@opengeni/vaults-protonpass 0.0.0-stage → 3.3.0

package/dist/index.js

@@ -0,0 +1,1836 @@
+// src/provider.ts
+import { lstatSync as lstatSync2, readFileSync, rmSync as rmSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/contract.ts
+import {
+  VaultProviderError
+} from "@opengeni/vaults";
+import {
+  VAULT_LIMITS,
+  parseTotpInput
+} from "@opengeni/contracts";
+
+// src/naming.ts
+var FORBIDDEN_NAME_CHARS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/g;
+function nameKey(name) {
+  return name.normalize("NFC").trim().toLowerCase();
+}
+function safeSecretName(raw, fallback) {
+  const max = VAULT_LIMITS.nameMaxChars;
+  let name = raw.replace(FORBIDDEN_NAME_CHARS, "-").trim().slice(0, max).trim();
+  if (!name) name = fallback.replace(FORBIDDEN_NAME_CHARS, "-").trim().slice(0, max) || "item";
+  if (/^id:/i.test(name)) name = `id-${name.slice(3)}`;
+  return name;
+}
+function safeFieldName(raw, fallback) {
+  const name = safeSecretName(raw, fallback);
+  return nameKey(name) === "otp" ? "otp-code" : name;
+}
+function uniqueName(name, taken) {
+  let candidate = name;
+  for (let n = 2; taken.has(nameKey(candidate)); n += 1) {
+    const suffix = ` (${n})`;
+    candidate = `${name.slice(0, VAULT_LIMITS.nameMaxChars - suffix.length)}${suffix}`;
+  }
+  taken.add(nameKey(candidate));
+  return candidate;
+}
+function totpUri(params, label) {
+  const query = new URLSearchParams({
+    secret: params.secretBase32,
+    algorithm: params.algorithm,
+    digits: String(params.digits),
+    period: String(params.periodSeconds)
+  });
+  return `otpauth://totp/${encodeURIComponent(label || "Opengeni")}?${query.toString()}`;
+}
+
+// src/mapping.ts
+var NOTE_FIELD_ID = "@note";
+var FILE_FIELD_PREFIX = "@file:";
+var LOGIN_FIELD_IDS = {
+  username: "login.username",
+  email: "login.email",
+  password: "login.password",
+  totp: "login.totp"
+};
+var TOTP_FIELD_NAME = "one-time password";
+var IDENTITY_CONCEALED = /* @__PURE__ */ new Set(["social_security_number", "passport_number", "license_number"]);
+var FieldCollector = class {
+  fields = [];
+  names = /* @__PURE__ */ new Set();
+  ids = /* @__PURE__ */ new Map();
+  add(baseId, rawName, kind, value) {
+    const seen = (this.ids.get(baseId) ?? 0) + 1;
+    this.ids.set(baseId, seen);
+    const externalFieldId = seen === 1 ? baseId : `${baseId}#${seen}`;
+    const name = uniqueName(safeFieldName(rawName, "field"), this.names);
+    this.fields.push({ externalFieldId, name, kind, value });
+  }
+  extra(prefix, field) {
+    const content = field.content;
+    const id = `${prefix}${field.name}`;
+    if ("Text" in content) this.add(id, field.name, "text", { type: "text", value: content.Text });
+    else if ("Hidden" in content) {
+      this.add(id, field.name, "concealed", { type: "text", value: content.Hidden });
+    } else if ("Totp" in content) {
+      if (content.Totp) this.add(id, field.name, "totp", { type: "totp", uri: content.Totp });
+      else this.add(id, field.name, "text", { type: "text", value: "" });
+    } else {
+      this.add(id, field.name, "text", { type: "text", value: timestampText(content.Timestamp) });
+    }
+  }
+  sections(sections) {
+    for (const section of sections) {
+      for (const field of section.section_fields) this.extra(`s:${section.section_name}/`, field);
+    }
+  }
+};
+function timestampText(seconds) {
+  const date = new Date(seconds * 1e3);
+  return Number.isNaN(date.getTime()) ? String(seconds) : date.toISOString();
+}
+function variantName(content) {
+  if (typeof content === "string") return content;
+  return Object.keys(content)[0] ?? "Note";
+}
+function itemTypeForVariant(variant) {
+  switch (variant) {
+    case "Login":
+      return "login";
+    case "Note":
+      return "note";
+    case "Custom":
+    case "SshKey":
+      return "api_key";
+    default:
+      return "note";
+  }
+}
+function civilToIso(civil) {
+  const date = /* @__PURE__ */ new Date(`${civil}Z`);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+function concealedText(collector, id, name, value) {
+  collector.add(id, name, "concealed", { type: "text", value });
+}
+function plainText(collector, id, name, value) {
+  collector.add(id, name, "text", { type: "text", value });
+}
+function identityFields(collector, identity) {
+  for (const [key, value] of Object.entries(identity)) {
+    if (typeof value === "string") {
+      if (!value) continue;
+      if (IDENTITY_CONCEALED.has(key)) concealedText(collector, `identity.${key}`, key, value);
+      else plainText(collector, `identity.${key}`, key, value);
+      continue;
+    }
+    if (!Array.isArray(value)) continue;
+    for (const entry of value) {
+      if (!entry || typeof entry !== "object") continue;
+      const record = entry;
+      if (typeof record.section_name === "string" && Array.isArray(record.section_fields)) {
+        collector.sections([
+          { section_name: record.section_name, section_fields: extraFields(record.section_fields) }
+        ]);
+      } else {
+        for (const field of extraFields([record])) collector.extra(`s:${key}/`, field);
+      }
+    }
+  }
+}
+function extraFields(values) {
+  const out = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object") continue;
+    const record = value;
+    if (typeof record.name !== "string" || !record.content || typeof record.content !== "object") {
+      continue;
+    }
+    const content = record.content;
+    if (typeof content.Text === "string")
+      out.push({ name: record.name, content: { Text: content.Text } });
+    else if (typeof content.Hidden === "string") {
+      out.push({ name: record.name, content: { Hidden: content.Hidden } });
+    } else if (typeof content.Totp === "string") {
+      out.push({ name: record.name, content: { Totp: content.Totp } });
+    } else if (typeof content.Timestamp === "number") {
+      out.push({ name: record.name, content: { Timestamp: content.Timestamp } });
+    }
+  }
+  return out;
+}
+function mapItem(item, attachments = []) {
+  const collector = new FieldCollector();
+  const content = item.content.content;
+  const variant = variantName(content);
+  const websites = [];
+  if (typeof content === "object") {
+    if ("Login" in content) {
+      const login = content.Login;
+      plainText(collector, LOGIN_FIELD_IDS.username, "username", login.username);
+      if (login.email) plainText(collector, LOGIN_FIELD_IDS.email, "email", login.email);
+      concealedText(collector, LOGIN_FIELD_IDS.password, "password", login.password);
+      if (login.totp_uri) {
+        collector.add(LOGIN_FIELD_IDS.totp, TOTP_FIELD_NAME, "totp", {
+          type: "totp",
+          uri: login.totp_uri
+        });
+      }
+      websites.push(...login.urls.filter((url) => url.trim().length > 0));
+    } else if ("SshKey" in content) {
+      concealedText(collector, "ssh.private_key", "private key", content.SshKey.private_key);
+      plainText(collector, "ssh.public_key", "public key", content.SshKey.public_key);
+      collector.sections(content.SshKey.sections);
+    } else if ("Wifi" in content) {
+      plainText(collector, "wifi.ssid", "ssid", content.Wifi.ssid);
+      concealedText(collector, "wifi.password", "password", content.Wifi.password);
+      collector.sections(content.Wifi.sections);
+    } else if ("CreditCard" in content) {
+      const card = content.CreditCard;
+      plainText(collector, "card.cardholder_name", "cardholder name", card.cardholder_name);
+      concealedText(collector, "card.number", "number", card.number);
+      concealedText(
+        collector,
+        "card.verification_number",
+        "verification number",
+        card.verification_number
+      );
+      plainText(collector, "card.expiration_date", "expiration date", card.expiration_date);
+      if (card.pin) concealedText(collector, "card.pin", "PIN", card.pin);
+    } else if ("Identity" in content) {
+      identityFields(collector, content.Identity);
+    } else if ("Custom" in content) {
+      collector.sections(content.Custom.sections);
+    }
+  }
+  const note = item.content.note;
+  if (variant === "Note" || note) {
+    collector.add(NOTE_FIELD_ID, "note", "concealed", { type: "text", value: note });
+  }
+  for (const field of item.content.extra_fields) collector.extra("x:", field);
+  for (const attachment of attachments) {
+    collector.add(`${FILE_FIELD_PREFIX}${attachment.id}`, attachment.content.name, "file", {
+      type: "file",
+      attachment
+    });
+  }
+  const meta = {
+    externalItemId: item.id,
+    name: safeSecretName(item.content.title, item.id),
+    type: itemTypeForVariant(variant),
+    websites,
+    fields: collector.fields.map(({ externalFieldId, name, kind }) => ({
+      externalFieldId,
+      name,
+      kind
+    })),
+    version: item.modify_time,
+    updatedAt: civilToIso(item.modify_time)
+  };
+  return { meta, fields: collector.fields };
+}
+
+// src/operations.ts
+import { providerOperations } from "@opengeni/vaults";
+function refused(what) {
+  throw new VaultProviderError(
+    "provider_permission_denied",
+    `${what} is not enabled for this vault connection`
+  );
+}
+function checkWrite(operations, item) {
+  const totp = item.fields.some((field) => field.kind === "totp" && !field.remove);
+  if (item.externalItemId !== void 0) {
+    if (!operations.updateItem) refused("Updating items");
+    if (totp && !operations.updateTotp) refused("Changing one-time password seeds");
+    if (item.fields.some((field) => field.remove) && !operations.removeField)
+      refused("Removing fields");
+    return;
+  }
+  if (!operations.createItemTypes.includes(item.type)) refused(`Creating ${item.type} items`);
+  if (totp && !operations.createTotp) refused("Adding one-time password seeds");
+}
+function restrictToOperations(provider, verified, fileFieldPrefix) {
+  if (!verified) return provider;
+  const effective = () => providerOperations(provider.capabilities(), { operations: verified, writeAccess: "unknown" });
+  return {
+    ...provider,
+    capabilities() {
+      const base = provider.capabilities();
+      const operations = effective();
+      const writes = operations.createItemTypes.length > 0 || operations.updateItem || operations.archiveItem;
+      return { ...base, write: base.write && writes, operations };
+    },
+    async readFields(ctx, vaultId, itemId, fieldIds) {
+      if (!effective().readFiles && fieldIds.some((id) => id.startsWith(fileFieldPrefix)))
+        refused("Reading files");
+      return provider.readFields(ctx, vaultId, itemId, fieldIds);
+    },
+    async writeItem(ctx, vaultId, item) {
+      checkWrite(effective(), item);
+      return provider.writeItem(ctx, vaultId, item);
+    },
+    async archiveItem(ctx, vaultId, itemId) {
+      if (!effective().archiveItem) refused("Archiving items");
+      return provider.archiveItem(ctx, vaultId, itemId);
+    }
+  };
+}
+
+// src/schema.ts
+import { z } from "zod";
+var Id = z.string().min(1).max(512);
+var CivilDateTime = z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?$/);
+var ShareRole = z.union([
+  z.enum(["Owner", "Manager", "Editor", "Viewer"]),
+  z.object({
+    Custom: z.object({ name: z.string().optional(), permission: z.number().int().min(0) })
+  })
+]);
+var ShareListOutput = z.object({
+  shares: z.array(
+    z.object({
+      id: Id,
+      name: z.string(),
+      share_type: z.string(),
+      share_role: ShareRole
+    })
+  )
+});
+var VaultListOutput = z.object({
+  vaults: z.array(z.object({ name: z.string(), vault_id: Id, share_id: Id }))
+});
+var ExtraFieldContent = z.union([
+  z.object({ Text: z.string() }),
+  z.object({ Hidden: z.string() }),
+  z.object({ Totp: z.string() }),
+  z.object({ Timestamp: z.number().int() })
+]);
+var ExtraField = z.object({ name: z.string(), content: ExtraFieldContent });
+var Section = z.object({ section_name: z.string(), section_fields: z.array(ExtraField) });
+var OptionalString = z.string().nullish().transform((value) => value ?? "");
+var LoginContent = z.object({
+  email: OptionalString,
+  username: OptionalString,
+  password: OptionalString,
+  urls: z.array(z.string()).default([]),
+  totp_uri: OptionalString
+});
+var SshKeyContent = z.object({
+  private_key: OptionalString,
+  public_key: OptionalString,
+  sections: z.array(Section).default([])
+});
+var WifiContent = z.object({
+  ssid: OptionalString,
+  password: OptionalString,
+  sections: z.array(Section).default([])
+});
+var CreditCardContent = z.object({
+  cardholder_name: OptionalString,
+  number: OptionalString,
+  verification_number: OptionalString,
+  expiration_date: OptionalString,
+  pin: OptionalString
+});
+var IdentityContent = z.record(z.string(), z.unknown());
+var CustomContent = z.object({ sections: z.array(Section).default([]) });
+var ItemContentVariant = z.union([
+  z.object({ Note: z.null() }).strict(),
+  z.object({ Alias: z.null() }).strict(),
+  z.object({ Login: LoginContent }),
+  z.object({ SshKey: SshKeyContent }),
+  z.object({ Wifi: WifiContent }),
+  z.object({ CreditCard: CreditCardContent }),
+  z.object({ Identity: IdentityContent }),
+  z.object({ Custom: CustomContent }),
+  z.literal("Note"),
+  z.literal("Alias")
+]);
+var Item = z.object({
+  id: Id,
+  share_id: Id,
+  vault_id: z.string().optional(),
+  content: z.object({
+    title: z.string(),
+    note: OptionalString,
+    content: ItemContentVariant,
+    extra_fields: z.array(ExtraField).default([])
+  }),
+  state: z.string(),
+  flags: z.array(z.string()).default([]),
+  create_time: CivilDateTime,
+  modify_time: CivilDateTime
+});
+var Attachment = z.object({
+  id: Id,
+  size: z.number().int().min(0),
+  content: z.object({ name: z.string(), mime_type: z.string().optional() })
+});
+var ItemDetails = z.object({
+  item: Item,
+  attachments: z.array(Attachment).default([])
+});
+var FullItemList = z.object({ items: z.array(Item) });
+var ItemSummary = z.object({
+  id: Id,
+  share_id: Id,
+  state: z.string(),
+  flags: z.array(z.string()).default([]),
+  create_time: CivilDateTime,
+  modify_time: CivilDateTime,
+  title: z.string(),
+  item_type: z.string()
+});
+var ItemSummaryList = z.object({ items: z.array(ItemSummary) });
+var InfoOutput = z.object({
+  personal_access_token_name: z.string().optional(),
+  username: z.string().optional(),
+  session_has_lock: z.boolean().optional()
+});
+var ITEM_HAS_FILES = "ItemHasFiles";
+var SHARE_PERMISSION = {
+  admin: 1,
+  read: 2,
+  create: 4,
+  update: 8,
+  trash: 16,
+  delete: 32
+};
+
+// src/session.ts
+import { createHash, randomBytes } from "crypto";
+import {
+  accessSync,
+  chmodSync,
+  constants as fsConstants,
+  createReadStream,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  realpathSync,
+  rmSync,
+  statSync
+} from "fs";
+import { tmpdir } from "os";
+import { delimiter, isAbsolute, join, resolve } from "path";
+
+// src/errors.ts
+var REASON = /Could not perform operation\. Reason: ([A-Za-z]+)/;
+var STATUS = /Invalid status code(?: for download chunk)?: (\d{3})/;
+var SESSION_INVALIDATED = /Your session has been invalidated/;
+var NOT_AUTHENTICATED = /This operation requires an authenticated client/;
+var NOT_FOUND = /Item not found|Share with id \S+ not found|Could not find vault|Could not find item|Attachment not found/;
+var NETWORK = /error sending request|dns error|failed to lookup address|Connection refused|connection (?:reset|closed)|operation timed out|tcp connect error|certificate/i;
+var PERMISSION_REASONS = /* @__PURE__ */ new Set([
+  "PermissionDenied",
+  "NotAllowed",
+  "InsufficientScope",
+  "AdminPermissionMissing",
+  "Banned",
+  "FeatureDisabled"
+]);
+var NOT_FOUND_REASONS = /* @__PURE__ */ new Set(["NotExists", "DeletedShare"]);
+var CONFLICT_REASONS = /* @__PURE__ */ new Set(["NotLatestRevision", "NotLatestKey", "AlreadyExists"]);
+var QUOTA_REASONS = /* @__PURE__ */ new Set(["NoQuotaLeft", "ResourceLimitExceeded", "PayloadTooLarge"]);
+function protonReason(stderr) {
+  return REASON.exec(stderr)?.[1] ?? null;
+}
+function protonStatus(stderr) {
+  const match = STATUS.exec(stderr);
+  return match ? Number(match[1]) : null;
+}
+var PROTON_DEFINITE_REJECTION_STATUSES = /* @__PURE__ */ new Set([
+  400,
+  401,
+  403,
+  404,
+  409,
+  413,
+  422,
+  429
+]);
+var PROTON_DEFINITE_REJECTION_REASONS = /* @__PURE__ */ new Set([
+  ...PERMISSION_REASONS,
+  ...NOT_FOUND_REASONS,
+  ...CONFLICT_REASONS,
+  ...QUOTA_REASONS,
+  "SessionLocked",
+  "IsLocked",
+  "InvalidSignature",
+  "MissingKeys",
+  "RotationPayloadIncomplete",
+  "IncompatibleState",
+  "BadLockId",
+  "InvalidRequirements",
+  "InvalidValue",
+  "InvalidType",
+  "ValueOutOfBounds",
+  "NotNull",
+  "NotEmpty",
+  "NotTrue",
+  "NotFalse",
+  "NotEqual",
+  "Equal",
+  "NotSameAsField",
+  "RegexError",
+  "InvalidNumber",
+  "InvalidLength",
+  "TooShort",
+  "TooLong",
+  "HashNotEqual",
+  "EmailFormat",
+  "IpFormat",
+  "UrlFormat",
+  "CurrencyFormat",
+  "LocaleFormat",
+  "DateFormat",
+  "JsonFormat",
+  "MimeFormat",
+  "PhoneFormat",
+  "DomainFormat",
+  "PgpFormat",
+  "IdFormat",
+  "HexFormat",
+  "Base64Format",
+  "VersionFormat",
+  "ImageFormat"
+]);
+function isDefiniteRejection(stderr) {
+  const reason = protonReason(stderr);
+  if (reason !== null) return PROTON_DEFINITE_REJECTION_REASONS.has(reason);
+  const status = protonStatus(stderr);
+  return status !== null && PROTON_DEFINITE_REJECTION_STATUSES.has(status);
+}
+function mapProtonFailure(result, subject) {
+  if (result.spawnError) {
+    return new VaultProviderError("provider_unavailable", "pass-cli could not be started");
+  }
+  if (result.timedOut) {
+    return new VaultProviderError("provider_unavailable", `Proton Pass timed out (${subject})`);
+  }
+  if (result.aborted) {
+    return new VaultProviderError(
+      "provider_unavailable",
+      `Proton Pass call cancelled (${subject})`
+    );
+  }
+  const stderr = result.stderr;
+  if (SESSION_INVALIDATED.test(stderr) || NOT_AUTHENTICATED.test(stderr)) {
+    return new VaultProviderError(
+      "provider_auth_expired",
+      "The Proton Pass session ended; sign in again with the personal access token"
+    );
+  }
+  const reason = protonReason(stderr);
+  if (reason) {
+    if (reason === "SessionLocked" || reason === "IsLocked") {
+      return new VaultProviderError("provider_locked", "The Proton Pass session is locked");
+    }
+    if (PERMISSION_REASONS.has(reason)) {
+      return new VaultProviderError(
+        "provider_permission_denied",
+        `The Proton Pass token may not ${subject} (${reason})`
+      );
+    }
+    if (NOT_FOUND_REASONS.has(reason)) {
+      return new VaultProviderError("provider_not_found", "No such Proton Pass vault or item");
+    }
+    if (CONFLICT_REASONS.has(reason)) {
+      return new VaultProviderError(
+        "provider_conflict",
+        `Proton Pass rejected the change because the item changed (${reason})`
+      );
+    }
+    if (QUOTA_REASONS.has(reason)) {
+      return new VaultProviderError(
+        "provider_unavailable",
+        `Proton Pass refused the request: account limit reached (${reason})`
+      );
+    }
+    return new VaultProviderError(
+      "provider_unavailable",
+      `Proton Pass rejected the request (${reason})`
+    );
+  }
+  const status = protonStatus(stderr);
+  if (status !== null) {
+    if (status === 429) {
+      return new VaultProviderError(
+        "provider_rate_limited",
+        "Proton Pass is rate limiting",
+        6e4
+      );
+    }
+    if (status === 401) {
+      return new VaultProviderError("provider_auth_expired", "The Proton Pass session expired");
+    }
+    if (status === 403) {
+      return new VaultProviderError(
+        "provider_permission_denied",
+        `The Proton Pass token may not ${subject}`
+      );
+    }
+    if (status === 404) {
+      return new VaultProviderError("provider_not_found", "No such Proton Pass vault or item");
+    }
+    if (status === 409) {
+      return new VaultProviderError("provider_conflict", "Proton Pass reported a conflict");
+    }
+    return new VaultProviderError("provider_unavailable", `Proton Pass returned HTTP ${status}`);
+  }
+  if (NOT_FOUND.test(stderr)) {
+    return new VaultProviderError("provider_not_found", "No such Proton Pass vault or item");
+  }
+  if (NETWORK.test(stderr)) {
+    return new VaultProviderError("provider_unavailable", "Proton Pass could not be reached");
+  }
+  return new VaultProviderError("provider_unavailable", `Proton Pass could not ${subject}`);
+}
+var PRE_FLIGHT = /Error parsing JSON|Error parsing template JSON|Error reading (?:from stdin|template)|Error converting template|requires an authenticated client|Agent sessions must set the PROTON_PASS_AGENT_REASON|PROTON_PASS_AGENT_REASON is (?:set but empty|too long)|Invalid field type|Invalid timestamp value|Please provide either|Error creating trash item request|Could not find vault|Share with id \S+ not found/;
+function isDefiniteMutationFailure(result, mutationContext) {
+  if (result.spawnError) return true;
+  if (result.timedOut || result.aborted || result.signal !== null || result.stdoutOverflow) {
+    return false;
+  }
+  if (result.exitCode === null) return false;
+  const stderr = result.stderr;
+  if (SESSION_INVALIDATED.test(stderr)) return false;
+  if (PRE_FLIGHT.test(stderr)) return true;
+  return mutationContext.test(stderr) && isDefiniteRejection(stderr);
+}
+function outcomeUnknown(subject) {
+  return new VaultProviderError(
+    "provider_outcome_unknown",
+    `Proton Pass may or may not have completed "${subject}"; check the vault before retrying`
+  );
+}
+var LOGIN_CONTEXT = /Error logging in with personal access token/;
+var LOGIN_REJECTED_STATUSES = /* @__PURE__ */ new Set([400, 401, 403, 422]);
+function loginFailure(result) {
+  const stderr = result.stderr;
+  const answered = !result.spawnError && !result.timedOut && !result.aborted && LOGIN_CONTEXT.test(stderr);
+  if (answered) {
+    const status = protonStatus(stderr);
+    const reason = protonReason(stderr);
+    if (status !== null && LOGIN_REJECTED_STATUSES.has(status) || reason !== null && (PERMISSION_REASONS.has(reason) || NOT_FOUND_REASONS.has(reason))) {
+      return new VaultProviderError(
+        "provider_auth_invalid",
+        "Proton Pass rejected the personal access token (revoked, expired or mistyped)"
+      );
+    }
+  }
+  const mapped = mapProtonFailure(result, "sign in");
+  if (mapped.code === "provider_rate_limited") return mapped;
+  if (mapped.code === "provider_unavailable") return mapped;
+  return new VaultProviderError("provider_unavailable", "Proton Pass could not sign in");
+}
+
+// src/runner.ts
+import { spawn } from "child_process";
+var KILL_GRACE_MS = 1e3;
+var runProcess = (request) => new Promise((resolve2) => {
+  const stdout = [];
+  const stderr = [];
+  let stdoutBytes = 0;
+  let stderrBytes = 0;
+  let stdoutOverflow = false;
+  let timedOut = false;
+  let aborted = false;
+  let settled = false;
+  let killTimer;
+  if (request.signal?.aborted) {
+    resolve2({
+      exitCode: null,
+      signal: null,
+      stdout: "",
+      stderr: "",
+      timedOut: false,
+      aborted: true,
+      stdoutOverflow: false,
+      spawnError: null
+    });
+    return;
+  }
+  const child = spawn(request.file, [...request.args], {
+    cwd: request.cwd,
+    env: { ...request.env },
+    shell: false,
+    detached: process.platform !== "win32",
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true
+  });
+  const terminate = () => {
+    if (child.exitCode !== null || child.signalCode !== null) return;
+    const kill = (sig) => {
+      try {
+        if (child.pid !== void 0 && process.platform !== "win32")
+          process.kill(-child.pid, sig);
+        else child.kill(sig);
+      } catch {
+      }
+    };
+    kill("SIGTERM");
+    killTimer ??= setTimeout(() => kill("SIGKILL"), KILL_GRACE_MS);
+    killTimer.unref?.();
+  };
+  const timer = setTimeout(() => {
+    timedOut = true;
+    terminate();
+  }, request.timeoutMs);
+  timer.unref?.();
+  const onAbort = () => {
+    aborted = true;
+    terminate();
+  };
+  request.signal?.addEventListener("abort", onAbort, { once: true });
+  const finish = (result) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    if (killTimer) clearTimeout(killTimer);
+    request.signal?.removeEventListener("abort", onAbort);
+    resolve2({
+      ...result,
+      stdout: Buffer.concat(stdout).toString("utf8"),
+      stderr: Buffer.concat(stderr).toString("utf8"),
+      timedOut,
+      aborted,
+      stdoutOverflow
+    });
+  };
+  child.stdout.on("data", (chunk) => {
+    if (stdoutOverflow) return;
+    stdoutBytes += chunk.length;
+    if (stdoutBytes > request.maxStdoutBytes) {
+      stdoutOverflow = true;
+      terminate();
+      return;
+    }
+    stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderrBytes >= request.maxStderrBytes) return;
+    const room = request.maxStderrBytes - stderrBytes;
+    const kept = chunk.length > room ? chunk.subarray(0, room) : chunk;
+    stderrBytes += kept.length;
+    stderr.push(kept);
+  });
+  child.on("error", (error) => {
+    finish({ exitCode: null, signal: null, spawnError: error.code ?? "spawn_failed" });
+  });
+  child.on("close", (exitCode, signal) => {
+    finish({ exitCode, signal, spawnError: null });
+  });
+  child.stdin.on("error", () => {
+  });
+  child.stdin.end(request.stdin ?? "");
+});
+
+// src/session.ts
+var PROTON_PASS_CLI_VERSION = "2.4.2";
+var PROTON_PASS_SESSION_MAX_AGE_MS = 105 * 6e4;
+var PROTON_PASS_IDLE_CLOSE_MS = 15 * 6e4;
+var PROTON_PASS_COMMAND_TIMEOUT_MS = 6e4;
+var PROTON_PASS_MAX_STDOUT_BYTES = 32 * 1024 * 1024;
+var PROTON_PASS_MAX_REASON_CHARS = 300;
+var PROTON_PASS_MAX_PROCESSES = 4;
+var MAX_STDERR_BYTES = 16 * 1024;
+var SMALL_STDOUT_BYTES = 256 * 1024;
+var PASSTHROUGH_ENV = [
+  "HTTPS_PROXY",
+  "HTTP_PROXY",
+  "NO_PROXY",
+  "https_proxy",
+  "http_proxy",
+  "no_proxy",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR"
+];
+function createSlotSemaphore(limit) {
+  let active = 0;
+  const waiters = [];
+  function releaser() {
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const next = waiters.shift();
+      if (next) next();
+      else active -= 1;
+    };
+  }
+  return {
+    async acquire(signal) {
+      if (active < limit) {
+        active += 1;
+        return releaser();
+      }
+      await new Promise((resolveSlot, reject) => {
+        if (signal?.aborted) {
+          reject(signal.reason ?? new Error("aborted"));
+          return;
+        }
+        const ready = () => {
+          signal?.removeEventListener("abort", onAbort);
+          resolveSlot();
+        };
+        const onAbort = () => {
+          const index = waiters.indexOf(ready);
+          if (index >= 0) waiters.splice(index, 1);
+          reject(signal?.reason ?? new Error("aborted"));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        waiters.push(ready);
+      });
+      return releaser();
+    },
+    active: () => active,
+    waiting: () => waiters.length
+  };
+}
+var processSlots = createSlotSemaphore(PROTON_PASS_MAX_PROCESSES);
+function acquireProcessSlot(signal) {
+  return processSlots.acquire(signal);
+}
+var liveStateDirs = /* @__PURE__ */ new Set();
+var exitHookInstalled = false;
+function trackStateDir(dir) {
+  liveStateDirs.add(dir);
+  if (exitHookInstalled) return;
+  exitHookInstalled = true;
+  process.once("exit", () => {
+    for (const path of liveStateDirs) {
+      try {
+        rmSync(path, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  });
+}
+function unavailable(message) {
+  return new VaultProviderError("provider_unavailable", message);
+}
+function findOnPath(command, pathValue) {
+  for (const dir of (pathValue ?? "").split(delimiter)) {
+    if (!dir || !isAbsolute(dir)) continue;
+    const candidate = join(dir, command);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+}
+function ensurePrivateDirectory(path) {
+  mkdirSync(path, { recursive: true, mode: 448 });
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw unavailable("The Proton Pass state directory is not a private directory");
+  }
+  const uid = process.getuid?.();
+  if (uid !== void 0 && stat.uid !== uid) {
+    throw unavailable("The Proton Pass state directory is owned by another user");
+  }
+  if ((stat.mode & 63) !== 0) chmodSync(path, 448);
+}
+function agentReason(subject, authority) {
+  const clean = (value) => value.replace(/[^A-Za-z0-9:._-]/g, "").slice(0, 64);
+  const parts = [`Opengeni ${subject.replace(/[^A-Za-z0-9 ._-]/g, "")}`];
+  if (authority) {
+    parts.push(`workspace ${clean(authority.workspaceId)}`);
+    if (authority.sessionId) parts.push(`session ${clean(authority.sessionId)}`);
+    if (authority.turnId) parts.push(`turn ${clean(authority.turnId)}`);
+    if (authority.subjectId) parts.push(`subject ${clean(authority.subjectId)}`);
+  }
+  return parts.join("; ").slice(0, PROTON_PASS_MAX_REASON_CHARS);
+}
+function succeeded(result) {
+  return result.exitCode === 0 && result.signal === null && !result.timedOut && !result.aborted && !result.stdoutOverflow && result.spawnError === null;
+}
+var ProtonCliSession = class {
+  constructor(token, options = {}) {
+    this.token = token;
+    this.options = options;
+    this.runner = options.runner ?? runProcess;
+    this.now = options.now ?? Date.now;
+    this.hostEnv = options.hostEnv ?? process.env;
+  }
+  runner;
+  now;
+  hostEnv;
+  encryptionKey = randomBytes(32).toString("hex");
+  binary = null;
+  dir = null;
+  loggedInAt = null;
+  info = null;
+  queue = Promise.resolve();
+  pending = 0;
+  idleTimer = null;
+  closed = false;
+  /** The state directory while a session is open (tests and diagnostics). */
+  get stateDirectory() {
+    return this.dir;
+  }
+  get sessionInfo() {
+    return this.info;
+  }
+  /** Runs one pass-cli command after ensuring a fresh login; returns stdout. */
+  run(command) {
+    return this.serialize(async () => (await this.execute(command)).stdout);
+  }
+  /** Login state for `validate`: logs in when needed and returns the token identity. */
+  ensureSession(signal) {
+    return this.serialize(async () => {
+      await this.ensureLogin(signal);
+      return this.info;
+    });
+  }
+  /** Allocates a private directory inside the session state for one download. */
+  privateScratchDir() {
+    const dir = this.requireDir();
+    return mkdtempSync(join(dir, "dl-"));
+  }
+  /** Logs out (best effort) and wipes the state directory. */
+  async close() {
+    this.closed = true;
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    this.idleTimer = null;
+    await this.queue.catch(() => {
+    });
+    await this.teardown();
+  }
+  serialize(work) {
+    if (this.closed) return Promise.reject(unavailable("The Proton Pass connection is closed"));
+    this.pending += 1;
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    this.idleTimer = null;
+    const run = this.queue.then(work, work);
+    this.queue = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run.finally(() => {
+      this.pending -= 1;
+      if (this.pending === 0 && !this.closed) this.armIdleClose();
+    });
+  }
+  armIdleClose() {
+    if (this.dir === null) return;
+    const idleMs = this.options.idleCloseMs ?? PROTON_PASS_IDLE_CLOSE_MS;
+    this.idleTimer = setTimeout(() => {
+      this.idleTimer = null;
+      if (this.pending > 0 || this.closed) return;
+      void this.serialize(() => this.teardown()).catch(() => {
+      });
+    }, idleMs);
+    this.idleTimer.unref?.();
+  }
+  async teardown() {
+    const dir = this.dir;
+    if (!dir) return;
+    if (this.loggedInAt !== null) {
+      try {
+        await this.spawn({ args: ["logout"], subject: "sign out" }, false, 1e4);
+      } catch {
+      }
+    }
+    this.loggedInAt = null;
+    this.info = null;
+    this.dir = null;
+    liveStateDirs.delete(dir);
+    rmSync(dir, { recursive: true, force: true });
+  }
+  requireDir() {
+    if (this.dir) return this.dir;
+    const root = resolve(this.options.stateRoot ?? join(tmpdir(), "opengeni-protonpass"));
+    ensurePrivateDirectory(root);
+    const dir = mkdtempSync(join(root, "pp-"));
+    ensurePrivateDirectory(dir);
+    trackStateDir(dir);
+    this.dir = dir;
+    return dir;
+  }
+  sessionDir() {
+    return join(this.requireDir(), "session");
+  }
+  baseEnv() {
+    const dir = this.requireDir();
+    const env = {
+      HOME: dir,
+      TZ: "UTC",
+      LANG: "C.UTF-8",
+      LC_ALL: "C.UTF-8",
+      PATH: "/usr/bin:/bin",
+      PROTON_PASS_SESSION_DIR: this.sessionDir(),
+      PROTON_PASS_KEY_PROVIDER: "env",
+      PROTON_PASS_ENCRYPTION_KEY: this.encryptionKey,
+      PROTON_PASS_DISABLE_TELEMETRY: "1",
+      PROTON_PASS_NO_UPDATE_CHECK: "1",
+      PASS_LOG_LEVEL: "off"
+    };
+    for (const name of PASSTHROUGH_ENV) {
+      const value = this.hostEnv[name];
+      if (value) env[name] = value;
+    }
+    return env;
+  }
+  async resolveBinary() {
+    this.binary ??= (async () => {
+      const configured = this.options.binaryPath;
+      if (configured !== void 0 && !isAbsolute(configured)) {
+        throw unavailable("The pass-cli path must be absolute");
+      }
+      const found = configured ?? findOnPath("pass-cli", this.hostEnv.PATH);
+      if (!found) throw unavailable("pass-cli is not installed on this Opengeni server");
+      let path;
+      try {
+        path = realpathSync(found);
+        const stat = statSync(path);
+        if (!stat.isFile()) throw new Error("not a file");
+        if ((stat.mode & 2) !== 0) {
+          throw unavailable("pass-cli is world-writable; refusing to run it");
+        }
+        accessSync(path, fsConstants.X_OK);
+      } catch (error) {
+        if (error instanceof VaultProviderError) throw error;
+        throw unavailable("pass-cli is not an executable file");
+      }
+      const expectedSha = this.options.expectedSha256?.toLowerCase();
+      if (expectedSha && await sha256File(path) !== expectedSha) {
+        throw unavailable("pass-cli does not match the configured SHA-256");
+      }
+      const expected = this.options.expectedVersion ?? PROTON_PASS_CLI_VERSION;
+      const result = await this.runner({
+        file: path,
+        args: ["--version"],
+        env: { HOME: this.requireDir(), PATH: "/usr/bin:/bin", LANG: "C.UTF-8" },
+        cwd: this.requireDir(),
+        timeoutMs: 1e4,
+        maxStdoutBytes: 4096,
+        maxStderrBytes: 4096
+      });
+      const version = /\b(\d+\.\d+\.\d+)\b/.exec(result.stdout)?.[1];
+      if (!succeeded(result) || !version) {
+        throw unavailable("pass-cli --version failed");
+      }
+      if (version !== expected) {
+        throw unavailable(
+          `pass-cli ${version} is not supported; install pass-cli ${expected} for this Opengeni release`
+        );
+      }
+      return path;
+    })();
+    this.binary.catch(() => {
+      this.binary = null;
+    });
+    return this.binary;
+  }
+  async spawn(command, withToken, timeoutMs) {
+    const file = await this.resolveBinary();
+    const env = this.baseEnv();
+    if (withToken) env.PROTON_PASS_PERSONAL_ACCESS_TOKEN = this.token;
+    else env.PROTON_PASS_AGENT_REASON = agentReason(command.subject, command.authority);
+    const release = await acquireProcessSlot(command.signal);
+    try {
+      return await this.runner({
+        file,
+        args: command.args,
+        env,
+        cwd: this.requireDir(),
+        ...command.stdin !== void 0 ? { stdin: command.stdin } : {},
+        timeoutMs: timeoutMs ?? this.options.commandTimeoutMs ?? PROTON_PASS_COMMAND_TIMEOUT_MS,
+        maxStdoutBytes: command.maxStdoutBytes ?? this.options.maxStdoutBytes ?? PROTON_PASS_MAX_STDOUT_BYTES,
+        maxStderrBytes: MAX_STDERR_BYTES,
+        ...command.signal ? { signal: command.signal } : {}
+      });
+    } finally {
+      release();
+    }
+  }
+  sessionFresh() {
+    if (this.loggedInAt === null || this.info === null) return false;
+    const maxAge = this.options.sessionMaxAgeMs ?? PROTON_PASS_SESSION_MAX_AGE_MS;
+    return this.now() - this.loggedInAt < maxAge;
+  }
+  async ensureLogin(signal) {
+    if (this.sessionFresh()) return;
+    await this.login(signal);
+  }
+  async login(signal) {
+    this.loggedInAt = null;
+    this.info = null;
+    const sessionDir = this.sessionDir();
+    rmSync(sessionDir, { recursive: true, force: true });
+    mkdirSync(sessionDir, { mode: 448 });
+    const result = await this.spawn(
+      {
+        args: ["login"],
+        subject: "sign in",
+        maxStdoutBytes: SMALL_STDOUT_BYTES,
+        ...signal ? { signal } : {}
+      },
+      true
+    );
+    if (!succeeded(result)) {
+      signal?.throwIfAborted();
+      throw loginFailure(result);
+    }
+    this.loggedInAt = this.now();
+    const infoResult = await this.spawn(
+      {
+        args: ["info", "--output", "json"],
+        subject: "read session info",
+        maxStdoutBytes: SMALL_STDOUT_BYTES,
+        ...signal ? { signal } : {}
+      },
+      false
+    );
+    if (!succeeded(infoResult)) {
+      this.loggedInAt = null;
+      signal?.throwIfAborted();
+      throw mapProtonFailure(infoResult, "read session info");
+    }
+    const parsed = InfoOutput.safeParse(parseJson(infoResult.stdout));
+    if (!parsed.success) {
+      this.loggedInAt = null;
+      throw unavailable("pass-cli returned unexpected session info");
+    }
+    if (parsed.data.username !== void 0) {
+      this.loggedInAt = null;
+      throw new VaultProviderError(
+        "provider_auth_invalid",
+        "The Proton Pass session is not a personal access token session"
+      );
+    }
+    const tokenName = parsed.data.personal_access_token_name ?? null;
+    this.info = {
+      tokenName: tokenName?.replace(/^\[Agent\] /, "") ?? null,
+      agent: tokenName?.startsWith("[Agent] ") ?? false
+    };
+  }
+  async execute(command) {
+    command.signal?.throwIfAborted();
+    await this.ensureLogin(command.signal);
+    let result = await this.spawn(command, false);
+    if (!succeeded(result) && !result.timedOut && !result.aborted) {
+      if (NOT_AUTHENTICATED.test(result.stderr)) {
+        await this.login(command.signal);
+        result = await this.spawn(command, false);
+      } else if (SESSION_INVALIDATED.test(result.stderr)) {
+        this.loggedInAt = null;
+        this.info = null;
+        if (command.mutationContext) throw outcomeUnknown(command.subject);
+        await this.login(command.signal);
+        result = await this.spawn(command, false);
+      }
+    }
+    if (succeeded(result)) return result;
+    if (SESSION_INVALIDATED.test(result.stderr) || NOT_AUTHENTICATED.test(result.stderr)) {
+      this.loggedInAt = null;
+      this.info = null;
+    }
+    if (command.mutationContext) {
+      if (!isDefiniteMutationFailure(result, command.mutationContext)) {
+        throw outcomeUnknown(command.subject);
+      }
+      throw mapProtonFailure(result, command.subject);
+    }
+    if (result.aborted) command.signal?.throwIfAborted();
+    if (result.stdoutOverflow) {
+      throw new VaultProviderError(
+        command.overflowCode ?? "provider_unavailable",
+        `Proton Pass returned more data than Opengeni reads at once (${command.subject})`
+      );
+    }
+    throw mapProtonFailure(result, command.subject);
+  }
+};
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/provider.ts
+var PROTON_PASS_VALUE_CACHE_MS = VAULT_LIMITS.providerValueCacheMs;
+var PROTON_PASS_MAX_ITEM_VIEWS_PER_LIST = 500;
+var PROTON_PASS_OPERATIONS = {
+  createItemTypes: ["login", "note", "api_key"],
+  updateItem: false,
+  removeField: false,
+  archiveItem: true,
+  archiveKind: "trash",
+  deleteItem: false,
+  restoreItem: false,
+  readFiles: true,
+  writeFiles: false,
+  createTotp: true,
+  updateTotp: false,
+  createVault: false,
+  restoreFieldHistory: false
+};
+function protonPassCapabilities() {
+  return {
+    write: true,
+    createVault: false,
+    totp: true,
+    // Legacy flag means file writes; reads are declared in operations.readFiles.
+    files: false,
+    groupGrants: false,
+    passkeys: false,
+    operations: {
+      ...PROTON_PASS_OPERATIONS,
+      createItemTypes: [...PROTON_PASS_OPERATIONS.createItemTypes]
+    }
+  };
+}
+var PROTON_ID = /^[A-Za-z0-9_=+/][A-Za-z0-9_=+/-]{0,255}$/;
+function assertIds(...ids) {
+  for (const id of ids) {
+    if (!PROTON_ID.test(id)) {
+      throw new VaultProviderError("provider_not_found", "No such Proton Pass vault or item");
+    }
+  }
+}
+var TOKEN_SHAPE = /^[\x21-\x7e]{8,4096}$/;
+function writeAccessFor(role) {
+  if (typeof role === "string") return role === "Viewer" ? "read_only" : "read_write";
+  return (role.Custom.permission & SHARE_PERMISSION.create) !== 0 ? "read_write" : "read_only";
+}
+function operationsFor(role) {
+  if (typeof role === "string") return void 0;
+  const permission = role.Custom.permission;
+  const canCreate = (permission & SHARE_PERMISSION.create) !== 0;
+  const canTrash = (permission & SHARE_PERMISSION.trash) !== 0;
+  return {
+    ...PROTON_PASS_OPERATIONS,
+    createItemTypes: canCreate ? [...PROTON_PASS_OPERATIONS.createItemTypes] : [],
+    createTotp: canCreate,
+    archiveItem: canTrash,
+    archiveKind: canTrash ? "trash" : "none"
+  };
+}
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function refuse(message) {
+  throw new VaultProviderError("provider_unavailable", message);
+}
+function fieldValue(field) {
+  if (field.remove) refuse("Proton Pass items cannot have fields removed from Opengeni");
+  const value = field.value ?? "";
+  if (utf8Bytes(value) > VAULT_LIMITS.textValueMaxBytes) {
+    refuse(`The value of "${field.name}" is larger than Opengeni stores`);
+  }
+  return value;
+}
+function totpValue(field, label) {
+  try {
+    return totpUri(parseTotpInput(fieldValue(field)), label);
+  } catch (error) {
+    if (error instanceof VaultProviderError) throw error;
+    throw new VaultProviderError(
+      "provider_unavailable",
+      `"${field.name}" is not a TOTP seed or otpauth:// URI`
+    );
+  }
+}
+function planCreate(item) {
+  const title = item.name;
+  if (item.type === "login") {
+    let username = null;
+    let email = null;
+    let password = null;
+    let totp = null;
+    for (const field of item.fields) {
+      const key = nameKey(field.name);
+      if (field.kind === "totp") {
+        if (totp !== null) refuse("Proton Pass logins hold one one-time password");
+        totp = totpValue(field, title);
+      } else if (field.kind === "text" && key === "username" && username === null) {
+        username = fieldValue(field);
+      } else if (field.kind === "text" && key === "email" && email === null) {
+        email = fieldValue(field);
+      } else if (field.kind === "concealed" && key === "password" && password === null) {
+        password = fieldValue(field);
+      } else {
+        refuse(
+          `Proton Pass logins created from Opengeni hold a username, email, password and one one-time password; "${field.name}" needs an API key (custom) item`
+        );
+      }
+    }
+    const urls = item.websites.filter((url) => url.trim().length > 0);
+    return {
+      kind: "login",
+      template: { title, username, email, password, totp_uri: totp, urls },
+      synthetic: {
+        Login: {
+          username: username ?? "",
+          email: email ?? "",
+          password: password ?? "",
+          totp_uri: totp ?? "",
+          urls
+        }
+      },
+      note: "",
+      extraSections: []
+    };
+  }
+  if (item.type === "note") {
+    if (item.fields.length > 1) refuse("A Proton Pass note holds one note field");
+    const field = item.fields[0];
+    if (field && field.kind !== "text" && field.kind !== "concealed") {
+      refuse("A Proton Pass note holds text only");
+    }
+    const note = field ? fieldValue(field) : "";
+    return {
+      kind: "note",
+      template: { title, note },
+      synthetic: { Note: null },
+      note,
+      extraSections: []
+    };
+  }
+  if (item.type === "api_key") {
+    const fields = item.fields.map((field) => {
+      if (field.kind === "file") refuse("Proton Pass files cannot be written from Opengeni");
+      const fieldType = field.kind === "totp" ? "totp" : field.kind === "concealed" ? "hidden" : "text";
+      const value = field.kind === "totp" ? totpValue(field, title) : fieldValue(field);
+      return { field_name: field.name, field_type: fieldType, value };
+    });
+    const sections = fields.length ? [{ section_name: "Fields", fields }] : [];
+    return {
+      kind: "custom",
+      template: { title, note: null, sections },
+      synthetic: {
+        Custom: {
+          sections: sections.map((section) => ({
+            section_name: section.section_name,
+            section_fields: section.fields.map((field) => ({
+              name: field.field_name,
+              content: field.field_type === "totp" ? { Totp: field.value } : field.field_type === "hidden" ? { Hidden: field.value } : { Text: field.value }
+            }))
+          }))
+        }
+      },
+      note: "",
+      extraSections: []
+    };
+  }
+  return refuse(
+    item.type === "passkey" ? "Passkeys live only in Opengeni vaults" : "Proton Pass file items cannot be created from Opengeni"
+  );
+}
+var CREATE_CONTEXT = {
+  login: /Error creating login item/,
+  note: /Error creating note item/,
+  custom: /Error creating custom item/
+};
+function createProtonPassVaultProvider(options) {
+  const token = options.token.trim();
+  if (!TOKEN_SHAPE.test(token)) {
+    throw new VaultProviderError(
+      "provider_auth_invalid",
+      "A Proton Pass personal access token looks like pst_\u2026::\u2026"
+    );
+  }
+  const session = new ProtonCliSession(token, options);
+  const now = options.now ?? Date.now;
+  const valueCacheMs = options.valueCacheMs ?? PROTON_PASS_VALUE_CACHE_MS;
+  const attemptCaches = /* @__PURE__ */ new WeakMap();
+  const maxViews = options.maxItemViewsPerList ?? PROTON_PASS_MAX_ITEM_VIEWS_PER_LIST;
+  const shareAccess = /* @__PURE__ */ new Map();
+  function cli(ctx, op, command) {
+    ctx.signal?.throwIfAborted();
+    ctx.budget.take(op);
+    return session.run({
+      ...command,
+      ...ctx.authority ? { authority: ctx.authority } : {},
+      ...ctx.signal ? { signal: ctx.signal } : {}
+    });
+  }
+  function parseOutput(stdout, schema, code) {
+    const parsed = schema.safeParse(parseJson(stdout));
+    if (!parsed.success) {
+      throw new VaultProviderError(
+        code,
+        "pass-cli returned output this Opengeni release does not understand"
+      );
+    }
+    return parsed.data;
+  }
+  function viewItem(ctx, shareId, itemId, subject) {
+    return cli(ctx, "read", {
+      args: ["item", "view", `--share-id=${shareId}`, `--item-id=${itemId}`, "--output", "json"],
+      subject
+    }).then((stdout) => parseOutput(stdout, ItemDetails, "provider_unavailable"));
+  }
+  function cachedItem(ctx, shareId, itemId) {
+    let cache = attemptCaches.get(ctx.budget);
+    if (!cache) {
+      cache = /* @__PURE__ */ new Map();
+      attemptCaches.set(ctx.budget, cache);
+    }
+    const key = `${ctx.cacheEpoch ?? ""}|${shareId}/${itemId}`;
+    const cached = cache.get(key);
+    if (cached && !ctx.forceRefresh && now() - cached.at < valueCacheMs) return cached.details;
+    const details = viewItem(ctx, shareId, itemId, "read item");
+    const entry = { at: now(), details };
+    cache.set(key, entry);
+    details.catch(() => {
+      if (cache.get(key) === entry) cache.delete(key);
+    });
+    return details;
+  }
+  function forgetItem(ctx, shareId, itemId) {
+    const cache = attemptCaches.get(ctx.budget);
+    if (!cache) return;
+    for (const key of cache.keys()) if (key.endsWith(`|${shareId}/${itemId}`)) cache.delete(key);
+  }
+  function reportFresh(ctx) {
+    const at = new Date(now()).toISOString();
+    ctx.onFreshness?.({
+      state: "current",
+      lastCheckedAt: at,
+      sourceSyncedAt: at,
+      source: "live",
+      errorCode: null,
+      retryAt: null
+    });
+  }
+  async function downloadFile(ctx, shareId, itemId, field) {
+    const attachment = field.value.attachment;
+    assertIds(attachment.id);
+    if (attachment.size > VAULT_LIMITS.fileValueMaxBytes) {
+      refuse(`"${field.name}" is larger than Opengeni reads from Proton Pass`);
+    }
+    const dir = session.privateScratchDir();
+    const target = join2(dir, "attachment");
+    try {
+      await cli(ctx, "read", {
+        args: [
+          "item",
+          "attachment",
+          "download",
+          `--share-id=${shareId}`,
+          `--item-id=${itemId}`,
+          `--attachment-id=${attachment.id}`,
+          `--output=${target}`
+        ],
+        subject: "download attachment",
+        maxStdoutBytes: 64 * 1024
+      });
+      let size;
+      try {
+        const stat = lstatSync2(target);
+        if (!stat.isFile()) throw new Error("not a file");
+        size = stat.size;
+      } catch {
+        return refuse("pass-cli did not produce the attachment");
+      }
+      if (size > VAULT_LIMITS.fileValueMaxBytes) {
+        refuse(`"${field.name}" is larger than Opengeni reads from Proton Pass`);
+      }
+      return new Uint8Array(readFileSync(target));
+    } finally {
+      rmSync2(dir, { recursive: true, force: true });
+    }
+  }
+  async function material(ctx, shareId, itemId, mapped, externalFieldId) {
+    const field = mapped.fields.find((candidate) => candidate.externalFieldId === externalFieldId);
+    if (!field) {
+      throw new VaultProviderError(
+        "provider_not_found",
+        `Proton Pass item "${mapped.meta.name}" has no field ${externalFieldId}`
+      );
+    }
+    const value = field.value;
+    if (value.type === "text") return { type: "text", value: value.value };
+    if (value.type === "totp") {
+      try {
+        return { type: "totp", params: parseTotpInput(value.uri) };
+      } catch {
+        return refuse(`The one-time password in "${mapped.meta.name}" is not a valid TOTP seed`);
+      }
+    }
+    const bytes = await downloadFile(ctx, shareId, itemId, { ...field, value });
+    return { type: "bytes", value: bytes };
+  }
+  const provider = {
+    id: "protonpass",
+    capabilities: protonPassCapabilities,
+    async validate(ctx) {
+      ctx.signal?.throwIfAborted();
+      const info = await session.ensureSession(ctx.signal);
+      await provider.listVaults(ctx);
+      return { accountName: info.tokenName };
+    },
+    async listVaults(ctx) {
+      let shares;
+      try {
+        shares = parseOutput(
+          await cli(ctx, "list", {
+            args: ["share", "list", "--only-vaults=true", "--output", "json"],
+            subject: "list vaults",
+            overflowCode: "provider_inventory_incomplete"
+          }),
+          ShareListOutput,
+          "provider_inventory_incomplete"
+        );
+      } catch (error) {
+        if (!(error instanceof VaultProviderError) || ![
+          "provider_permission_denied",
+          "provider_not_found",
+          "provider_inventory_incomplete"
+        ].includes(error.code)) {
+          throw error;
+        }
+        const vaults = parseOutput(
+          await cli(ctx, "list", {
+            args: ["vault", "list", "--output", "json"],
+            subject: "list vaults",
+            overflowCode: "provider_inventory_incomplete"
+          }),
+          VaultListOutput,
+          "provider_inventory_incomplete"
+        );
+        reportFresh(ctx);
+        return vaults.vaults.map((vault) => {
+          shareAccess.set(vault.share_id, "unknown");
+          return {
+            externalVaultId: vault.share_id,
+            name: safeSecretName(vault.name, vault.share_id),
+            contentVersion: null,
+            itemCount: null,
+            writeAccess: "unknown"
+          };
+        });
+      }
+      reportFresh(ctx);
+      return shares.shares.filter((share) => share.share_type === "Vault").map((share) => {
+        const writeAccess = writeAccessFor(share.share_role);
+        shareAccess.set(share.id, writeAccess);
+        const operations = operationsFor(share.share_role);
+        return {
+          externalVaultId: share.id,
+          name: safeSecretName(share.name, share.id),
+          contentVersion: null,
+          itemCount: null,
+          writeAccess,
+          ...operations ? { operations } : {}
+        };
+      });
+    },
+    async listItems(ctx, externalVaultId) {
+      assertIds(externalVaultId);
+      await session.ensureSession(ctx.signal);
+      const agent = session.sessionInfo?.agent ?? false;
+      const base = ["item", "list", `--share-id=${externalVaultId}`, "--filter-state", "active"];
+      const metas = [];
+      if (!agent) {
+        const list = parseOutput(
+          await cli(ctx, "list", {
+            args: [...base, "--show-secrets", "--output", "json"],
+            subject: "list items",
+            overflowCode: "provider_inventory_incomplete"
+          }),
+          FullItemList,
+          "provider_inventory_incomplete"
+        );
+        const withFiles = list.items.filter(
+          (item) => item.share_id === externalVaultId && item.flags.includes(ITEM_HAS_FILES)
+        );
+        if (withFiles.length > maxViews) incomplete();
+        for (const item of list.items) {
+          if (item.share_id !== externalVaultId) continue;
+          if (item.flags.includes(ITEM_HAS_FILES)) {
+            const details = await viewItem(ctx, externalVaultId, item.id, "list items");
+            metas.push(mapItem(details.item, details.attachments).meta);
+          } else {
+            metas.push(mapItem(item).meta);
+          }
+        }
+      } else {
+        const list = parseOutput(
+          await cli(ctx, "list", {
+            args: [...base, "--output", "json"],
+            subject: "list items",
+            overflowCode: "provider_inventory_incomplete"
+          }),
+          ItemSummaryList,
+          "provider_inventory_incomplete"
+        );
+        const summaries = list.items.filter((item) => item.share_id === externalVaultId);
+        if (summaries.length > maxViews) incomplete();
+        for (const summary of summaries) {
+          const details = await viewItem(ctx, externalVaultId, summary.id, "list items");
+          metas.push(mapItem(details.item, details.attachments).meta);
+        }
+      }
+      if (metas.length > VAULT_LIMITS.itemsPerVault) incomplete();
+      for (const meta of metas) assertMirrorable(meta);
+      reportFresh(ctx);
+      return metas;
+    },
+    async readFields(ctx, externalVaultId, externalItemId, externalFieldIds) {
+      assertIds(externalVaultId, externalItemId);
+      const details = await cachedItem(ctx, externalVaultId, externalItemId);
+      if (details.item.share_id !== externalVaultId || details.item.state !== "Active") {
+        throw new VaultProviderError("provider_not_found", "No such Proton Pass vault or item");
+      }
+      const mapped = mapItem(details.item, details.attachments);
+      const values = [];
+      for (const externalFieldId of externalFieldIds) {
+        values.push({
+          externalFieldId,
+          material: await material(ctx, externalVaultId, externalItemId, mapped, externalFieldId)
+        });
+      }
+      return values;
+    },
+    async writeItem(ctx, externalVaultId, item) {
+      assertIds(externalVaultId);
+      if (item.externalItemId !== void 0) {
+        throw new VaultProviderError(
+          "provider_unavailable",
+          "Proton Pass items cannot be updated from Opengeni: pass-cli 2.4.2 takes new values only as command-line arguments and cannot edit one-time passwords"
+        );
+      }
+      if (shareAccess.get(externalVaultId) === "read_only") {
+        throw new VaultProviderError(
+          "provider_permission_denied",
+          "The Proton Pass token can only read this vault"
+        );
+      }
+      const plan = planCreate(item);
+      const stdout = await cli(ctx, "write", {
+        args: [
+          "item",
+          "create",
+          plan.kind,
+          `--share-id=${externalVaultId}`,
+          "--from-template",
+          "-"
+        ],
+        stdin: JSON.stringify(plan.template),
+        subject: `create ${plan.kind} item`,
+        mutationContext: CREATE_CONTEXT[plan.kind],
+        maxStdoutBytes: 64 * 1024
+      });
+      const lines = stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+      const itemId = lines.at(-1);
+      if (!itemId || !PROTON_ID.test(itemId)) {
+        throw new VaultProviderError(
+          "provider_outcome_unknown",
+          "Proton Pass did not confirm the new item; check the vault before retrying"
+        );
+      }
+      try {
+        const details = await viewItem(ctx, externalVaultId, itemId, "read created item");
+        return mapItem(details.item, details.attachments).meta;
+      } catch {
+        const synthetic = mapItem({
+          id: itemId,
+          share_id: externalVaultId,
+          content: {
+            title: item.name,
+            note: plan.note,
+            content: plan.synthetic,
+            extra_fields: []
+          },
+          state: "Active",
+          flags: [],
+          create_time: "1970-01-01T00:00:00",
+          modify_time: "1970-01-01T00:00:00"
+        }).meta;
+        return { ...synthetic, version: null, updatedAt: null };
+      }
+    },
+    async archiveItem(ctx, externalVaultId, externalItemId) {
+      assertIds(externalVaultId, externalItemId);
+      if (shareAccess.get(externalVaultId) === "read_only") {
+        throw new VaultProviderError(
+          "provider_permission_denied",
+          "The Proton Pass token can only read this vault"
+        );
+      }
+      await cli(ctx, "write", {
+        args: ["item", "trash", `--share-id=${externalVaultId}`, `--item-id=${externalItemId}`],
+        subject: "trash item",
+        mutationContext: /Error trashing item/,
+        maxStdoutBytes: 64 * 1024
+      });
+      forgetItem(ctx, externalVaultId, externalItemId);
+    },
+    close: () => session.close()
+  };
+  return restrictToOperations(provider, options.operations, FILE_FIELD_PREFIX);
+}
+function incomplete() {
+  throw new VaultProviderError(
+    "provider_inventory_incomplete",
+    "The Proton Pass vault has more items than Opengeni mirrors at once"
+  );
+}
+function assertMirrorable(meta) {
+  if (meta.fields.length > VAULT_LIMITS.fieldsPerItem || meta.websites.length > VAULT_LIMITS.websitesPerItem || meta.websites.some((website) => website.length > VAULT_LIMITS.websiteMaxChars)) {
+    throw new VaultProviderError(
+      "provider_inventory_incomplete",
+      `A Proton Pass item has more than ${VAULT_LIMITS.fieldsPerItem} fields or ${VAULT_LIMITS.websitesPerItem} websites (or a website over ${VAULT_LIMITS.websiteMaxChars} characters), more than Opengeni mirrors`
+    );
+  }
+}
+
+// src/pool.ts
+import { createHmac, randomBytes as randomBytes2, randomUUID } from "crypto";
+var PROTON_PASS_POOL_MAX_SESSIONS = 32;
+var PROTON_PASS_POOL_IDLE_MS = 15 * 6e4;
+var PROTON_PASS_POOL_BUSY_RETRY_MS = 5e3;
+function createProtonPassProviderPool(options) {
+  const {
+    maxSessions = PROTON_PASS_POOL_MAX_SESSIONS,
+    poolIdleMs = PROTON_PASS_POOL_IDLE_MS,
+    create = createProtonPassVaultProvider,
+    ...providerOptions
+  } = options;
+  if (!Number.isInteger(maxSessions) || maxSessions < 1) {
+    throw new RangeError("maxSessions must be a positive integer");
+  }
+  const now = providerOptions.now ?? Date.now;
+  const key = randomBytes2(32);
+  const entries = /* @__PURE__ */ new Map();
+  let sweeper = null;
+  let closed = false;
+  function retire(id, entry) {
+    entries.delete(id);
+    void entry.provider.close().catch(() => {
+    });
+    if (entries.size === 0 && sweeper) {
+      clearInterval(sweeper);
+      sweeper = null;
+    }
+  }
+  function sweep() {
+    const at = now();
+    for (const [id, entry] of entries) {
+      if (entry.active === 0 && at - entry.lastUsed >= poolIdleMs) retire(id, entry);
+    }
+  }
+  function evictForRoom() {
+    while (entries.size >= maxSessions) {
+      let oldest = null;
+      for (const pair of entries) {
+        if (pair[1].active > 0) continue;
+        if (!oldest || pair[1].lastUsed < oldest[1].lastUsed) oldest = pair;
+      }
+      if (!oldest) return;
+      retire(oldest[0], oldest[1]);
+    }
+  }
+  function entryFor(scope, token) {
+    if (closed) {
+      throw new VaultProviderError(
+        "provider_unavailable",
+        "The Proton Pass session pool is closed"
+      );
+    }
+    const id = createHmac("sha256", key).update(JSON.stringify([scope, token])).digest("hex");
+    sweep();
+    const existing = entries.get(id);
+    if (existing) return existing;
+    for (const [otherId, other] of entries) {
+      if (other.scope === scope && other.active === 0) retire(otherId, other);
+    }
+    evictForRoom();
+    if (entries.size >= maxSessions) {
+      throw new VaultProviderError(
+        "provider_rate_limited",
+        "Every Proton Pass CLI session on this server is busy; try again shortly",
+        PROTON_PASS_POOL_BUSY_RETRY_MS
+      );
+    }
+    const entry = {
+      provider: create({ ...providerOptions, token }),
+      scope,
+      lastUsed: now(),
+      active: 0
+    };
+    entries.set(id, entry);
+    if (!sweeper) {
+      sweeper = setInterval(sweep, Math.max(1e3, Math.min(poolIdleMs, 6e4)));
+      sweeper.unref?.();
+    }
+    return entry;
+  }
+  function tracked(scope, token) {
+    const run = async (work) => {
+      const entry = entryFor(scope, token);
+      entry.active += 1;
+      entry.lastUsed = now();
+      try {
+        return await work(entry.provider);
+      } finally {
+        entry.active -= 1;
+        entry.lastUsed = now();
+      }
+    };
+    return {
+      id: "protonpass",
+      capabilities: protonPassCapabilities,
+      validate: (ctx) => run((provider) => provider.validate(ctx)),
+      listVaults: (ctx) => run((provider) => provider.listVaults(ctx)),
+      listItems: (ctx, vaultId) => run((provider) => provider.listItems(ctx, vaultId)),
+      readFields: (ctx, vaultId, itemId, fieldIds) => run((provider) => provider.readFields(ctx, vaultId, itemId, fieldIds)),
+      writeItem: (ctx, vaultId, item) => run((provider) => provider.writeItem(ctx, vaultId, item)),
+      archiveItem: (ctx, vaultId, itemId) => run((provider) => provider.archiveItem(ctx, vaultId, itemId))
+    };
+  }
+  return {
+    provider(token, { connectionId, operations } = {}) {
+      const scope = connectionId === void 0 ? `standalone:${randomUUID()}` : `connection:${connectionId}`;
+      return restrictToOperations(tracked(scope, token), operations, FILE_FIELD_PREFIX);
+    },
+    async close() {
+      closed = true;
+      if (sweeper) clearInterval(sweeper);
+      sweeper = null;
+      const all = [...entries.values()];
+      entries.clear();
+      await Promise.all(all.map((entry) => entry.provider.close().catch(() => {
+      })));
+    },
+    size: () => entries.size
+  };
+}
+export {
+  FILE_FIELD_PREFIX,
+  LOGIN_FIELD_IDS,
+  NOTE_FIELD_ID,
+  PROTON_PASS_CLI_VERSION,
+  PROTON_PASS_COMMAND_TIMEOUT_MS,
+  PROTON_PASS_IDLE_CLOSE_MS,
+  PROTON_PASS_MAX_ITEM_VIEWS_PER_LIST,
+  PROTON_PASS_MAX_PROCESSES,
+  PROTON_PASS_OPERATIONS,
+  PROTON_PASS_POOL_BUSY_RETRY_MS,
+  PROTON_PASS_POOL_IDLE_MS,
+  PROTON_PASS_POOL_MAX_SESSIONS,
+  PROTON_PASS_SESSION_MAX_AGE_MS,
+  PROTON_PASS_VALUE_CACHE_MS,
+  createProtonPassProviderPool,
+  createProtonPassVaultProvider,
+  protonPassCapabilities,
+  restrictToOperations
+};
+//# sourceMappingURL=index.js.map