@opengeni/vaults-keeper 0.0.0-stage → 3.2.2

package/dist/index.js

@@ -0,0 +1,1450 @@
+// src/contract.ts
+import {
+  VaultProviderError
+} from "@opengeni/vaults";
+import {
+  VAULT_LIMITS,
+  parseTotpInput
+} from "@opengeni/contracts";
+
+// src/config.ts
+var KEEPER_REGION_HOSTS = {
+  US: "keepersecurity.com",
+  EU: "keepersecurity.eu",
+  AU: "keepersecurity.com.au",
+  GOV: "govcloud.keepersecurity.us",
+  JP: "keepersecurity.jp",
+  CA: "keepersecurity.ca",
+  IL5: "il5.keepersecurity.us"
+};
+var KEEPER_DEFAULT_ALLOWED_HOSTS = Object.values(KEEPER_REGION_HOSTS);
+var KEEPER_CONFIG_KEYS = [
+  "hostname",
+  "clientId",
+  "clientKey",
+  "privateKey",
+  "appKey",
+  "appOwnerPublicKey",
+  "serverPublicKeyId",
+  "serverPublicKey"
+];
+var KNOWN = new Set(KEEPER_CONFIG_KEYS);
+function invalid(message) {
+  throw new VaultProviderError("provider_auth_invalid", message);
+}
+function parseKeeperConfiguration(input) {
+  if (typeof input !== "string") {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+      return invalid("The Keeper configuration is not KSM JSON");
+    }
+    return valuesOf(input);
+  }
+  let text = input.trim();
+  if (!text.startsWith("{")) {
+    try {
+      text = Buffer.from(text, "base64").toString("utf8").trim();
+    } catch {
+      invalid("The Keeper configuration is not KSM JSON");
+    }
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return invalid("The Keeper configuration is not KSM JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return invalid("The Keeper configuration is not KSM JSON");
+  }
+  return valuesOf(parsed);
+}
+function valuesOf(parsed) {
+  const values = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!KNOWN.has(key)) continue;
+    if (typeof value !== "string" || value.length === 0 || value.length > 4096) {
+      invalid(`The Keeper configuration has an invalid ${key}`);
+    }
+    values.set(key, value);
+  }
+  for (const key of ["hostname", "clientId", "privateKey", "appKey"]) {
+    if (!values.get(key)) {
+      invalid(
+        key === "appKey" ? "The Keeper configuration is not bound yet; connect with a one-time token" : `The Keeper configuration has no ${key}`
+      );
+    }
+  }
+  return values;
+}
+function serializeKeeperConfiguration(values) {
+  const out = {};
+  for (const key of KEEPER_CONFIG_KEYS) {
+    const value = values.get(key);
+    if (value !== void 0) out[key] = value;
+  }
+  return JSON.stringify(out);
+}
+function keeperConfigurationRecord(configuration) {
+  return JSON.parse(
+    serializeKeeperConfiguration(parseKeeperConfiguration(configuration))
+  );
+}
+function assertAllowedHost(hostname, allowed) {
+  const host = (hostname ?? "").trim().toLowerCase();
+  if (!host || !allowed.includes(host)) {
+    throw new VaultProviderError(
+      "provider_auth_invalid",
+      "The Keeper region host is not one Opengeni connects to"
+    );
+  }
+  return host;
+}
+function memoryKeeperStorage(initial = /* @__PURE__ */ new Map()) {
+  const values = new Map(initial);
+  const before = serializeKeeperConfiguration(initial);
+  const set = (key, value) => {
+    if (!KNOWN.has(key)) throw new Error(`unexpected Keeper storage key ${key}`);
+    values.set(key, value);
+  };
+  return {
+    values,
+    changed: () => serializeKeeperConfiguration(values) !== before,
+    getString: async (key) => values.get(key),
+    saveString: async (key, value) => set(key, value),
+    getBytes: async (key) => {
+      const value = values.get(key);
+      return value === void 0 ? void 0 : new Uint8Array(Buffer.from(value, "base64"));
+    },
+    saveBytes: async (key, value) => set(key, Buffer.from(value).toString("base64")),
+    delete: async (key) => {
+      values.delete(key);
+    }
+  };
+}
+
+// src/errors.ts
+var AUTH_HINT = /signature|client ?id|clientid|one[- ]?time|token|expired|ip address|ip lock|locked out|not bound|unbound|device|revoked/i;
+var NOT_FOUND_HINT = /not found|does not exist|no such|unknown (?:record|folder)/i;
+var CONFLICT_HINT = /revision|out of (?:date|sync)|conflict|modified/i;
+function keeperErrorBody(error) {
+  if (!(error instanceof Error)) return null;
+  const text = error.message.trim();
+  if (!text.startsWith("{")) return null;
+  try {
+    const body = JSON.parse(text);
+    const code = body.result_code ?? body.error;
+    const retry = body.retry_after;
+    return {
+      code: typeof code === "string" ? code.slice(0, 64) : null,
+      message: typeof body.message === "string" ? body.message : "",
+      retryAfterSeconds: typeof retry === "number" && retry >= 0 ? retry : null
+    };
+  } catch {
+    const code = /"(?:result_code|error)"\s*:\s*"([a-z_]{1,64})"/.exec(text)?.[1] ?? null;
+    return { code, message: "", retryAfterSeconds: null };
+  }
+}
+function safeCode(code) {
+  return code && /^[a-z0-9_]{1,64}$/i.test(code) ? code : "error";
+}
+function isAbortLike(error) {
+  if (!(error instanceof Error)) return false;
+  return error.name === "AbortError" || error.name === "TimeoutError" || /timed out after \d+ms/.test(error.message);
+}
+function mapKeeperError(error, subject) {
+  if (error instanceof VaultProviderError) return error;
+  if (error instanceof Error && error.name === "KeeperThrottleError") {
+    return new VaultProviderError(
+      "provider_rate_limited",
+      "Keeper is rate limiting this application",
+      6e4
+    );
+  }
+  if (isAbortLike(error)) {
+    return new VaultProviderError(
+      "provider_unavailable",
+      `Keeper did not answer in time (${subject})`
+    );
+  }
+  const body = keeperErrorBody(error);
+  if (body) {
+    const { code, message } = body;
+    if (code === "throttled") {
+      return new VaultProviderError(
+        "provider_rate_limited",
+        "Keeper is rate limiting this application",
+        (body.retryAfterSeconds ?? 60) * 1e3
+      );
+    }
+    if (code === "access_denied" || code === "invalid_client" || code === "invalid_client_version") {
+      if (code !== "access_denied" || AUTH_HINT.test(message)) {
+        return new VaultProviderError(
+          "provider_auth_invalid",
+          "Keeper rejected this application's credentials; reconnect with a new one-time token"
+        );
+      }
+      if (NOT_FOUND_HINT.test(message)) {
+        return new VaultProviderError(
+          "provider_not_found",
+          "No such Keeper shared folder or record"
+        );
+      }
+      return new VaultProviderError(
+        "provider_permission_denied",
+        `The Keeper application may not ${subject}`
+      );
+    }
+    if (NOT_FOUND_HINT.test(message) || code && /not_found|invalid_record|record_uid/.test(code)) {
+      return new VaultProviderError("provider_not_found", "No such Keeper shared folder or record");
+    }
+    if (CONFLICT_HINT.test(message) || code && /revision|conflict/.test(code)) {
+      return new VaultProviderError(
+        "provider_conflict",
+        "The Keeper record changed since it was read; read it again before writing"
+      );
+    }
+    return new VaultProviderError(
+      "provider_unavailable",
+      `Keeper rejected the request (${safeCode(code)})`
+    );
+  }
+  const status = error instanceof Error ? /unknown ksm error, code (\d{3})/.exec(error.message)?.[1] : void 0;
+  if (status) {
+    const code = Number(status);
+    if (code === 401) {
+      return new VaultProviderError(
+        "provider_auth_invalid",
+        "Keeper rejected this application's credentials"
+      );
+    }
+    if (code === 403) {
+      return new VaultProviderError(
+        "provider_permission_denied",
+        `The Keeper application may not ${subject}`
+      );
+    }
+    if (code === 404)
+      return new VaultProviderError("provider_not_found", "No such Keeper shared folder or record");
+    if (code === 429)
+      return new VaultProviderError(
+        "provider_rate_limited",
+        "Keeper is rate limiting this application",
+        6e4
+      );
+    return new VaultProviderError("provider_unavailable", `Keeper returned HTTP ${code}`);
+  }
+  return new VaultProviderError("provider_unavailable", `Keeper could not ${subject}`);
+}
+var KEEPER_DEFINITE_REJECTION_STATUSES = /* @__PURE__ */ new Set([
+  400,
+  401,
+  403,
+  404,
+  409,
+  429
+]);
+function mapKeeperMutationError(error, subject, tracker) {
+  const definite = tracker.sent === 0 || tracker.lastStatus !== null && KEEPER_DEFINITE_REJECTION_STATUSES.has(tracker.lastStatus);
+  if (!definite) {
+    return new VaultProviderError(
+      "provider_outcome_unknown",
+      `Keeper may or may not have completed "${subject}"; check the record before retrying`
+    );
+  }
+  return mapKeeperError(error, subject);
+}
+
+// src/naming.ts
+var FORBIDDEN_NAME_CHARS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/g;
+function nameKey(name) {
+  return name.normalize("NFC").trim().toLowerCase();
+}
+function safeSecretName(raw, fallback) {
+  const max = VAULT_LIMITS.nameMaxChars;
+  let name = raw.replace(FORBIDDEN_NAME_CHARS, "-").trim().slice(0, max).trim();
+  if (!name) name = fallback.replace(FORBIDDEN_NAME_CHARS, "-").trim().slice(0, max) || "item";
+  if (/^id:/i.test(name)) name = `id-${name.slice(3)}`;
+  return name;
+}
+function safeFieldName(raw, fallback) {
+  const name = safeSecretName(raw, fallback);
+  return nameKey(name) === "otp" ? "otp-code" : name;
+}
+function uniqueName(name, taken) {
+  let candidate = name;
+  for (let n = 2; taken.has(nameKey(candidate)); n += 1) {
+    const suffix = ` (${n})`;
+    candidate = `${name.slice(0, VAULT_LIMITS.nameMaxChars - suffix.length)}${suffix}`;
+  }
+  taken.add(nameKey(candidate));
+  return candidate;
+}
+function totpUri(params, label) {
+  const query = new URLSearchParams({
+    secret: params.secretBase32,
+    algorithm: params.algorithm,
+    digits: String(params.digits),
+    period: String(params.periodSeconds)
+  });
+  return `otpauth://totp/${encodeURIComponent(label || "Opengeni")}?${query.toString()}`;
+}
+
+// src/mapping.ts
+var NOTES_FIELD_ID = "@notes";
+var FILE_FIELD_PREFIX = "@file:";
+var CONCEALED_TYPES = /* @__PURE__ */ new Set(["password", "secret", "pinCode", "note"]);
+var TOTP_TYPES = /* @__PURE__ */ new Set(["oneTimeCode", "otp"]);
+var CONCEALED_COMPLEX = /* @__PURE__ */ new Set(["paymentCard", "bankAccount", "keyPair", "securityQuestion"]);
+var SKIPPED_TYPES = /* @__PURE__ */ new Set(["fileRef", "passkey", "recordRef", "cardRef", "addressRef"]);
+var DATE_TYPES = /* @__PURE__ */ new Set(["date", "birthDate", "expirationDate"]);
+var STANDARD_NAMES = {
+  login: "username",
+  password: "password",
+  oneTimeCode: "one-time password",
+  otp: "one-time password",
+  url: "website",
+  email: "email",
+  note: "note",
+  pinCode: "PIN"
+};
+var API_KEY_TYPES = /* @__PURE__ */ new Set([
+  "serverCredentials",
+  "databaseCredentials",
+  "sshKeys",
+  "softwareLicense",
+  "pamDatabase",
+  "pamMachine"
+]);
+function itemTypeForRecordType(type) {
+  if (type === "login") return "login";
+  if (type === "encryptedNotes") return "note";
+  if (type === "file") return "file";
+  if (type && API_KEY_TYPES.has(type)) return "api_key";
+  return "note";
+}
+function kindFor(entry) {
+  if (SKIPPED_TYPES.has(entry.type)) return null;
+  if (TOTP_TYPES.has(entry.type)) return "totp";
+  if (CONCEALED_TYPES.has(entry.type) || CONCEALED_COMPLEX.has(entry.type)) return "concealed";
+  return "text";
+}
+function valueText(entry) {
+  const values = Array.isArray(entry.value) ? entry.value : [];
+  if (values.length === 0) return "";
+  if (DATE_TYPES.has(entry.type) && typeof values[0] === "number") {
+    const date = new Date(values[0]);
+    return Number.isNaN(date.getTime()) ? String(values[0]) : date.toISOString();
+  }
+  if (values.length === 1 && (typeof values[0] === "string" || typeof values[0] === "number" || typeof values[0] === "boolean")) {
+    return String(values[0]);
+  }
+  return JSON.stringify(values.length === 1 ? values[0] : values);
+}
+var Collector = class {
+  fields = [];
+  names = /* @__PURE__ */ new Set();
+  ids = /* @__PURE__ */ new Map();
+  add(baseId, rawName, kind, source, value) {
+    const seen = (this.ids.get(baseId) ?? 0) + 1;
+    this.ids.set(baseId, seen);
+    this.fields.push({
+      externalFieldId: seen === 1 ? baseId : `${baseId}#${seen}`,
+      name: uniqueName(safeFieldName(rawName, "field"), this.names),
+      kind,
+      source,
+      value
+    });
+  }
+};
+function recordData(record) {
+  const data = record.data;
+  return data && typeof data === "object" ? data : {};
+}
+function mapRecord(record) {
+  const data = recordData(record);
+  const collector = new Collector();
+  const websites = [];
+  const lists = [
+    ["fields", Array.isArray(data.fields) ? data.fields : []],
+    ["custom", Array.isArray(data.custom) ? data.custom : []]
+  ];
+  for (const [list, entries] of lists) {
+    entries.forEach((entry, index) => {
+      if (!entry || typeof entry !== "object" || typeof entry.type !== "string") return;
+      const kind = kindFor(entry);
+      if (!kind) return;
+      const value = valueText(entry);
+      if (entry.type === "url") {
+        for (const url of Array.isArray(entry.value) ? entry.value : []) {
+          if (typeof url === "string" && url.trim()) websites.push(url);
+        }
+      }
+      if (kind === "totp" && !value) return;
+      const label = typeof entry.label === "string" && entry.label.trim() ? entry.label : "";
+      const name = list === "fields" ? label || STANDARD_NAMES[entry.type] || entry.type : label || entry.type;
+      const baseId = list === "fields" ? `f:${entry.type}` : `c:${label || entry.type}`;
+      collector.add(baseId, name, kind, { kind: "field", list, index }, value);
+    });
+  }
+  if (typeof data.notes === "string" && data.notes) {
+    collector.add(NOTES_FIELD_ID, "notes", "concealed", { kind: "notes" }, data.notes);
+  }
+  for (const file of record.files ?? []) {
+    const fileData = file.data ?? {};
+    const name = typeof fileData.title === "string" && fileData.title || typeof fileData.name === "string" && fileData.name || "file";
+    collector.add(`${FILE_FIELD_PREFIX}${file.fileUid}`, name, "file", { kind: "file", file }, "");
+  }
+  return {
+    meta: {
+      externalItemId: record.recordUid,
+      name: safeSecretName(typeof data.title === "string" ? data.title : "", record.recordUid),
+      type: itemTypeForRecordType(typeof data.type === "string" ? data.type : void 0),
+      websites,
+      fields: collector.fields.map(({ externalFieldId, name, kind }) => ({
+        externalFieldId,
+        name,
+        kind
+      })),
+      version: Number.isFinite(record.revision) ? String(record.revision) : null,
+      updatedAt: null
+    },
+    fields: collector.fields
+  };
+}
+function fileSize(file) {
+  const size = file.data?.size;
+  return typeof size === "number" && size >= 0 ? size : null;
+}
+function totpParamsFor(value) {
+  try {
+    return parseTotpInput(value);
+  } catch {
+    return null;
+  }
+}
+function unavailable(message) {
+  throw new VaultProviderError("provider_unavailable", message);
+}
+function textValue(field) {
+  const value = field.value ?? "";
+  if (Buffer.byteLength(value, "utf8") > VAULT_LIMITS.textValueMaxBytes) {
+    unavailable(`The value of "${field.name}" is larger than Opengeni stores`);
+  }
+  return value;
+}
+function totpValue(field, label) {
+  const params = totpParamsFor(textValue(field));
+  if (!params) unavailable(`"${field.name}" is not a TOTP seed or otpauth:// URI`);
+  return totpUri(params, label);
+}
+function customEntry(field, title) {
+  if (field.kind === "file") unavailable("Keeper files cannot be written from Opengeni");
+  if (field.kind === "totp")
+    return { type: "oneTimeCode", label: field.name, value: [totpValue(field, title)] };
+  return {
+    type: field.kind === "concealed" ? "secret" : "text",
+    label: field.name,
+    value: [textValue(field)]
+  };
+}
+function buildCreateData(item) {
+  const title = item.name;
+  for (const field of item.fields) {
+    if (field.remove) unavailable("A new Keeper record has no fields to remove");
+  }
+  if (item.type === "login") {
+    let login = null;
+    let password = null;
+    let otp = null;
+    const custom = [];
+    const concealed = item.fields.filter((field) => field.kind === "concealed");
+    for (const field of item.fields) {
+      const key = nameKey(field.name);
+      if (field.kind === "text" && key === "username" && login === null) login = textValue(field);
+      else if (field.kind === "concealed" && password === null && (key === "password" || concealed.length === 1)) {
+        password = textValue(field);
+      } else if (field.kind === "totp" && otp === null) otp = totpValue(field, title);
+      else custom.push(customEntry(field, title));
+    }
+    const [first, ...rest] = item.websites.filter((url) => url.trim().length > 0);
+    for (const url of rest) custom.push({ type: "url", label: "website", value: [url] });
+    return {
+      type: "login",
+      title,
+      notes: "",
+      fields: [
+        { type: "login", value: login === null ? [] : [login] },
+        { type: "password", value: password === null ? [] : [password] },
+        { type: "url", value: first ? [first] : [] },
+        { type: "fileRef", value: [] },
+        { type: "oneTimeCode", value: otp === null ? [] : [otp] }
+      ],
+      custom
+    };
+  }
+  if (item.type === "note") {
+    let note = null;
+    const custom = [];
+    for (const field of item.fields) {
+      if (note === null && (field.kind === "text" || field.kind === "concealed"))
+        note = textValue(field);
+      else custom.push(customEntry(field, title));
+    }
+    return {
+      type: "encryptedNotes",
+      title,
+      notes: "",
+      fields: [
+        { type: "note", value: note === null ? [] : [note] },
+        { type: "date", value: [] }
+      ],
+      custom
+    };
+  }
+  return unavailable(
+    item.type === "passkey" ? "Passkeys live only in Opengeni vaults" : item.type === "api_key" ? "Keeper has no API key record type; create a login or a secure note" : "Keeper file records cannot be created from Opengeni"
+  );
+}
+function setEntryValue(entry, field, title) {
+  if (field.kind === "file") unavailable("Keeper files cannot be written from Opengeni");
+  if (TOTP_TYPES.has(entry.type)) {
+    entry.value = [totpValue(field, title)];
+    return;
+  }
+  const current = Array.isArray(entry.value) ? entry.value : [];
+  const scalar = current.length <= 1 && (current.length === 0 || typeof current[0] === "string");
+  if (!scalar || CONCEALED_COMPLEX.has(entry.type) || DATE_TYPES.has(entry.type)) {
+    unavailable(`"${field.name}" is a structured Keeper field; edit it in Keeper`);
+  }
+  entry.value = [field.kind === "totp" ? totpValue(field, title) : textValue(field)];
+}
+function applyPatch(record, item) {
+  const data = recordData(record);
+  data.fields = Array.isArray(data.fields) ? data.fields : [];
+  data.custom = Array.isArray(data.custom) ? data.custom : [];
+  const title = item.name;
+  const mapped = mapRecord(record).fields;
+  const removals = [];
+  for (const field of item.fields) {
+    const target = field.externalFieldId ? mapped.find((candidate) => candidate.externalFieldId === field.externalFieldId) : mapped.find((candidate) => nameKey(candidate.name) === nameKey(field.name));
+    if (field.externalFieldId && !target) {
+      throw new VaultProviderError(
+        "provider_not_found",
+        `The Keeper record has no field ${field.externalFieldId}`
+      );
+    }
+    if (!target) {
+      if (field.remove) continue;
+      data.custom.push(customEntry(field, title));
+      continue;
+    }
+    const source = target.source;
+    if (source.kind === "file") unavailable("Keeper files cannot be changed from Opengeni");
+    if (source.kind === "notes") {
+      data.notes = field.remove ? "" : textValue(field);
+      continue;
+    }
+    const entry = data[source.list][source.index];
+    if (field.remove) {
+      if (source.list === "custom") removals.push(source.index);
+      else entry.value = [];
+      continue;
+    }
+    setEntryValue(entry, field, title);
+  }
+  for (const index of removals.sort((a, b) => b - a)) data.custom.splice(index, 1);
+  data.title = title;
+  const websites = item.websites.filter((url) => url.trim().length > 0);
+  const current = mapRecord(record).meta.websites;
+  if (JSON.stringify(websites) !== JSON.stringify(current)) {
+    const standard = data.fields.find((entry) => entry.type === "url");
+    data.custom = data.custom.filter(
+      (entry) => !(entry.type === "url" && entry.label === "website")
+    );
+    const [first, ...rest] = websites;
+    if (standard) standard.value = first ? [first] : [];
+    else if (first) rest.unshift(first);
+    for (const url of rest) data.custom.push({ type: "url", label: "website", value: [url] });
+  }
+}
+
+// src/operations.ts
+import { providerOperations } from "@opengeni/vaults";
+function refused(what) {
+  throw new VaultProviderError(
+    "provider_permission_denied",
+    `${what} is not enabled for this vault connection`
+  );
+}
+function checkWrite(operations, item) {
+  const totp = item.fields.some((field) => field.kind === "totp" && !field.remove);
+  if (item.externalItemId !== void 0) {
+    if (!operations.updateItem) refused("Updating items");
+    if (totp && !operations.updateTotp) refused("Changing one-time password seeds");
+    if (item.fields.some((field) => field.remove) && !operations.removeField)
+      refused("Removing fields");
+    return;
+  }
+  if (!operations.createItemTypes.includes(item.type)) refused(`Creating ${item.type} items`);
+  if (totp && !operations.createTotp) refused("Adding one-time password seeds");
+}
+function restrictToOperations(provider, verified, fileFieldPrefix) {
+  if (!verified) return provider;
+  const effective = () => providerOperations(provider.capabilities(), { operations: verified, writeAccess: "unknown" });
+  return {
+    ...provider,
+    capabilities() {
+      const base = provider.capabilities();
+      const operations = effective();
+      const writes = operations.createItemTypes.length > 0 || operations.updateItem || operations.archiveItem;
+      return { ...base, write: base.write && writes, operations };
+    },
+    async readFields(ctx, vaultId, itemId, fieldIds) {
+      if (!effective().readFiles && fieldIds.some((id) => id.startsWith(fileFieldPrefix)))
+        refused("Reading files");
+      return provider.readFields(ctx, vaultId, itemId, fieldIds);
+    },
+    async writeItem(ctx, vaultId, item) {
+      checkWrite(effective(), item);
+      return provider.writeItem(ctx, vaultId, item);
+    },
+    async archiveItem(ctx, vaultId, itemId) {
+      if (!effective().archiveItem) refused("Archiving items");
+      return provider.archiveItem(ctx, vaultId, itemId);
+    }
+  };
+}
+
+// src/sdk.ts
+import * as nodeCrypto from "crypto";
+import { constants as fsConstants, readFileSync } from "fs";
+import { createRequire } from "module";
+import * as nodePath from "path";
+var KEEPER_SDK_VERSION = "17.6.0";
+var KEEPER_SDK_PACKAGE = "@keeper-security/secrets-manager-core";
+var KEEPER_SDK_SHA256 = "94787ce51324f36c1b62d19ac29fbe3b9b206305695e508b76585a4d6e39635c";
+var CapturedConsole = class _CapturedConsole {
+  lines = [];
+  static MAX_LINES = 200;
+  static MAX_CHARS = 500;
+  push(args) {
+    if (this.lines.length >= _CapturedConsole.MAX_LINES) return;
+    const text = args.map((arg) => arg instanceof Error ? `${arg.name}: ${arg.message}` : String(arg)).join(" ");
+    this.lines.push(text.slice(0, _CapturedConsole.MAX_CHARS));
+  }
+  error = (...args) => this.push(args);
+  warn = (...args) => this.push(args);
+  log = (...args) => this.push(args);
+  info = (...args) => this.push(args);
+  debug = (...args) => this.push(args);
+  /** True when the SDK dropped a record, folder or file it could not decrypt. */
+  get skippedSomething() {
+    return this.lines.some((line) => /skipped due to error|could not be decrypted/.test(line));
+  }
+};
+function denied(module) {
+  throw new Error(`The Keeper SDK may not use ${module} inside Opengeni`);
+}
+var FS_STUB = Object.freeze({ constants: fsConstants });
+var HTTPS_STUB = Object.freeze({});
+var OS_STUB = Object.freeze({});
+function sdkRequire(name) {
+  switch (name) {
+    case "crypto":
+      return nodeCrypto;
+    case "path":
+      return nodePath;
+    case "fs":
+      return FS_STUB;
+    case "https":
+      return HTTPS_STUB;
+    case "os":
+      return OS_STUB;
+    default:
+      return denied(name);
+  }
+}
+var compiled = null;
+function readInstalledKeeperSdkSource() {
+  const require2 = createRequire(import.meta.url);
+  let path;
+  try {
+    path = require2.resolve(KEEPER_SDK_PACKAGE);
+  } catch {
+    throw new VaultProviderError(
+      "provider_unavailable",
+      `${KEEPER_SDK_PACKAGE} ${KEEPER_SDK_VERSION} is not installed on this Opengeni server`
+    );
+  }
+  return readFileSync(path, "utf8");
+}
+function factoryFor(source, expectedSha256) {
+  const sha256 = nodeCrypto.createHash("sha256").update(source).digest("hex");
+  if (compiled && compiled.sha256 === sha256) return compiled.factory;
+  if (sha256 !== expectedSha256) {
+    throw new VaultProviderError(
+      "provider_unavailable",
+      `The installed Keeper SDK is not ${KEEPER_SDK_PACKAGE} ${KEEPER_SDK_VERSION}`
+    );
+  }
+  const factory = new Function("module", "exports", "require", "console", source);
+  compiled = { sha256, factory };
+  return factory;
+}
+function createKeeperSdkLoader(options = {}) {
+  let factory = null;
+  return {
+    instance() {
+      if (!factory) {
+        const source = typeof options.source === "function" ? options.source() : options.source ?? readInstalledKeeperSdkSource();
+        factory = factoryFor(source, options.expectedSha256 ?? KEEPER_SDK_SHA256);
+      }
+      const captured = new CapturedConsole();
+      const module = { exports: {} };
+      factory(module, module.exports, sdkRequire, captured);
+      return { sdk: module.exports, console: captured };
+    }
+  };
+}
+var KEEPER_REQUEST_TIMEOUT_MS = 15e3;
+var KEEPER_MAX_RESPONSE_BYTES = 32 * 1024 * 1024;
+async function readBounded(response, maxBytes) {
+  const declared = Number(response.headers.get("content-length") ?? "NaN");
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    await response.body?.cancel().catch(() => {
+    });
+    throw new VaultProviderError(
+      "provider_unavailable",
+      "Keeper returned more data than Opengeni reads"
+    );
+  }
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {
+      });
+      throw new VaultProviderError(
+        "provider_unavailable",
+        "Keeper returned more data than Opengeni reads"
+      );
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out;
+}
+function withDeadline(signal, timeoutMs) {
+  const timeout = AbortSignal.timeout(timeoutMs);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+async function refuseRedirect(response) {
+  if (response.status >= 300 && response.status < 400) {
+    await response.body?.cancel().catch(() => {
+    });
+    throw new VaultProviderError("provider_unavailable", "Keeper answered with a redirect");
+  }
+}
+function createKeeperFetchTransport(options = {}) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const maxBytes = options.maxResponseBytes ?? KEEPER_MAX_RESPONSE_BYTES;
+  return async (url, transmissionKey, payload, _allowUnverifiedCertificate, timeoutMs) => {
+    const response = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/octet-stream",
+        PublicKeyId: String(transmissionKey.publicKeyId),
+        TransmissionKey: Buffer.from(transmissionKey.encryptedKey).toString("base64"),
+        Authorization: `Signature ${Buffer.from(payload.signature).toString("base64")}`,
+        "User-Agent": `Opengeni (KSM JS ${KEEPER_SDK_VERSION})`
+      },
+      body: payload.payload,
+      redirect: "error",
+      signal: withDeadline(options.signal, timeoutMs ?? KEEPER_REQUEST_TIMEOUT_MS)
+    });
+    await refuseRedirect(response);
+    const data = await readBounded(response, maxBytes);
+    return { statusCode: response.status, headers: Object.fromEntries(response.headers), data };
+  };
+}
+function createKeeperFileFetcher(fetchImpl = (input, init) => globalThis.fetch(input, init)) {
+  return async (url, options) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+      throw new VaultProviderError("provider_unavailable", "Keeper returned a non-HTTPS file URL");
+    }
+    const response = await fetchImpl(parsed, {
+      redirect: "error",
+      signal: withDeadline(options.signal, options.timeoutMs)
+    });
+    await refuseRedirect(response);
+    if (!response.ok) {
+      await response.body?.cancel().catch(() => {
+      });
+      throw new VaultProviderError(
+        "provider_unavailable",
+        `Keeper file storage returned HTTP ${response.status}`
+      );
+    }
+    return readBounded(response, options.maxBytes);
+  };
+}
+
+// src/provider.ts
+var KEEPER_VALUE_CACHE_MS = VAULT_LIMITS.providerValueCacheMs;
+var KEEPER_OPERATIONS = {
+  createItemTypes: ["login", "note"],
+  updateItem: true,
+  removeField: true,
+  archiveItem: false,
+  archiveKind: "none",
+  deleteItem: false,
+  restoreItem: false,
+  readFiles: true,
+  writeFiles: false,
+  createTotp: true,
+  updateTotp: true,
+  createVault: false,
+  restoreFieldHistory: false
+};
+var KEEPER_UID = /^[A-Za-z0-9_-]{16,64}$/;
+function assertUids(...uids) {
+  for (const uid of uids) {
+    if (!KEEPER_UID.test(uid)) {
+      throw new VaultProviderError("provider_not_found", "No such Keeper shared folder or record");
+    }
+  }
+}
+async function runKeeperOperation(input) {
+  const allowed = (input.runtime.allowedHosts ?? KEEPER_DEFAULT_ALLOWED_HOSTS).map(
+    (host) => host.toLowerCase()
+  );
+  const { sdk, console } = input.loader.instance();
+  const storage = memoryKeeperStorage(input.config);
+  const transport = input.runtime.queryFunction ?? createKeeperFetchTransport({
+    ...input.signal ? { signal: input.signal } : {},
+    ...input.runtime.fetch ? { fetch: input.runtime.fetch } : {}
+  });
+  const tracker = { sent: 0, lastStatus: null, mutating: false };
+  const queryFunction = async (url, transmissionKey, payload, allow, timeoutMs) => {
+    input.signal?.throwIfAborted();
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || !parsed.pathname.startsWith("/api/rest/sm/v1/")) {
+      throw new VaultProviderError("provider_unavailable", "Refused an unexpected Keeper request");
+    }
+    assertAllowedHost(parsed.hostname, allowed);
+    if (tracker.mutating) {
+      tracker.sent += 1;
+      tracker.lastStatus = null;
+    }
+    const response = await transport(url, transmissionKey, payload, false, timeoutMs);
+    if (tracker.mutating) tracker.lastStatus = response.statusCode;
+    return response;
+  };
+  const options = {
+    storage,
+    queryFunction,
+    requestTimeoutMs: input.runtime.requestTimeoutMs ?? KEEPER_REQUEST_TIMEOUT_MS,
+    // Never sleep inside a request: surface the server's back-off to the caller.
+    throttleSleep: (ms) => Promise.reject(
+      new VaultProviderError(
+        "provider_rate_limited",
+        "Keeper is rate limiting this application",
+        ms
+      )
+    ),
+    onDecryptionError: () => {
+      throw new VaultProviderError(
+        "provider_inventory_incomplete",
+        "Keeper returned a folder Opengeni could not decrypt"
+      );
+    }
+  };
+  input.beforeNetwork?.(storage);
+  if (input.hostInConfig !== false) assertAllowedHost(storage.values.get("hostname"), allowed);
+  const result = await input.work({ sdk, options, console, tracker }, storage);
+  return { result, storage };
+}
+function cacheFor(map, budget) {
+  let cache = map.get(budget);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    map.set(budget, cache);
+  }
+  return cache;
+}
+function createKeeperVaultProvider(options) {
+  let config = parseKeeperConfiguration(options.configuration);
+  let persisted = serializeKeeperConfiguration(config);
+  let pending = null;
+  const loader = options.sdk ?? createKeeperSdkLoader();
+  const now = options.now ?? Date.now;
+  const valueCacheMs = options.valueCacheMs ?? KEEPER_VALUE_CACHE_MS;
+  const fetchFile = options.fetchFile ?? createKeeperFileFetcher(options.fetch);
+  let queue = Promise.resolve();
+  const attemptListCaches = /* @__PURE__ */ new WeakMap();
+  const attemptRecordCaches = /* @__PURE__ */ new WeakMap();
+  async function flushPending() {
+    if (pending === null) return;
+    const next = pending;
+    try {
+      await options.persistConfiguration(next, { previous: persisted, reason: "rotation" });
+    } catch {
+      throw new VaultProviderError(
+        "provider_unavailable",
+        "Opengeni could not save the updated Keeper configuration"
+      );
+    }
+    persisted = next;
+    if (pending === next) pending = null;
+  }
+  function serialized(work) {
+    const run = queue.then(work, work);
+    queue = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  function operation(ctx, op, subject, work) {
+    ctx.signal?.throwIfAborted();
+    ctx.budget.take(op);
+    return serialized(async () => {
+      ctx.signal?.throwIfAborted();
+      await flushPending();
+      let outcome = null;
+      let failure = null;
+      let storageRef = null;
+      let tracker = null;
+      try {
+        outcome = await runKeeperOperation({
+          runtime: options,
+          loader,
+          config,
+          ...ctx.signal ? { signal: ctx.signal } : {},
+          beforeNetwork: (storage2) => {
+            storageRef = storage2;
+          },
+          work: (keeper) => {
+            tracker = keeper.tracker;
+            return work(keeper);
+          }
+        });
+      } catch (error) {
+        failure = error;
+      }
+      const storage = outcome?.storage ?? storageRef;
+      let persistError = null;
+      if (storage?.changed()) {
+        config = new Map(storage.values);
+        pending = serializeKeeperConfiguration(config);
+        try {
+          await flushPending();
+        } catch (error) {
+          persistError = error;
+        }
+      }
+      if (failure !== null) {
+        const usedTracker = tracker;
+        if (op === "write" && usedTracker && (usedTracker.sent > 0 || usedTracker.mutating)) {
+          throw mapKeeperMutationError(failure, subject, usedTracker);
+        }
+        if (op !== "write" && failure instanceof Error && failure.name === "AbortError") {
+          ctx.signal?.throwIfAborted();
+        }
+        throw mapKeeperError(failure, subject);
+      }
+      if (persistError && op !== "write") throw persistError;
+      return outcome.result;
+    });
+  }
+  function reportFresh(ctx) {
+    const at = new Date(now()).toISOString();
+    ctx.onFreshness?.({
+      state: "current",
+      lastCheckedAt: at,
+      sourceSyncedAt: at,
+      source: "live",
+      errorCode: null,
+      retryAt: null
+    });
+  }
+  function incomplete() {
+    throw new VaultProviderError(
+      "provider_inventory_incomplete",
+      "Keeper returned records Opengeni could not decrypt; the listing is incomplete"
+    );
+  }
+  function allRecords(ctx) {
+    const cache = cacheFor(attemptListCaches, ctx.budget);
+    const key = ctx.cacheEpoch ?? "";
+    const cached = cache.get(key);
+    if (cached && !ctx.forceRefresh && now() - cached.at < valueCacheMs) return cached.records;
+    const records = operation(
+      ctx,
+      "list",
+      "list records",
+      async ({ sdk, options: sdkOptions, console }) => {
+        const secrets = await sdk.getSecrets2(sdkOptions);
+        if (console.skippedSomething) incomplete();
+        return secrets.records;
+      }
+    );
+    const entry = { at: now(), records };
+    cache.set(key, entry);
+    records.catch(() => {
+      if (cache.get(key) === entry) cache.delete(key);
+    });
+    return records;
+  }
+  async function fetchRecord(keeper, externalVaultId, externalItemId) {
+    const secrets = await keeper.sdk.getSecrets2(keeper.options, {
+      recordsFilter: [externalItemId]
+    });
+    const record = secrets.records.find((candidate) => candidate.recordUid === externalItemId);
+    if (!record) {
+      if (keeper.console.skippedSomething) {
+        throw new VaultProviderError(
+          "provider_unavailable",
+          "Opengeni could not decrypt this Keeper record"
+        );
+      }
+      throw new VaultProviderError("provider_not_found", "No such Keeper record");
+    }
+    if (record.folderUid !== externalVaultId) {
+      throw new VaultProviderError(
+        "provider_not_found",
+        "No such Keeper record in this shared folder"
+      );
+    }
+    return record;
+  }
+  function materialFor(mapped, field) {
+    if (field.kind === "totp") {
+      const params = totpParamsFor(field.value);
+      if (!params) {
+        throw new VaultProviderError(
+          "provider_unavailable",
+          `The one-time code in Keeper record "${mapped.meta.name}" is not a valid TOTP seed`
+        );
+      }
+      return { type: "totp", params };
+    }
+    return { type: "text", value: field.value };
+  }
+  async function readFile(keeper, field, signal) {
+    if (field.source.kind !== "file") throw new Error("not a file field");
+    const file = field.source.file;
+    const limit = VAULT_LIMITS.fileValueMaxBytes;
+    const size = fileSize(file);
+    if (size === null || size > limit) {
+      throw new VaultProviderError(
+        "provider_unavailable",
+        `"${field.name}" is larger than Opengeni reads from Keeper`
+      );
+    }
+    if (!file.url)
+      throw new VaultProviderError("provider_unavailable", "Keeper returned no download URL");
+    const encrypted = await fetchFile(file.url, {
+      ...signal ? { signal } : {},
+      // AES-GCM adds a 12-byte nonce and a 16-byte tag.
+      maxBytes: limit + 28,
+      timeoutMs: options.requestTimeoutMs ?? KEEPER_REQUEST_TIMEOUT_MS
+    });
+    const plain = await keeper.sdk.platform.decrypt(encrypted, file.fileUid);
+    if (plain.byteLength > limit) {
+      throw new VaultProviderError(
+        "provider_unavailable",
+        `"${field.name}" is larger than Opengeni reads from Keeper`
+      );
+    }
+    return new Uint8Array(plain);
+  }
+  const provider = {
+    id: "keeper",
+    capabilities() {
+      return {
+        write: true,
+        createVault: false,
+        totp: true,
+        // Legacy flag means file writes; reads are declared in operations.readFiles.
+        files: false,
+        groupGrants: false,
+        passkeys: false,
+        operations: {
+          ...KEEPER_OPERATIONS,
+          createItemTypes: [...KEEPER_OPERATIONS.createItemTypes]
+        }
+      };
+    },
+    async validate(ctx) {
+      const name = await operation(
+        ctx,
+        "list",
+        "validate",
+        async ({ sdk, options: sdkOptions }) => {
+          const secrets = await sdk.getSecrets2(sdkOptions);
+          const title = secrets.appData?.title;
+          return typeof title === "string" && title.trim() ? title.trim().slice(0, 200) : null;
+        }
+      );
+      return { accountName: name };
+    },
+    async listVaults(ctx) {
+      const folders = await operation(
+        ctx,
+        "list",
+        "list shared folders",
+        async ({ sdk, options: sdkOptions, console }) => {
+          const result = await sdk.getFolders(sdkOptions);
+          if (console.skippedSomething) incomplete();
+          return result;
+        }
+      );
+      reportFresh(ctx);
+      return folders.filter((folder) => !folder.parentUid).map((folder) => ({
+        externalVaultId: folder.folderUid,
+        name: safeSecretName(folder.name ?? "", folder.folderUid),
+        contentVersion: null,
+        itemCount: null,
+        // KSM does not tell an application whether a shared folder is editable.
+        writeAccess: "unknown"
+      }));
+    },
+    async listItems(ctx, externalVaultId) {
+      assertUids(externalVaultId);
+      const records = await allRecords(ctx);
+      const metas = records.filter((record) => record.folderUid === externalVaultId).map((record) => mapRecord(record).meta);
+      if (metas.length > VAULT_LIMITS.itemsPerVault) {
+        throw new VaultProviderError(
+          "provider_inventory_incomplete",
+          "The Keeper shared folder has more records than Opengeni mirrors at once"
+        );
+      }
+      for (const meta of metas) assertMirrorable(meta);
+      reportFresh(ctx);
+      return metas;
+    },
+    async readFields(ctx, externalVaultId, externalItemId, externalFieldIds) {
+      assertUids(externalVaultId, externalItemId);
+      const wantsFile = externalFieldIds.some((id) => id.startsWith("@file:"));
+      const cache = cacheFor(attemptRecordCaches, ctx.budget);
+      const key = `${ctx.cacheEpoch ?? ""}|${externalVaultId}/${externalItemId}`;
+      const cached = cache.get(key);
+      if (!wantsFile && cached && !ctx.forceRefresh && now() - cached.at < valueCacheMs) {
+        const mapped = await cached.record;
+        return externalFieldIds.map((externalFieldId) => {
+          const field = mapped.fields.find(
+            (candidate) => candidate.externalFieldId === externalFieldId
+          );
+          if (!field)
+            throw new VaultProviderError(
+              "provider_not_found",
+              `Keeper record has no field ${externalFieldId}`
+            );
+          return { externalFieldId, material: materialFor(mapped, field) };
+        });
+      }
+      let resolveMapped;
+      let rejectMapped;
+      const mappedPromise = new Promise((resolve, reject) => {
+        resolveMapped = resolve;
+        rejectMapped = reject;
+      });
+      mappedPromise.catch(() => {
+      });
+      const entry = { at: now(), record: mappedPromise };
+      cache.set(key, entry);
+      try {
+        return await operation(ctx, "read", "read record", async (keeper) => {
+          const record = await fetchRecord(keeper, externalVaultId, externalItemId);
+          const mapped = mapRecord(record);
+          resolveMapped({
+            ...mapped,
+            fields: mapped.fields.filter((field) => field.kind !== "file")
+          });
+          const values = [];
+          for (const externalFieldId of externalFieldIds) {
+            const field = mapped.fields.find(
+              (candidate) => candidate.externalFieldId === externalFieldId
+            );
+            if (!field) {
+              throw new VaultProviderError(
+                "provider_not_found",
+                `Keeper record "${mapped.meta.name}" has no field ${externalFieldId}`
+              );
+            }
+            values.push({
+              externalFieldId,
+              material: field.kind === "file" ? { type: "bytes", value: await readFile(keeper, field, ctx.signal) } : materialFor(mapped, field)
+            });
+          }
+          return values;
+        });
+      } catch (error) {
+        rejectMapped(error);
+        if (cache.get(key) === entry) cache.delete(key);
+        throw error;
+      }
+    },
+    async writeItem(ctx, externalVaultId, item) {
+      assertUids(externalVaultId);
+      const meta = await writeRecord(ctx, externalVaultId, item);
+      attemptRecordCaches.get(ctx.budget)?.clear();
+      attemptListCaches.get(ctx.budget)?.clear();
+      return meta;
+    },
+    async archiveItem() {
+      throw new VaultProviderError(
+        "provider_unavailable",
+        "Keeper Secrets Manager applications cannot archive or trash records; remove it in Keeper"
+      );
+    },
+    currentConfiguration: () => serializeKeeperConfiguration(config),
+    close: async () => {
+      await queue.catch(() => {
+      });
+    }
+  };
+  function writeRecord(ctx, externalVaultId, item) {
+    if (item.externalItemId === void 0) {
+      const data = buildCreateData(item);
+      return operation(ctx, "write", "create record", async (keeper) => {
+        const folders = await keeper.sdk.getFolders(keeper.options);
+        const folder = folders.find((candidate) => candidate.folderUid === externalVaultId);
+        if (!folder || folder.parentUid) {
+          throw new VaultProviderError("provider_not_found", "No such Keeper shared folder");
+        }
+        keeper.tracker.mutating = true;
+        const recordUid2 = await keeper.sdk.createSecret2(
+          keeper.options,
+          { folderUid: externalVaultId },
+          data
+        );
+        keeper.tracker.mutating = false;
+        try {
+          return mapRecord(await fetchRecord(keeper, externalVaultId, recordUid2)).meta;
+        } catch {
+          const meta = mapRecord({
+            recordUid: recordUid2,
+            folderUid: externalVaultId,
+            data,
+            revision: Number.NaN
+          }).meta;
+          return { ...meta, version: null };
+        }
+      });
+    }
+    const recordUid = item.externalItemId;
+    assertUids(recordUid);
+    return operation(ctx, "write", "update record", async (keeper) => {
+      const record = await fetchRecord(keeper, externalVaultId, recordUid);
+      if (item.expectedVersion !== void 0 && item.expectedVersion !== null && String(record.revision) !== item.expectedVersion) {
+        throw new VaultProviderError(
+          "provider_conflict",
+          "The Keeper record changed since it was read; read it again before writing"
+        );
+      }
+      applyPatch(record, item);
+      keeper.tracker.mutating = true;
+      await keeper.sdk.updateSecret2(keeper.options, record);
+      keeper.tracker.mutating = false;
+      try {
+        return mapRecord(await fetchRecord(keeper, externalVaultId, recordUid)).meta;
+      } catch {
+        return { ...mapRecord(record).meta, version: null };
+      }
+    });
+  }
+  return restrictToOperations(provider, options.operations, FILE_FIELD_PREFIX);
+}
+function assertMirrorable(meta) {
+  if (meta.fields.length > VAULT_LIMITS.fieldsPerItem || meta.websites.length > VAULT_LIMITS.websitesPerItem || meta.websites.some((website) => website.length > VAULT_LIMITS.websiteMaxChars)) {
+    throw new VaultProviderError(
+      "provider_inventory_incomplete",
+      `A Keeper record has more than ${VAULT_LIMITS.fieldsPerItem} fields or ${VAULT_LIMITS.websitesPerItem} websites (or a website over ${VAULT_LIMITS.websiteMaxChars} characters), more than Opengeni mirrors`
+    );
+  }
+}
+
+// src/bootstrap.ts
+var TOKEN_PART = /^[A-Za-z0-9_-]{16,128}$/;
+function invalidToken() {
+  throw new VaultProviderError(
+    "provider_auth_invalid",
+    "That is not a Keeper Secrets Manager one-time access token"
+  );
+}
+function keeperTokenHost(oneTimeToken, hostname) {
+  const parts = oneTimeToken.trim().split(":");
+  if (parts.length === 1) {
+    if (!TOKEN_PART.test(parts[0])) invalidToken();
+    if (!hostname) {
+      throw new VaultProviderError(
+        "provider_auth_invalid",
+        "This one-time token has no region prefix; choose the Keeper region"
+      );
+    }
+    return hostname;
+  }
+  if (parts.length !== 2 && !(parts.length === 4 && parts[0].toUpperCase() === "IL5"))
+    invalidToken();
+  if (!TOKEN_PART.test(parts[1])) invalidToken();
+  const region = parts[0].toUpperCase();
+  return KEEPER_REGION_HOSTS[region] ?? parts[0];
+}
+async function bootstrapKeeperConfiguration(options) {
+  const token = options.oneTimeToken.trim();
+  const allowed = (options.allowedHosts ?? KEEPER_DEFAULT_ALLOWED_HOSTS).map(
+    (host) => host.toLowerCase()
+  );
+  assertAllowedHost(keeperTokenHost(token, options.hostname), allowed);
+  const loader = options.sdk ?? createKeeperSdkLoader();
+  let tracker = null;
+  let bindStorage = null;
+  let accountName = null;
+  let failure = null;
+  try {
+    await runKeeperOperation({
+      runtime: options,
+      loader,
+      config: /* @__PURE__ */ new Map(),
+      hostInConfig: false,
+      ...options.signal ? { signal: options.signal } : {},
+      work: async (keeper, storage) => {
+        tracker = keeper.tracker;
+        bindStorage = storage;
+        await keeper.sdk.initializeStorage(storage, token, options.hostname);
+        assertAllowedHost(storage.values.get("hostname"), allowed);
+        keeper.tracker.mutating = true;
+        const secrets = await keeper.sdk.getSecrets2(keeper.options);
+        keeper.tracker.mutating = false;
+        const title = secrets.appData?.title;
+        accountName = typeof title === "string" && title.trim() ? title.trim().slice(0, 200) : null;
+      }
+    });
+  } catch (error) {
+    failure = error;
+  }
+  const bound = bindStorage;
+  if (bound?.values.get("appKey")) {
+    bound.values.delete("clientKey");
+    const configuration = serializeKeeperConfiguration(bound.values);
+    parseKeeperConfiguration(configuration);
+    if (options.persistConfiguration) {
+      try {
+        await options.persistConfiguration(configuration, { previous: null, reason: "bind" });
+      } catch {
+        throw new VaultProviderError(
+          "provider_unavailable",
+          "Keeper accepted the one-time token but Opengeni could not save the connection; generate a new token and connect again"
+        );
+      }
+    }
+    return { configuration, accountName };
+  }
+  try {
+    if (failure === null) {
+      throw new VaultProviderError(
+        "provider_outcome_unknown",
+        "Keeper did not complete binding; generate a new one-time token"
+      );
+    }
+    throw failure;
+  } catch (error) {
+    if (error instanceof VaultProviderError && error.code === "provider_outcome_unknown")
+      throw error;
+    const used = tracker;
+    const mapped = used ? mapKeeperMutationError(error, "redeem the one-time token", used) : error instanceof VaultProviderError ? error : new VaultProviderError(
+      "provider_auth_invalid",
+      "Keeper could not use that one-time token"
+    );
+    if (mapped.code === "provider_outcome_unknown") {
+      throw new VaultProviderError(
+        "provider_outcome_unknown",
+        "Keeper may have redeemed the one-time token; generate a new one and connect again"
+      );
+    }
+    if (mapped.code === "provider_auth_invalid" || mapped.code === "provider_permission_denied") {
+      throw new VaultProviderError(
+        "provider_auth_invalid",
+        "Keeper rejected the one-time token (expired, already used, or IP-locked); generate a new one"
+      );
+    }
+    throw mapped;
+  }
+}
+async function bootstrapKeeperVaultProvider(options) {
+  const { oneTimeToken: _token, hostname: _hostname, signal: _signal, ...runtime } = options;
+  const result = await bootstrapKeeperConfiguration(options);
+  const provider = createKeeperVaultProvider({ ...runtime, configuration: result.configuration });
+  return { ...result, provider };
+}
+
+// src/connection.ts
+async function openKeeperConnection(options) {
+  const persist = options.persistConfiguration;
+  if (!persist) {
+    throw new VaultProviderError(
+      "provider_unavailable",
+      "Keeper connections need durable configuration storage on this server"
+    );
+  }
+  const { credentials, persistConfiguration: _persist, operations, signal, ...runtime } = options;
+  let configuration;
+  if ("oneTimeToken" in credentials) {
+    const bound = await bootstrapKeeperConfiguration({
+      ...runtime,
+      oneTimeToken: credentials.oneTimeToken,
+      ...credentials.hostname ? { hostname: credentials.hostname } : {},
+      ...signal ? { signal } : {},
+      persistConfiguration: (next, context) => persist(keeperConfigurationRecord(next), { reason: context.reason })
+    });
+    configuration = keeperConfigurationRecord(bound.configuration);
+  } else {
+    configuration = keeperConfigurationRecord(credentials.configuration);
+  }
+  const provider = createKeeperVaultProvider({
+    ...runtime,
+    configuration,
+    ...operations ? { operations } : {},
+    persistConfiguration: (next, context) => persist(keeperConfigurationRecord(next), { reason: context.reason })
+  });
+  return { provider, configuration };
+}
+export {
+  FILE_FIELD_PREFIX,
+  KEEPER_CONFIG_KEYS,
+  KEEPER_DEFAULT_ALLOWED_HOSTS,
+  KEEPER_DEFINITE_REJECTION_STATUSES,
+  KEEPER_MAX_RESPONSE_BYTES,
+  KEEPER_OPERATIONS,
+  KEEPER_REGION_HOSTS,
+  KEEPER_REQUEST_TIMEOUT_MS,
+  KEEPER_SDK_PACKAGE,
+  KEEPER_SDK_SHA256,
+  KEEPER_SDK_VERSION,
+  KEEPER_VALUE_CACHE_MS,
+  NOTES_FIELD_ID,
+  bootstrapKeeperConfiguration,
+  bootstrapKeeperVaultProvider,
+  createKeeperSdkLoader,
+  createKeeperVaultProvider,
+  keeperConfigurationRecord,
+  keeperTokenHost,
+  openKeeperConnection,
+  parseKeeperConfiguration,
+  restrictToOperations,
+  serializeKeeperConfiguration
+};
+//# sourceMappingURL=index.js.map