@opengeni/sdk 3.1.2 → 3.2.2

package/dist/site.js

@@ -24,9 +24,9 @@ import {
   sanitizeOpenGeniSiteToolInvokeRequest,
   serveSiteHttp,
   siteSessionPath
-} from "./chunk-JXXCTW5W.js";
+} from "./chunk-PBVUAXSU.js";
 import "./chunk-P7UWKORG.js";
-import "./chunk-NEM5N6C6.js";
+import "./chunk-JKG75TTU.js";
 import "./chunk-VPVMLM7Q.js";
 import "./chunk-4AHR4KGA.js";
 import "./chunk-KADZ5PGG.js";

package/dist/vault-types.d.ts

@@ -1,11 +1,34 @@
 import type { VaultPolicy } from "./types.js";
 export type { VaultPolicy };
 export type VaultOwnerKind = "user" | "workspace" | "organization" | "task";
-export type VaultSource = "opengeni" | "onepassword" | "host";
+export type VaultSource = "opengeni" | "onepassword" | "host" | "external" | "protonpass" | "keeper" | "bitwarden";
 export type VaultMode = "read_write" | "read_only";
 export type VaultSyncStatus = "ok" | "syncing" | "error" | "auth_expired" | "rate_limited";
 export type VaultItemType = "login" | "api_key" | "note" | "file" | "passkey";
 export type VaultFieldKind = "text" | "concealed" | "totp" | "file";
+export type VaultProviderOperations = {
+    createItemTypes: VaultItemType[];
+    updateItem: boolean;
+    removeField: boolean;
+    archiveItem: boolean;
+    archiveKind: "archive" | "trash" | "none";
+    deleteItem: false;
+    restoreItem: boolean;
+    readFiles: boolean;
+    writeFiles: boolean;
+    createTotp: boolean;
+    updateTotp: boolean;
+    createVault: boolean;
+    restoreFieldHistory: boolean;
+};
+export type VaultProviderFreshness = {
+    state: "current" | "stale" | "refreshing" | "unavailable";
+    lastCheckedAt: string | null;
+    sourceSyncedAt: string | null;
+    source: "live" | "cache" | "unknown";
+    errorCode: string | null;
+    retryAt: string | null;
+};
 export type VaultAvailability = {
     /** null = every workspace in the organization. */
     allowedWorkspaceIds: string[] | null;
@@ -27,6 +50,8 @@ export type VaultSummary = {
     lastSyncedAt: string | null;
     rateLimitedUntil: string | null;
     providerConnectionId: string | null;
+    providerOperations?: VaultProviderOperations | undefined;
+    freshness?: VaultProviderFreshness | undefined;
     availability: VaultAvailability | null;
     isDefault: boolean;
     itemCount: number;
@@ -188,6 +213,8 @@ export type ProviderVaultMeta = {
     name: string;
     itemCount: number | null;
     linkedVaultId: string | null;
+    writeAccess?: "read_only" | "read_write" | "unknown" | undefined;
+    operations?: VaultProviderOperations | undefined;
 };
 export type InstallOnePasswordResponse = {
     connectionId: string;
@@ -220,7 +247,7 @@ export type DisconnectOnePasswordResponse = {
     unlinkedVaultIds: string[];
 };
 export type LinkProviderVaultRequest = {
-    provider: "onepassword" | "host";
+    provider: Exclude<VaultSource, "opengeni">;
     connectionId?: string | undefined;
     externalVaultId: string;
     ownerKind: "user" | "workspace" | "organization";
@@ -233,4 +260,65 @@ export type CreateManagedProviderVaultRequest = {
     ownerKind: "user" | "workspace" | "organization";
     groupId?: string | undefined;
 };
-export type VaultErrorCode = "vault_not_found" | "vault_item_not_found" | "vault_field_not_found" | "vault_name_conflict" | "vault_item_name_conflict" | "vault_limit_reached" | "vault_read_only" | "vault_generation_conflict" | "vault_permission_denied" | "vault_reveal_requires_human" | "vault_policy_outside_parent" | "encryption_key_missing" | "provider_auth_invalid" | "provider_auth_expired" | "provider_rate_limited" | "provider_unavailable" | "provider_conflict" | "variable_sets_removed" | "secret_save_forbidden" | "invalid_secret_name" | "secret_value_too_large" | "human_auth_required" | "secret_search_cursor_invalid";
+export type VaultErrorCode = "vault_not_found" | "vault_item_not_found" | "vault_field_not_found" | "vault_name_conflict" | "vault_item_name_conflict" | "vault_limit_reached" | "vault_read_only" | "vault_generation_conflict" | "vault_permission_denied" | "vault_reveal_requires_human" | "vault_policy_outside_parent" | "encryption_key_missing" | "provider_auth_invalid" | "provider_auth_expired" | "provider_rate_limited" | "provider_unavailable" | "provider_conflict" | "provider_locked" | "provider_inventory_incomplete" | "provider_outcome_unknown" | "variable_sets_removed" | "secret_save_forbidden" | "invalid_secret_name" | "secret_value_too_large" | "human_auth_required" | "secret_search_cursor_invalid";
+export type ExternalVaultProviderKind = "external" | "protonpass" | "keeper" | "bitwarden";
+export type VaultProviderCredentials = {
+    provider: "external";
+    endpoint: string;
+    signingSecret: string;
+} | {
+    provider: "bitwarden";
+    endpoint: string;
+    signingSecret: string;
+} | {
+    provider: "protonpass";
+    token: string;
+} | {
+    provider: "keeper";
+    oneTimeToken: string;
+    hostname?: string | undefined;
+};
+export type InstallVaultProviderRequest = {
+    credentials: VaultProviderCredentials;
+    ownership: "user" | "workspace" | "organization";
+    label?: string | undefined;
+};
+export type ReplaceVaultProviderCredentialsRequest = {
+    credentials: VaultProviderCredentials;
+};
+export type VaultProviderConnectionSummary = {
+    id: string;
+    provider: "onepassword" | ExternalVaultProviderKind;
+    ownership: "user" | "workspace" | "organization";
+    accountName: string | null;
+    label: string | null;
+    verifiedAt: string;
+    createdAt: string;
+    createdBySubjectId: string | null;
+    canManage: boolean;
+    operations: VaultProviderOperations;
+    planTier?: OnePasswordPlanTier | undefined;
+    available: boolean;
+    verificationStatus?: "ready" | "pending" | undefined;
+};
+export type ListVaultProviderConnectionsResponse = {
+    connections: VaultProviderConnectionSummary[];
+    providers?: VaultProviderAvailability[] | undefined;
+};
+export type VaultProviderAvailability = {
+    provider: VaultProviderConnectionSummary["provider"];
+    available: boolean;
+    reason: "not_enabled" | null;
+};
+export type InstallVaultProviderResponse = {
+    connectionId: string;
+    accountName: string | null;
+    provider: ExternalVaultProviderKind;
+    operations: VaultProviderOperations;
+    vaults: ProviderVaultMeta[];
+    discoveryPending?: boolean | undefined;
+    errorCode?: string | undefined;
+};
+export type DisconnectVaultProviderResponse = {
+    unlinkedVaultIds: string[];
+};

package/dist/vaults-api.d.ts

@@ -1,6 +1,6 @@
 import type { OpenGeniClient } from "./client.js";
 import type { VaultPolicy } from "./types.js";
-import type { CreateManagedProviderVaultRequest, CreateVaultItemRequest, CreateVaultRequest, DisconnectOnePasswordResponse, InstallOnePasswordRequest, InstallOnePasswordResponse, LinkProviderVaultRequest, ListVaultItemsQuery, MoveVaultItemRequest, OnePasswordConnectionSummary, ProviderVaultMeta, ReplaceOnePasswordTokenRequest, RevealVaultFieldResponse, SessionSecretsView, UpdateVaultItemRequest, UpdateVaultRequest, VaultErrorCode, VaultFieldVersionMeta, VaultItem, VaultItemSummary, VaultSummary } from "./vault-types.js";
+import type { CreateManagedProviderVaultRequest, CreateVaultItemRequest, CreateVaultRequest, DisconnectOnePasswordResponse, InstallOnePasswordRequest, InstallOnePasswordResponse, LinkProviderVaultRequest, ListVaultItemsQuery, MoveVaultItemRequest, OnePasswordConnectionSummary, ProviderVaultMeta, ReplaceOnePasswordTokenRequest, RevealVaultFieldResponse, SessionSecretsView, UpdateVaultItemRequest, UpdateVaultRequest, VaultErrorCode, VaultFieldVersionMeta, VaultItem, VaultItemSummary, VaultSummary, InstallVaultProviderRequest, InstallVaultProviderResponse, ReplaceVaultProviderCredentialsRequest, VaultProviderConnectionSummary, ListVaultProviderConnectionsResponse, DisconnectVaultProviderResponse } from "./vault-types.js";
 /**
  * Vault REST routes over the client's JSON transport. Responses carry metadata
  * only; plaintext comes back only from `revealField`, and callers keep it in
@@ -44,6 +44,14 @@ export declare function vaultsApi(client: VaultClientLike, workspaceId: string):
     /** Unlinks the connection's vaults (nothing is deleted in 1Password) and removes its token. */
     disconnectOnePassword: (connectionId: string) => Promise<DisconnectOnePasswordResponse>;
     listProviderVaults: (connectionId: string, signal?: AbortSignal) => Promise<ProviderVaultMeta[]>;
+    installVaultProvider: (request: InstallVaultProviderRequest) => Promise<InstallVaultProviderResponse>;
+    /** Connections plus configured providers, even before the first connection. */
+    getVaultProviderCatalog: (signal?: AbortSignal) => Promise<ListVaultProviderConnectionsResponse>;
+    listVaultProviderConnections: (signal?: AbortSignal) => Promise<VaultProviderConnectionSummary[]>;
+    replaceVaultProviderCredentials: (connectionId: string, request: ReplaceVaultProviderCredentialsRequest) => Promise<InstallVaultProviderResponse>;
+    disconnectVaultProvider: (connectionId: string) => Promise<DisconnectVaultProviderResponse>;
+    /** Continue verification using the saved credentials, without replaying setup tokens. */
+    verifyVaultProviderConnection: (connectionId: string) => Promise<InstallVaultProviderResponse>;
     linkProviderVault: (request: LinkProviderVaultRequest) => Promise<VaultSummary>;
     createManagedProviderVault: (connectionId: string, request: CreateManagedProviderVaultRequest) => Promise<VaultSummary>;
 };

package/dist/workspace-integrations.js

@@ -1,12 +1,6 @@
 import {
-  OPENGENI_DELIVERY_ID_HEADER,
-  OPENGENI_EVENT_ID_HEADER,
-  OPENGENI_SIGNATURE_HEADER,
-  OPENGENI_TEST_REQUEST_NIL_ID,
   OPENGENI_WEBHOOK_HEADERS,
-  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
   OpenGeniSignatureError,
-  WORKSPACE_WEBHOOK_EVENT_TYPES,
   createOrganizationWebhook,
   deleteOrganizationCredentialProvider,
   deleteOrganizationWebhook,
@@ -22,14 +16,22 @@ import {
   rotateOrganizationWebhookSecret,
   rotateWorkspaceCredentialProviderSecret,
   rotateWorkspaceWebhookSecret,
-  signOpenGeniPayload,
   testWorkspaceCredentialProvider,
   testWorkspaceWebhook,
   updateOrganizationWebhook,
   verifyCredentialProviderRequest,
-  verifyOpenGeniSignature,
   verifyWebhookEvent
-} from "./chunk-RJHCBZF7.js";
+} from "./chunk-VT4YM4XQ.js";
+import {
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature
+} from "./chunk-KGEABAID.js";
 export {
   OPENGENI_DELIVERY_ID_HEADER,
   OPENGENI_EVENT_ID_HEADER,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/sdk",
-  "version": "3.1.2",
+  "version": "3.2.2",
   "description": "Framework-agnostic TypeScript SDK for the Opengeni API: typed client, session lifecycle, SSE event streaming with reconnect + replay-by-sequence, and proxy re-streaming helpers.",
   "license": "Apache-2.0",
   "repository": {
@@ -78,6 +78,10 @@
       "types": "./dist/workspace-integrations.d.ts",
       "import": "./dist/workspace-integrations.js"
     },
+    "./external-vault-receiver": {
+      "types": "./dist/external-vault-receiver.d.ts",
+      "import": "./dist/external-vault-receiver.js"
+    },
     "./session-history-import": {
       "types": "./dist/session-history-import.d.ts",
       "import": "./dist/session-history-import.js"
@@ -194,8 +198,8 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/connect": "3.1.2",
-    "@opengeni/contracts": "3.1.2"
+    "@opengeni/connect": "3.2.2",
+    "@opengeni/contracts": "3.2.2"
   },
   "engines": {
     "node": ">=18"