@opengeni/vaults 1.4.5-canary.38533006839001 → 2.0.1

package/dist/{chunk-NBSBMJIA.js → chunk-7S23LHTK.js}

@@ -65,4 +65,4 @@ export {
   EMPTY_VAULT_PROVIDER_REGISTRY,
   createProviderCallBudget
 };
-//# sourceMappingURL=chunk-NBSBMJIA.js.map
+//# sourceMappingURL=chunk-7S23LHTK.js.map

package/dist/{chunk-NBSBMJIA.js.map → chunk-7S23LHTK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/provider.ts"],"sourcesContent":["import type {\n  ConnectionCredentialsPort,\n  SecretMaterial,\n  VaultFieldKind,\n  VaultItemType,\n  VaultSource,\n} from \"@opengeni/contracts\";\n\nexport interface VaultProviderCapabilities {\n  write: boolean;\n  createVault: boolean;\n  totp: boolean;\n  files: boolean;\n  groupGrants: boolean;\n  /** Passkeys live only in OpenGeni-hosted vaults (D20). */\n  passkeys: false;\n}\nexport interface ProviderVault {\n  externalVaultId: string;\n  name: string;\n  contentVersion: string | null;\n  itemCount: number | null;\n}\nexport interface ProviderFieldMeta {\n  externalFieldId: string;\n  name: string;\n  kind: VaultFieldKind;\n}\nexport interface ProviderItemMeta {\n  externalItemId: string;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: ProviderFieldMeta[];\n  version: string | null;\n  updatedAt: string | null;\n}\nexport interface ProviderFieldValue {\n  externalFieldId: string;\n  material: SecretMaterial;\n}\nexport interface ProviderWriteField {\n  externalFieldId?: string;\n  name: string;\n  kind: VaultFieldKind;\n  value?: string;\n  remove?: true;\n}\nexport interface ProviderWriteItem {\n  externalItemId?: string;\n  expectedVersion?: string | null;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: ProviderWriteField[];\n}\nexport type ProviderCallOperation = \"list\" | \"read\" | \"write\" | \"admin\";\nexport interface ProviderCallBudget {\n  /** Throws VaultProviderError(\"provider_rate_limited\") when exhausted. */\n  take(op: ProviderCallOperation): void;\n}\nexport interface VaultProviderContext {\n  connectionId: string | null;\n  budget: ProviderCallBudget;\n  signal?: AbortSignal;\n}\nexport interface VaultProvider {\n  readonly id: \"onepassword\" | \"host\" | \"fake\";\n  capabilities(): VaultProviderCapabilities;\n  validate(ctx: VaultProviderContext): Promise<{ accountName: string | null }>;\n  listVaults(ctx: VaultProviderContext): Promise<ProviderVault[]>;\n  listItems(ctx: VaultProviderContext, externalVaultId: string): Promise<ProviderItemMeta[]>;\n  readFields(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    externalItemId: string,\n    externalFieldIds: readonly string[],\n  ): Promise<ProviderFieldValue[]>;\n  writeItem(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    item: ProviderWriteItem,\n  ): Promise<ProviderItemMeta>;\n  archiveItem(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    externalItemId: string,\n  ): Promise<void>;\n  createVault?(\n    ctx: VaultProviderContext,\n    input: { name: string; description?: string; allowAdminsAccess: boolean; groupId?: string },\n  ): Promise<ProviderVault>;\n}\n\nexport const VAULT_PROVIDER_ERROR_CODES = [\n  \"provider_auth_invalid\",\n  \"provider_auth_expired\",\n  \"provider_rate_limited\",\n  \"provider_unavailable\",\n  \"provider_conflict\",\n  \"provider_not_found\",\n  /**\n   * The provider refused the operation for this credential (for example a\n   * write into a 1Password vault the service account can only read). The vault\n   * service reports `vault_read_only` for writes, `vault_permission_denied` otherwise.\n   */\n  \"provider_permission_denied\",\n] as const;\nexport type VaultProviderErrorCode = (typeof VAULT_PROVIDER_ERROR_CODES)[number];\n\nexport class VaultProviderError extends Error {\n  readonly code: VaultProviderErrorCode;\n  readonly retryAfterMs: number | undefined;\n  constructor(code: VaultProviderErrorCode, message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = \"VaultProviderError\";\n    this.code = code;\n    this.retryAfterMs = retryAfterMs;\n  }\n}\n\nexport function isVaultProviderError(error: unknown): error is VaultProviderError {\n  return error instanceof VaultProviderError;\n}\n\n/**\n * The embedder's connection-credential port with its password-manager leg\n * (design §10.9, OP-6). `@opengeni/contracts` cannot name `VaultProvider`\n * (this package depends on it), so the leg is added here; core and worker\n * dependencies use this type. A host provider is linked as a vault with\n * `source: \"host\"` and resolved through `createVaultProviderRegistry({ host })`.\n */\nexport type VaultConnectionCredentialsPort = ConnectionCredentialsPort & {\n  vaultProvider?: VaultProvider | null;\n};\n\nexport interface VaultProviderRegistry {\n  /** onepassword: loads the connection credential and the SDK lazily; host: the embedder port; fake: tests/dev. */\n  forVault(vault: {\n    source: VaultSource;\n    providerConnectionId: string | null;\n  }): Promise<VaultProvider>;\n}\n\n/**\n * A registry over fixed provider factories. Missing providers raise\n * `provider_unavailable`; `opengeni` (hosted) vaults never reach a provider.\n */\nexport function createVaultProviderRegistry(factories: {\n  onepassword?: (connectionId: string | null) => Promise<VaultProvider>;\n  host?: () => Promise<VaultProvider>;\n}): VaultProviderRegistry {\n  return {\n    async forVault(vault) {\n      if (vault.source === \"onepassword\" && factories.onepassword) {\n        return factories.onepassword(vault.providerConnectionId);\n      }\n      if (vault.source === \"host\" && factories.host) return factories.host();\n      throw new VaultProviderError(\n        \"provider_unavailable\",\n        vault.source === \"opengeni\"\n          ? \"hosted vaults are read from the database, not a provider\"\n          : `no ${vault.source} vault provider is configured`,\n      );\n    },\n  };\n}\n\n/** A registry with no providers: every provider vault is unavailable. */\nexport const EMPTY_VAULT_PROVIDER_REGISTRY: VaultProviderRegistry = createVaultProviderRegistry({});\n\n/**\n * A simple counting budget: at most `limit` calls of any kind (Q-18 uses 50\n * reads per attempt). Exhaustion raises `provider_rate_limited`.\n */\nexport function createProviderCallBudget(limit: number): ProviderCallBudget & { used(): number } {\n  let used = 0;\n  return {\n    take(op) {\n      if (used >= limit) {\n        throw new VaultProviderError(\n          \"provider_rate_limited\",\n          `this attempt used its ${limit} vault provider calls (last: ${op})`,\n        );\n      }\n      used += 1;\n    },\n    used: () => used,\n  };\n}\n"],"mappings":";AA8FO,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AACF;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACT,YAAY,MAA8B,SAAiB,cAAuB;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,eAAe;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,iBAAiB;AAC1B;AAyBO,SAAS,4BAA4B,WAGlB;AACxB,SAAO;AAAA,IACL,MAAM,SAAS,OAAO;AACpB,UAAI,MAAM,WAAW,iBAAiB,UAAU,aAAa;AAC3D,eAAO,UAAU,YAAY,MAAM,oBAAoB;AAAA,MACzD;AACA,UAAI,MAAM,WAAW,UAAU,UAAU,KAAM,QAAO,UAAU,KAAK;AACrE,YAAM,IAAI;AAAA,QACR;AAAA,QACA,MAAM,WAAW,aACb,6DACA,MAAM,MAAM,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,gCAAuD,4BAA4B,CAAC,CAAC;AAM3F,SAAS,yBAAyB,OAAwD;AAC/F,MAAI,OAAO;AACX,SAAO;AAAA,IACL,KAAK,IAAI;AACP,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI;AAAA,UACR;AAAA,UACA,yBAAyB,KAAK,gCAAgC,EAAE;AAAA,QAClE;AAAA,MACF;AACA,cAAQ;AAAA,IACV;AAAA,IACA,MAAM,MAAM;AAAA,EACd;AACF;","names":[]}
+{"version":3,"sources":["../src/provider.ts"],"sourcesContent":["import type {\n  ConnectionCredentialsPort,\n  SecretMaterial,\n  VaultFieldKind,\n  VaultItemType,\n  VaultSource,\n} from \"@opengeni/contracts\";\n\nexport interface VaultProviderCapabilities {\n  write: boolean;\n  createVault: boolean;\n  totp: boolean;\n  files: boolean;\n  groupGrants: boolean;\n  /** Passkeys live only in Opengeni-hosted vaults (D20). */\n  passkeys: false;\n}\nexport interface ProviderVault {\n  externalVaultId: string;\n  name: string;\n  contentVersion: string | null;\n  itemCount: number | null;\n}\nexport interface ProviderFieldMeta {\n  externalFieldId: string;\n  name: string;\n  kind: VaultFieldKind;\n}\nexport interface ProviderItemMeta {\n  externalItemId: string;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: ProviderFieldMeta[];\n  version: string | null;\n  updatedAt: string | null;\n}\nexport interface ProviderFieldValue {\n  externalFieldId: string;\n  material: SecretMaterial;\n}\nexport interface ProviderWriteField {\n  externalFieldId?: string;\n  name: string;\n  kind: VaultFieldKind;\n  value?: string;\n  remove?: true;\n}\nexport interface ProviderWriteItem {\n  externalItemId?: string;\n  expectedVersion?: string | null;\n  name: string;\n  type: VaultItemType;\n  websites: string[];\n  fields: ProviderWriteField[];\n}\nexport type ProviderCallOperation = \"list\" | \"read\" | \"write\" | \"admin\";\nexport interface ProviderCallBudget {\n  /** Throws VaultProviderError(\"provider_rate_limited\") when exhausted. */\n  take(op: ProviderCallOperation): void;\n}\nexport interface VaultProviderContext {\n  connectionId: string | null;\n  budget: ProviderCallBudget;\n  signal?: AbortSignal;\n}\nexport interface VaultProvider {\n  readonly id: \"onepassword\" | \"host\" | \"fake\";\n  capabilities(): VaultProviderCapabilities;\n  validate(ctx: VaultProviderContext): Promise<{ accountName: string | null }>;\n  listVaults(ctx: VaultProviderContext): Promise<ProviderVault[]>;\n  listItems(ctx: VaultProviderContext, externalVaultId: string): Promise<ProviderItemMeta[]>;\n  readFields(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    externalItemId: string,\n    externalFieldIds: readonly string[],\n  ): Promise<ProviderFieldValue[]>;\n  writeItem(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    item: ProviderWriteItem,\n  ): Promise<ProviderItemMeta>;\n  archiveItem(\n    ctx: VaultProviderContext,\n    externalVaultId: string,\n    externalItemId: string,\n  ): Promise<void>;\n  createVault?(\n    ctx: VaultProviderContext,\n    input: { name: string; description?: string; allowAdminsAccess: boolean; groupId?: string },\n  ): Promise<ProviderVault>;\n}\n\nexport const VAULT_PROVIDER_ERROR_CODES = [\n  \"provider_auth_invalid\",\n  \"provider_auth_expired\",\n  \"provider_rate_limited\",\n  \"provider_unavailable\",\n  \"provider_conflict\",\n  \"provider_not_found\",\n  /**\n   * The provider refused the operation for this credential (for example a\n   * write into a 1Password vault the service account can only read). The vault\n   * service reports `vault_read_only` for writes, `vault_permission_denied` otherwise.\n   */\n  \"provider_permission_denied\",\n] as const;\nexport type VaultProviderErrorCode = (typeof VAULT_PROVIDER_ERROR_CODES)[number];\n\nexport class VaultProviderError extends Error {\n  readonly code: VaultProviderErrorCode;\n  readonly retryAfterMs: number | undefined;\n  constructor(code: VaultProviderErrorCode, message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = \"VaultProviderError\";\n    this.code = code;\n    this.retryAfterMs = retryAfterMs;\n  }\n}\n\nexport function isVaultProviderError(error: unknown): error is VaultProviderError {\n  return error instanceof VaultProviderError;\n}\n\n/**\n * The embedder's connection-credential port with its password-manager leg\n * (design §10.9, OP-6). `@opengeni/contracts` cannot name `VaultProvider`\n * (this package depends on it), so the leg is added here; core and worker\n * dependencies use this type. A host provider is linked as a vault with\n * `source: \"host\"` and resolved through `createVaultProviderRegistry({ host })`.\n */\nexport type VaultConnectionCredentialsPort = ConnectionCredentialsPort & {\n  vaultProvider?: VaultProvider | null;\n};\n\nexport interface VaultProviderRegistry {\n  /** onepassword: loads the connection credential and the SDK lazily; host: the embedder port; fake: tests/dev. */\n  forVault(vault: {\n    source: VaultSource;\n    providerConnectionId: string | null;\n  }): Promise<VaultProvider>;\n}\n\n/**\n * A registry over fixed provider factories. Missing providers raise\n * `provider_unavailable`; `opengeni` (hosted) vaults never reach a provider.\n */\nexport function createVaultProviderRegistry(factories: {\n  onepassword?: (connectionId: string | null) => Promise<VaultProvider>;\n  host?: () => Promise<VaultProvider>;\n}): VaultProviderRegistry {\n  return {\n    async forVault(vault) {\n      if (vault.source === \"onepassword\" && factories.onepassword) {\n        return factories.onepassword(vault.providerConnectionId);\n      }\n      if (vault.source === \"host\" && factories.host) return factories.host();\n      throw new VaultProviderError(\n        \"provider_unavailable\",\n        vault.source === \"opengeni\"\n          ? \"hosted vaults are read from the database, not a provider\"\n          : `no ${vault.source} vault provider is configured`,\n      );\n    },\n  };\n}\n\n/** A registry with no providers: every provider vault is unavailable. */\nexport const EMPTY_VAULT_PROVIDER_REGISTRY: VaultProviderRegistry = createVaultProviderRegistry({});\n\n/**\n * A simple counting budget: at most `limit` calls of any kind (Q-18 uses 50\n * reads per attempt). Exhaustion raises `provider_rate_limited`.\n */\nexport function createProviderCallBudget(limit: number): ProviderCallBudget & { used(): number } {\n  let used = 0;\n  return {\n    take(op) {\n      if (used >= limit) {\n        throw new VaultProviderError(\n          \"provider_rate_limited\",\n          `this attempt used its ${limit} vault provider calls (last: ${op})`,\n        );\n      }\n      used += 1;\n    },\n    used: () => used,\n  };\n}\n"],"mappings":";AA8FO,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AACF;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACT,YAAY,MAA8B,SAAiB,cAAuB;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,eAAe;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,iBAAiB;AAC1B;AAyBO,SAAS,4BAA4B,WAGlB;AACxB,SAAO;AAAA,IACL,MAAM,SAAS,OAAO;AACpB,UAAI,MAAM,WAAW,iBAAiB,UAAU,aAAa;AAC3D,eAAO,UAAU,YAAY,MAAM,oBAAoB;AAAA,MACzD;AACA,UAAI,MAAM,WAAW,UAAU,UAAU,KAAM,QAAO,UAAU,KAAK;AACrE,YAAM,IAAI;AAAA,QACR;AAAA,QACA,MAAM,WAAW,aACb,6DACA,MAAM,MAAM,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,gCAAuD,4BAA4B,CAAC,CAAC;AAM3F,SAAS,yBAAyB,OAAwD;AAC/F,MAAI,OAAO;AACX,SAAO;AAAA,IACL,KAAK,IAAI;AACP,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAI;AAAA,UACR;AAAA,UACA,yBAAyB,KAAK,gCAAgC,EAAE;AAAA,QAClE;AAAA,MACF;AACA,cAAQ;AAAA,IACV;AAAA,IACA,MAAM,MAAM;AAAA,EACd;AACF;","names":[]}

package/dist/{chunk-M7JOCNPD.js → chunk-VKPGG2FW.js}

@@ -1,6 +1,6 @@
 import {
   VaultProviderError
-} from "./chunk-NBSBMJIA.js";
+} from "./chunk-7S23LHTK.js";
 
 // src/testing/fake-provider.ts
 import { parseTotpInput } from "@opengeni/contracts";
@@ -226,4 +226,4 @@ function createFakeVaultProvider(seed = {}) {
 export {
   createFakeVaultProvider
 };
-//# sourceMappingURL=chunk-M7JOCNPD.js.map
+//# sourceMappingURL=chunk-VKPGG2FW.js.map

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   createProviderCallBudget,
   createVaultProviderRegistry,
   isVaultProviderError
-} from "./chunk-NBSBMJIA.js";
+} from "./chunk-7S23LHTK.js";
 
 // src/splice/index.ts
 import { SecretReferenceError as SecretReferenceError3 } from "@opengeni/contracts";

package/dist/provider.d.ts

@@ -5,7 +5,7 @@ export interface VaultProviderCapabilities {
     totp: boolean;
     files: boolean;
     groupGrants: boolean;
-    /** Passkeys live only in OpenGeni-hosted vaults (D20). */
+    /** Passkeys live only in Opengeni-hosted vaults (D20). */
     passkeys: false;
 }
 export interface ProviderVault {

package/dist/testing/fake-provider.js

@@ -1,7 +1,7 @@
 import {
   createFakeVaultProvider
-} from "../chunk-M7JOCNPD.js";
-import "../chunk-NBSBMJIA.js";
+} from "../chunk-VKPGG2FW.js";
+import "../chunk-7S23LHTK.js";
 export {
   createFakeVaultProvider
 };

package/dist/testing/index.js

@@ -1,10 +1,10 @@
 import {
   createFakeVaultProvider
-} from "../chunk-M7JOCNPD.js";
+} from "../chunk-VKPGG2FW.js";
 import {
   VaultProviderError,
   createProviderCallBudget
-} from "../chunk-NBSBMJIA.js";
+} from "../chunk-7S23LHTK.js";
 
 // src/testing/static-resolver.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/vaults",
-  "version": "1.4.5-canary.38533006839001",
+  "version": "2.0.1",
   "description": "Vault provider interface, registry, shell splicers and test doubles for Opengeni secrets.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,7 +42,7 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/contracts": "1.4.5-canary.38533006839001"
+    "@opengeni/contracts": "2.0.1"
   },
   "engines": {
     "node": ">=18"

package/src/provider.ts

@@ -12,7 +12,7 @@ export interface VaultProviderCapabilities {
   totp: boolean;
   files: boolean;
   groupGrants: boolean;
-  /** Passkeys live only in OpenGeni-hosted vaults (D20). */
+  /** Passkeys live only in Opengeni-hosted vaults (D20). */
   passkeys: false;
 }
 export interface ProviderVault {