@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/chunk-G4RKARXZ.js

@@ -0,0 +1,1167 @@
+import {
+  boolean,
+  nonEmptyString,
+  nonnegativeInteger,
+  nullableString,
+  nullableUuid,
+  optionalBoolean,
+  optionalUuid,
+  positiveInteger,
+  string,
+  uuid
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/secret-generator.ts
+import { z } from "zod";
+var SECRET_GENERATOR_DEFAULT_SYMBOLS = "!#%+-.:=?@_";
+var SECRET_GENERATOR_AMBIGUOUS_CHARACTERS = "0O1lI|";
+var LOWERCASE = "abcdefghijklmnopqrstuvwxyz";
+var UPPERCASE = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var DIGITS = "0123456789";
+function isPrintableAscii(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 33 || code > 126) return false;
+  }
+  return true;
+}
+var GeneratePasswordSpec = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    length: z.number().int().min(8).max(128).default(24),
+    lowercase: boolean.default(true),
+    uppercase: boolean.default(true),
+    digits: boolean.default(true),
+    symbols: boolean.default(true),
+    // No quotes, $, `, \, braces, /, &, ; or | by default: generated values
+    // stay safe to paste into shells, URLs and config files.
+    symbolSet: z.string().min(1).max(64).refine(isPrintableAscii, "symbolSet must be printable ASCII without spaces").default(SECRET_GENERATOR_DEFAULT_SYMBOLS),
+    excludeAmbiguous: boolean.default(true),
+    requireEachClass: boolean.default(true)
+  }).strict().refine(
+    (spec) => spec.lowercase || spec.uppercase || spec.digits || spec.symbols,
+    "at least one character class must be enabled"
+  )
+);
+var PasswordGeneratorError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PasswordGeneratorError";
+  }
+};
+function defaultRandom(n) {
+  const bytes = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function uniqueCharacters(value) {
+  return [...new Set(value)].join("");
+}
+function passwordCharacterClasses(spec) {
+  const ambiguous = spec.excludeAmbiguous ? new Set(SECRET_GENERATOR_AMBIGUOUS_CHARACTERS) : null;
+  const strip = (alphabet) => uniqueCharacters(alphabet).split("").filter((character) => !ambiguous?.has(character)).join("");
+  const classes = [];
+  if (spec.lowercase) classes.push(strip(LOWERCASE));
+  if (spec.uppercase) classes.push(strip(UPPERCASE));
+  if (spec.digits) classes.push(strip(DIGITS));
+  if (spec.symbols) classes.push(strip(spec.symbolSet));
+  return classes.filter((characters) => characters.length > 0);
+}
+function uniformIndexes(count, size, random) {
+  if (size < 1 || size > 256) throw new PasswordGeneratorError("alphabet size out of range");
+  const limit = 256 - 256 % size;
+  const out = [];
+  let guard = 0;
+  while (out.length < count) {
+    const bytes = random(Math.max(16, (count - out.length) * 2));
+    for (const byte of bytes) {
+      if (byte < limit) out.push(byte % size);
+      if (out.length === count) break;
+    }
+    guard += 1;
+    if (guard > 1e4) throw new PasswordGeneratorError("random source is not producing entropy");
+  }
+  return out;
+}
+function generatePassword(spec, random = defaultRandom) {
+  const parsed = GeneratePasswordSpec.parse(spec ?? {});
+  const classes = passwordCharacterClasses(parsed);
+  if (classes.length === 0) throw new PasswordGeneratorError("no characters available");
+  const alphabet = uniqueCharacters(classes.join(""));
+  const requireClasses = parsed.requireEachClass ? classes : [];
+  if (requireClasses.length > parsed.length) {
+    throw new PasswordGeneratorError("length is shorter than the number of required classes");
+  }
+  for (let attempt = 0; attempt < 1e3; attempt += 1) {
+    const password = uniformIndexes(parsed.length, alphabet.length, random).map((index) => alphabet[index]).join("");
+    if (requireClasses.every((characters) => [...password].some((c) => characters.includes(c)))) {
+      return password;
+    }
+  }
+  throw new PasswordGeneratorError("could not satisfy the character class requirements");
+}
+function passwordStrength(password) {
+  let pool = 0;
+  if (/[a-z]/.test(password)) pool += 26;
+  if (/[A-Z]/.test(password)) pool += 26;
+  if (/[0-9]/.test(password)) pool += 10;
+  if (/[^a-zA-Z0-9]/.test(password)) pool += 33;
+  const length = [...password].length;
+  const bits = pool === 0 ? 0 : Math.round(length * Math.log2(pool) * 10) / 10;
+  const label = bits < 40 ? "weak" : bits < 60 ? "fair" : bits < 100 ? "strong" : "very_strong";
+  return { bits, label };
+}
+
+// src/vaults.ts
+import { z as z2 } from "zod";
+var VaultOwnerKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["user", "workspace", "organization", "task"])
+);
+var VaultSource = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["opengeni", "onepassword", "host", "external", "protonpass", "keeper", "bitwarden"])
+);
+var VaultMode = /* @__PURE__ */ defineSchema(() => z2.enum(["read_write", "read_only"]));
+var VaultSyncStatus = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["ok", "syncing", "error", "auth_expired", "rate_limited"])
+);
+var VaultItemType = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["login", "api_key", "note", "file", "passkey", "card", "identity", "ssh_key"])
+);
+var VAULT_ITEM_TYPE_COUNT = 8;
+var VAULT_ITEM_CATEGORY_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+var VaultItemCategory = /* @__PURE__ */ defineSchema(
+  () => z2.string().regex(VAULT_ITEM_CATEGORY_PATTERN, "a lower-case snake_case category")
+);
+var VAULT_ITEM_CATEGORIES = {
+  password: "api_key",
+  database: "api_key",
+  server: "api_key",
+  wifi: "api_key",
+  email_account: "api_key",
+  software_license: "api_key",
+  crypto_wallet: "api_key",
+  bank_account: "note",
+  membership: "note",
+  passport: "note",
+  driver_license: "note",
+  outdoor_license: "note",
+  reward_program: "note",
+  national_id: "note",
+  medical_record: "note",
+  health_insurance: "note",
+  birth_certificate: "note",
+  email_alias: "note",
+  address: "identity",
+  person: "identity",
+  photo: "file"
+};
+function vaultItemCategoryToken(raw) {
+  const token = raw.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^[^a-z]+/, "").slice(0, 64).replace(/_+$/, "");
+  return VAULT_ITEM_CATEGORY_PATTERN.test(token) ? token : null;
+}
+var VAULT_ITEM_TYPE_FIELDS = {
+  login: [
+    { name: "username", kind: "text" },
+    { name: "password", kind: "concealed" },
+    { name: "one-time password", kind: "totp" }
+  ],
+  api_key: [{ name: "value", kind: "concealed" }],
+  note: [{ name: "note", kind: "concealed" }],
+  file: [],
+  passkey: [],
+  card: [
+    { name: "cardholder name", kind: "text" },
+    { name: "brand", kind: "text" },
+    { name: "number", kind: "concealed" },
+    { name: "expiry month", kind: "text" },
+    { name: "expiry year", kind: "text" },
+    { name: "security code", kind: "concealed" }
+  ],
+  identity: [
+    { name: "title", kind: "text" },
+    { name: "first name", kind: "text" },
+    { name: "middle name", kind: "text" },
+    { name: "last name", kind: "text" },
+    { name: "username", kind: "text" },
+    { name: "company", kind: "text" },
+    { name: "email", kind: "text" },
+    { name: "phone", kind: "text" },
+    { name: "address 1", kind: "text" },
+    { name: "address 2", kind: "text" },
+    { name: "address 3", kind: "text" },
+    { name: "city", kind: "text" },
+    { name: "state", kind: "text" },
+    { name: "postal code", kind: "text" },
+    { name: "country", kind: "text" },
+    { name: "national ID number", kind: "concealed" },
+    { name: "passport number", kind: "concealed" },
+    { name: "license number", kind: "concealed" }
+  ],
+  ssh_key: [
+    { name: "private key", kind: "concealed" },
+    { name: "public key", kind: "text" },
+    { name: "fingerprint", kind: "text" }
+  ]
+};
+var GenerateSshKeySpec = /* @__PURE__ */ defineSchema(
+  () => z2.object({ algorithm: z2.enum(["ed25519", "rsa4096"]).default("ed25519") }).strict()
+);
+var VAULT_FIELD_NAME_SYNONYMS = {
+  card: {
+    "cardholder name": ["cardholder", "name on card"],
+    brand: ["type", "card type"],
+    number: ["card number"],
+    "security code": ["verification number", "cvv", "cvc", "cvv2", "csc"],
+    "expiry month": ["exp month", "expiration month"],
+    "expiry year": ["exp year", "expiration year"]
+  },
+  identity: {
+    "first name": ["firstname", "given name"],
+    "middle name": ["initial", "middle initial"],
+    "last name": ["lastname", "surname", "family name"],
+    email: ["email address"],
+    phone: ["phone number", "default phone"],
+    "address 1": ["address", "street address"],
+    "postal code": ["zip", "zip code", "postcode"],
+    "national ID number": ["ssn", "social security number"]
+  },
+  ssh_key: {}
+};
+function fieldNameKey(name) {
+  return name.normalize("NFC").trim().toLowerCase();
+}
+function standardVaultFieldName(type, name) {
+  const key = fieldNameKey(name);
+  const standard = VAULT_ITEM_TYPE_FIELDS[type].find((field) => fieldNameKey(field.name) === key);
+  if (standard) return standard.name;
+  for (const [canonical, synonyms] of Object.entries(VAULT_FIELD_NAME_SYNONYMS[type] ?? {})) {
+    if (synonyms.some((synonym) => fieldNameKey(synonym) === key)) return canonical;
+  }
+  return null;
+}
+function vaultFieldNameAlternatives(name) {
+  const key = fieldNameKey(name);
+  const out = /* @__PURE__ */ new Set();
+  for (const table of Object.values(VAULT_FIELD_NAME_SYNONYMS)) {
+    for (const [canonical, synonyms] of Object.entries(table ?? {})) {
+      const group = [canonical, ...synonyms];
+      if (!group.some((entry) => fieldNameKey(entry) === key)) continue;
+      for (const entry of group) if (fieldNameKey(entry) !== key) out.add(entry);
+    }
+  }
+  return [...out];
+}
+var VaultFieldKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["text", "concealed", "totp", "file"])
+);
+var VaultProviderOperations = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    createItemTypes: z2.array(VaultItemType).max(VAULT_ITEM_TYPE_COUNT),
+    updateItem: boolean,
+    removeField: boolean,
+    archiveItem: boolean,
+    archiveKind: z2.enum(["archive", "trash", "none"]),
+    /** Permanent provider deletion is deliberately not exposed. */
+    deleteItem: z2.literal(false),
+    restoreItem: boolean,
+    readFiles: boolean,
+    writeFiles: boolean,
+    createTotp: boolean,
+    updateTotp: boolean,
+    createVault: boolean,
+    restoreFieldHistory: boolean
+  }).strict()
+);
+var ARCHIVE_KIND_STRENGTH = { archive: 2, trash: 1, none: 0 };
+function weakerArchiveKind(left, right) {
+  return ARCHIVE_KIND_STRENGTH[left] <= ARCHIVE_KIND_STRENGTH[right] ? left : right;
+}
+var VaultProviderFreshness = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    state: z2.enum(["current", "stale", "refreshing", "unavailable"]),
+    lastCheckedAt: z2.string().datetime().nullable(),
+    sourceSyncedAt: z2.string().datetime().nullable(),
+    source: z2.enum(["live", "cache", "unknown"]),
+    errorCode: z2.string().max(100).nullable(),
+    retryAt: z2.string().datetime().nullable()
+  }).strict()
+);
+var VAULT_LOOKUP_TIERS = ["task", "user", "workspace", "organization"];
+var VAULT_LIMITS = {
+  vaultsPerOwnerScope: 200,
+  itemsPerVault: 2e3,
+  fieldsPerItem: 50,
+  versionsPerField: 10,
+  nameMaxChars: 120,
+  descriptionMaxChars: 2e3,
+  websitesPerItem: 20,
+  websiteMaxChars: 2048,
+  usernameMaxChars: 1024,
+  textValueMaxBytes: 65536,
+  fileValueMaxBytes: 262144,
+  referenceMaxChars: 300,
+  execEnvMaxBytes: 262144,
+  execValueMaxBytes: 102400,
+  policyVaultIdsMax: 200,
+  searchResultsMax: 50,
+  /** Items one agent search call examines before it returns a cursor. */
+  searchScanMax: 1e3,
+  searchCursorMaxChars: 1024,
+  providerReadsPerAttempt: 50,
+  providerValueCacheMs: 6e4
+};
+var DEFAULT_VAULT_NAMES = {
+  user: "Private",
+  workspace: "Shared",
+  task: "Task"
+};
+var VAULT_DEFAULT_PRIMARY_FIELD = {
+  login: "password",
+  api_key: "value",
+  note: "note",
+  file: "file",
+  passkey: null,
+  card: "number",
+  identity: null,
+  ssh_key: "private key"
+};
+var PASSKEY_FIELD_NAMES = [
+  "rpId",
+  "credentialId",
+  "userHandle",
+  "userName",
+  "privateKey"
+];
+var FORBIDDEN_NAME_CHARACTERS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/;
+function isValidSecretName(name) {
+  if (typeof name !== "string") return false;
+  const length = [...name].length;
+  if (length < 1 || length > VAULT_LIMITS.nameMaxChars) return false;
+  if (FORBIDDEN_NAME_CHARACTERS.test(name)) return false;
+  if (name.trim() !== name) return false;
+  if (name.toLowerCase().startsWith("id:")) return false;
+  return true;
+}
+function isReservedVaultFieldName(name) {
+  return name.normalize("NFC").trim().toLowerCase() === "otp";
+}
+var VaultName = /* @__PURE__ */ defineSchema(
+  () => nonEmptyString.max(VAULT_LIMITS.nameMaxChars).refine(isValidSecretName, "invalid_secret_name")
+);
+var VaultFieldName = /* @__PURE__ */ defineSchema(
+  () => VaultName.refine((name) => !isReservedVaultFieldName(name), "invalid_secret_name")
+);
+var VaultPolicy = /* @__PURE__ */ defineSchema(
+  () => z2.discriminatedUnion("mode", [
+    z2.object({ mode: z2.literal("all") }).strict(),
+    z2.object({
+      mode: z2.literal("selected"),
+      vaultIds: z2.array(uuid).max(VAULT_LIMITS.policyVaultIdsMax)
+    }).strict()
+  ])
+);
+var VAULT_POLICY_ALL = Object.freeze({ mode: "all" });
+function intersectVaultPolicies(a, b) {
+  if (a.mode === "all")
+    return b.mode === "all" ? VAULT_POLICY_ALL : { mode: "selected", vaultIds: [...b.vaultIds] };
+  if (b.mode === "all") return { mode: "selected", vaultIds: [...a.vaultIds] };
+  const allowed = new Set(b.vaultIds);
+  return { mode: "selected", vaultIds: a.vaultIds.filter((id) => allowed.has(id)) };
+}
+var VaultAvailability = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    allowedWorkspaceIds: z2.array(uuid).max(500).nullable(),
+    // null = every workspace
+    allowPersonalWorkspaces: boolean
+  }).strict()
+);
+var VaultSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: uuid,
+    workspaceId: uuid,
+    ownerKind: VaultOwnerKind,
+    /** "Only me" | workspace name | organization name | "This task" */
+    ownerLabel: string,
+    rootSessionId: nullableUuid,
+    name: string,
+    description: nullableString,
+    source: VaultSource,
+    mode: VaultMode,
+    syncStatus: VaultSyncStatus,
+    syncErrorCode: nullableString,
+    syncErrorMessage: nullableString,
+    lastSyncedAt: nullableString,
+    rateLimitedUntil: nullableString,
+    providerConnectionId: nullableUuid,
+    providerOperations: VaultProviderOperations.optional(),
+    freshness: VaultProviderFreshness.optional(),
+    /** Organization and Only-me vaults; null for workspace and task vaults. */
+    availability: VaultAvailability.nullable(),
+    isDefault: boolean,
+    itemCount: z2.number().int(),
+    canWrite: boolean,
+    canManage: boolean,
+    generation: z2.number().int(),
+    createdAt: string,
+    updatedAt: string
+  })
+);
+var VaultItemReferences = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    primary: nullableString,
+    otp: nullableString,
+    byField: z2.record(string, string)
+  })
+);
+var VaultItemSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: uuid,
+    vaultId: uuid,
+    type: VaultItemType,
+    /** Provider-specific kind of item (`VAULT_ITEM_CATEGORIES`); null for the plain type. */
+    category: nullableString,
+    name: string,
+    websites: z2.array(string),
+    /** Native username text field or the connected provider's display hint. */
+    username: nullableString,
+    hasTotp: boolean,
+    hasPasskey: boolean,
+    expiresAt: nullableString,
+    archivedAt: nullableString,
+    lastUsedAt: nullableString,
+    updatedAt: string,
+    references: VaultItemReferences
+  })
+);
+var VaultItemField = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: uuid,
+    name: string,
+    kind: VaultFieldKind,
+    position: z2.number().int(),
+    /** null for provider fields */
+    currentVersion: z2.number().int().nullable(),
+    /** Plaintext ONLY for kind "text"; null otherwise. */
+    value: nullableString,
+    fileName: nullableString,
+    fileSize: z2.number().int().nullable(),
+    reference: string,
+    updatedAt: string
+  })
+);
+var PasskeySummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    rpId: string,
+    userName: nullableString,
+    /** Last 8 characters of the credential ID. */
+    credentialIdSuffix: string,
+    signCount: z2.number().int(),
+    leasedUntil: nullableString,
+    lastUsedAt: nullableString
+  })
+);
+var VaultItem = /* @__PURE__ */ defineSchema(
+  () => VaultItemSummary.extend({
+    fields: z2.array(VaultItemField),
+    passkey: PasskeySummary.nullable(),
+    aliases: z2.array(string),
+    primaryFieldId: nullableUuid,
+    createdBySubjectId: nullableString,
+    createdAt: string,
+    generation: z2.number().int()
+  })
+);
+var VaultVersionCreatedByKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["human", "agent", "api_key", "migration", "provider", "system"])
+);
+var VaultFieldVersionMeta = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    version: z2.number().int(),
+    current: boolean,
+    createdAt: string,
+    createdByKind: VaultVersionCreatedByKind,
+    createdBySubjectId: nullableString
+  })
+);
+var CreateVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    name: VaultName,
+    description: string.max(VAULT_LIMITS.descriptionMaxChars).optional(),
+    ownerKind: z2.enum(["user", "workspace", "organization"]),
+    availability: VaultAvailability.optional()
+  }).strict()
+);
+var UpdateVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    expectedGeneration: z2.number().int(),
+    name: VaultName.optional(),
+    description: string.max(VAULT_LIMITS.descriptionMaxChars).nullable().optional(),
+    availability: VaultAvailability.optional()
+  }).strict()
+);
+var DeleteVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ confirmName: nonEmptyString }).strict()
+);
+var VALUE_SOURCE_KEYS = [
+  "value",
+  "generate",
+  "generateKey",
+  "fromReference",
+  "fileBase64",
+  "restoreVersion",
+  "remove"
+];
+function exactlyOneValueSource(input) {
+  return VALUE_SOURCE_KEYS.filter((key) => input[key] !== void 0).length === 1;
+}
+var VaultFieldInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    fieldId: optionalUuid,
+    name: VaultFieldName,
+    /** Default concealed; a field named "username" defaults to text. */
+    kind: VaultFieldKind.optional(),
+    value: z2.string().optional(),
+    generate: GeneratePasswordSpec.optional(),
+    generateKey: GenerateSshKeySpec.optional(),
+    fromReference: string.max(VAULT_LIMITS.referenceMaxChars).optional(),
+    fileBase64: z2.string().optional(),
+    fileName: z2.string().max(255).optional(),
+    restoreVersion: z2.number().int().optional(),
+    remove: z2.literal(true).optional()
+  }).strict().refine(
+    exactlyOneValueSource,
+    "exactly one of value|generate|generateKey|fromReference|fileBase64|restoreVersion|remove"
+  )
+);
+var CreateVaultItemShape = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    type: VaultItemType,
+    category: VaultItemCategory.nullable().optional(),
+    name: VaultName,
+    websites: z2.array(string.max(VAULT_LIMITS.websiteMaxChars)).max(VAULT_LIMITS.websitesPerItem).optional(),
+    expiresAt: string.datetime({ offset: true }).nullable().optional(),
+    fields: z2.array(VaultFieldInput).max(VAULT_LIMITS.fieldsPerItem),
+    primaryFieldName: z2.string().optional()
+  }).strict()
+);
+var CreateVaultItemRequest = CreateVaultItemShape;
+var UpdateVaultItemRequest = /* @__PURE__ */ defineSchema(
+  () => CreateVaultItemShape.partial().extend({ expectedGeneration: z2.number().int() }).strict()
+);
+var MoveVaultItemRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    targetVaultId: uuid,
+    mode: z2.enum(["move", "copy"]),
+    newName: VaultName.optional()
+  }).strict()
+);
+var RevealVaultFieldRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ version: z2.number().int().optional() }).strict()
+);
+var RevealVaultFieldResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    value: string,
+    encoding: z2.enum(["utf8", "base64"]),
+    version: z2.number().int().nullable(),
+    totp: z2.object({
+      code: string,
+      periodSeconds: z2.number().int(),
+      expiresAt: string
+    }).nullable()
+  })
+);
+var RestoreVaultFieldVersionRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ version: positiveInteger }).strict()
+);
+var QUERY_TRUE = /* @__PURE__ */ new Set(["true", "1", "yes"]);
+var QUERY_FALSE = /* @__PURE__ */ new Set(["false", "0", "no"]);
+var QueryBoolean = /* @__PURE__ */ defineSchema(
+  () => z2.preprocess((value) => {
+    if (typeof value !== "string") return value;
+    const normalized = value.trim().toLowerCase();
+    return QUERY_TRUE.has(normalized) ? true : QUERY_FALSE.has(normalized) ? false : value;
+  }, boolean)
+);
+var QueryInt = /* @__PURE__ */ defineSchema(
+  () => z2.preprocess(
+    (value) => typeof value === "string" && /^\d+$/.test(value) ? Number(value) : value,
+    z2.number().int().min(1).max(200)
+  )
+);
+var ListVaultItemsQuery = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    q: z2.string().max(200).optional(),
+    type: VaultItemType.optional(),
+    includeArchived: QueryBoolean.optional(),
+    cursor: z2.string().optional(),
+    limit: QueryInt.optional()
+  })
+);
+var ListVaultsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({ vaults: z2.array(VaultSummary) })
+);
+var ListVaultItemsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    items: z2.array(VaultItemSummary),
+    nextCursor: nullableString
+  })
+);
+var ListVaultFieldVersionsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    versions: z2.array(VaultFieldVersionMeta)
+  })
+);
+var SetSessionVaultPolicyRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ policy: VaultPolicy }).strict()
+);
+var SessionSecretsView = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    capabilityEnabled: boolean,
+    policy: VaultPolicy,
+    effectiveVaultIds: z2.array(uuid),
+    /** Nearest ancestor that narrowed, if any. */
+    narrowedBySessionId: nullableUuid,
+    taskVault: VaultSummary.nullable(),
+    taskItems: z2.array(VaultItemSummary),
+    reachableVaults: z2.array(
+      VaultSummary.extend({ selected: boolean, selectable: boolean })
+    )
+  })
+);
+var InstallOnePasswordRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    // Real service-account tokens are long; the dev fakes (ops_fake_healthy) are 16 chars.
+    token: string.trim().min(16).max(4096),
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    planTier: z2.enum(["family", "teams", "business"]).default("teams"),
+    label: z2.string().max(120).optional()
+  }).strict()
+);
+var ProviderVaultMeta = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    externalVaultId: string,
+    name: string,
+    itemCount: z2.number().int().nullable(),
+    linkedVaultId: nullableUuid,
+    /** Unknown means the provider does not expose the grant; writes still check upstream. */
+    writeAccess: z2.enum(["read_only", "read_write", "unknown"]).optional(),
+    operations: VaultProviderOperations.optional()
+  })
+);
+var InstallOnePasswordResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connectionId: uuid,
+    accountName: nullableString,
+    vaults: z2.array(ProviderVaultMeta)
+  })
+);
+var OnePasswordConnectionSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: uuid,
+    /** Who can use the vaults linked through it. */
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    /** Sign-in host from the token, for example "my.1password.com". */
+    accountName: nullableString,
+    label: nullableString,
+    planTier: z2.enum(["family", "teams", "business"]),
+    /** When the current token was last checked against 1Password. */
+    verifiedAt: string,
+    createdAt: string,
+    createdBySubjectId: nullableString,
+    /** The caller can link vaults, replace the token and disconnect it. */
+    canManage: boolean
+  })
+);
+var ListOnePasswordConnectionsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connections: z2.array(OnePasswordConnectionSummary)
+  })
+);
+var ReplaceOnePasswordTokenRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    token: string.trim().min(16).max(4096),
+    planTier: z2.enum(["family", "teams", "business"]).optional()
+  }).strict()
+);
+var DisconnectOnePasswordResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    /** The Opengeni vaults that were unlinked. Nothing is deleted in 1Password. */
+    unlinkedVaultIds: z2.array(uuid)
+  })
+);
+var ExternalVaultProviderKind = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["external", "protonpass", "keeper", "bitwarden"])
+);
+var VaultProviderCredentials = /* @__PURE__ */ defineSchema(
+  () => z2.discriminatedUnion("provider", [
+    z2.object({
+      provider: z2.literal("external"),
+      endpoint: z2.string().url().max(2048),
+      signingSecret: z2.string().min(32).max(4096)
+    }).strict(),
+    /**
+     * Bitwarden or Vaultwarden: the server address, the account's personal
+     * API key (Settings, Security, Keys) and the master password. The master
+     * password opens the account once during setup and is never stored.
+     */
+    z2.object({
+      provider: z2.literal("bitwarden"),
+      serverUrl: z2.string().trim().min(1).max(2048),
+      clientId: z2.string().trim().min(1).max(200),
+      clientSecret: z2.string().trim().min(1).max(1024),
+      masterPassword: z2.string().min(1).max(1024)
+    }).strict(),
+    z2.object({
+      provider: z2.literal("protonpass"),
+      token: z2.string().min(16).max(4096)
+    }).strict(),
+    z2.object({
+      provider: z2.literal("keeper"),
+      oneTimeToken: z2.string().min(16).max(4096),
+      /** Optional region host for tokens that do not encode one. */
+      hostname: z2.string().max(253).optional()
+    }).strict()
+  ])
+);
+var InstallVaultProviderRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    credentials: VaultProviderCredentials,
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    label: string.trim().min(1).max(120).optional()
+  }).strict()
+);
+var ReplaceVaultProviderCredentialsRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({ credentials: VaultProviderCredentials }).strict()
+);
+var VaultProviderConnectionSummary = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: uuid,
+    provider: z2.enum(["onepassword", "external", "protonpass", "keeper", "bitwarden"]),
+    ownership: z2.enum(["user", "workspace", "organization"]),
+    accountName: nullableString,
+    label: nullableString,
+    verifiedAt: string,
+    createdAt: string,
+    createdBySubjectId: nullableString,
+    canManage: boolean,
+    operations: VaultProviderOperations,
+    /** Only 1Password uses a plan tier. */
+    planTier: z2.enum(["family", "teams", "business"]).optional(),
+    /** Unavailable means this deployment cannot run the adapter, not bad credentials. */
+    available: boolean,
+    /** Setup material is saved, but provider verification has not completed. */
+    verificationStatus: z2.enum(["ready", "pending"]).optional()
+  })
+);
+var VaultProviderAvailability = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    provider: VaultProviderConnectionSummary.shape.provider,
+    available: boolean,
+    reason: z2.enum(["not_enabled"]).nullable()
+  })
+);
+var ListVaultProviderConnectionsResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connections: z2.array(VaultProviderConnectionSummary),
+    /** Additive: older servers may omit this metadata-only deployment catalog. */
+    providers: z2.array(VaultProviderAvailability).optional()
+  })
+);
+var InstallVaultProviderResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    connectionId: uuid,
+    accountName: nullableString,
+    provider: ExternalVaultProviderKind,
+    operations: VaultProviderOperations,
+    vaults: z2.array(ProviderVaultMeta),
+    /** Retry verification on this connection; never replay a consumed bootstrap token. */
+    discoveryPending: optionalBoolean,
+    errorCode: z2.string().max(100).optional()
+  })
+);
+var DisconnectVaultProviderResponse = /* @__PURE__ */ defineSchema(
+  () => z2.object({ unlinkedVaultIds: z2.array(uuid) })
+);
+var LinkProviderVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    provider: z2.enum(["onepassword", "host", "external", "protonpass", "keeper", "bitwarden"]),
+    /** Required except for an in-process host provider. */
+    connectionId: optionalUuid,
+    externalVaultId: string,
+    ownerKind: z2.enum(["user", "workspace", "organization"]),
+    mode: VaultMode,
+    name: VaultName.optional(),
+    availability: VaultAvailability.optional()
+  }).strict()
+);
+var CreateManagedProviderVaultRequest = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    name: VaultName,
+    ownerKind: z2.enum(["user", "workspace", "organization"]),
+    groupId: z2.string().optional()
+  }).strict()
+);
+var VaultErrorCode = /* @__PURE__ */ defineSchema(
+  () => z2.enum([
+    "vault_not_found",
+    "vault_item_not_found",
+    "vault_field_not_found",
+    "vault_name_conflict",
+    "vault_item_name_conflict",
+    "vault_limit_reached",
+    "vault_read_only",
+    /**
+     * A writable connected vault cannot do this one thing (an item type, a
+     * file, a one-time password or an operation its provider does not
+     * offer). Unlike `vault_read_only`, other writes still work.
+     */
+    "vault_operation_unsupported",
+    "vault_generation_conflict",
+    "vault_permission_denied",
+    /** A session's vault policy reaches outside its parent's effective vaults (AX-2). */
+    "vault_policy_outside_parent",
+    "vault_reveal_requires_human",
+    "encryption_key_missing",
+    "provider_auth_invalid",
+    "provider_auth_expired",
+    "provider_rate_limited",
+    "provider_unavailable",
+    "provider_conflict",
+    "provider_locked",
+    "provider_inventory_incomplete",
+    "provider_outcome_unknown",
+    "variable_sets_removed",
+    "secret_save_forbidden",
+    "invalid_secret_name",
+    "secret_value_too_large",
+    "human_auth_required",
+    "secret_search_cursor_invalid"
+  ])
+);
+var VaultApiError = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    error: VaultErrorCode,
+    message: string,
+    details: z2.record(string, z2.unknown()).optional()
+  })
+);
+var VAULT_ERROR_HTTP_STATUS = {
+  vault_not_found: 404,
+  vault_item_not_found: 404,
+  vault_field_not_found: 404,
+  vault_name_conflict: 409,
+  vault_item_name_conflict: 409,
+  vault_generation_conflict: 409,
+  provider_conflict: 409,
+  vault_limit_reached: 422,
+  invalid_secret_name: 422,
+  secret_value_too_large: 422,
+  secret_save_forbidden: 422,
+  secret_search_cursor_invalid: 422,
+  vault_policy_outside_parent: 422,
+  vault_read_only: 403,
+  vault_operation_unsupported: 422,
+  vault_permission_denied: 403,
+  vault_reveal_requires_human: 403,
+  human_auth_required: 403,
+  variable_sets_removed: 422,
+  encryption_key_missing: 503,
+  provider_unavailable: 503,
+  provider_rate_limited: 429,
+  provider_auth_invalid: 401,
+  provider_auth_expired: 401,
+  provider_locked: 423,
+  provider_inventory_incomplete: 503,
+  provider_outcome_unknown: 503
+};
+var SECRET_TOOL_NAMES = [
+  "secret_search",
+  "secret_save",
+  "secret_get",
+  "secret_move",
+  "secret_delete"
+];
+var SECRET_SAVE_TO = /* @__PURE__ */ defineSchema(
+  () => z2.enum(["user", "task", "workspace"])
+);
+var SecretSearchInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    query: z2.string().max(200).optional(),
+    website: string.max(VAULT_LIMITS.websiteMaxChars).optional(),
+    type: VaultItemType.optional(),
+    /** Vault name or ID. */
+    vault: z2.string().max(200).optional(),
+    limit: z2.number().int().min(1).max(VAULT_LIMITS.searchResultsMax).default(20),
+    /** `nextCursor` from the previous call with the same filters. */
+    cursor: string.max(VAULT_LIMITS.searchCursorMaxChars).optional(),
+    /** Refresh provider metadata and subsequent value reads; never bypass rate limits. */
+    refresh: optionalBoolean
+  }).strict()
+);
+var SecretSearchResult = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    vault: z2.object({
+      id: uuid,
+      name: string,
+      ownerKind: VaultOwnerKind,
+      source: VaultSource,
+      mode: VaultMode
+    }),
+    item: z2.object({
+      id: uuid,
+      name: string,
+      type: VaultItemType,
+      category: nullableString,
+      websites: z2.array(string),
+      username: nullableString,
+      hasTotp: boolean,
+      hasPasskey: boolean,
+      expiresAt: nullableString
+    }),
+    fields: z2.array(z2.object({ name: string, kind: VaultFieldKind })),
+    references: VaultItemReferences
+  })
+);
+var SecretSearchVault = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    id: uuid,
+    name: string,
+    ownerKind: VaultOwnerKind,
+    source: VaultSource,
+    mode: VaultMode,
+    itemCount: nonnegativeInteger,
+    freshness: VaultProviderFreshness.optional()
+  })
+);
+var SecretSearchOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    items: z2.array(SecretSearchResult),
+    /** True when more matches remain; pass `nextCursor` to continue. */
+    truncated: boolean,
+    nextCursor: nullableString,
+    /** Every vault the caller can reach, on the first page only. */
+    vaults: z2.array(SecretSearchVault).optional(),
+    /** False when a reachable provider could not be checked; empty items are not proof of absence. */
+    complete: optionalBoolean,
+    /** Included on every page so failures are not lost after page one. */
+    sources: z2.array(
+      z2.object({
+        vaultId: uuid,
+        freshness: VaultProviderFreshness
+      })
+    ).optional()
+  })
+);
+var SecretSaveFieldInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    name: VaultFieldName,
+    kind: VaultFieldKind.optional(),
+    value: z2.string().optional(),
+    generate: GeneratePasswordSpec.optional(),
+    /** An `ssh_key` item's "private key" only: a new key pair. */
+    generateKey: GenerateSshKeySpec.optional(),
+    fromReference: string.max(VAULT_LIMITS.referenceMaxChars).optional(),
+    restoreVersion: z2.number().int().optional()
+  }).strict().refine(
+    exactlyOneValueSource,
+    "exactly one of value|generate|generateKey|fromReference|restoreVersion"
+  )
+);
+var SecretSaveInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    item: VaultName,
+    /** Vault name or ID; defaults to the saveTo scope's default vault. */
+    vault: z2.string().max(200).optional(),
+    saveTo: SECRET_SAVE_TO.optional(),
+    type: VaultItemType.default("login"),
+    /** A more specific kind of item, such as "database" or "bank_account". */
+    category: VaultItemCategory.nullable().optional(),
+    websites: z2.array(string.max(VAULT_LIMITS.websiteMaxChars)).max(VAULT_LIMITS.websitesPerItem).optional(),
+    username: z2.string().max(512).optional(),
+    fields: z2.array(SecretSaveFieldInput).max(VAULT_LIMITS.fieldsPerItem).optional(),
+    mode: z2.enum(["create", "update", "upsert"]).default("upsert")
+  }).strict()
+);
+var SecretSaveOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    item: VaultItemSummary,
+    references: VaultItemReferences,
+    generatedFields: z2.array(string)
+  })
+);
+var SecretGetInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    reference: nonEmptyString.max(VAULT_LIMITS.referenceMaxChars),
+    version: z2.number().int().optional()
+  }).strict()
+);
+var SecretGetOutput = RevealVaultFieldResponse;
+var SecretMoveInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    reference: nonEmptyString.max(VAULT_LIMITS.referenceMaxChars),
+    /** Vault name or ID. */
+    toVault: z2.string().min(1).max(200),
+    mode: z2.enum(["move", "copy"]).default("move"),
+    newName: VaultName.optional()
+  }).strict()
+);
+var SecretMoveOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({
+    item: VaultItemSummary,
+    references: VaultItemReferences
+  })
+);
+var SecretDeleteInput = /* @__PURE__ */ defineSchema(
+  () => z2.object({ reference: nonEmptyString.max(VAULT_LIMITS.referenceMaxChars) }).strict()
+);
+var SecretDeleteOutput = /* @__PURE__ */ defineSchema(
+  () => z2.object({ archived: z2.literal(true), restoreHint: string })
+);
+var VAULT_POLICY_UPDATED_EVENT_TYPE = "session.vaultPolicy.updated";
+var VAULT_AUDIT_ACTIONS = [
+  "vault.created",
+  "vault.updated",
+  "vault.deleted",
+  "vault.item.created",
+  "vault.item.updated",
+  "vault.item.archived",
+  "vault.item.restored",
+  "vault.item.deleted",
+  "vault.item.moved",
+  "vault.item.copied",
+  "vault.field.set",
+  "vault.field.revealed",
+  "vault.secret.used",
+  "vault.secret.read",
+  "vault.secret.read.denied",
+  "vault.reference.failed",
+  "vault.provider.connected",
+  "vault.provider.linked",
+  "vault.provider.synced",
+  "vault.provider.error",
+  "vault.passkey.registered",
+  "vault.passkey.asserted",
+  "vault.policy.updated",
+  "vault.migrated"
+];
+var VaultAuditAction = /* @__PURE__ */ defineSchema(() => z2.enum(VAULT_AUDIT_ACTIONS));
+var VAULT_AUDIT_TARGET_TYPES = ["vault", "vault_item"];
+var VAULT_METRIC_NAMES = {
+  resolutions: "opengeni_secret_resolutions_total",
+  resolutionDuration: "opengeni_secret_resolution_duration_seconds",
+  execEnvBytes: "opengeni_secret_exec_env_bytes",
+  providerCalls: "opengeni_vault_provider_calls_total",
+  providerRateLimited: "opengeni_vault_provider_rate_limited_total",
+  passkeyAssertions: "opengeni_passkey_assertions_total"
+};
+
+export {
+  SECRET_GENERATOR_DEFAULT_SYMBOLS,
+  SECRET_GENERATOR_AMBIGUOUS_CHARACTERS,
+  GeneratePasswordSpec,
+  PasswordGeneratorError,
+  passwordCharacterClasses,
+  generatePassword,
+  passwordStrength,
+  VaultOwnerKind,
+  VaultSource,
+  VaultMode,
+  VaultSyncStatus,
+  VaultItemType,
+  VAULT_ITEM_TYPE_COUNT,
+  VAULT_ITEM_CATEGORY_PATTERN,
+  VaultItemCategory,
+  VAULT_ITEM_CATEGORIES,
+  vaultItemCategoryToken,
+  VAULT_ITEM_TYPE_FIELDS,
+  GenerateSshKeySpec,
+  VAULT_FIELD_NAME_SYNONYMS,
+  standardVaultFieldName,
+  vaultFieldNameAlternatives,
+  VaultFieldKind,
+  VaultProviderOperations,
+  weakerArchiveKind,
+  VaultProviderFreshness,
+  VAULT_LOOKUP_TIERS,
+  VAULT_LIMITS,
+  DEFAULT_VAULT_NAMES,
+  VAULT_DEFAULT_PRIMARY_FIELD,
+  PASSKEY_FIELD_NAMES,
+  isValidSecretName,
+  isReservedVaultFieldName,
+  VaultName,
+  VaultFieldName,
+  VaultPolicy,
+  VAULT_POLICY_ALL,
+  intersectVaultPolicies,
+  VaultAvailability,
+  VaultSummary,
+  VaultItemReferences,
+  VaultItemSummary,
+  VaultItemField,
+  PasskeySummary,
+  VaultItem,
+  VaultVersionCreatedByKind,
+  VaultFieldVersionMeta,
+  CreateVaultRequest,
+  UpdateVaultRequest,
+  DeleteVaultRequest,
+  exactlyOneValueSource,
+  VaultFieldInput,
+  CreateVaultItemRequest,
+  UpdateVaultItemRequest,
+  MoveVaultItemRequest,
+  RevealVaultFieldRequest,
+  RevealVaultFieldResponse,
+  RestoreVaultFieldVersionRequest,
+  ListVaultItemsQuery,
+  ListVaultsResponse,
+  ListVaultItemsResponse,
+  ListVaultFieldVersionsResponse,
+  SetSessionVaultPolicyRequest,
+  SessionSecretsView,
+  InstallOnePasswordRequest,
+  ProviderVaultMeta,
+  InstallOnePasswordResponse,
+  OnePasswordConnectionSummary,
+  ListOnePasswordConnectionsResponse,
+  ReplaceOnePasswordTokenRequest,
+  DisconnectOnePasswordResponse,
+  ExternalVaultProviderKind,
+  VaultProviderCredentials,
+  InstallVaultProviderRequest,
+  ReplaceVaultProviderCredentialsRequest,
+  VaultProviderConnectionSummary,
+  VaultProviderAvailability,
+  ListVaultProviderConnectionsResponse,
+  InstallVaultProviderResponse,
+  DisconnectVaultProviderResponse,
+  LinkProviderVaultRequest,
+  CreateManagedProviderVaultRequest,
+  VaultErrorCode,
+  VaultApiError,
+  VAULT_ERROR_HTTP_STATUS,
+  SECRET_TOOL_NAMES,
+  SECRET_SAVE_TO,
+  SecretSearchInput,
+  SecretSearchResult,
+  SecretSearchVault,
+  SecretSearchOutput,
+  SecretSaveFieldInput,
+  SecretSaveInput,
+  SecretSaveOutput,
+  SecretGetInput,
+  SecretGetOutput,
+  SecretMoveInput,
+  SecretMoveOutput,
+  SecretDeleteInput,
+  SecretDeleteOutput,
+  VAULT_POLICY_UPDATED_EVENT_TYPE,
+  VAULT_AUDIT_ACTIONS,
+  VaultAuditAction,
+  VAULT_AUDIT_TARGET_TYPES,
+  VAULT_METRIC_NAMES
+};
+//# sourceMappingURL=chunk-G4RKARXZ.js.map