@opengeni/vaults-keeper 0.0.0-stage → 3.3.0

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Cloudgeni-ai
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,148 @@
-# Temporary Holding Version
+# `@opengeni/vaults-keeper`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The Keeper Secrets Manager (KSM) provider for Opengeni vaults. It implements
+`VaultProvider` from `@opengeni/vaults` on a KSM application, using the
+official `@keeper-security/secrets-manager-core` pinned to exactly 17.6.0.
+
+Load it only with a dynamic `import()` from the API or the worker. Nothing
+else may import it, and nothing may import the SDK as a module
+(`test/import-guard.test.ts`).
+
+## Connecting: one-time token to configuration
+
+A customer creates a KSM application, shares folders with it and generates a
+one-time access token (`US:…`, `EU:…` and so on). The first request redeems
+the token and binds a key pair; the result is the connection's credential.
+
+```ts
+const keeper = await import("@opengeni/vaults-keeper");
+const { configuration, accountName } = await keeper.bootstrapKeeperConfiguration({
+  oneTimeToken, // hostname is needed only for a token without a region prefix
+  persistConfiguration: async (configuration, { previous, reason }) => {
+    // reason "bind", previous null: store it encrypted before anything else runs
+  },
+});
+const provider = keeper.createKeeperVaultProvider({
+  configuration, // or the stored string record
+  persistConfiguration: async (next, { previous }) => {
+    // compare-and-swap the stored, encrypted configuration from `previous` to `next`
+  },
+});
+```
+
+`bootstrapKeeperVaultProvider(options)` does both and returns
+`{ provider, configuration, accountName }`. It requires
+`persistConfiguration` and awaits it with the bound configuration before
+returning, so a later validate or list failure cannot lose a spent token's
+credential.
+
+- **Redeem once, save at once.** As soon as Keeper has bound the key pair,
+  the configuration is passed to `persistConfiguration` (`previous: null`,
+  `reason: "bind"`), even if something after the bind failed. If that save
+  fails, bootstrap reports `provider_unavailable` (without the configuration)
+  and the customer generates a new token. A lost bind response is
+  `provider_outcome_unknown` and is never retried, and so is a 5xx or any
+  other unexpected status (Keeper may have applied the bind behind a failing
+  gateway). A definite refusal is
+  `provider_auth_invalid`. If the application is IP-locked, the first request
+  locks it to the Opengeni egress address.
+- **Configuration.** JSON, base64 JSON (as Keeper tools export it) or a
+  string record. The adapter emits canonical JSON of a string record, with
+  binary entries in base64; `keeperConfigurationRecord()` returns the record
+  for structured storage. Only the known keys are kept; `hostname`,
+  `clientId`, `privateKey` and `appKey` are required. The host must be on
+  `allowedHosts` (default `KEEPER_REGION_HOSTS`: US, EU, AU, GOV, JP, CA and
+  IL5), checked before every request.
+- **Rotation.** When the server rotates its key, the SDK changes the
+  configuration and the adapter awaits `persistConfiguration` (`reason:
+  "rotation"`, `previous` the last saved value). If that fails,
+  the change stays pending and is persisted first on the next call, and the
+  read fails with `provider_unavailable` (a write that already happened still
+  succeeds). `currentConfiguration()` returns the latest value.
+
+Other options: `allowedHosts`, `requestTimeoutMs` (default 15 s),
+`valueCacheMs`, `operations` (the operations verified at setup; the provider
+narrows to them and refuses the rest before any request) and `fetch`. Servers
+pass a DNS-pinned `fetch` (the API and worker use `pinnedFetch` from
+`@opengeni/network`); both the KSM transport and file downloads use it and
+still apply the caller's abort signal, deadline, size bound and no-redirect
+rule. `queryFunction`, `fetchFile`, `sdk` and `now` exist for tests.
+
+Servers usually call `openKeeperConnection({ credentials, persistConfiguration,
+operations, fetch })` instead. `credentials` is either `{ oneTimeToken,
+hostname? }` or `{ configuration }` (a string record or JSON), and
+`persistConfiguration(record, { reason })` is required: without it the call
+refuses before any request. It returns `{ provider, configuration }`, the
+bound configuration as a string record, never the token.
+
+## How it uses the SDK
+
+The SDK keeps its keys in module-global state and, by default, can write its
+configuration and a response cache to disk. So the adapter never imports it
+as a module. `createKeeperSdkLoader` reads the SDK's `dist/index.cjs.js`,
+checks it against `KEEPER_SDK_SHA256`, and evaluates a fresh copy for every
+operation:
+
+- each operation has its own key cache, so connections in one process never
+  share key material;
+- `fs` is a stub with constants only, and `https` and `os` are empty, so the
+  SDK cannot touch disk or open its own connections;
+- configuration lives only in an in-memory store per operation;
+- requests go through the adapter's transport: POST only, no redirects, a
+  deadline and abort, and responses of at most 32 MB;
+- SDK console output is captured, bounded and never forwarded. Records the
+  SDK skips because they cannot be decrypted make a listing
+  `provider_inventory_incomplete`.
+
+Bundlers must keep `@keeper-security/secrets-manager-core` as an installed,
+external package: the loader resolves and reads its file at run time.
+
+Each operation is charged to the attempt's call budget, and operations for
+one connection are serialized. Throttling is reported at once as
+`provider_rate_limited` with Keeper's retry hint.
+
+## What it can do
+
+Vaults are the application's **shared folders**. Records shared directly to
+the application, outside a shared folder, are not listed. Subfolders are
+part of their shared folder.
+
+| Operation | Supported | Notes |
+| --- | --- | --- |
+| List vaults | yes | Shared folders; `writeAccess` is `"unknown"` because KSM does not report it. |
+| List items, read values | yes | Values read live, cached per attempt; `forceRefresh` bypasses the cache. |
+| Read files | yes | Size-checked, downloaded over HTTPS and decrypted in memory, at most 256 KiB. |
+| Create | login, note | In an existing shared folder. API key, file and passkey items are refused before any request. |
+| Update | yes | Field patch with the record revision as the version; a stale version is `provider_conflict`. Standard fields are emptied, custom fields removed. Structured fields (cards, bank accounts, key pairs, security questions) cannot be patched. |
+| TOTP | create and update | `oneTimeCode` fields. |
+| Archive, delete | **no** | KSM can only delete permanently, which the adapter does not expose. |
+| Create vault, write files | no | |
+
+Read-only shared folders and other permission checks are enforced by
+Keeper; a refused write is `provider_permission_denied`. A write whose
+response is lost, or answered with anything but 400, 401, 403, 404, 409 or
+429 (`KEEPER_DEFINITE_REJECTION_STATUSES`), is `provider_outcome_unknown`
+and is never retried.
+
+The per-attempt record cache belongs to one provider instance (one bound
+application), so providers that share an attempt budget never reuse each
+other's records. Records with more than 50 fields or 20 websites (or a
+website over 2,048 characters) make the listing
+`provider_inventory_incomplete` instead of being mirrored cut down.
+
+Field ids: `f:<type>` (standard fields), `c:<label or type>` (custom
+fields), `@notes` and `@file:<fileUid>`, with `#n` on repeated names.
+Records report their revision as the version and no update time.
+
+## Testing
+
+`bun test` runs against `test/fake-ksm.ts`, a fake KSM server that speaks
+the wire protocol with real cryptography (key binding, AES-GCM and CBC,
+ECDSA request signatures and key rotation). It covers the shared provider
+contract (read side), bootstrap, configuration rotation and persistence
+failure, reads, writes, permissions, conflicts, lost responses, throttling,
+budgets, aborts and SDK isolation.
+
+No live Keeper account was used. Request shapes come from the SDK source;
+the error bodies for throttling, permissions and revision conflicts follow
+the SDK's handling and Keeper documentation and are not verified live.

package/dist/bootstrap.d.ts

@@ -0,0 +1,40 @@
+import { type KeeperRuntimeOptions, type KeeperVaultProvider, type PersistKeeperConfiguration } from "./provider.js";
+export interface KeeperBootstrapOptions extends KeeperRuntimeOptions {
+    /** One-time access token, `REGION:key` (for example `US:…`), or a bare key with `hostname`. */
+    oneTimeToken: string;
+    /** Region host for a token without a region prefix. */
+    hostname?: string;
+    signal?: AbortSignal;
+    /**
+     * Awaited with the bound configuration (`previous: null`, `reason: "bind"`)
+     * as soon as Keeper has accepted the token, before bootstrap returns or
+     * reports a later failure. The token is spent at that point, so this is the
+     * only copy of the credential.
+     */
+    persistConfiguration?: PersistKeeperConfiguration;
+}
+export interface KeeperBootstrapResult {
+    /** Bound KSM configuration (JSON). Store it encrypted; it is the connection's credential. */
+    configuration: string;
+    /** The Secrets Manager application's title. */
+    accountName: string | null;
+}
+/** The region host a token names, checked against the allowlist before any network call. */
+export declare function keeperTokenHost(oneTimeToken: string, hostname?: string): string;
+/**
+ * Redeems a one-time access token once: generates the client key pair in
+ * memory, binds it with the first `get_secret` call, and returns the bound
+ * configuration. The token is never retried; an ambiguous failure means the
+ * customer must generate a new token.
+ */
+export declare function bootstrapKeeperConfiguration(options: KeeperBootstrapOptions): Promise<KeeperBootstrapResult>;
+/**
+ * Bootstrap, then a provider over the bound configuration. The configuration
+ * is persisted through `persistConfiguration` (reason `"bind"`) before this
+ * returns and before the provider makes any request.
+ */
+export declare function bootstrapKeeperVaultProvider(options: KeeperBootstrapOptions & {
+    persistConfiguration: PersistKeeperConfiguration;
+}): Promise<KeeperBootstrapResult & {
+    provider: KeeperVaultProvider;
+}>;

package/dist/config.d.ts

@@ -0,0 +1,41 @@
+import type { KeyValueStorage } from "./sdk.js";
+/** Region prefixes of a one-time token (`US:…`), as mapped by SDK 17.6.0 `initializeStorage`. */
+export declare const KEEPER_REGION_HOSTS: {
+    readonly US: "keepersecurity.com";
+    readonly EU: "keepersecurity.eu";
+    readonly AU: "keepersecurity.com.au";
+    readonly GOV: "govcloud.keepersecurity.us";
+    readonly JP: "keepersecurity.jp";
+    readonly CA: "keepersecurity.ca";
+    readonly IL5: "il5.keepersecurity.us";
+};
+/**
+ * Hosts a configuration may talk to. The SDK treats an unknown token prefix
+ * as a host name, so without this list a crafted token or configuration could
+ * point Opengeni's server at an arbitrary host.
+ */
+export declare const KEEPER_DEFAULT_ALLOWED_HOSTS: readonly string[];
+/** Keys of the standard KSM JSON configuration. Bytes are standard base64. */
+export declare const KEEPER_CONFIG_KEYS: readonly ["hostname", "clientId", "clientKey", "privateKey", "appKey", "appOwnerPublicKey", "serverPublicKeyId", "serverPublicKey"];
+export type KeeperConfigKey = (typeof KEEPER_CONFIG_KEYS)[number];
+export type KeeperConfigValues = Map<KeeperConfigKey, string>;
+/**
+ * Parses a bound KSM configuration (JSON, or base64 of JSON as Keeper tools
+ * export it, or the already parsed string record). Unknown keys are dropped;
+ * the client must already be bound (appKey present).
+ */
+export declare function parseKeeperConfiguration(input: string | Readonly<Record<string, string>>): KeeperConfigValues;
+/** The canonical JSON form (sorted known keys) handed to the persistence callback. */
+export declare function serializeKeeperConfiguration(values: KeeperConfigValues): string;
+/** The canonical string record of a bound configuration, for structured storage. */
+export declare function keeperConfigurationRecord(configuration: string | Readonly<Record<string, string>>): Record<string, string>;
+export declare function assertAllowedHost(hostname: string | undefined, allowed: readonly string[]): string;
+/**
+ * In-memory KSM storage over a copy of the configuration. Nothing reaches
+ * disk; `changed` reports whether the SDK rewrote any persisted key (binding,
+ * server key rotation) so the caller can persist the new configuration.
+ */
+export declare function memoryKeeperStorage(initial?: KeeperConfigValues): KeyValueStorage & {
+    readonly values: KeeperConfigValues;
+    changed(): boolean;
+};

package/dist/connection.d.ts

@@ -0,0 +1,37 @@
+import { type VaultProviderOperations } from "./contract.js";
+import { type KeeperRuntimeOptions, type KeeperVaultProvider } from "./provider.js";
+/** What a server stores for a Keeper connection: setup input, or the bound configuration. */
+export type KeeperConnectionCredentials = {
+    oneTimeToken: string;
+    hostname?: string;
+} | {
+    configuration: string | Readonly<Record<string, string>>;
+};
+/**
+ * Durable, encrypted storage for the bound configuration. Called with
+ * `reason: "bind"` when a one-time token is redeemed (before anything else
+ * runs) and `reason: "rotation"` when Keeper rotates its key.
+ */
+export type PersistKeeperConfigurationRecord = (configuration: Record<string, string>, context: {
+    reason: "bind" | "rotation";
+}) => Promise<void>;
+export interface OpenKeeperConnectionOptions extends KeeperRuntimeOptions {
+    credentials: KeeperConnectionCredentials;
+    /** Required: without durable storage a redeemed token or a rotated key would be lost. */
+    persistConfiguration?: PersistKeeperConfigurationRecord;
+    /** Operations verified at setup; the provider narrows to them. */
+    operations?: VaultProviderOperations;
+    valueCacheMs?: number;
+    signal?: AbortSignal;
+}
+/**
+ * One Keeper connection for a server: redeems a one-time token or opens a
+ * stored configuration, and returns the provider with the bound configuration
+ * as a string record. The one-time token is never part of the result. Each
+ * call has its own provider; SDK state is per operation, so connections never
+ * share keys.
+ */
+export declare function openKeeperConnection(options: OpenKeeperConnectionOptions): Promise<{
+    provider: KeeperVaultProvider;
+    configuration: Record<string, string>;
+}>;

package/dist/contract.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The shared vault contracts this adapter implements, re-exported for the
+ * package's modules so every file names one source.
+ */
+export { VaultProviderError, type ProviderCallBudget, type ProviderCallOperation, type ProviderFieldMeta, type ProviderFieldValue, type ProviderItemMeta, type ProviderVault, type ProviderWriteField, type ProviderWriteItem, type VaultProvider, type VaultProviderAuthority, type VaultProviderCapabilities, type VaultProviderContext, type VaultProviderErrorCode, } from "@opengeni/vaults";
+export { VAULT_LIMITS, parseTotpInput, type SecretMaterial, type TotpParams, type VaultFieldKind, type VaultItemType, type VaultProviderOperations, } from "@opengeni/contracts";

package/dist/errors.d.ts

@@ -0,0 +1,36 @@
+import { VaultProviderError } from "./contract.js";
+export interface KeeperErrorBody {
+    code: string | null;
+    message: string;
+    retryAfterSeconds: number | null;
+}
+/** Parses the JSON error body the SDK embeds in its Error message. */
+export declare function keeperErrorBody(error: unknown): KeeperErrorBody | null;
+export declare function isAbortLike(error: unknown): boolean;
+/**
+ * Maps any failure of a read-side operation. stderr-like SDK text never
+ * leaves this function; only a closed result code may appear in messages.
+ */
+export declare function mapKeeperError(error: unknown, subject: string): VaultProviderError;
+/** Tracks one mutation's requests so a failure can be classified as definite or unknown. */
+export interface MutationTracker {
+    /** Requests started for the mutation itself. */
+    sent: number;
+    /** Status of the last mutation response, if one arrived. */
+    lastStatus: number | null;
+}
+/**
+ * Statuses with which Keeper refuses a request before applying it: a bad or
+ * unauthorised request (400, 401, 403), a missing target (404), a revision
+ * conflict (409) or throttling (429). Any other status after the request was
+ * sent (5xx from Keeper or a proxy, an unexpected 2xx or 3xx) may follow an
+ * applied change.
+ */
+export declare const KEEPER_DEFINITE_REJECTION_STATUSES: ReadonlySet<number>;
+/**
+ * A mutation failure is definite only when nothing was sent, or Keeper
+ * answered the last request with a known rejection status. A transport
+ * failure, deadline or abort after sending, any other status (502 included),
+ * or any failure after a 200, leaves the outcome unknown.
+ */
+export declare function mapKeeperMutationError(error: unknown, subject: string, tracker: MutationTracker): VaultProviderError;

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { KEEPER_OPERATIONS, KEEPER_VALUE_CACHE_MS, createKeeperVaultProvider, type KeeperRuntimeOptions, type KeeperVaultProvider, type KeeperVaultProviderOptions, type PersistKeeperConfiguration, } from "./provider.js";
+export { bootstrapKeeperConfiguration, bootstrapKeeperVaultProvider, keeperTokenHost, type KeeperBootstrapOptions, type KeeperBootstrapResult, } from "./bootstrap.js";
+export { KEEPER_CONFIG_KEYS, KEEPER_DEFAULT_ALLOWED_HOSTS, KEEPER_REGION_HOSTS, keeperConfigurationRecord, parseKeeperConfiguration, serializeKeeperConfiguration, } from "./config.js";
+export { KEEPER_MAX_RESPONSE_BYTES, KEEPER_REQUEST_TIMEOUT_MS, KEEPER_SDK_PACKAGE, KEEPER_SDK_SHA256, KEEPER_SDK_VERSION, createKeeperSdkLoader, type KeeperFetch, type KeeperFileFetcher, type KeeperQueryFunction, type KeeperSdkLoader, } from "./sdk.js";
+export { FILE_FIELD_PREFIX, NOTES_FIELD_ID } from "./mapping.js";
+export { openKeeperConnection, type KeeperConnectionCredentials, type OpenKeeperConnectionOptions, type PersistKeeperConfigurationRecord, } from "./connection.js";
+export { restrictToOperations } from "./operations.js";
+export { KEEPER_DEFINITE_REJECTION_STATUSES } from "./errors.js";