
+    username: z2.string().nullable(),
+    hasTotp: z2.boolean(),
+    hasPasskey: z2.boolean(),
+    expiresAt: z2.string().nullable(),
+    archivedAt: z2.string().nullable(),
+    lastUsedAt: z2.string().nullable(),
+    updatedAt: z2.string(),
+    references: VaultItemReferences
+  })
+);
+var VaultItemField = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: z2.string().uuid(),
+    name: z2.string(),
+    kind: VaultFieldKind,
+    position: z2.number().int(),
+    /** null for provider fields */
+    currentVersion: z2.number().int().nullable(),
+    /** Plaintext ONLY for kind "text"; null otherwise. */
+    value: z2.string().nullable(),
+    fileName: z2.string().nullable(),
+    fileSize: z2.number().int().nullable(),
+    reference: z2.string(),
+    updatedAt: z2.string()
+  })
+);
+var PasskeySummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    rpId: z2.string(),
+    userName: z2.string().nullable(),
+    /** Last 8 characters of the credential ID. */
+    credentialIdSuffix: z2.string(),
+    signCount: z2.number().int(),
+    leasedUntil: z2.string().nullable(),
+    lastUsedAt: z2.string().nullable()
+  })
+);
+var VaultItem = /* @__PURE__ */ defineSchema(
+  () => VaultItemSummary.extend({
+    fields: z2.array(VaultItemField),
+    passkey: PasskeySummary.nullable(),
+    aliases: z2.array(z2.string()),
+    primaryFieldId: z2.string().uuid().nullable(),
+    createdBySubjectId: z2.string().nullable(),
+    createdAt: z2.string(),
+    generation: z2.number().int()
+  })
+);
+var VaultVersionCreatedByKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["human", "agent", "api_key", "migration", "provider", "system"])
+);
+var VaultFieldVersionMeta = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    version: z2.number().int(),
+    current: z2.boolean(),
+    createdAt: z2.string(),
+    createdByKind: VaultVersionCreatedByKind,
+    createdBySubjectId: z2.string().nullable()
+  })
+);
+var CreateVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    name: VaultName,
+    description: z2.string().max(VAULT_LIMITS.descriptionMaxChars).optional(),
+    ownerKind: z2.enum(["user", "workspace", "organization"]),
+    availability: VaultAvailability.optional()
+  }).strict()
+);
+var UpdateVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    expectedGeneration: z2.number().int(),
+    name: VaultName.optional(),
+    description: z2.string().max(VAULT_LIMITS.descriptionMaxChars).nullable().optional(),
+    availability: VaultAvailability.optional()
+  }).strict()
+);
+var DeleteVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ confirmName: z2.string().min(1) }).strict()
+);
+var VALUE_SOURCE_KEYS = [
+  "value",
+  "generate",
+  "fromReference",
+  "fileBase64",
+  "restoreVersion",
+  "remove"
+];
+function exactlyOneValueSource(input) {
+  return VALUE_SOURCE_KEYS.filter((key) => input[key] !== void 0).length === 1;
+}
+var VaultFieldInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    fieldId: z2.string().uuid().optional(),
+    name: VaultFieldName,
+    /** Default concealed; a field named "username" defaults to text. */
+    kind: VaultFieldKind.optional(),
+    value: z2.string().optional(),
+    generate: GeneratePasswordSpec.optional(),
+    fromReference: z2.string().max(VAULT_LIMITS.referenceMaxChars).optional(),
+    fileBase64: z2.string().optional(),
+    fileName: z2.string().max(255).optional(),
+    restoreVersion: z2.number().int().optional(),
+    remove: z2.literal(true).optional()
+  }).strict().refine(
+    exactlyOneValueSource,
+    "exactly one of value|generate|fromReference|fileBase64|restoreVersion|remove"
+  )
+);
+var CreateVaultItemShape = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    type: VaultItemType,
+    name: VaultName,
+    websites: z2.array(z2.string().max(VAULT_LIMITS.websiteMaxChars)).max(VAULT_LIMITS.websitesPerItem).optional(),
+    expiresAt: z2.string().datetime({ offset: true }).nullable().optional(),
+    fields: z2.array(VaultFieldInput).max(VAULT_LIMITS.fieldsPerItem),
+    primaryFieldName: z2.string().optional()
+  }).strict()
+);
+var CreateVaultItemRequest = CreateVaultItemShape;
+var UpdateVaultItemRequest = /* @__PURE__ */ defineSchema(
+  () => CreateVaultItemShape.partial().extend({ expectedGeneration: z2.number().int() }).strict()
+);
+var MoveVaultItemRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    targetVaultId: z2.string().uuid(),
+    mode: z2.enum(["move", "copy"]),
+    newName: VaultName.optional()
+  }).strict()
+);
+var RevealVaultFieldRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ version: z2.number().int().optional() }).strict()
+);
+var RevealVaultFieldResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    value: z2.string(),
+    encoding: z2.enum(["utf8", "base64"]),
+    version: z2.number().int().nullable(),
+    totp: z2.object({ code: z2.string(), periodSeconds: z2.number().int(), expiresAt: z2.string() }).nullable()
+  })
+);
+var RestoreVaultFieldVersionRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ version: z2.number().int().positive() }).strict()
+);
+var QueryBoolean = /* @__PURE__ */ defineSchema(
+  () => z2.preprocess(
+    (value) => value === "true" ? true : value === "false" ? false : value,
+    z2.boolean()
+  )
+);
+var QueryInt = /* @__PURE__ */ defineSchema(
+  () => z2.preprocess(
+    (value) => typeof value === "string" && /^\d+$/.test(value) ? Number(value) : value,
+    z2.number().int().min(1).max(200)
+  )
+);
+var ListVaultItemsQuery = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    q: z2.string().max(200).optional(),
+    type: VaultItemType.optional(),
+    includeArchived: QueryBoolean.optional(),
+    cursor: z2.string().optional(),
+    limit: QueryInt.optional()
+  })
+);
+var ListVaultsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({ vaults: z2.array(VaultSummary) })
+);
+var ListVaultItemsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    items: z2.array(VaultItemSummary),
+    nextCursor: z2.string().nullable()
+  })
+);
+var ListVaultFieldVersionsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    versions: z2.array(VaultFieldVersionMeta)
+  })
+);
+var SetSessionVaultPolicyRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ policy: VaultPolicy }).strict()
+);
+var SessionSecretsView = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    capabilityEnabled: z2.boolean(),
+    policy: VaultPolicy,
+    effectiveVaultIds: z2.array(z2.string().uuid()),
+    /** Nearest ancestor that narrowed, if any. */
+    narrowedBySessionId: z2.string().uuid().nullable(),
+    taskVault: VaultSummary.nullable(),
+    taskItems: z2.array(VaultItemSummary),
+    reachableVaults: z2.array(
+      VaultSummary.extend({ selected: z2.boolean(), selectable: z2.boolean() })
+    )
+  })
+);
+var InstallOnePasswordRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    // Real service-account tokens are long; the dev fakes (ops_fake_healthy) are 16 chars.
+    token: z2.string().trim().min(16).max(4096),
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    planTier: z2.enum(["family", "teams", "business"]).default("teams"),
+    label: z2.string().max(120).optional()
+  }).strict()
+);
+var ProviderVaultMeta = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    externalVaultId: z2.string(),
+    name: z2.string(),
+    itemCount: z2.number().int().nullable(),
+    linkedVaultId: z2.string().uuid().nullable(),
+    /** Unknown means the provider does not expose the grant; writes still check upstream. */
+    writeAccess: z2.enum(["read_only", "read_write", "unknown"]).optional(),
+    operations: VaultProviderOperations.optional()
+  })
+);
+var InstallOnePasswordResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connectionId: z2.string().uuid(),
+    accountName: z2.string().nullable(),
+    vaults: z2.array(ProviderVaultMeta)
+  })
+);
+var OnePasswordConnectionSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: z2.string().uuid(),
+    /** Who can use the vaults linked through it. */
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    /** Sign-in host from the token, for example "my.1password.com". */
+    accountName: z2.string().nullable(),
+    label: z2.string().nullable(),
+    planTier: z2.enum(["family", "teams", "business"]),
+    /** When the current token was last checked against 1Password. */
+    verifiedAt: z2.string(),
+    createdAt: z2.string(),
+    createdBySubjectId: z2.string().nullable(),
+    /** The caller can link vaults, replace the token and disconnect it. */
+    canManage: z2.boolean()
+  })
+);
+var ListOnePasswordConnectionsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connections: z2.array(OnePasswordConnectionSummary)
+  })
+);
+var ReplaceOnePasswordTokenRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    token: z2.string().trim().min(16).max(4096),
+    planTier: z2.enum(["family", "teams", "business"]).optional()
+  }).strict()
+);
+var DisconnectOnePasswordResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    /** The Opengeni vaults that were unlinked. Nothing is deleted in 1Password. */
+    unlinkedVaultIds: z2.array(z2.string().uuid())
+  })
+);
+var ExternalVaultProviderKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["external", "protonpass", "keeper", "bitwarden"])
+);
+var VaultProviderCredentials = /* @__PURE__ */ defineSchema(
+  () => z2.discriminatedUnion("provider", [
+    z2.object({
+      provider: z2.literal("external"),
+      endpoint: z2.string().url().max(2048),
+      signingSecret: z2.string().min(32).max(4096)
+    }).strict(),
+    z2.object({
+      provider: z2.literal("bitwarden"),
+      endpoint: z2.string().url().max(2048),
+      signingSecret: z2.string().min(32).max(4096)
+    }).strict(),
+    z2.object({
+      provider: z2.literal("protonpass"),
+      token: z2.string().min(16).max(4096)
+    }).strict(),
+    z2.object({
+      provider: z2.literal("keeper"),
+      oneTimeToken: z2.string().min(16).max(4096),
+      /** Optional region host for tokens that do not encode one. */
+      hostname: z2.string().max(253).optional()
+    }).strict()
+  ])
+);
+var InstallVaultProviderRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    credentials: VaultProviderCredentials,
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    label: z2.string().trim().min(1).max(120).optional()
+  }).strict()
+);
+var ReplaceVaultProviderCredentialsRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ credentials: VaultProviderCredentials }).strict()
+);
+var VaultProviderConnectionSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: z2.string().uuid(),
+    provider: z2.enum(["onepassword", "external", "protonpass", "keeper", "bitwarden"]),
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    accountName: z2.string().nullable(),
+    label: z2.string().nullable(),
+    verifiedAt: z2.string(),
+    createdAt: z2.string(),
+    createdBySubjectId: z2.string().nullable(),
+    canManage: z2.boolean(),
+    operations: VaultProviderOperations,
+    /** Only 1Password uses a plan tier. */
+    planTier: z2.enum(["family", "teams", "business"]).optional(),
+    /** Unavailable means this deployment cannot run the adapter, not bad credentials. */
+    available: z2.boolean(),
+    /** Setup material is saved, but provider verification has not completed. */
+    verificationStatus: z2.enum(["ready", "pending"]).optional()
+  })
+);
+var VaultProviderAvailability = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    provider: VaultProviderConnectionSummary.shape.provider,
+    available: z2.boolean(),
+    reason: z2.enum(["not_enabled"]).nullable()
+  })
+);
+var ListVaultProviderConnectionsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connections: z2.array(VaultProviderConnectionSummary),
+    /** Additive: older servers may omit this metadata-only deployment catalog. */
+    providers: z2.array(VaultProviderAvailability).optional()
+  })
+);
+var InstallVaultProviderResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connectionId: z2.string().uuid(),
+    accountName: z2.string().nullable(),
+    provider: ExternalVaultProviderKind,
+    operations: VaultProviderOperations,
+    vaults: z2.array(ProviderVaultMeta),
+    /** Retry verification on this connection; never replay a consumed bootstrap token. */
+    discoveryPending: z2.boolean().optional(),
+    errorCode: z2.string().max(100).optional()
+  })
+);
+var DisconnectVaultProviderResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({ unlinkedVaultIds: z2.array(z2.string().uuid()) })
+);
+var LinkProviderVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    provider: z2.enum(["onepassword", "host", "external", "protonpass", "keeper", "bitwarden"]),
+    /** Required except for an in-process host provider. */
+    connectionId: z2.string().uuid().optional(),
+    externalVaultId: z2.string(),
+    ownerKind: z2.enum(["user", "workspace", "organization"]),
+    mode: VaultMode,
+    name: VaultName.optional(),
+    availability: VaultAvailability.optional()
+  }).strict()
+);
+var CreateManagedProviderVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    name: VaultName,
+    ownerKind: z2.enum(["user", "workspace", "organization"]),
+    groupId: z2.string().optional()
+  }).strict()
+);
+var VaultErrorCode = /* @__PURE__ */ defineSchema(
+  () => z2.enum([
+    "vault_not_found",
+    "vault_item_not_found",
+    "vault_field_not_found",
+    "vault_name_conflict",
+    "vault_item_name_conflict",
+    "vault_limit_reached",
+    "vault_read_only",
+    "vault_generation_conflict",
+    "vault_permission_denied",
+    /** A session's vault policy reaches outside its parent's effective vaults (AX-2). */
+    "vault_policy_outside_parent",
+    "vault_reveal_requires_human",
+    "encryption_key_missing",
+    "provider_auth_invalid",
+    "provider_auth_expired",
+    "provider_rate_limited",
+    "provider_unavailable",
+    "provider_conflict",
+    "provider_locked",
+    "provider_inventory_incomplete",
+    "provider_outcome_unknown",
+    "variable_sets_removed",
+    "secret_save_forbidden",
+    "invalid_secret_name",
+    "secret_value_too_large",
+    "human_auth_required",
+    "secret_search_cursor_invalid"
+  ])
+);
+var VaultApiError = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    error: VaultErrorCode,
+    message: z2.string(),
+    details: z2.record(z2.string(), z2.unknown()).optional()
+  })
+);
+var VAULT_ERROR_HTTP_STATUS = {
+  vault_not_found: 404,
+  vault_item_not_found: 404,
+  vault_field_not_found: 404,
+  vault_name_conflict: 409,
+  vault_item_name_conflict: 409,
+  vault_generation_conflict: 409,
+  provider_conflict: 409,
+  vault_limit_reached: 422,
+  invalid_secret_name: 422,
+  secret_value_too_large: 422,
+  secret_save_forbidden: 422,
+  secret_search_cursor_invalid: 422,
+  vault_policy_outside_parent: 422,
+  vault_read_only: 403,
+  vault_permission_denied: 403,
+  vault_reveal_requires_human: 403,
+  human_auth_required: 403,
+  variable_sets_removed: 410,
+  encryption_key_missing: 503,
+  provider_unavailable: 503,
+  provider_rate_limited: 429,
+  provider_auth_invalid: 401,
+  provider_auth_expired: 401,
+  provider_locked: 423,
+  provider_inventory_incomplete: 503,
+  provider_outcome_unknown: 503
+};
+var SECRET_TOOL_NAMES = [
+  "secret_search",
+  "secret_save",
+  "secret_get",
+  "secret_move",
+  "secret_delete"
+];
+var SECRET_SAVE_TO = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["user", "task", "workspace"])
+);
+var SecretSearchInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    query: z2.string().max(200).optional(),
+    website: z2.string().max(VAULT_LIMITS.websiteMaxChars).optional(),
+    type: VaultItemType.optional(),
+    /** Vault name or ID. */
+    vault: z2.string().max(200).optional(),
+    limit: z2.number().int().min(1).max(VAULT_LIMITS.searchResultsMax).default(20),
+    /** `nextCursor` from the previous call with the same filters. */
+    cursor: z2.string().max(VAULT_LIMITS.searchCursorMaxChars).optional(),
+    /** Refresh provider metadata and subsequent value reads; never bypass rate limits. */
+    refresh: z2.boolean().optional()
+  }).strict()
+);
+var SecretSearchResult = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    vault: z2.object({
+      id: z2.string().uuid(),
+      name: z2.string(),
+      ownerKind: VaultOwnerKind,
+      source: VaultSource,
+      mode: VaultMode
+    }),
+    item: z2.object({
+      id: z2.string().uuid(),
+      name: z2.string(),
+      type: VaultItemType,
+      websites: z2.array(z2.string()),
+      username: z2.string().nullable(),
+      hasTotp: z2.boolean(),
+      hasPasskey: z2.boolean(),
+      expiresAt: z2.string().nullable()
+    }),
+    fields: z2.array(z2.object({ name: z2.string(), kind: VaultFieldKind })),
+    references: VaultItemReferences
+  })
+);
+var SecretSearchVault = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: z2.string().uuid(),
+    name: z2.string(),
+    ownerKind: VaultOwnerKind,
+    source: VaultSource,
+    mode: VaultMode,
+    itemCount: z2.number().int().nonnegative(),
+    freshness: VaultProviderFreshness.optional()
+  })
+);
+var SecretSearchOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    items: z2.array(SecretSearchResult),
+    /** True when more matches remain; pass `nextCursor` to continue. */
+    truncated: z2.boolean(),
+    nextCursor: z2.string().nullable(),
+    /** Every vault the caller can reach, on the first page only. */
+    vaults: z2.array(SecretSearchVault).optional(),
+    /** False when a reachable provider could not be checked; empty items are not proof of absence. */
+    complete: z2.boolean().optional(),
+    /** Included on every page so failures are not lost after page one. */
+    sources: z2.array(
+      z2.object({
+        vaultId: z2.string().uuid(),
+        freshness: VaultProviderFreshness
+      })
+    ).optional()
+  })
+);
+var SecretSaveFieldInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    name: VaultFieldName,
+    kind: VaultFieldKind.optional(),
+    value: z2.string().optional(),
+    generate: GeneratePasswordSpec.optional(),
+    fromReference: z2.string().max(VAULT_LIMITS.referenceMaxChars).optional(),
+    restoreVersion: z2.number().int().optional()
+  }).strict().refine(exactlyOneValueSource, "exactly one of value|generate|fromReference|restoreVersion")
+);
+var SecretSaveInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    item: VaultName,
+    /** Vault name or ID; defaults to the saveTo scope's default vault. */
+    vault: z2.string().max(200).optional(),
+    saveTo: SECRET_SAVE_TO.optional(),
+    type: VaultItemType.default("login"),
+    websites: z2.array(z2.string().max(VAULT_LIMITS.websiteMaxChars)).max(VAULT_LIMITS.websitesPerItem).optional(),
+    username: z2.string().max(512).optional(),
+    fields: z2.array(SecretSaveFieldInput).max(VAULT_LIMITS.fieldsPerItem).optional(),
+    mode: z2.enum(["create", "update", "upsert"]).default("upsert")
+  }).strict()
+);
+var SecretSaveOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    item: VaultItemSummary,
+    references: VaultItemReferences,
+    generatedFields: z2.array(z2.string())
+  })
+);
+var SecretGetInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    reference: z2.string().min(1).max(VAULT_LIMITS.referenceMaxChars),
+    version: z2.number().int().optional()
+  }).strict()
+);
+var SecretGetOutput = RevealVaultFieldResponse;
+var SecretMoveInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    reference: z2.string().min(1).max(VAULT_LIMITS.referenceMaxChars),
+    /** Vault name or ID. */
+    toVault: z2.string().min(1).max(200),
+    mode: z2.enum(["move", "copy"]).default("move"),
+    newName: VaultName.optional()
+  }).strict()
+);
+var SecretMoveOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    item: VaultItemSummary,
+    references: VaultItemReferences
+  })
+);
+var SecretDeleteInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({ reference: z2.string().min(1).max(VAULT_LIMITS.referenceMaxChars) }).strict()
+);
+var SecretDeleteOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({ archived: z2.literal(true), restoreHint: z2.string() })
+);
+var VAULT_POLICY_UPDATED_EVENT_TYPE = "session.vaultPolicy.updated";
+var VAULT_AUDIT_ACTIONS = [
+  "vault.created",
+  "vault.updated",
+  "vault.deleted",
+  "vault.item.created",
+  "vault.item.updated",
+  "vault.item.archived",
+  "vault.item.restored",
+  "vault.item.deleted",
+  "vault.item.moved",
+  "vault.item.copied",
+  "vault.field.set",
+  "vault.field.revealed",
+  "vault.secret.used",
+  "vault.secret.read",
+  "vault.secret.read.denied",
+  "vault.reference.failed",
+  "vault.provider.connected",
+  "vault.provider.linked",
+  "vault.provider.synced",
+  "vault.provider.error",
+  "vault.passkey.registered",
+  "vault.passkey.asserted",
+  "vault.policy.updated",
+  "vault.migrated"
+];
+var VaultAuditAction = /* @__PURE__ */ defineSchema(() => z2.enum(VAULT_AUDIT_ACTIONS));
+var VAULT_AUDIT_TARGET_TYPES = ["vault", "vault_item"];
+var VAULT_METRIC_NAMES = {
+  resolutions: "opengeni_secret_resolutions_total",
+  resolutionDuration: "opengeni_secret_resolution_duration_seconds",
+  execEnvBytes: "opengeni_secret_exec_env_bytes",
+  providerCalls: "opengeni_vault_provider_calls_total",
+  providerRateLimited: "opengeni_vault_provider_rate_limited_total",
+  passkeyAssertions: "opengeni_passkey_assertions_total"
+};
+
+// src/vault-provider-wire.ts
+var VAULT_PROVIDER_WIRE_VERSION = "opengeni.vault.v1";
+var VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER = "OpenGeni-Vault-Response-Signature";
+function vaultProviderWireResponseKey(signingSecret) {
+  return `${signingSecret}\0${VAULT_PROVIDER_WIRE_VERSION}.response`;
+}
+var VAULT_PROVIDER_WIRE_LIMITS = {
+  maxRequestBytes: 4 * 1024 * 1024,
+  maxResponseBytes: 4 * 1024 * 1024,
+  /** Sum of returned secret value bytes in one read. */
+  maxReadValueBytes: 3 * 1024 * 1024,
+  pageSizeMax: 100,
+  cursorMaxChars: 1024,
+  snapshotMaxChars: 1024,
+  externalIdMaxChars: 300,
+  vaultNameMaxChars: 300,
+  nativeIdMaxChars: 200,
+  readFieldsMax: VAULT_LIMITS.fieldsPerItem,
+  idempotencyKeyMaxChars: 200,
+  accountIdMaxChars: 300,
+  accountNameMaxChars: 300,
+  versionMaxChars: 300,
+  cacheEpochMaxChars: 200,
+  /** Per request deadline enforced by Opengeni's transport. */
+  defaultTimeoutMs: 15e3,
+  maxTimeoutMs: 6e4,
+  /** Accepted request age; matches `OPENGENI_SIGNATURE_TOLERANCE_SECONDS`. */
+  signatureToleranceSeconds: 300
+};
+var VAULT_PROVIDER_WIRE_ERROR_CODES = [
+  "provider_auth_invalid",
+  "provider_auth_expired",
+  "provider_rate_limited",
+  "provider_unavailable",
+  "provider_conflict",
+  "provider_not_found",
+  "provider_permission_denied",
+  "provider_locked",
+  "provider_inventory_incomplete",
+  "provider_outcome_unknown"
+];
+var VAULT_PROVIDER_WIRE_OPERATIONS = [
+  "describe",
+  "refresh",
+  "list_vaults",
+  "list_items",
+  "read_fields",
+  "write_item",
+  "archive_item"
+];
+function isVaultProviderWireMutation(op) {
+  return op === "write_item" || op === "archive_item";
+}
+var VaultProviderWireProvider = /* @__PURE__ */ defineSchema(
+  () => z3.enum(["external", "bitwarden"])
+);
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/;
+var encoder = /* @__PURE__ */ new TextEncoder();
+function vaultProviderWireUtf8Bytes(value) {
+  return encoder.encode(value).byteLength;
+}
+function boundedText(max) {
+  return z3.string().min(1).max(max).refine((value) => !CONTROL_CHARACTERS.test(value), "control characters are not allowed");
+}
+var ExternalId = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.externalIdMaxChars)
+);
+var NativeId = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.nativeIdMaxChars)
+);
+var ItemName = /* @__PURE__ */ defineSchema(
+  () => z3.string().refine(isValidSecretName, "invalid_secret_name")
+);
+var FieldName = /* @__PURE__ */ defineSchema(
+  () => z3.string().refine(
+    (name) => isValidSecretName(name) && !isReservedVaultFieldName(name),
+    "invalid_secret_name"
+  )
+);
+var Website = /* @__PURE__ */ defineSchema(() => boundedText(VAULT_LIMITS.websiteMaxChars));
+var Version = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.versionMaxChars)
+);
+var Cursor = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.cursorMaxChars)
+);
+var Snapshot = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.snapshotMaxChars)
+);
+var IdempotencyKey = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.idempotencyKeyMaxChars)
+);
+var CacheEpoch = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.cacheEpochMaxChars).nullable()
+);
+function uniqueBy(values, key) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const k = key(value);
+    if (seen.has(k)) return false;
+    seen.add(k);
+  }
+  return true;
+}
+function vaultProviderWireNameKey(name) {
+  return name.normalize("NFC").trim().toLowerCase();
+}
+var VaultProviderWireAuthority = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    accountId: NativeId,
+    workspaceId: NativeId,
+    /** Null for workspace-level background work with no acting human. */
+    subjectId: NativeId.nullable(),
+    /** Workspace that owns the encrypted connection (may differ from the caller). */
+    connectionWorkspaceId: NativeId,
+    sessionId: NativeId.optional(),
+    turnId: NativeId.optional(),
+    attemptId: NativeId.optional(),
+    siteId: NativeId.optional()
+  }).strict()
+);
+var VaultProviderWirePage = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    limit: z3.number().int().min(1).max(VAULT_PROVIDER_WIRE_LIMITS.pageSizeMax),
+    cursor: Cursor.optional(),
+    snapshot: Snapshot.optional()
+  }).strict()
+);
+var VaultProviderWireWriteField = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    externalFieldId: ExternalId.optional(),
+    name: FieldName,
+    kind: VaultFieldKind,
+    /** Omitted on an update: keep the current value. */
+    value: z3.string().refine(
+      (value) => vaultProviderWireUtf8Bytes(value) <= VAULT_LIMITS.textValueMaxBytes,
+      "secret_value_too_large"
+    ).optional(),
+    remove: z3.literal(true).optional()
+  }).strict().refine((field) => !(field.remove && field.value !== void 0), "remove carries no value").refine((field) => !(field.remove && !field.externalFieldId), "remove needs a field id").refine(
+    (field) => !(field.kind === "file" && field.value !== void 0),
+    "file writes are not supported"
+  )
+);
+var VaultProviderWireWriteItem = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    externalItemId: ExternalId.optional(),
+    expectedVersion: Version.nullable().optional(),
+    name: ItemName,
+    type: VaultItemType.refine((type) => type !== "passkey", "passkeys are hosted only"),
+    websites: z3.array(Website).max(VAULT_LIMITS.websitesPerItem),
+    fields: z3.array(VaultProviderWireWriteField).max(VAULT_LIMITS.fieldsPerItem)
+  }).strict().refine(
+    (item) => uniqueBy(
+      item.fields.filter((field) => !field.remove),
+      (field) => vaultProviderWireNameKey(field.name)
+    ) && uniqueBy(
+      item.fields.filter((field) => field.externalFieldId !== void 0),
+      (field) => field.externalFieldId
+    ),
+    "duplicate fields"
+  )
+);
+var ReadContext = {
+  /** Recheck upstream; never bypasses authorization or upstream rate limits. */
+  forceRefresh: z3.boolean(),
+  /** Opengeni's mirror freshness epoch, for receiver-side cache invalidation. */
+  cacheEpoch: CacheEpoch
+};
+var VaultProviderWireOperation = /* @__PURE__ */ defineSchema(
+  () => z3.discriminatedUnion("op", [
+    z3.object({ op: z3.literal("describe") }).strict(),
+    z3.object({ op: z3.literal("refresh") }).strict(),
+    z3.object({ op: z3.literal("list_vaults"), page: VaultProviderWirePage, ...ReadContext }).strict(),
+    z3.object({
+      op: z3.literal("list_items"),
+      externalVaultId: ExternalId,
+      page: VaultProviderWirePage,
+      ...ReadContext
+    }).strict(),
+    z3.object({
+      op: z3.literal("read_fields"),
+      externalVaultId: ExternalId,
+      externalItemId: ExternalId,
+      externalFieldIds: z3.array(ExternalId).min(1).max(VAULT_PROVIDER_WIRE_LIMITS.readFieldsMax).refine((ids) => new Set(ids).size === ids.length, "duplicate field ids"),
+      ...ReadContext
+    }).strict(),
+    z3.object({
+      op: z3.literal("write_item"),
+      externalVaultId: ExternalId,
+      item: VaultProviderWireWriteItem,
+      idempotencyKey: IdempotencyKey
+    }).strict(),
+    z3.object({
+      op: z3.literal("archive_item"),
+      externalVaultId: ExternalId,
+      externalItemId: ExternalId,
+      idempotencyKey: IdempotencyKey
+    }).strict()
+  ])
+);
+var VaultProviderWireRequest = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    version: z3.literal(VAULT_PROVIDER_WIRE_VERSION),
+    type: z3.literal("request"),
+    requestId: z3.string().uuid(),
+    sentAt: z3.string().datetime(),
+    provider: VaultProviderWireProvider,
+    connectionId: z3.string().uuid(),
+    authority: VaultProviderWireAuthority,
+    operation: VaultProviderWireOperation
+  }).strict()
+);
+var VaultProviderWireErrorCode = /* @__PURE__ */ defineSchema(
+  () => z3.enum(VAULT_PROVIDER_WIRE_ERROR_CODES)
+);
+var VaultProviderWireFreshness = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    state: z3.enum(["current", "stale", "refreshing", "unavailable"]),
+    /** When the receiver last synchronized with its upstream store. */
+    sourceSyncedAt: z3.string().datetime().nullable(),
+    source: z3.enum(["live", "cache", "unknown"]),
+    errorCode: VaultProviderWireErrorCode.nullable(),
+    retryAt: z3.string().datetime().nullable()
+  }).strict()
+);
+var VaultProviderWireVault = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    externalVaultId: ExternalId,
+    name: boundedText(VAULT_PROVIDER_WIRE_LIMITS.vaultNameMaxChars),
+    contentVersion: Version.nullable(),
+    itemCount: z3.number().int().nonnegative().nullable(),
+    writeAccess: z3.enum(["read_only", "read_write", "unknown"]),
+    /** Narrows the connection operations for this vault; never widens them. */
+    operations: VaultProviderOperations.optional()
+  }).strict()
+);
+var VaultProviderWireFieldMeta = /* @__PURE__ */ defineSchema(
+  () => z3.object({ externalFieldId: ExternalId, name: FieldName, kind: VaultFieldKind }).strict()
+);
+var VaultProviderWireItemMeta = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    externalItemId: ExternalId,
+    name: ItemName,
+    type: VaultItemType,
+    websites: z3.array(Website).max(VAULT_LIMITS.websitesPerItem),
+    fields: z3.array(VaultProviderWireFieldMeta).max(VAULT_LIMITS.fieldsPerItem).refine(
+      (fields) => uniqueBy(fields, (field) => field.externalFieldId) && uniqueBy(fields, (field) => vaultProviderWireNameKey(field.name)),
+      "duplicate fields"
+    ),
+    version: Version.nullable(),
+    updatedAt: z3.string().datetime().nullable()
+  }).strict()
+);
+var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+var VaultProviderWireFieldValue = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    externalFieldId: ExternalId,
+    value: z3.discriminatedUnion("type", [
+      z3.object({
+        type: z3.literal("text"),
+        value: z3.string().refine(
+          (value) => vaultProviderWireUtf8Bytes(value) <= VAULT_LIMITS.textValueMaxBytes
+        )
+      }).strict(),
+      /** An `otpauth://` URI or Base32 seed; Opengeni computes codes at use. */
+      z3.object({ type: z3.literal("totp"), value: boundedText(VAULT_LIMITS.websiteMaxChars) }).strict(),
+      z3.object({
+        type: z3.literal("bytes"),
+        base64: z3.string().max(Math.ceil(VAULT_LIMITS.fileValueMaxBytes / 3) * 4).regex(BASE64)
+      }).strict()
+    ])
+  }).strict()
+);
+function valueBytes(field) {
+  if (field.value.type === "bytes") return Math.floor(field.value.base64.length * 3 / 4);
+  return vaultProviderWireUtf8Bytes(field.value.value);
+}
+var VaultProviderWireDescribeResult = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    /** Stable upstream account or bridge identity; reconnect rejects a change. */
+    accountId: boundedText(VAULT_PROVIDER_WIRE_LIMITS.accountIdMaxChars),
+    accountName: boundedText(VAULT_PROVIDER_WIRE_LIMITS.accountNameMaxChars).nullable(),
+    operations: VaultProviderOperations,
+    capabilities: z3.object({ totp: z3.boolean(), files: z3.boolean() }).strict(),
+    /** One fixed inventory per connection, independent of the acting subject. */
+    inventoryScope: z3.literal("connection")
+  }).strict()
+);
+function pageOf(item) {
+  return z3.object({
+    items: z3.array(item).max(VAULT_PROVIDER_WIRE_LIMITS.pageSizeMax),
+    nextCursor: Cursor.nullable(),
+    /** Null only when the receiver cannot supply snapshot consistency. */
+    snapshot: Snapshot.nullable()
+  }).strict();
+}
+var VaultProviderWireListVaultsResult = /* @__PURE__ */ defineSchema(
+  () => pageOf(VaultProviderWireVault)
+);
+var VaultProviderWireListItemsResult = /* @__PURE__ */ defineSchema(
+  () => pageOf(VaultProviderWireItemMeta)
+);
+var VaultProviderWireReadFieldsResult = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    fields: z3.array(VaultProviderWireFieldValue).max(VAULT_PROVIDER_WIRE_LIMITS.readFieldsMax).refine((fields) => uniqueBy(fields, (field) => field.externalFieldId), "duplicate fields").refine(
+      (fields) => fields.reduce((total, field) => total + valueBytes(field), 0) <= VAULT_PROVIDER_WIRE_LIMITS.maxReadValueBytes,
+      "secret values too large"
+    )
+  }).strict()
+);
+var VaultProviderWireRefreshResult = /* @__PURE__ */ defineSchema(
+  () => z3.object({ refreshed: z3.literal(true) }).strict()
+);
+var VaultProviderWireWriteItemResult = /* @__PURE__ */ defineSchema(
+  () => z3.object({ item: VaultProviderWireItemMeta }).strict()
+);
+var VaultProviderWireArchiveItemResult = /* @__PURE__ */ defineSchema(
+  () => z3.object({ archived: z3.literal(true) }).strict()
+);
+var VaultProviderWireResults = {
+  describe: VaultProviderWireDescribeResult,
+  refresh: VaultProviderWireRefreshResult,
+  list_vaults: VaultProviderWireListVaultsResult,
+  list_items: VaultProviderWireListItemsResult,
+  read_fields: VaultProviderWireReadFieldsResult,
+  write_item: VaultProviderWireWriteItemResult,
+  archive_item: VaultProviderWireArchiveItemResult
+};
+var VaultProviderWireError = /* @__PURE__ */ defineSchema(
+  () => z3.object({
+    code: VaultProviderWireErrorCode,
+    retryAfterMs: z3.number().int().min(0).max(864e5).nullable()
+  }).strict()
+);
+var VaultProviderWireResponseEnvelope = /* @__PURE__ */ defineSchema(
+  () => z3.discriminatedUnion("ok", [
+    z3.object({
+      version: z3.literal(VAULT_PROVIDER_WIRE_VERSION),
+      type: z3.literal("response"),
+      requestId: z3.string().uuid(),
+      ok: z3.literal(true),
+      op: z3.enum(VAULT_PROVIDER_WIRE_OPERATIONS),
+      result: z3.unknown(),
+      freshness: VaultProviderWireFreshness.nullable()
+    }).strict(),
+    z3.object({
+      version: z3.literal(VAULT_PROVIDER_WIRE_VERSION),
+      type: z3.literal("response"),
+      requestId: z3.string().uuid(),
+      ok: z3.literal(false),
+      op: z3.enum(VAULT_PROVIDER_WIRE_OPERATIONS),
+      error: VaultProviderWireError,
+      freshness: VaultProviderWireFreshness.nullable()
+    }).strict()
+  ])
+);
+function parseVaultProviderWireResponse(value, expected) {
+  const envelope = VaultProviderWireResponseEnvelope.safeParse(value);
+  if (!envelope.success) return null;
+  const response = envelope.data;
+  if (response.requestId !== expected.requestId || response.op !== expected.op) return null;
+  if (!response.ok) return response;
+  const result = VaultProviderWireResults[expected.op].safeParse(response.result);
+  if (!result.success) return null;
+  return { ...response, op: expected.op, result: result.data };
+}
+
+export {
+  SECRET_GENERATOR_DEFAULT_SYMBOLS,
+  SECRET_GENERATOR_AMBIGUOUS_CHARACTERS,
+  GeneratePasswordSpec,
+  PasswordGeneratorError,
+  passwordCharacterClasses,
+  generatePassword,
+  passwordStrength,
+  VaultOwnerKind,
+  VaultSource,
+  VaultMode,
+  VaultSyncStatus,
+  VaultItemType,
+  VaultFieldKind,
+  VaultProviderOperations,
+  VaultProviderFreshness,
+  VAULT_LOOKUP_TIERS,
+  VAULT_LIMITS,
+  DEFAULT_VAULT_NAMES,
+  VAULT_DEFAULT_PRIMARY_FIELD,
+  PASSKEY_FIELD_NAMES,
+  isValidSecretName,
+  isReservedVaultFieldName,
+  VaultName,
+  VaultFieldName,
+  VaultPolicy,
+  VAULT_POLICY_ALL,
+  intersectVaultPolicies,
+  VaultAvailability,
+  VaultSummary,
+  VaultItemReferences,
+  VaultItemSummary,
+  VaultItemField,
+  PasskeySummary,
+  VaultItem,
+  VaultVersionCreatedByKind,
+  VaultFieldVersionMeta,
+  CreateVaultRequest,
+  UpdateVaultRequest,
+  DeleteVaultRequest,
+  exactlyOneValueSource,
+  VaultFieldInput,
+  CreateVaultItemRequest,
+  UpdateVaultItemRequest,
+  MoveVaultItemRequest,
+  RevealVaultFieldRequest,
+  RevealVaultFieldResponse,
+  RestoreVaultFieldVersionRequest,
+  ListVaultItemsQuery,
+  ListVaultsResponse,
+  ListVaultItemsResponse,
+  ListVaultFieldVersionsResponse,
+  SetSessionVaultPolicyRequest,
+  SessionSecretsView,
+  InstallOnePasswordRequest,
+  ProviderVaultMeta,
+  InstallOnePasswordResponse,
+  OnePasswordConnectionSummary,
+  ListOnePasswordConnectionsResponse,
+  ReplaceOnePasswordTokenRequest,
+  DisconnectOnePasswordResponse,
+  ExternalVaultProviderKind,
+  VaultProviderCredentials,
+  InstallVaultProviderRequest,
+  ReplaceVaultProviderCredentialsRequest,
+  VaultProviderConnectionSummary,
+  VaultProviderAvailability,
+  ListVaultProviderConnectionsResponse,
+  InstallVaultProviderResponse,
+  DisconnectVaultProviderResponse,
+  LinkProviderVaultRequest,
+  CreateManagedProviderVaultRequest,
+  VaultErrorCode,
+  VaultApiError,
+  VAULT_ERROR_HTTP_STATUS,
+  SECRET_TOOL_NAMES,
+  SECRET_SAVE_TO,
+  SecretSearchInput,
+  SecretSearchResult,
+  SecretSearchVault,
+  SecretSearchOutput,
+  SecretSaveFieldInput,
+  SecretSaveInput,
+  SecretSaveOutput,
+  SecretGetInput,
+  SecretGetOutput,
+  SecretMoveInput,
+  SecretMoveOutput,
+  SecretDeleteInput,
+  SecretDeleteOutput,
+  VAULT_POLICY_UPDATED_EVENT_TYPE,
+  VAULT_AUDIT_ACTIONS,
+  VaultAuditAction,
+  VAULT_AUDIT_TARGET_TYPES,
+  VAULT_METRIC_NAMES,
+  VAULT_PROVIDER_WIRE_VERSION,
+  VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER,
+  vaultProviderWireResponseKey,
+  VAULT_PROVIDER_WIRE_LIMITS,
+  VAULT_PROVIDER_WIRE_ERROR_CODES,
+  VAULT_PROVIDER_WIRE_OPERATIONS,
+  isVaultProviderWireMutation,
+  VaultProviderWireProvider,
+  vaultProviderWireUtf8Bytes,
+  vaultProviderWireNameKey,
+  VaultProviderWireAuthority,
+  VaultProviderWirePage,
+  VaultProviderWireWriteField,
+  VaultProviderWireWriteItem,
+  VaultProviderWireOperation,
+  VaultProviderWireRequest,
+  VaultProviderWireErrorCode,
+  VaultProviderWireFreshness,
+  VaultProviderWireVault,
+  VaultProviderWireFieldMeta,
+  VaultProviderWireItemMeta,
+  VaultProviderWireFieldValue,
+  VaultProviderWireDescribeResult,
+  VaultProviderWireListVaultsResult,
+  VaultProviderWireListItemsResult,
+  VaultProviderWireReadFieldsResult,
+  VaultProviderWireRefreshResult,
+  VaultProviderWireWriteItemResult,
+  VaultProviderWireArchiveItemResult,
+  VaultProviderWireResults,
+  VaultProviderWireError,
+  VaultProviderWireResponseEnvelope,
+  parseVaultProviderWireResponse
+};
+//# sourceMappingURL=chunk-C6HESWDB.js.map