@opengeni/vaults 0.0.0-stage → 1.4.5-canary.38367122680001

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Cloudgeni-ai
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# `@opengeni/vaults`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Provider-side building blocks for Opengeni secrets (vaults). The shared types
+(vaults, items, references, the resolver contract, the password generator and
+TOTP) live in `@opengeni/contracts`; access decisions and the hosted resolver
+live in `@opengeni/core` (`domain/vaults`).
+
+This package owns:
+
+- `VaultProvider`, the interface every external vault source implements
+  (1Password in `@opengeni/vaults-onepassword`, an embedder's host provider,
+  and the in-memory fake), plus `VaultProviderError` and its codes;
+- `createVaultProviderRegistry`, which picks the provider for a vault;
+- `createProviderCallBudget`, the per-attempt provider call budget;
+- the shell splice contract (`spliceShellCommand`, `dialectFromShell`) used
+  by `exec_command` and `run_on` to turn references into per-command
+  environment variables;
+- test doubles under `@opengeni/vaults/testing`: `createFakeVaultProvider`,
+  `createStaticSecretResolver` and `runVaultProviderContractSuite`.
+
+Providers never see principals: access is decided before a provider is called.
+Provider errors always map to a `VaultProviderErrorCode`; nothing is swallowed.

package/dist/chunk-M7JOCNPD.js

@@ -0,0 +1,229 @@
+import {
+  VaultProviderError
+} from "./chunk-NBSBMJIA.js";
+
+// src/testing/fake-provider.ts
+import { parseTotpInput } from "@opengeni/contracts";
+var fakeIdCounter = 0;
+function fakeId(prefix) {
+  fakeIdCounter += 1;
+  return `${prefix}${fakeIdCounter.toString(36).padStart(6, "0")}`;
+}
+function materialFor(field) {
+  if (field.kind === "totp") return { type: "totp", params: parseTotpInput(field.value) };
+  if (field.kind === "file") {
+    return { type: "bytes", value: Uint8Array.from(atob(field.value), (c) => c.charCodeAt(0)) };
+  }
+  return { type: "text", value: field.value };
+}
+function itemMeta(item) {
+  return {
+    externalItemId: item.externalItemId,
+    name: item.name,
+    type: item.type,
+    websites: [...item.websites],
+    fields: item.fields.map(({ externalFieldId, name, kind }) => ({ externalFieldId, name, kind })),
+    version: String(item.version),
+    updatedAt: item.updatedAt
+  };
+}
+function vaultMeta(vault) {
+  return {
+    externalVaultId: vault.externalVaultId,
+    name: vault.name,
+    contentVersion: String(vault.contentVersion),
+    itemCount: vault.items.filter((item) => !item.archived).length
+  };
+}
+function createFakeVaultProvider(seed = {}) {
+  const calls = [];
+  const now = () => (/* @__PURE__ */ new Date()).toISOString();
+  const vaults = (seed.vaults ?? []).map((vault) => ({
+    externalVaultId: vault.externalVaultId ?? fakeId("fv"),
+    name: vault.name,
+    contentVersion: 1,
+    readOnly: vault.readOnly ?? false,
+    items: (vault.items ?? []).map((item) => ({
+      externalItemId: item.externalItemId ?? fakeId("fi"),
+      name: item.name,
+      type: item.type ?? "login",
+      websites: item.websites ?? [],
+      version: 1,
+      archived: false,
+      updatedAt: now(),
+      fields: item.fields.map((field) => ({
+        externalFieldId: field.externalFieldId ?? fakeId("ff"),
+        name: field.name,
+        kind: field.kind ?? (field.name === "username" ? "text" : "concealed"),
+        value: field.value
+      }))
+    }))
+  }));
+  const capabilities = {
+    write: true,
+    createVault: true,
+    totp: true,
+    files: true,
+    groupGrants: false,
+    ...seed.capabilities,
+    passkeys: false
+  };
+  function charge(ctx, call, op) {
+    calls.push(call);
+    if (ctx.signal?.aborted) throw new VaultProviderError("provider_unavailable", "aborted");
+    ctx.budget.take(op);
+    if (seed.failWith)
+      throw new VaultProviderError(seed.failWith, `fake provider: ${seed.failWith}`);
+  }
+  function vaultById(id) {
+    const vault = vaults.find((candidate) => candidate.externalVaultId === id);
+    if (!vault) throw new VaultProviderError("provider_not_found", "vault not found");
+    return vault;
+  }
+  function writableVault(id) {
+    const vault = vaultById(id);
+    if (vault.readOnly)
+      throw new VaultProviderError(
+        "provider_permission_denied",
+        "vault is read-only for this credential"
+      );
+    return vault;
+  }
+  function itemById(vault, id) {
+    const item = vault.items.find(
+      (candidate) => candidate.externalItemId === id && !candidate.archived
+    );
+    if (!item) throw new VaultProviderError("provider_not_found", "item not found");
+    return item;
+  }
+  const provider = {
+    id: "fake",
+    calls,
+    capabilities: () => ({ ...capabilities }),
+    async validate(ctx) {
+      charge(ctx, { op: "validate", connectionId: ctx.connectionId }, "admin");
+      return { accountName: seed.accountName ?? "Fake account" };
+    },
+    async listVaults(ctx) {
+      charge(ctx, { op: "listVaults", connectionId: ctx.connectionId }, "list");
+      return vaults.map(vaultMeta);
+    },
+    async listItems(ctx, externalVaultId) {
+      charge(ctx, { op: "listItems", connectionId: ctx.connectionId, externalVaultId }, "list");
+      return vaultById(externalVaultId).items.filter((item) => !item.archived).map(itemMeta);
+    },
+    async readFields(ctx, externalVaultId, externalItemId, externalFieldIds) {
+      charge(
+        ctx,
+        {
+          op: "readFields",
+          connectionId: ctx.connectionId,
+          externalVaultId,
+          externalItemId,
+          externalFieldIds
+        },
+        "read"
+      );
+      const item = itemById(vaultById(externalVaultId), externalItemId);
+      return externalFieldIds.map((externalFieldId) => {
+        const field = item.fields.find(
+          (candidate) => candidate.externalFieldId === externalFieldId
+        );
+        if (!field) throw new VaultProviderError("provider_not_found", "field not found");
+        return { externalFieldId, material: materialFor(field) };
+      });
+    },
+    async writeItem(ctx, externalVaultId, input) {
+      charge(
+        ctx,
+        {
+          op: "writeItem",
+          connectionId: ctx.connectionId,
+          externalVaultId,
+          ...input.externalItemId ? { externalItemId: input.externalItemId } : {}
+        },
+        "write"
+      );
+      if (!capabilities.write)
+        throw new VaultProviderError("provider_conflict", "provider is read-only");
+      const vault = writableVault(externalVaultId);
+      let item;
+      if (input.externalItemId) {
+        item = itemById(vault, input.externalItemId);
+        if (input.expectedVersion != null && input.expectedVersion !== String(item.version)) {
+          throw new VaultProviderError("provider_conflict", "item changed since it was read");
+        }
+      } else {
+        item = {
+          externalItemId: fakeId("fi"),
+          name: input.name,
+          type: input.type,
+          websites: [],
+          fields: [],
+          version: 0,
+          archived: false,
+          updatedAt: now()
+        };
+        vault.items.push(item);
+      }
+      item.name = input.name;
+      item.type = input.type;
+      item.websites = [...input.websites];
+      for (const change of input.fields) {
+        const existing = item.fields.find(
+          (field) => change.externalFieldId !== void 0 && field.externalFieldId === change.externalFieldId || change.externalFieldId === void 0 && field.name === change.name
+        );
+        if (change.remove) {
+          if (existing) item.fields.splice(item.fields.indexOf(existing), 1);
+          continue;
+        }
+        if (existing) {
+          existing.name = change.name;
+          existing.kind = change.kind;
+          if (change.value !== void 0) existing.value = change.value;
+        } else {
+          item.fields.push({
+            externalFieldId: fakeId("ff"),
+            name: change.name,
+            kind: change.kind,
+            value: change.value ?? ""
+          });
+        }
+      }
+      item.version += 1;
+      item.updatedAt = now();
+      vault.contentVersion += 1;
+      return itemMeta(item);
+    },
+    async archiveItem(ctx, externalVaultId, externalItemId) {
+      charge(
+        ctx,
+        { op: "archiveItem", connectionId: ctx.connectionId, externalVaultId, externalItemId },
+        "write"
+      );
+      const vault = writableVault(externalVaultId);
+      itemById(vault, externalItemId).archived = true;
+      vault.contentVersion += 1;
+    },
+    async createVault(ctx, input) {
+      charge(ctx, { op: "createVault", connectionId: ctx.connectionId }, "admin");
+      if (!capabilities.createVault)
+        throw new VaultProviderError("provider_conflict", "cannot create vaults");
+      const vault = {
+        externalVaultId: fakeId("fv"),
+        name: input.name,
+        items: [],
+        contentVersion: 1,
+        readOnly: false
+      };
+      vaults.push(vault);
+      return vaultMeta(vault);
+    }
+  };
+  return provider;
+}
+
+export {
+  createFakeVaultProvider
+};
+//# sourceMappingURL=chunk-M7JOCNPD.js.map

package/dist/chunk-M7JOCNPD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testing/fake-provider.ts"],"sourcesContent":["import type { SecretMaterial, VaultFieldKind, VaultItemType } from \"@opengeni/contracts\";\nimport { parseTotpInput } from \"@opengeni/contracts\";\nimport {\n  VaultProviderError,\n  type ProviderItemMeta,\n  type ProviderVault,\n  type VaultProvider,\n  type VaultProviderCapabilities,\n  type VaultProviderContext,\n  type VaultProviderErrorCode,\n} from \"../provider\";\n\nexport interface FakeProviderSeedField {\n  externalFieldId?: string;\n  name: string;\n  kind?: VaultFieldKind;\n  value: string;\n}\nexport interface FakeProviderSeedItem {\n  externalItemId?: string;\n  name: string;\n  type?: VaultItemType;\n  websites?: string[];\n  fields: FakeProviderSeedField[];\n}\nexport interface FakeProviderSeedVault {\n  externalVaultId?: string;\n  name: string;\n  items?: FakeProviderSeedItem[];\n  /** The credential can read but not write this vault (`provider_permission_denied`). */\n  readOnly?: boolean;\n}\nexport interface FakeProviderSeed {\n  accountName?: string | null;\n  vaults?: FakeProviderSeedVault[];\n  capabilities?: Partial<Omit<VaultProviderCapabilities, \"passkeys\">>;\n  /** Every call fails with this code (auth, outage and rate-limit tests). */\n  failWith?: VaultProviderErrorCode | null;\n}\nexport interface FakeProviderCall {\n  op:\n    | \"validate\"\n    | \"listVaults\"\n    | \"listItems\"\n    | \"readFields\"\n    | \"writeItem\"\n    | \"archiveItem\"\n    | \"createVault\";\n  connectionId: string | null;\n  externalVaultId?: string;\n  externalItemId?: string;\n  externalFieldIds?: readonly string[];\n}\n\ninterface FakeField {\n  externalFieldId: string;\n  name: string;\n  kind: VaultFieldKind;\n  value: string;\n}\ninterface FakeItem {\n  externalItemId: string;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: FakeField[];\n  version: number;\n  archived: boolean;\n  updatedAt: string;\n}\ninterface FakeVault {\n  externalVaultId: string;\n  name: string;\n  items: FakeItem[];\n  contentVersion: number;\n  readOnly: boolean;\n}\n\nlet fakeIdCounter = 0;\nfunction fakeId(prefix: string): string {\n  fakeIdCounter += 1;\n  return `${prefix}${fakeIdCounter.toString(36).padStart(6, \"0\")}`;\n}\n\nfunction materialFor(field: FakeField): SecretMaterial {\n  if (field.kind === \"totp\") return { type: \"totp\", params: parseTotpInput(field.value) };\n  if (field.kind === \"file\") {\n    return { type: \"bytes\", value: Uint8Array.from(atob(field.value), (c) => c.charCodeAt(0)) };\n  }\n  return { type: \"text\", value: field.value };\n}\n\nfunction itemMeta(item: FakeItem): ProviderItemMeta {\n  return {\n    externalItemId: item.externalItemId,\n    name: item.name,\n    type: item.type,\n    websites: [...item.websites],\n    fields: item.fields.map(({ externalFieldId, name, kind }) => ({ externalFieldId, name, kind })),\n    version: String(item.version),\n    updatedAt: item.updatedAt,\n  };\n}\n\nfunction vaultMeta(vault: FakeVault): ProviderVault {\n  return {\n    externalVaultId: vault.externalVaultId,\n    name: vault.name,\n    contentVersion: String(vault.contentVersion),\n    itemCount: vault.items.filter((item) => !item.archived).length,\n  };\n}\n\n/**\n * In-memory `VaultProvider` for tests and local development. Values are\n * kept in memory only; every call is recorded in `calls` (without values) and\n * charged to the context budget like a real provider.\n */\nexport function createFakeVaultProvider(\n  seed: FakeProviderSeed = {},\n): VaultProvider & { calls: FakeProviderCall[] } {\n  const calls: FakeProviderCall[] = [];\n  const now = () => new Date().toISOString();\n  const vaults: FakeVault[] = (seed.vaults ?? []).map((vault) => ({\n    externalVaultId: vault.externalVaultId ?? fakeId(\"fv\"),\n    name: vault.name,\n    contentVersion: 1,\n    readOnly: vault.readOnly ?? false,\n    items: (vault.items ?? []).map((item) => ({\n      externalItemId: item.externalItemId ?? fakeId(\"fi\"),\n      name: item.name,\n      type: item.type ?? \"login\",\n      websites: item.websites ?? [],\n      version: 1,\n      archived: false,\n      updatedAt: now(),\n      fields: item.fields.map((field) => ({\n        externalFieldId: field.externalFieldId ?? fakeId(\"ff\"),\n        name: field.name,\n        kind: field.kind ?? (field.name === \"username\" ? \"text\" : \"concealed\"),\n        value: field.value,\n      })),\n    })),\n  }));\n  const capabilities: VaultProviderCapabilities = {\n    write: true,\n    createVault: true,\n    totp: true,\n    files: true,\n    groupGrants: false,\n    ...seed.capabilities,\n    passkeys: false,\n  };\n\n  function charge(\n    ctx: VaultProviderContext,\n    call: FakeProviderCall,\n    op: \"list\" | \"read\" | \"write\" | \"admin\",\n  ) {\n    calls.push(call);\n    if (ctx.signal?.aborted) throw new VaultProviderError(\"provider_unavailable\", \"aborted\");\n    ctx.budget.take(op);\n    if (seed.failWith)\n      throw new VaultProviderError(seed.failWith, `fake provider: ${seed.failWith}`);\n  }\n  function vaultById(id: string): FakeVault {\n    const vault = vaults.find((candidate) => candidate.externalVaultId === id);\n    if (!vault) throw new VaultProviderError(\"provider_not_found\", \"vault not found\");\n    return vault;\n  }\n  function writableVault(id: string): FakeVault {\n    const vault = vaultById(id);\n    if (vault.readOnly)\n      throw new VaultProviderError(\n        \"provider_permission_denied\",\n        \"vault is read-only for this credential\",\n      );\n    return vault;\n  }\n  function itemById(vault: FakeVault, id: string): FakeItem {\n    const item = vault.items.find(\n      (candidate) => candidate.externalItemId === id && !candidate.archived,\n    );\n    if (!item) throw new VaultProviderError(\"provider_not_found\", \"item not found\");\n    return item;\n  }\n\n  const provider: VaultProvider & { calls: FakeProviderCall[] } = {\n    id: \"fake\",\n    calls,\n    capabilities: () => ({ ...capabilities }),\n    async validate(ctx) {\n      charge(ctx, { op: \"validate\", connectionId: ctx.connectionId }, \"admin\");\n      return { accountName: seed.accountName ?? \"Fake account\" };\n    },\n    async listVaults(ctx) {\n      charge(ctx, { op: \"listVaults\", connectionId: ctx.connectionId }, \"list\");\n      return vaults.map(vaultMeta);\n    },\n    async listItems(ctx, externalVaultId) {\n      charge(ctx, { op: \"listItems\", connectionId: ctx.connectionId, externalVaultId }, \"list\");\n      return vaultById(externalVaultId)\n        .items.filter((item) => !item.archived)\n        .map(itemMeta);\n    },\n    async readFields(ctx, externalVaultId, externalItemId, externalFieldIds) {\n      charge(\n        ctx,\n        {\n          op: \"readFields\",\n          connectionId: ctx.connectionId,\n          externalVaultId,\n          externalItemId,\n          externalFieldIds,\n        },\n        \"read\",\n      );\n      const item = itemById(vaultById(externalVaultId), externalItemId);\n      return externalFieldIds.map((externalFieldId) => {\n        const field = item.fields.find(\n          (candidate) => candidate.externalFieldId === externalFieldId,\n        );\n        if (!field) throw new VaultProviderError(\"provider_not_found\", \"field not found\");\n        return { externalFieldId, material: materialFor(field) };\n      });\n    },\n    async writeItem(ctx, externalVaultId, input) {\n      charge(\n        ctx,\n        {\n          op: \"writeItem\",\n          connectionId: ctx.connectionId,\n          externalVaultId,\n          ...(input.externalItemId ? { externalItemId: input.externalItemId } : {}),\n        },\n        \"write\",\n      );\n      if (!capabilities.write)\n        throw new VaultProviderError(\"provider_conflict\", \"provider is read-only\");\n      const vault = writableVault(externalVaultId);\n      let item: FakeItem;\n      if (input.externalItemId) {\n        item = itemById(vault, input.externalItemId);\n        if (input.expectedVersion != null && input.expectedVersion !== String(item.version)) {\n          throw new VaultProviderError(\"provider_conflict\", \"item changed since it was read\");\n        }\n      } else {\n        item = {\n          externalItemId: fakeId(\"fi\"),\n          name: input.name,\n          type: input.type,\n          websites: [],\n          fields: [],\n          version: 0,\n          archived: false,\n          updatedAt: now(),\n        };\n        vault.items.push(item);\n      }\n      item.name = input.name;\n      item.type = input.type;\n      item.websites = [...input.websites];\n      for (const change of input.fields) {\n        const existing = item.fields.find(\n          (field) =>\n            (change.externalFieldId !== undefined &&\n              field.externalFieldId === change.externalFieldId) ||\n            (change.externalFieldId === undefined && field.name === change.name),\n        );\n        if (change.remove) {\n          if (existing) item.fields.splice(item.fields.indexOf(existing), 1);\n          continue;\n        }\n        if (existing) {\n          existing.name = change.name;\n          existing.kind = change.kind;\n          if (change.value !== undefined) existing.value = change.value;\n        } else {\n          item.fields.push({\n            externalFieldId: fakeId(\"ff\"),\n            name: change.name,\n            kind: change.kind,\n            value: change.value ?? \"\",\n          });\n        }\n      }\n      item.version += 1;\n      item.updatedAt = now();\n      vault.contentVersion += 1;\n      return itemMeta(item);\n    },\n    async archiveItem(ctx, externalVaultId, externalItemId) {\n      charge(\n        ctx,\n        { op: \"archiveItem\", connectionId: ctx.connectionId, externalVaultId, externalItemId },\n        \"write\",\n      );\n      const vault = writableVault(externalVaultId);\n      itemById(vault, externalItemId).archived = true;\n      vault.contentVersion += 1;\n    },\n    async createVault(ctx, input) {\n      charge(ctx, { op: \"createVault\", connectionId: ctx.connectionId }, \"admin\");\n      if (!capabilities.createVault)\n        throw new VaultProviderError(\"provider_conflict\", \"cannot create vaults\");\n      const vault: FakeVault = {\n        externalVaultId: fakeId(\"fv\"),\n        name: input.name,\n        items: [],\n        contentVersion: 1,\n        readOnly: false,\n      };\n      vaults.push(vault);\n      return vaultMeta(vault);\n    },\n  };\n  return provider;\n}\n"],"mappings":";;;;;AACA,SAAS,sBAAsB;AA6E/B,IAAI,gBAAgB;AACpB,SAAS,OAAO,QAAwB;AACtC,mBAAiB;AACjB,SAAO,GAAG,MAAM,GAAG,cAAc,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAChE;AAEA,SAAS,YAAY,OAAkC;AACrD,MAAI,MAAM,SAAS,OAAQ,QAAO,EAAE,MAAM,QAAQ,QAAQ,eAAe,MAAM,KAAK,EAAE;AACtF,MAAI,MAAM,SAAS,QAAQ;AACzB,WAAO,EAAE,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE;AAAA,EAC5F;AACA,SAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,MAAM;AAC5C;AAEA,SAAS,SAAS,MAAkC;AAClD,SAAO;AAAA,IACL,gBAAgB,KAAK;AAAA,IACrB,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,UAAU,CAAC,GAAG,KAAK,QAAQ;AAAA,IAC3B,QAAQ,KAAK,OAAO,IAAI,CAAC,EAAE,iBAAiB,MAAM,KAAK,OAAO,EAAE,iBAAiB,MAAM,KAAK,EAAE;AAAA,IAC9F,SAAS,OAAO,KAAK,OAAO;AAAA,IAC5B,WAAW,KAAK;AAAA,EAClB;AACF;AAEA,SAAS,UAAU,OAAiC;AAClD,SAAO;AAAA,IACL,iBAAiB,MAAM;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,gBAAgB,OAAO,MAAM,cAAc;AAAA,IAC3C,WAAW,MAAM,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE;AAAA,EAC1D;AACF;AAOO,SAAS,wBACd,OAAyB,CAAC,GACqB;AAC/C,QAAM,QAA4B,CAAC;AACnC,QAAM,MAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAAuB,KAAK,UAAU,CAAC,GAAG,IAAI,CAAC,WAAW;AAAA,IAC9D,iBAAiB,MAAM,mBAAmB,OAAO,IAAI;AAAA,IACrD,MAAM,MAAM;AAAA,IACZ,gBAAgB;AAAA,IAChB,UAAU,MAAM,YAAY;AAAA,IAC5B,QAAQ,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU;AAAA,MACxC,gBAAgB,KAAK,kBAAkB,OAAO,IAAI;AAAA,MAClD,MAAM,KAAK;AAAA,MACX,MAAM,KAAK,QAAQ;AAAA,MACnB,UAAU,KAAK,YAAY,CAAC;AAAA,MAC5B,SAAS;AAAA,MACT,UAAU;AAAA,MACV,WAAW,IAAI;AAAA,MACf,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,iBAAiB,MAAM,mBAAmB,OAAO,IAAI;AAAA,QACrD,MAAM,MAAM;AAAA,QACZ,MAAM,MAAM,SAAS,MAAM,SAAS,aAAa,SAAS;AAAA,QAC1D,OAAO,MAAM;AAAA,MACf,EAAE;AAAA,IACJ,EAAE;AAAA,EACJ,EAAE;AACF,QAAM,eAA0C;AAAA,IAC9C,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,GAAG,KAAK;AAAA,IACR,UAAU;AAAA,EACZ;AAEA,WAAS,OACP,KACA,MACA,IACA;AACA,UAAM,KAAK,IAAI;AACf,QAAI,IAAI,QAAQ,QAAS,OAAM,IAAI,mBAAmB,wBAAwB,SAAS;AACvF,QAAI,OAAO,KAAK,EAAE;AAClB,QAAI,KAAK;AACP,YAAM,IAAI,mBAAmB,KAAK,UAAU,kBAAkB,KAAK,QAAQ,EAAE;AAAA,EACjF;AACA,WAAS,UAAU,IAAuB;AACxC,UAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,UAAU,oBAAoB,EAAE;AACzE,QAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,sBAAsB,iBAAiB;AAChF,WAAO;AAAA,EACT;AACA,WAAS,cAAc,IAAuB;AAC5C,UAAM,QAAQ,UAAU,EAAE;AAC1B,QAAI,MAAM;AACR,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,WAAO;AAAA,EACT;AACA,WAAS,SAAS,OAAkB,IAAsB;AACxD,UAAM,OAAO,MAAM,MAAM;AAAA,MACvB,CAAC,cAAc,UAAU,mBAAmB,MAAM,CAAC,UAAU;AAAA,IAC/D;AACA,QAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,sBAAsB,gBAAgB;AAC9E,WAAO;AAAA,EACT;AAEA,QAAM,WAA0D;AAAA,IAC9D,IAAI;AAAA,IACJ;AAAA,IACA,cAAc,OAAO,EAAE,GAAG,aAAa;AAAA,IACvC,MAAM,SAAS,KAAK;AAClB,aAAO,KAAK,EAAE,IAAI,YAAY,cAAc,IAAI,aAAa,GAAG,OAAO;AACvE,aAAO,EAAE,aAAa,KAAK,eAAe,eAAe;AAAA,IAC3D;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,aAAO,KAAK,EAAE,IAAI,cAAc,cAAc,IAAI,aAAa,GAAG,MAAM;AACxE,aAAO,OAAO,IAAI,SAAS;AAAA,IAC7B;AAAA,IACA,MAAM,UAAU,KAAK,iBAAiB;AACpC,aAAO,KAAK,EAAE,IAAI,aAAa,cAAc,IAAI,cAAc,gBAAgB,GAAG,MAAM;AACxF,aAAO,UAAU,eAAe,EAC7B,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,EACrC,IAAI,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,WAAW,KAAK,iBAAiB,gBAAgB,kBAAkB;AACvE;AAAA,QACE;AAAA,QACA;AAAA,UACE,IAAI;AAAA,UACJ,cAAc,IAAI;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AACA,YAAM,OAAO,SAAS,UAAU,eAAe,GAAG,cAAc;AAChE,aAAO,iBAAiB,IAAI,CAAC,oBAAoB;AAC/C,cAAM,QAAQ,KAAK,OAAO;AAAA,UACxB,CAAC,cAAc,UAAU,oBAAoB;AAAA,QAC/C;AACA,YAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,sBAAsB,iBAAiB;AAChF,eAAO,EAAE,iBAAiB,UAAU,YAAY,KAAK,EAAE;AAAA,MACzD,CAAC;AAAA,IACH;AAAA,IACA,MAAM,UAAU,KAAK,iBAAiB,OAAO;AAC3C;AAAA,QACE;AAAA,QACA;AAAA,UACE,IAAI;AAAA,UACJ,cAAc,IAAI;AAAA,UAClB;AAAA,UACA,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,QACzE;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,mBAAmB,qBAAqB,uBAAuB;AAC3E,YAAM,QAAQ,cAAc,eAAe;AAC3C,UAAI;AACJ,UAAI,MAAM,gBAAgB;AACxB,eAAO,SAAS,OAAO,MAAM,cAAc;AAC3C,YAAI,MAAM,mBAAmB,QAAQ,MAAM,oBAAoB,OAAO,KAAK,OAAO,GAAG;AACnF,gBAAM,IAAI,mBAAmB,qBAAqB,gCAAgC;AAAA,QACpF;AAAA,MACF,OAAO;AACL,eAAO;AAAA,UACL,gBAAgB,OAAO,IAAI;AAAA,UAC3B,MAAM,MAAM;AAAA,UACZ,MAAM,MAAM;AAAA,UACZ,UAAU,CAAC;AAAA,UACX,QAAQ,CAAC;AAAA,UACT,SAAS;AAAA,UACT,UAAU;AAAA,UACV,WAAW,IAAI;AAAA,QACjB;AACA,cAAM,MAAM,KAAK,IAAI;AAAA,MACvB;AACA,WAAK,OAAO,MAAM;AAClB,WAAK,OAAO,MAAM;AAClB,WAAK,WAAW,CAAC,GAAG,MAAM,QAAQ;AAClC,iBAAW,UAAU,MAAM,QAAQ;AACjC,cAAM,WAAW,KAAK,OAAO;AAAA,UAC3B,CAAC,UACE,OAAO,oBAAoB,UAC1B,MAAM,oBAAoB,OAAO,mBAClC,OAAO,oBAAoB,UAAa,MAAM,SAAS,OAAO;AAAA,QACnE;AACA,YAAI,OAAO,QAAQ;AACjB,cAAI,SAAU,MAAK,OAAO,OAAO,KAAK,OAAO,QAAQ,QAAQ,GAAG,CAAC;AACjE;AAAA,QACF;AACA,YAAI,UAAU;AACZ,mBAAS,OAAO,OAAO;AACvB,mBAAS,OAAO,OAAO;AACvB,cAAI,OAAO,UAAU,OAAW,UAAS,QAAQ,OAAO;AAAA,QAC1D,OAAO;AACL,eAAK,OAAO,KAAK;AAAA,YACf,iBAAiB,OAAO,IAAI;AAAA,YAC5B,MAAM,OAAO;AAAA,YACb,MAAM,OAAO;AAAA,YACb,OAAO,OAAO,SAAS;AAAA,UACzB,CAAC;AAAA,QACH;AAAA,MACF;AACA,WAAK,WAAW;AAChB,WAAK,YAAY,IAAI;AACrB,YAAM,kBAAkB;AACxB,aAAO,SAAS,IAAI;AAAA,IACtB;AAAA,IACA,MAAM,YAAY,KAAK,iBAAiB,gBAAgB;AACtD;AAAA,QACE;AAAA,QACA,EAAE,IAAI,eAAe,cAAc,IAAI,cAAc,iBAAiB,eAAe;AAAA,QACrF;AAAA,MACF;AACA,YAAM,QAAQ,cAAc,eAAe;AAC3C,eAAS,OAAO,cAAc,EAAE,WAAW;AAC3C,YAAM,kBAAkB;AAAA,IAC1B;AAAA,IACA,MAAM,YAAY,KAAK,OAAO;AAC5B,aAAO,KAAK,EAAE,IAAI,eAAe,cAAc,IAAI,aAAa,GAAG,OAAO;AAC1E,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,mBAAmB,qBAAqB,sBAAsB;AAC1E,YAAM,QAAmB;AAAA,QACvB,iBAAiB,OAAO,IAAI;AAAA,QAC5B,MAAM,MAAM;AAAA,QACZ,OAAO,CAAC;AAAA,QACR,gBAAgB;AAAA,QAChB,UAAU;AAAA,MACZ;AACA,aAAO,KAAK,KAAK;AACjB,aAAO,UAAU,KAAK;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-NBSBMJIA.js

@@ -0,0 +1,68 @@
+// src/provider.ts
+var VAULT_PROVIDER_ERROR_CODES = [
+  "provider_auth_invalid",
+  "provider_auth_expired",
+  "provider_rate_limited",
+  "provider_unavailable",
+  "provider_conflict",
+  "provider_not_found",
+  /**
+   * The provider refused the operation for this credential (for example a
+   * write into a 1Password vault the service account can only read). The vault
+   * service reports `vault_read_only` for writes, `vault_permission_denied` otherwise.
+   */
+  "provider_permission_denied"
+];
+var VaultProviderError = class extends Error {
+  code;
+  retryAfterMs;
+  constructor(code, message, retryAfterMs) {
+    super(message);
+    this.name = "VaultProviderError";
+    this.code = code;
+    this.retryAfterMs = retryAfterMs;
+  }
+};
+function isVaultProviderError(error) {
+  return error instanceof VaultProviderError;
+}
+function createVaultProviderRegistry(factories) {
+  return {
+    async forVault(vault) {
+      if (vault.source === "onepassword" && factories.onepassword) {
+        return factories.onepassword(vault.providerConnectionId);
+      }
+      if (vault.source === "host" && factories.host) return factories.host();
+      throw new VaultProviderError(
+        "provider_unavailable",
+        vault.source === "opengeni" ? "hosted vaults are read from the database, not a provider" : `no ${vault.source} vault provider is configured`
+      );
+    }
+  };
+}
+var EMPTY_VAULT_PROVIDER_REGISTRY = createVaultProviderRegistry({});
+function createProviderCallBudget(limit) {
+  let used = 0;
+  return {
+    take(op) {
+      if (used >= limit) {
+        throw new VaultProviderError(
+          "provider_rate_limited",
+          `this attempt used its ${limit} vault provider calls (last: ${op})`
+        );
+      }
+      used += 1;
+    },
+    used: () => used
+  };
+}
+
+export {
+  VAULT_PROVIDER_ERROR_CODES,
+  VaultProviderError,
+  isVaultProviderError,
+  createVaultProviderRegistry,
+  EMPTY_VAULT_PROVIDER_REGISTRY,
+  createProviderCallBudget
+};
+//# sourceMappingURL=chunk-NBSBMJIA.js.map

package/dist/chunk-NBSBMJIA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provider.ts"],"sourcesContent":["import type {\n  ConnectionCredentialsPort,\n  SecretMaterial,\n  VaultFieldKind,\n  VaultItemType,\n  VaultSource,\n} from \"@opengeni/contracts\";\n\nexport interface VaultProviderCapabilities {\n  write: boolean;\n  createVault: boolean;\n  totp: boolean;\n  files: boolean;\n  groupGrants: boolean;\n  /** Passkeys live only in OpenGeni-hosted vaults (D20). */\n  passkeys: false;\n}\nexport interface ProviderVault {\n  externalVaultId: string;\n  name: string;\n  contentVersion: string | null;\n  itemCount: number | null;\n}\nexport interface ProviderFieldMeta {\n  externalFieldId: string;\n  name: string;\n  kind: VaultFieldKind;\n}\nexport interface ProviderItemMeta {\n  externalItemId: string;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: ProviderFieldMeta[];\n  version: string | null;\n  updatedAt: string | null;\n}\nexport interface ProviderFieldValue {\n  externalFieldId: string;\n  material: SecretMaterial;\n}\nexport interface ProviderWriteField {\n  externalFieldId?: string;\n  name: string;\n  kind: VaultFieldKind;\n  value?: string;\n  remove?: true;\n}\nexport interface ProviderWriteItem {\n  externalItemId?: string;\n  expectedVersion?: string | null;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: ProviderWriteField[];\n}\nexport type ProviderCallOperation = \"list\" | \"read\" | \"write\" | \"admin\";\nexport interface ProviderCallBudget {\n  /** Throws VaultProviderError(\"provider_rate_limited\") when exhausted. */\n  take(op: ProviderCallOperation): void;\n}\nexport interface VaultProviderContext {\n  connectionId: string | null;\n  budget: ProviderCallBudget;\n  signal?: AbortSignal;\n}\nexport interface VaultProvider {\n  readonly id: \"onepassword\" | \"host\" | \"fake\";\n  capabilities(): VaultProviderCapabilities;\n  validate(ctx: VaultProviderContext): Promise<{ accountName: string | null }>;\n  listVaults(ctx: VaultProviderContext): Promise<ProviderVault[]>;\n  listItems(ctx: VaultProviderContext, externalVaultId: string): Promise<ProviderItemMeta[]>;\n  readFields(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    externalItemId: string,\n    externalFieldIds: readonly string[],\n  ): Promise<ProviderFieldValue[]>;\n  writeItem(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    item: ProviderWriteItem,\n  ): Promise<ProviderItemMeta>;\n  archiveItem(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    externalItemId: string,\n  ): Promise<void>;\n  createVault?(\n    ctx: VaultProviderContext,\n    input: { name: string; description?: string; allowAdminsAccess: boolean; groupId?: string },\n  ): Promise<ProviderVault>;\n}\n\nexport const VAULT_PROVIDER_ERROR_CODES = [\n  \"provider_auth_invalid\",\n  \"provider_auth_expired\",\n  \"provider_rate_limited\",\n  \"provider_unavailable\",\n  \"provider_conflict\",\n  \"provider_not_found\",\n  /**\n   * The provider refused the operation for this credential (for example a\n   * write into a 1Password vault the service account can only read). The vault\n   * service reports `vault_read_only` for writes, `vault_permission_denied` otherwise.\n   */\n  \"provider_permission_denied\",\n] as const;\nexport type VaultProviderErrorCode = (typeof VAULT_PROVIDER_ERROR_CODES)[number];\n\nexport class VaultProviderError extends Error {\n  readonly code: VaultProviderErrorCode;\n  readonly retryAfterMs: number | undefined;\n  constructor(code: VaultProviderErrorCode, message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = \"VaultProviderError\";\n    this.code = code;\n    this.retryAfterMs = retryAfterMs;\n  }\n}\n\nexport function isVaultProviderError(error: unknown): error is VaultProviderError {\n  return error instanceof VaultProviderError;\n}\n\n/**\n * The embedder's connection-credential port with its password-manager leg\n * (design §10.9, OP-6). `@opengeni/contracts` cannot name `VaultProvider`\n * (this package depends on it), so the leg is added here; core and worker\n * dependencies use this type. A host provider is linked as a vault with\n * `source: \"host\"` and resolved through `createVaultProviderRegistry({ host })`.\n */\nexport type VaultConnectionCredentialsPort = ConnectionCredentialsPort & {\n  vaultProvider?: VaultProvider | null;\n};\n\nexport interface VaultProviderRegistry {\n  /** onepassword: loads the connection credential and the SDK lazily; host: the embedder port; fake: tests/dev. */\n  forVault(vault: {\n    source: VaultSource;\n    providerConnectionId: string | null;\n  }): Promise<VaultProvider>;\n}\n\n/**\n * A registry over fixed provider factories. Missing providers raise\n * `provider_unavailable`; `opengeni` (hosted) vaults never reach a provider.\n */\nexport function createVaultProviderRegistry(factories: {\n  onepassword?: (connectionId: string | null) => Promise<VaultProvider>;\n  host?: () => Promise<VaultProvider>;\n}): VaultProviderRegistry {\n  return {\n    async forVault(vault) {\n      if (vault.source === \"onepassword\" && factories.onepassword) {\n        return factories.onepassword(vault.providerConnectionId);\n      }\n      if (vault.source === \"host\" && factories.host) return factories.host();\n      throw new VaultProviderError(\n        \"provider_unavailable\",\n        vault.source === \"opengeni\"\n          ? \"hosted vaults are read from the database, not a provider\"\n          : `no ${vault.source} vault provider is configured`,\n      );\n    },\n  };\n}\n\n/** A registry with no providers: every provider vault is unavailable. */\nexport const EMPTY_VAULT_PROVIDER_REGISTRY: VaultProviderRegistry = createVaultProviderRegistry({});\n\n/**\n * A simple counting budget: at most `limit` calls of any kind (Q-18 uses 50\n * reads per attempt). Exhaustion raises `provider_rate_limited`.\n */\nexport function createProviderCallBudget(limit: number): ProviderCallBudget & { used(): number } {\n  let used = 0;\n  return {\n    take(op) {\n      if (used >= limit) {\n        throw new VaultProviderError(\n          \"provider_rate_limited\",\n          `this attempt used its ${limit} vault provider calls (last: ${op})`,\n        );\n      }\n      used += 1;\n    },\n    used: () => used,\n  };\n}\n"],"mappings":";AA8FO,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AACF;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACT,YAAY,MAA8B,SAAiB,cAAuB;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,eAAe;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,iBAAiB;AAC1B;AAyBO,SAAS,4BAA4B,WAGlB;AACxB,SAAO;AAAA,IACL,MAAM,SAAS,OAAO;AACpB,UAAI,MAAM,WAAW,iBAAiB,UAAU,aAAa;AAC3D,eAAO,UAAU,YAAY,MAAM,oBAAoB;AAAA,MACzD;AACA,UAAI,MAAM,WAAW,UAAU,UAAU,KAAM,QAAO,UAAU,KAAK;AACrE,YAAM,IAAI;AAAA,QACR;AAAA,QACA,MAAM,WAAW,aACb,6DACA,MAAM,MAAM,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,gCAAuD,4BAA4B,CAAC,CAAC;AAM3F,SAAS,yBAAyB,OAAwD;AAC/F,MAAI,OAAO;AACX,SAAO;AAAA,IACL,KAAK,IAAI;AACP,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI;AAAA,UACR;AAAA,UACA,yBAAyB,KAAK,gCAAgC,EAAE;AAAA,QAClE;AAAA,MACF;AACA,cAAQ;AAAA,IACV;AAAA,IACA,MAAM,MAAM;AAAA,EACd;AACF;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./provider.js";
+export * from "./splice/index.js";