@rafads/plugin-onepassword 1.5.38

package/README.md

@@ -0,0 +1,79 @@
+# @rafads/plugin-onepassword
+
+[1Password](https://1password.com) integration for the executor. Provides a secret source that resolves values from a 1Password vault, backed by either the desktop app (connect.sock) or a service account token.
+
+## Install
+
+```sh
+bun add @rafads/sdk @rafads/plugin-onepassword
+# or
+npm install @rafads/sdk @rafads/plugin-onepassword
+```
+
+## Usage
+
+```ts
+import { createExecutor } from "@rafads/sdk";
+import { onepasswordPlugin } from "@rafads/plugin-onepassword";
+
+const executor = await createExecutor({
+  onElicitation: "accept-all",
+  plugins: [onepasswordPlugin()] as const,
+});
+
+// Point the plugin at your account
+await executor.onepassword.configure({
+  auth: { kind: "desktop-app", accountName: "my-account" },
+  vaultId: "my-vault-id",
+  name: "Personal",
+});
+
+// Inspect connection / list vaults
+const status = await executor.onepassword.status();
+const vaults = await executor.onepassword.listVaults({
+  kind: "desktop-app",
+  accountName: "my-account",
+});
+```
+
+For CI and headless environments, use a service-account token instead of the desktop app. Store the token through the executor's secret store first, then reference it by id:
+
+```ts
+import { createExecutor } from "@rafads/sdk";
+import { onepasswordPlugin } from "@rafads/plugin-onepassword";
+import { fileSecretsPlugin } from "@rafads/plugin-file-secrets";
+
+const executor = await createExecutor({
+  onElicitation: "accept-all",
+  plugins: [fileSecretsPlugin(), onepasswordPlugin()] as const,
+});
+
+await executor.secrets.set({
+  id: "op-token",
+  name: "1Password service account",
+  value: process.env.OP_SERVICE_ACCOUNT_TOKEN!,
+  scope: executor.scopes[0]!.id,
+});
+
+await executor.onepassword.configure({
+  auth: { kind: "service-account", tokenSecretId: "op-token" },
+  vaultId: "my-vault-id",
+  name: "CI",
+});
+```
+
+## Using with Effect
+
+If you're building on `@rafads/sdk/core` (the raw Effect entry), import this plugin from its `/core` subpath instead — it returns the Effect-shaped plugin with `Effect.Effect<...>`-returning methods rather than promisified wrappers:
+
+```ts
+import { onepasswordPlugin } from "@rafads/plugin-onepassword/core";
+```
+
+## Status
+
+Pre-`1.0`. APIs may still change between beta releases. Part of the [executor monorepo](https://github.com/UsefulSoftwareCo/executor).
+
+## License
+
+MIT

package/dist/OnePasswordSettings-YYVXN2JL.js

@@ -0,0 +1,401 @@
+import {
+  ConnectionStatus,
+  OnePasswordConfig,
+  OnePasswordError,
+  RedactedOnePasswordConfig,
+  Vault
+} from "./chunk-OYHEG6OK.js";
+
+// src/react/OnePasswordSettings.tsx
+import { useState } from "react";
+import { useAtomSet, useAtomValue } from "@effect/atom-react";
+import * as Exit from "effect/Exit";
+import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
+import { Button } from "@rafads/react/components/button";
+import { Input } from "@rafads/react/components/input";
+import { Label } from "@rafads/react/components/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue
+} from "@rafads/react/components/select";
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+  DialogFooter,
+  DialogClose
+} from "@rafads/react/components/dialog";
+import {
+  CardStackEntry,
+  CardStackEntryActions,
+  CardStackEntryContent,
+  CardStackEntryDescription
+} from "@rafads/react/components/card-stack";
+
+// src/react/atoms.ts
+import { ReactivityKey } from "@rafads/react/api/reactivity-keys";
+
+// src/react/client.ts
+import { createPluginAtomClient } from "@rafads/sdk/client";
+import {
+  getExecutorOrganizationHeaders,
+  getExecutorApiBaseUrl,
+  getExecutorServerAuthorizationHeader
+} from "@rafads/react/api/server-connection";
+
+// src/api/group.ts
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { Schema } from "effect";
+import { InternalError } from "@rafads/sdk/shared";
+var ConfigurePayload = OnePasswordConfig;
+var ListVaultsParams = Schema.Struct({
+  authKind: Schema.Literals(["desktop-app", "service-account"]),
+  account: Schema.String
+});
+var ListVaultsResponse = Schema.Struct({
+  vaults: Schema.Array(Vault)
+});
+var GetConfigResponse = Schema.NullOr(RedactedOnePasswordConfig);
+var OnePasswordGroup = HttpApiGroup.make("onepassword").add(
+  HttpApiEndpoint.get("getConfig", "/onepassword/config", {
+    success: GetConfigResponse,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.put("configure", "/onepassword/config", {
+    payload: ConfigurePayload,
+    success: Schema.Void,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.delete("removeConfig", "/onepassword/config", {
+    success: Schema.Void,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.get("status", "/onepassword/status", {
+    success: ConnectionStatus,
+    error: [InternalError, OnePasswordError]
+  })
+).add(
+  HttpApiEndpoint.get("listVaults", "/onepassword/vaults", {
+    query: ListVaultsParams,
+    success: ListVaultsResponse,
+    error: [InternalError, OnePasswordError]
+  })
+);
+
+// src/react/client.ts
+var OnePasswordClient = createPluginAtomClient(OnePasswordGroup, {
+  baseUrl: getExecutorApiBaseUrl,
+  authorizationHeader: getExecutorServerAuthorizationHeader,
+  headers: getExecutorOrganizationHeaders
+});
+
+// src/react/atoms.ts
+var onepasswordWriteKeys = [ReactivityKey.providers];
+var onepasswordConfigAtom = OnePasswordClient.query("onepassword", "getConfig", {
+  timeToLive: "30 seconds",
+  reactivityKeys: [ReactivityKey.providers]
+});
+var onepasswordStatusAtom = OnePasswordClient.query("onepassword", "status", {
+  timeToLive: "15 seconds",
+  reactivityKeys: [ReactivityKey.providers]
+});
+var onepasswordVaultsAtom = (authKind, account) => OnePasswordClient.query("onepassword", "listVaults", {
+  query: { authKind, account },
+  timeToLive: "30 seconds",
+  reactivityKeys: [ReactivityKey.providers]
+});
+var configureOnePassword = OnePasswordClient.mutation("onepassword", "configure");
+var removeOnePasswordConfig = OnePasswordClient.mutation("onepassword", "removeConfig");
+
+// src/react/OnePasswordSettings.tsx
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var VAULT_LIST_ERROR_FALLBACK = "Failed to list vaults";
+var formatVaultListError = (error) => {
+  const message = error.message.trim();
+  return message ? `${VAULT_LIST_ERROR_FALLBACK}: ${message}` : VAULT_LIST_ERROR_FALLBACK;
+};
+function VaultPicker(props) {
+  const account = props.accountName.trim();
+  const vaultsResult = useAtomValue(onepasswordVaultsAtom(props.authKind, account));
+  const { vaults, isLoading, error } = AsyncResult.matchWithError(
+    vaultsResult,
+    {
+      onInitial: () => ({
+        vaults: [],
+        isLoading: true,
+        error: null
+      }),
+      onError: (queryError) => ({
+        vaults: [],
+        isLoading: false,
+        error: formatVaultListError(queryError)
+      }),
+      onDefect: () => ({
+        vaults: [],
+        isLoading: false,
+        error: VAULT_LIST_ERROR_FALLBACK
+      }),
+      onSuccess: ({ value }) => {
+        const v = value.vaults;
+        const defaultVault = v[0];
+        if (defaultVault && (!props.vaultId || v.length === 1 && props.vaultId !== defaultVault.id)) {
+          queueMicrotask(() => props.onVaultSelect(defaultVault.id, defaultVault.name));
+        }
+        return { vaults: [...v], isLoading: false, error: null };
+      }
+    }
+  );
+  if (!account) {
+    return /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground/50 py-1", children: "Enter account details to load vaults." });
+  }
+  const singleVault = vaults.length === 1 ? vaults[0] : null;
+  return /* @__PURE__ */ jsxs("div", { className: "grid gap-2", children: [
+    singleVault ? /* @__PURE__ */ jsx("div", { className: "flex h-9 items-center rounded-md border border-input bg-muted/30 px-3 text-[13px] text-foreground", children: /* @__PURE__ */ jsx("span", { className: "truncate", children: singleVault.name }) }) : /* @__PURE__ */ jsxs(
+      Select,
+      {
+        disabled: isLoading || vaults.length === 0,
+        value: props.vaultId,
+        onValueChange: (id) => {
+          const v = vaults.find((vault) => vault.id === id);
+          if (v) props.onVaultSelect(v.id, v.name);
+        },
+        children: [
+          /* @__PURE__ */ jsx(SelectTrigger, { className: "h-9 text-[13px]", children: /* @__PURE__ */ jsx(SelectValue, { placeholder: isLoading ? "Loading\u2026" : "Select a vault" }) }),
+          /* @__PURE__ */ jsx(SelectContent, { children: vaults.map((v) => /* @__PURE__ */ jsx(SelectItem, { value: v.id, children: v.name }, v.id)) })
+        ]
+      }
+    ),
+    error && /* @__PURE__ */ jsx("div", { className: "rounded-md border border-destructive/20 bg-destructive/5 px-2.5 py-1.5", children: /* @__PURE__ */ jsx("p", { className: "text-[11px] text-destructive leading-relaxed whitespace-pre-line", children: error }) })
+  ] });
+}
+function ConfigDialog(props) {
+  const isEdit = !!props.initial;
+  const [authKind, setAuthKind] = useState(
+    props.initial?.authKind ?? "desktop-app"
+  );
+  const [accountName, setAccountName] = useState(props.initial?.accountName ?? "my.1password.com");
+  const [vaultId, setVaultId] = useState(props.initial?.vaultId ?? "");
+  const [vaultName, setVaultName] = useState(props.initial?.name ?? "");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState(null);
+  const doConfigure = useAtomSet(configureOnePassword, { mode: "promiseExit" });
+  const reset = () => {
+    if (!isEdit) {
+      setAuthKind("desktop-app");
+      setAccountName("my.1password.com");
+      setVaultId("");
+      setVaultName("");
+    }
+    setError(null);
+    setSaving(false);
+  };
+  const handleSave = async () => {
+    if (!accountName.trim() || !vaultId.trim()) return;
+    setSaving(true);
+    setError(null);
+    const auth = authKind === "desktop-app" ? { kind: "desktop-app", accountName: accountName.trim() } : { kind: "service-account", token: accountName.trim() };
+    const exit = await doConfigure({
+      payload: {
+        auth,
+        vaultId: vaultId.trim(),
+        name: vaultName.trim() || "1Password"
+      },
+      reactivityKeys: onepasswordWriteKeys
+    });
+    if (Exit.isFailure(exit)) {
+      setError("Failed to save configuration");
+      setSaving(false);
+      return;
+    }
+    props.onOpenChange(false);
+    reset();
+  };
+  return /* @__PURE__ */ jsx(
+    Dialog,
+    {
+      open: props.open,
+      onOpenChange: (v) => {
+        if (!v) reset();
+        props.onOpenChange(v);
+      },
+      children: /* @__PURE__ */ jsxs(DialogContent, { className: "sm:max-w-[420px]", children: [
+        /* @__PURE__ */ jsxs(DialogHeader, { children: [
+          /* @__PURE__ */ jsx(DialogTitle, { className: "font-display text-xl", children: isEdit ? "Edit 1Password" : "Connect 1Password" }),
+          /* @__PURE__ */ jsx(DialogDescription, { className: "text-[13px] leading-relaxed", children: "Link a vault to resolve secrets via the 1Password desktop app or a service account." })
+        ] }),
+        /* @__PURE__ */ jsxs("div", { className: "grid gap-5 py-3", children: [
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: "Auth method" }),
+            /* @__PURE__ */ jsxs(
+              Select,
+              {
+                value: authKind,
+                onValueChange: (v) => setAuthKind(v),
+                children: [
+                  /* @__PURE__ */ jsx(SelectTrigger, { className: "h-9 text-[13px]", children: /* @__PURE__ */ jsx(SelectValue, {}) }),
+                  /* @__PURE__ */ jsxs(SelectContent, { children: [
+                    /* @__PURE__ */ jsx(SelectItem, { value: "desktop-app", children: "Desktop App (biometric)" }),
+                    /* @__PURE__ */ jsx(SelectItem, { value: "service-account", children: "Service Account" })
+                  ] })
+                ]
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: authKind === "desktop-app" ? "Account domain" : "Service account token" }),
+            /* @__PURE__ */ jsx(
+              Input,
+              {
+                placeholder: authKind === "desktop-app" ? "my.1password.com" : "ops_...",
+                value: accountName,
+                onChange: (e) => setAccountName(e.target.value),
+                className: "font-mono text-[13px] h-9"
+              }
+            ),
+            /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground/60 leading-relaxed", children: authKind === "desktop-app" ? "Requires the 1Password desktop app with biometric unlock." : "The token is stored in this provider's owner-scoped config and never surfaced again." })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: "Vault" }),
+            /* @__PURE__ */ jsx(
+              VaultPicker,
+              {
+                authKind,
+                accountName,
+                vaultId,
+                onVaultSelect: (id, name) => {
+                  setVaultId(id);
+                  setVaultName(name);
+                }
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "grid gap-1.5", children: [
+            /* @__PURE__ */ jsx(Label, { className: "text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground", children: "Display name" }),
+            /* @__PURE__ */ jsx(
+              Input,
+              {
+                placeholder: "1Password",
+                value: vaultName,
+                onChange: (e) => setVaultName(e.target.value),
+                className: "text-[13px] h-9"
+              }
+            )
+          ] }),
+          error && /* @__PURE__ */ jsx("div", { className: "rounded-md border border-destructive/20 bg-destructive/5 px-3 py-2", children: /* @__PURE__ */ jsx("p", { className: "text-[12px] text-destructive whitespace-pre-line", children: error }) })
+        ] }),
+        /* @__PURE__ */ jsxs(DialogFooter, { children: [
+          /* @__PURE__ */ jsx(DialogClose, { asChild: true, children: /* @__PURE__ */ jsx(Button, { variant: "ghost", size: "sm", children: "Cancel" }) }),
+          /* @__PURE__ */ jsx(
+            Button,
+            {
+              size: "sm",
+              onClick: handleSave,
+              disabled: !accountName.trim() || !vaultId.trim() || saving,
+              children: saving ? "Saving\u2026" : isEdit ? "Update" : "Connect"
+            }
+          )
+        ] })
+      ] })
+    }
+  );
+}
+function OnePasswordSettings() {
+  const [configOpen, setConfigOpen] = useState(false);
+  const configResult = useAtomValue(onepasswordConfigAtom);
+  const doRemove = useAtomSet(removeOnePasswordConfig, { mode: "promiseExit" });
+  const handleRemove = async () => {
+    await doRemove({ reactivityKeys: onepasswordWriteKeys });
+  };
+  const config = AsyncResult.match(
+    configResult,
+    {
+      onInitial: () => null,
+      onFailure: () => null,
+      onSuccess: ({ value }) => value
+    }
+  );
+  const isLoading = AsyncResult.match(
+    configResult,
+    {
+      onInitial: () => true,
+      onFailure: () => false,
+      onSuccess: () => false
+    }
+  );
+  const isError = AsyncResult.match(
+    configResult,
+    {
+      onInitial: () => false,
+      onFailure: () => true,
+      onSuccess: () => false
+    }
+  );
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsxs(CardStackEntry, { children: [
+      /* @__PURE__ */ jsx(CardStackEntryContent, { children: isLoading ? /* @__PURE__ */ jsx(CardStackEntryDescription, { children: "Loading\u2026" }) : isError ? /* @__PURE__ */ jsx(CardStackEntryDescription, { className: "text-destructive", children: "Failed to load configuration" }) : config ? /* @__PURE__ */ jsxs("div", { className: "grid grid-cols-[auto_1fr] gap-x-6 gap-y-1 text-[12px]", children: [
+        /* @__PURE__ */ jsx("span", { className: "text-muted-foreground/60", children: "Auth" }),
+        /* @__PURE__ */ jsx("span", { className: "font-mono text-foreground/80 truncate", children: config.auth.kind === "desktop-app" ? config.auth.accountName : "service-account" }),
+        /* @__PURE__ */ jsx("span", { className: "text-muted-foreground/60", children: "Vault" }),
+        /* @__PURE__ */ jsx("div", { className: "flex items-center gap-2 min-w-0", children: /* @__PURE__ */ jsx("span", { className: "text-foreground/80 truncate", children: config.name }) })
+      ] }) : /* @__PURE__ */ jsx(CardStackEntryDescription, { children: "Resolve secrets from your 1Password vault." }) }),
+      /* @__PURE__ */ jsx(CardStackEntryActions, { children: config ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            variant: "ghost",
+            size: "sm",
+            className: "h-7 px-2.5 text-[12px]",
+            onClick: () => setConfigOpen(true),
+            children: "Edit"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            variant: "ghost",
+            size: "sm",
+            className: "h-7 px-2.5 text-[12px] text-destructive/70 hover:text-destructive",
+            onClick: handleRemove,
+            children: "Disconnect"
+          }
+        )
+      ] }) : !isLoading && !isError && /* @__PURE__ */ jsx(
+        Button,
+        {
+          variant: "link",
+          size: "sm",
+          className: "h-7 px-0 text-[12px] shrink-0",
+          onClick: () => setConfigOpen(true),
+          children: "Add 1Password"
+        }
+      ) })
+    ] }),
+    configOpen && /* @__PURE__ */ jsx(
+      ConfigDialog,
+      {
+        open: configOpen,
+        onOpenChange: setConfigOpen,
+        initial: config ? {
+          authKind: config.auth.kind,
+          // Service-account tokens are never surfaced (redacted); the
+          // user re-enters the token when editing that auth method.
+          accountName: config.auth.kind === "desktop-app" ? config.auth.accountName : "",
+          vaultId: config.vaultId,
+          name: config.name
+        } : void 0
+      }
+    )
+  ] });
+}
+export {
+  OnePasswordSettings as default
+};
+//# sourceMappingURL=OnePasswordSettings-YYVXN2JL.js.map

package/dist/OnePasswordSettings-YYVXN2JL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/OnePasswordSettings.tsx","../src/react/atoms.ts","../src/react/client.ts","../src/api/group.ts"],"sourcesContent":["import { useState } from \"react\";\nimport { useAtomSet, useAtomValue } from \"@effect/atom-react\";\nimport * as Exit from \"effect/Exit\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\nimport { Button } from \"@rafads/react/components/button\";\nimport { Input } from \"@rafads/react/components/input\";\nimport { Label } from \"@rafads/react/components/label\";\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from \"@rafads/react/components/select\";\nimport {\n  Dialog,\n  DialogContent,\n  DialogHeader,\n  DialogTitle,\n  DialogDescription,\n  DialogFooter,\n  DialogClose,\n} from \"@rafads/react/components/dialog\";\nimport {\n  CardStackEntry,\n  CardStackEntryActions,\n  CardStackEntryContent,\n  CardStackEntryDescription,\n} from \"@rafads/react/components/card-stack\";\n\nimport {\n  onepasswordConfigAtom,\n  onepasswordVaultsAtom,\n  configureOnePassword,\n  removeOnePasswordConfig,\n  onepasswordWriteKeys,\n} from \"./atoms\";\nimport type { RedactedOnePasswordConfig } from \"../sdk/types\";\n\n// ---------------------------------------------------------------------------\n// Vault picker\n// ---------------------------------------------------------------------------\n\nconst VAULT_LIST_ERROR_FALLBACK = \"Failed to list vaults\";\n\nconst formatVaultListError = (error: Error): string => {\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OnePasswordError carries a typed `message`\n  const message = error.message.trim();\n  return message ? `${VAULT_LIST_ERROR_FALLBACK}: ${message}` : VAULT_LIST_ERROR_FALLBACK;\n};\n\nfunction VaultPicker(props: {\n  authKind: \"desktop-app\" | \"service-account\";\n  accountName: string;\n  vaultId: string;\n  onVaultSelect: (id: string, name: string) => void;\n}) {\n  const account = props.accountName.trim();\n  const vaultsResult = useAtomValue(onepasswordVaultsAtom(props.authKind, account));\n\n  const { vaults, isLoading, error } = AsyncResult.matchWithError(\n    vaultsResult as AsyncResult.AsyncResult<\n      { vaults: ReadonlyArray<{ id: string; name: string }> },\n      Error\n    >,\n    {\n      onInitial: () => ({\n        vaults: [] as { id: string; name: string }[],\n        isLoading: true,\n        error: null,\n      }),\n      onError: (queryError) => ({\n        vaults: [] as { id: string; name: string }[],\n        isLoading: false,\n        error: formatVaultListError(queryError),\n      }),\n      onDefect: () => ({\n        vaults: [] as { id: string; name: string }[],\n        isLoading: false,\n        error: VAULT_LIST_ERROR_FALLBACK,\n      }),\n      onSuccess: ({ value }) => {\n        const v = value.vaults;\n        const defaultVault = v[0];\n        if (\n          defaultVault &&\n          (!props.vaultId || (v.length === 1 && props.vaultId !== defaultVault.id))\n        ) {\n          queueMicrotask(() => props.onVaultSelect(defaultVault.id, defaultVault.name));\n        }\n        return { vaults: [...v], isLoading: false, error: null };\n      },\n    },\n  );\n\n  if (!account) {\n    return (\n      <p className=\"text-[11px] text-muted-foreground/50 py-1\">\n        Enter account details to load vaults.\n      </p>\n    );\n  }\n\n  const singleVault = vaults.length === 1 ? vaults[0] : null;\n\n  return (\n    <div className=\"grid gap-2\">\n      {singleVault ? (\n        <div className=\"flex h-9 items-center rounded-md border border-input bg-muted/30 px-3 text-[13px] text-foreground\">\n          <span className=\"truncate\">{singleVault.name}</span>\n        </div>\n      ) : (\n        <Select\n          disabled={isLoading || vaults.length === 0}\n          value={props.vaultId}\n          onValueChange={(id) => {\n            const v = vaults.find((vault) => vault.id === id);\n            if (v) props.onVaultSelect(v.id, v.name);\n          }}\n        >\n          <SelectTrigger className=\"h-9 text-[13px]\">\n            <SelectValue placeholder={isLoading ? \"Loading…\" : \"Select a vault\"} />\n          </SelectTrigger>\n          <SelectContent>\n            {vaults.map((v) => (\n              <SelectItem key={v.id} value={v.id}>\n                {v.name}\n              </SelectItem>\n            ))}\n          </SelectContent>\n        </Select>\n      )}\n      {error && (\n        <div className=\"rounded-md border border-destructive/20 bg-destructive/5 px-2.5 py-1.5\">\n          <p className=\"text-[11px] text-destructive leading-relaxed whitespace-pre-line\">\n            {error}\n          </p>\n        </div>\n      )}\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Config dialog\n// ---------------------------------------------------------------------------\n\nfunction ConfigDialog(props: {\n  open: boolean;\n  onOpenChange: (v: boolean) => void;\n  initial?: {\n    authKind: string;\n    accountName: string;\n    vaultId: string;\n    name: string;\n  };\n}) {\n  const isEdit = !!props.initial;\n  const [authKind, setAuthKind] = useState<\"desktop-app\" | \"service-account\">(\n    (props.initial?.authKind as \"desktop-app\" | \"service-account\") ?? \"desktop-app\",\n  );\n  const [accountName, setAccountName] = useState(props.initial?.accountName ?? \"my.1password.com\");\n  const [vaultId, setVaultId] = useState(props.initial?.vaultId ?? \"\");\n  const [vaultName, setVaultName] = useState(props.initial?.name ?? \"\");\n  const [saving, setSaving] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  const doConfigure = useAtomSet(configureOnePassword, { mode: \"promiseExit\" });\n\n  const reset = () => {\n    if (!isEdit) {\n      setAuthKind(\"desktop-app\");\n      setAccountName(\"my.1password.com\");\n      setVaultId(\"\");\n      setVaultName(\"\");\n    }\n    setError(null);\n    setSaving(false);\n  };\n\n  const handleSave = async () => {\n    if (!accountName.trim() || !vaultId.trim()) return;\n    setSaving(true);\n    setError(null);\n\n    const auth =\n      authKind === \"desktop-app\"\n        ? { kind: \"desktop-app\" as const, accountName: accountName.trim() }\n        : { kind: \"service-account\" as const, token: accountName.trim() };\n\n    const exit = await doConfigure({\n      payload: {\n        auth,\n        vaultId: vaultId.trim(),\n        name: vaultName.trim() || \"1Password\",\n      },\n      reactivityKeys: onepasswordWriteKeys,\n    });\n    if (Exit.isFailure(exit)) {\n      setError(\"Failed to save configuration\");\n      setSaving(false);\n      return;\n    }\n\n    props.onOpenChange(false);\n    reset();\n  };\n\n  return (\n    <Dialog\n      open={props.open}\n      onOpenChange={(v) => {\n        if (!v) reset();\n        props.onOpenChange(v);\n      }}\n    >\n      <DialogContent className=\"sm:max-w-[420px]\">\n        <DialogHeader>\n          <DialogTitle className=\"font-display text-xl\">\n            {isEdit ? \"Edit 1Password\" : \"Connect 1Password\"}\n          </DialogTitle>\n          <DialogDescription className=\"text-[13px] leading-relaxed\">\n            Link a vault to resolve secrets via the 1Password desktop app or a service account.\n          </DialogDescription>\n        </DialogHeader>\n\n        <div className=\"grid gap-5 py-3\">\n          {/* Auth method */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              Auth method\n            </Label>\n            <Select\n              value={authKind}\n              onValueChange={(v) => setAuthKind(v as \"desktop-app\" | \"service-account\")}\n            >\n              <SelectTrigger className=\"h-9 text-[13px]\">\n                <SelectValue />\n              </SelectTrigger>\n              <SelectContent>\n                <SelectItem value=\"desktop-app\">Desktop App (biometric)</SelectItem>\n                <SelectItem value=\"service-account\">Service Account</SelectItem>\n              </SelectContent>\n            </Select>\n          </div>\n\n          {/* Account / token */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              {authKind === \"desktop-app\" ? \"Account domain\" : \"Service account token\"}\n            </Label>\n            <Input\n              placeholder={authKind === \"desktop-app\" ? \"my.1password.com\" : \"ops_...\"}\n              value={accountName}\n              onChange={(e) => setAccountName((e.target as HTMLInputElement).value)}\n              className=\"font-mono text-[13px] h-9\"\n            />\n            <p className=\"text-[11px] text-muted-foreground/60 leading-relaxed\">\n              {authKind === \"desktop-app\"\n                ? \"Requires the 1Password desktop app with biometric unlock.\"\n                : \"The token is stored in this provider's owner-scoped config and never surfaced again.\"}\n            </p>\n          </div>\n\n          {/* Vault */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              Vault\n            </Label>\n            <VaultPicker\n              authKind={authKind}\n              accountName={accountName}\n              vaultId={vaultId}\n              onVaultSelect={(id, name) => {\n                setVaultId(id);\n                setVaultName(name);\n              }}\n            />\n          </div>\n\n          {/* Display name */}\n          <div className=\"grid gap-1.5\">\n            <Label className=\"text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground\">\n              Display name\n            </Label>\n            <Input\n              placeholder=\"1Password\"\n              value={vaultName}\n              onChange={(e) => setVaultName((e.target as HTMLInputElement).value)}\n              className=\"text-[13px] h-9\"\n            />\n          </div>\n\n          {error && (\n            <div className=\"rounded-md border border-destructive/20 bg-destructive/5 px-3 py-2\">\n              <p className=\"text-[12px] text-destructive whitespace-pre-line\">{error}</p>\n            </div>\n          )}\n        </div>\n\n        <DialogFooter>\n          <DialogClose asChild>\n            <Button variant=\"ghost\" size=\"sm\">\n              Cancel\n            </Button>\n          </DialogClose>\n          <Button\n            size=\"sm\"\n            onClick={handleSave}\n            disabled={!accountName.trim() || !vaultId.trim() || saving}\n          >\n            {saving ? \"Saving…\" : isEdit ? \"Update\" : \"Connect\"}\n          </Button>\n        </DialogFooter>\n      </DialogContent>\n    </Dialog>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Settings card\n// ---------------------------------------------------------------------------\n\nexport default function OnePasswordSettings() {\n  const [configOpen, setConfigOpen] = useState(false);\n  const configResult = useAtomValue(onepasswordConfigAtom);\n  const doRemove = useAtomSet(removeOnePasswordConfig, { mode: \"promiseExit\" });\n\n  const handleRemove = async () => {\n    await doRemove({ reactivityKeys: onepasswordWriteKeys });\n  };\n\n  const config: RedactedOnePasswordConfig | null = AsyncResult.match(\n    configResult as AsyncResult.AsyncResult<RedactedOnePasswordConfig | null, unknown>,\n    {\n      onInitial: () => null,\n      onFailure: () => null,\n      onSuccess: ({ value }) => value,\n    },\n  );\n  const isLoading = AsyncResult.match(\n    configResult as AsyncResult.AsyncResult<RedactedOnePasswordConfig | null, unknown>,\n    {\n      onInitial: () => true,\n      onFailure: () => false,\n      onSuccess: () => false,\n    },\n  );\n  const isError = AsyncResult.match(\n    configResult as AsyncResult.AsyncResult<RedactedOnePasswordConfig | null, unknown>,\n    {\n      onInitial: () => false,\n      onFailure: () => true,\n      onSuccess: () => false,\n    },\n  );\n\n  return (\n    <>\n      <CardStackEntry>\n        <CardStackEntryContent>\n          {isLoading ? (\n            <CardStackEntryDescription>Loading…</CardStackEntryDescription>\n          ) : isError ? (\n            <CardStackEntryDescription className=\"text-destructive\">\n              Failed to load configuration\n            </CardStackEntryDescription>\n          ) : config ? (\n            <div className=\"grid grid-cols-[auto_1fr] gap-x-6 gap-y-1 text-[12px]\">\n              <span className=\"text-muted-foreground/60\">Auth</span>\n              <span className=\"font-mono text-foreground/80 truncate\">\n                {config.auth.kind === \"desktop-app\" ? config.auth.accountName : \"service-account\"}\n              </span>\n              <span className=\"text-muted-foreground/60\">Vault</span>\n              <div className=\"flex items-center gap-2 min-w-0\">\n                <span className=\"text-foreground/80 truncate\">{config.name}</span>\n              </div>\n            </div>\n          ) : (\n            <CardStackEntryDescription>\n              Resolve secrets from your 1Password vault.\n            </CardStackEntryDescription>\n          )}\n        </CardStackEntryContent>\n        <CardStackEntryActions>\n          {config ? (\n            <>\n              <Button\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"h-7 px-2.5 text-[12px]\"\n                onClick={() => setConfigOpen(true)}\n              >\n                Edit\n              </Button>\n              <Button\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"h-7 px-2.5 text-[12px] text-destructive/70 hover:text-destructive\"\n                onClick={handleRemove}\n              >\n                Disconnect\n              </Button>\n            </>\n          ) : (\n            !isLoading &&\n            !isError && (\n              <Button\n                variant=\"link\"\n                size=\"sm\"\n                className=\"h-7 px-0 text-[12px] shrink-0\"\n                onClick={() => setConfigOpen(true)}\n              >\n                Add 1Password\n              </Button>\n            )\n          )}\n        </CardStackEntryActions>\n      </CardStackEntry>\n\n      {configOpen && (\n        <ConfigDialog\n          open={configOpen}\n          onOpenChange={setConfigOpen}\n          initial={\n            config\n              ? {\n                  authKind: config.auth.kind,\n                  // Service-account tokens are never surfaced (redacted); the\n                  // user re-enters the token when editing that auth method.\n                  accountName: config.auth.kind === \"desktop-app\" ? config.auth.accountName : \"\",\n                  vaultId: config.vaultId,\n                  name: config.name,\n                }\n              : undefined\n          }\n        />\n      )}\n    </>\n  );\n}\n","import { ReactivityKey } from \"@rafads/react/api/reactivity-keys\";\nimport { OnePasswordClient } from \"./client\";\n\n// 1Password is a CredentialProvider in v2 — its owner-scoped config lives in\n// the `providers` reactivity family (the v1 `secrets` key is gone).\nexport const onepasswordWriteKeys = [ReactivityKey.providers] as const;\n\n// ---------------------------------------------------------------------------\n// Query atoms\n//\n// v2: the 1Password config is a single owner-partitioned binding the server\n// derives from the executor's owner — there are no owner path params here; the\n// server reads the acting owner from the executor binding.\n// ---------------------------------------------------------------------------\n\nexport const onepasswordConfigAtom = OnePasswordClient.query(\"onepassword\", \"getConfig\", {\n  timeToLive: \"30 seconds\",\n  reactivityKeys: [ReactivityKey.providers],\n});\n\nexport const onepasswordStatusAtom = OnePasswordClient.query(\"onepassword\", \"status\", {\n  timeToLive: \"15 seconds\",\n  reactivityKeys: [ReactivityKey.providers],\n});\n\n// ---------------------------------------------------------------------------\n// Query atoms — vaults\n// ---------------------------------------------------------------------------\n\nexport const onepasswordVaultsAtom = (\n  authKind: \"desktop-app\" | \"service-account\",\n  account: string,\n) =>\n  OnePasswordClient.query(\"onepassword\", \"listVaults\", {\n    query: { authKind, account },\n    timeToLive: \"30 seconds\",\n    reactivityKeys: [ReactivityKey.providers],\n  });\n\n// ---------------------------------------------------------------------------\n// Mutation atoms\n// ---------------------------------------------------------------------------\n\nexport const configureOnePassword = OnePasswordClient.mutation(\"onepassword\", \"configure\");\n\nexport const removeOnePasswordConfig = OnePasswordClient.mutation(\"onepassword\", \"removeConfig\");\n","import { createPluginAtomClient } from \"@rafads/sdk/client\";\nimport {\n  getExecutorOrganizationHeaders,\n  getExecutorApiBaseUrl,\n  getExecutorServerAuthorizationHeader,\n} from \"@rafads/react/api/server-connection\";\nimport { OnePasswordGroup } from \"../api/group\";\n\nexport const OnePasswordClient = createPluginAtomClient(OnePasswordGroup, {\n  baseUrl: getExecutorApiBaseUrl,\n  authorizationHeader: getExecutorServerAuthorizationHeader,\n  headers: getExecutorOrganizationHeaders,\n});\n","import { HttpApiEndpoint, HttpApiGroup } from \"effect/unstable/httpapi\";\nimport { Schema } from \"effect\";\nimport { InternalError } from \"@rafads/sdk/shared\";\n\nimport { OnePasswordError } from \"../sdk/errors\";\nimport {\n  OnePasswordConfig,\n  RedactedOnePasswordConfig,\n  Vault,\n  ConnectionStatus,\n} from \"../sdk/types\";\n\n// ---------------------------------------------------------------------------\n// Payloads\n//\n// v2: config is a single per-owner binding the extension derives from the\n// executor's owner binding — there are no scope segments in the path. The\n// configure payload carries the full config (including the service-account\n// token); reads return the redacted projection so the token never leaves the\n// plugin.\n// ---------------------------------------------------------------------------\n\nconst ConfigurePayload = OnePasswordConfig;\n\nconst ListVaultsParams = Schema.Struct({\n  authKind: Schema.Literals([\"desktop-app\", \"service-account\"]),\n  account: Schema.String,\n});\n\n// ---------------------------------------------------------------------------\n// Responses\n// ---------------------------------------------------------------------------\n\nconst ListVaultsResponse = Schema.Struct({\n  vaults: Schema.Array(Vault),\n});\n\nconst GetConfigResponse = Schema.NullOr(RedactedOnePasswordConfig);\n\n// ---------------------------------------------------------------------------\n// Group\n//\n// Plugin SDK errors (OnePasswordError) are declared once per endpoint via the\n// `error` field — the error carries its own 502 status via `HttpApiSchema`\n// annotations in errors.ts.\n//\n// `InternalError` is the shared opaque 500 schema translated at the HTTP edge\n// by `withCapture`. Storage failures on `ctx.storage` flow through as\n// `StorageFailure` in the typed channel and are captured + downgraded to\n// `InternalError({ traceId })` at Layer composition.\n// ---------------------------------------------------------------------------\n\nexport const OnePasswordGroup = HttpApiGroup.make(\"onepassword\")\n  .add(\n    HttpApiEndpoint.get(\"getConfig\", \"/onepassword/config\", {\n      success: GetConfigResponse,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.put(\"configure\", \"/onepassword/config\", {\n      payload: ConfigurePayload,\n      success: Schema.Void,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"removeConfig\", \"/onepassword/config\", {\n      success: Schema.Void,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"status\", \"/onepassword/status\", {\n      success: ConnectionStatus,\n      error: [InternalError, OnePasswordError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"listVaults\", \"/onepassword/vaults\", {\n      query: ListVaultsParams,\n      success: ListVaultsResponse,\n      error: [InternalError, OnePasswordError],\n    }),\n  );\n"],"mappings":";;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,oBAAoB;AACzC,YAAY,UAAU;AACtB,YAAY,iBAAiB;AAC7B,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AC5BP,SAAS,qBAAqB;;;ACA9B,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACLP,SAAS,iBAAiB,oBAAoB;AAC9C,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAoB9B,IAAM,mBAAmB;AAEzB,IAAM,mBAAmB,OAAO,OAAO;AAAA,EACrC,UAAU,OAAO,SAAS,CAAC,eAAe,iBAAiB,CAAC;AAAA,EAC5D,SAAS,OAAO;AAClB,CAAC;AAMD,IAAM,qBAAqB,OAAO,OAAO;AAAA,EACvC,QAAQ,OAAO,MAAM,KAAK;AAC5B,CAAC;AAED,IAAM,oBAAoB,OAAO,OAAO,yBAAyB;AAe1D,IAAM,mBAAmB,aAAa,KAAK,aAAa,EAC5D;AAAA,EACC,gBAAgB,IAAI,aAAa,uBAAuB;AAAA,IACtD,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,aAAa,uBAAuB;AAAA,IACtD,SAAS;AAAA,IACT,SAAS,OAAO;AAAA,IAChB,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,OAAO,gBAAgB,uBAAuB;AAAA,IAC5D,SAAS,OAAO;AAAA,IAChB,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,UAAU,uBAAuB;AAAA,IACnD,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,cAAc,uBAAuB;AAAA,IACvD,OAAO;AAAA,IACP,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,gBAAgB;AAAA,EACzC,CAAC;AACH;;;AD5EK,IAAM,oBAAoB,uBAAuB,kBAAkB;AAAA,EACxE,SAAS;AAAA,EACT,qBAAqB;AAAA,EACrB,SAAS;AACX,CAAC;;;ADPM,IAAM,uBAAuB,CAAC,cAAc,SAAS;AAUrD,IAAM,wBAAwB,kBAAkB,MAAM,eAAe,aAAa;AAAA,EACvF,YAAY;AAAA,EACZ,gBAAgB,CAAC,cAAc,SAAS;AAC1C,CAAC;AAEM,IAAM,wBAAwB,kBAAkB,MAAM,eAAe,UAAU;AAAA,EACpF,YAAY;AAAA,EACZ,gBAAgB,CAAC,cAAc,SAAS;AAC1C,CAAC;AAMM,IAAM,wBAAwB,CACnC,UACA,YAEA,kBAAkB,MAAM,eAAe,cAAc;AAAA,EACnD,OAAO,EAAE,UAAU,QAAQ;AAAA,EAC3B,YAAY;AAAA,EACZ,gBAAgB,CAAC,cAAc,SAAS;AAC1C,CAAC;AAMI,IAAM,uBAAuB,kBAAkB,SAAS,eAAe,WAAW;AAElF,IAAM,0BAA0B,kBAAkB,SAAS,eAAe,cAAc;;;ADoDzF,SAiSM,UAjSN,KAeE,YAfF;AAtDN,IAAM,4BAA4B;AAElC,IAAM,uBAAuB,CAAC,UAAyB;AAErD,QAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,SAAO,UAAU,GAAG,yBAAyB,KAAK,OAAO,KAAK;AAChE;AAEA,SAAS,YAAY,OAKlB;AACD,QAAM,UAAU,MAAM,YAAY,KAAK;AACvC,QAAM,eAAe,aAAa,sBAAsB,MAAM,UAAU,OAAO,CAAC;AAEhF,QAAM,EAAE,QAAQ,WAAW,MAAM,IAAgB;AAAA,IAC/C;AAAA,IAIA;AAAA,MACE,WAAW,OAAO;AAAA,QAChB,QAAQ,CAAC;AAAA,QACT,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,QACxB,QAAQ,CAAC;AAAA,QACT,WAAW;AAAA,QACX,OAAO,qBAAqB,UAAU;AAAA,MACxC;AAAA,MACA,UAAU,OAAO;AAAA,QACf,QAAQ,CAAC;AAAA,QACT,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,WAAW,CAAC,EAAE,MAAM,MAAM;AACxB,cAAM,IAAI,MAAM;AAChB,cAAM,eAAe,EAAE,CAAC;AACxB,YACE,iBACC,CAAC,MAAM,WAAY,EAAE,WAAW,KAAK,MAAM,YAAY,aAAa,KACrE;AACA,yBAAe,MAAM,MAAM,cAAc,aAAa,IAAI,aAAa,IAAI,CAAC;AAAA,QAC9E;AACA,eAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,OAAO,OAAO,KAAK;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WACE,oBAAC,OAAE,WAAU,6CAA4C,mDAEzD;AAAA,EAEJ;AAEA,QAAM,cAAc,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI;AAEtD,SACE,qBAAC,SAAI,WAAU,cACZ;AAAA,kBACC,oBAAC,SAAI,WAAU,qGACb,8BAAC,UAAK,WAAU,YAAY,sBAAY,MAAK,GAC/C,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,UAAU,aAAa,OAAO,WAAW;AAAA,QACzC,OAAO,MAAM;AAAA,QACb,eAAe,CAAC,OAAO;AACrB,gBAAM,IAAI,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,EAAE;AAChD,cAAI,EAAG,OAAM,cAAc,EAAE,IAAI,EAAE,IAAI;AAAA,QACzC;AAAA,QAEA;AAAA,8BAAC,iBAAc,WAAU,mBACvB,8BAAC,eAAY,aAAa,YAAY,kBAAa,kBAAkB,GACvE;AAAA,UACA,oBAAC,iBACE,iBAAO,IAAI,CAAC,MACX,oBAAC,cAAsB,OAAO,EAAE,IAC7B,YAAE,QADY,EAAE,EAEnB,CACD,GACH;AAAA;AAAA;AAAA,IACF;AAAA,IAED,SACC,oBAAC,SAAI,WAAU,0EACb,8BAAC,OAAE,WAAU,oEACV,iBACH,GACF;AAAA,KAEJ;AAEJ;AAMA,SAAS,aAAa,OASnB;AACD,QAAM,SAAS,CAAC,CAAC,MAAM;AACvB,QAAM,CAAC,UAAU,WAAW,IAAI;AAAA,IAC7B,MAAM,SAAS,YAAkD;AAAA,EACpE;AACA,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,MAAM,SAAS,eAAe,kBAAkB;AAC/F,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM,SAAS,WAAW,EAAE;AACnE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,MAAM,SAAS,QAAQ,EAAE;AACpE,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AAEtD,QAAM,cAAc,WAAW,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE5E,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,QAAQ;AACX,kBAAY,aAAa;AACzB,qBAAe,kBAAkB;AACjC,iBAAW,EAAE;AACb,mBAAa,EAAE;AAAA,IACjB;AACA,aAAS,IAAI;AACb,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,YAAY,KAAK,KAAK,CAAC,QAAQ,KAAK,EAAG;AAC5C,cAAU,IAAI;AACd,aAAS,IAAI;AAEb,UAAM,OACJ,aAAa,gBACT,EAAE,MAAM,eAAwB,aAAa,YAAY,KAAK,EAAE,IAChE,EAAE,MAAM,mBAA4B,OAAO,YAAY,KAAK,EAAE;AAEpE,UAAM,OAAO,MAAM,YAAY;AAAA,MAC7B,SAAS;AAAA,QACP;AAAA,QACA,SAAS,QAAQ,KAAK;AAAA,QACtB,MAAM,UAAU,KAAK,KAAK;AAAA,MAC5B;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAS,eAAU,IAAI,GAAG;AACxB,eAAS,8BAA8B;AACvC,gBAAU,KAAK;AACf;AAAA,IACF;AAEA,UAAM,aAAa,KAAK;AACxB,UAAM;AAAA,EACR;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAM,MAAM;AAAA,MACZ,cAAc,CAAC,MAAM;AACnB,YAAI,CAAC,EAAG,OAAM;AACd,cAAM,aAAa,CAAC;AAAA,MACtB;AAAA,MAEA,+BAAC,iBAAc,WAAU,oBACvB;AAAA,6BAAC,gBACC;AAAA,8BAAC,eAAY,WAAU,wBACpB,mBAAS,mBAAmB,qBAC/B;AAAA,UACA,oBAAC,qBAAkB,WAAU,+BAA8B,iGAE3D;AAAA,WACF;AAAA,QAEA,qBAAC,SAAI,WAAU,mBAEb;AAAA,+BAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EAA4E,yBAE7F;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAO;AAAA,gBACP,eAAe,CAAC,MAAM,YAAY,CAAsC;AAAA,gBAExE;AAAA,sCAAC,iBAAc,WAAU,mBACvB,8BAAC,eAAY,GACf;AAAA,kBACA,qBAAC,iBACC;AAAA,wCAAC,cAAW,OAAM,eAAc,qCAAuB;AAAA,oBACvD,oBAAC,cAAW,OAAM,mBAAkB,6BAAe;AAAA,qBACrD;AAAA;AAAA;AAAA,YACF;AAAA,aACF;AAAA,UAGA,qBAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EACd,uBAAa,gBAAgB,mBAAmB,yBACnD;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,aAAa,aAAa,gBAAgB,qBAAqB;AAAA,gBAC/D,OAAO;AAAA,gBACP,UAAU,CAAC,MAAM,eAAgB,EAAE,OAA4B,KAAK;AAAA,gBACpE,WAAU;AAAA;AAAA,YACZ;AAAA,YACA,oBAAC,OAAE,WAAU,wDACV,uBAAa,gBACV,8DACA,wFACN;AAAA,aACF;AAAA,UAGA,qBAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EAA4E,mBAE7F;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,eAAe,CAAC,IAAI,SAAS;AAC3B,6BAAW,EAAE;AACb,+BAAa,IAAI;AAAA,gBACnB;AAAA;AAAA,YACF;AAAA,aACF;AAAA,UAGA,qBAAC,SAAI,WAAU,gBACb;AAAA,gCAAC,SAAM,WAAU,6EAA4E,0BAE7F;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,aAAY;AAAA,gBACZ,OAAO;AAAA,gBACP,UAAU,CAAC,MAAM,aAAc,EAAE,OAA4B,KAAK;AAAA,gBAClE,WAAU;AAAA;AAAA,YACZ;AAAA,aACF;AAAA,UAEC,SACC,oBAAC,SAAI,WAAU,sEACb,8BAAC,OAAE,WAAU,oDAAoD,iBAAM,GACzE;AAAA,WAEJ;AAAA,QAEA,qBAAC,gBACC;AAAA,8BAAC,eAAY,SAAO,MAClB,8BAAC,UAAO,SAAQ,SAAQ,MAAK,MAAK,oBAElC,GACF;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS;AAAA,cACT,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK;AAAA,cAEnD,mBAAS,iBAAY,SAAS,WAAW;AAAA;AAAA,UAC5C;AAAA,WACF;AAAA,SACF;AAAA;AAAA,EACF;AAEJ;AAMe,SAAR,sBAAuC;AAC5C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,eAAe,aAAa,qBAAqB;AACvD,QAAM,WAAW,WAAW,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAE5E,QAAM,eAAe,YAAY;AAC/B,UAAM,SAAS,EAAE,gBAAgB,qBAAqB,CAAC;AAAA,EACzD;AAEA,QAAM,SAAuD;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,WAAW,CAAC,EAAE,MAAM,MAAM;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,YAAwB;AAAA,IAC5B;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACA,QAAM,UAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AAEA,SACE,iCACE;AAAA,yBAAC,kBACC;AAAA,0BAAC,yBACE,sBACC,oBAAC,6BAA0B,2BAAQ,IACjC,UACF,oBAAC,6BAA0B,WAAU,oBAAmB,0CAExD,IACE,SACF,qBAAC,SAAI,WAAU,yDACb;AAAA,4BAAC,UAAK,WAAU,4BAA2B,kBAAI;AAAA,QAC/C,oBAAC,UAAK,WAAU,yCACb,iBAAO,KAAK,SAAS,gBAAgB,OAAO,KAAK,cAAc,mBAClE;AAAA,QACA,oBAAC,UAAK,WAAU,4BAA2B,mBAAK;AAAA,QAChD,oBAAC,SAAI,WAAU,mCACb,8BAAC,UAAK,WAAU,+BAA+B,iBAAO,MAAK,GAC7D;AAAA,SACF,IAEA,oBAAC,6BAA0B,wDAE3B,GAEJ;AAAA,MACA,oBAAC,yBACE,mBACC,iCACE;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,cAAc,IAAI;AAAA,YAClC;AAAA;AAAA,QAED;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACV;AAAA;AAAA,QAED;AAAA,SACF,IAEA,CAAC,aACD,CAAC,WACC;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS,MAAM,cAAc,IAAI;AAAA,UAClC;AAAA;AAAA,MAED,GAGN;AAAA,OACF;AAAA,IAEC,cACC;AAAA,MAAC;AAAA;AAAA,QACC,MAAM;AAAA,QACN,cAAc;AAAA,QACd,SACE,SACI;AAAA,UACE,UAAU,OAAO,KAAK;AAAA;AAAA;AAAA,UAGtB,aAAa,OAAO,KAAK,SAAS,gBAAgB,OAAO,KAAK,cAAc;AAAA,UAC5E,SAAS,OAAO;AAAA,UAChB,MAAM,OAAO;AAAA,QACf,IACA;AAAA;AAAA,IAER;AAAA,KAEJ;AAEJ;","names":[]}

package/dist/api/group.d.ts

@@ -0,0 +1,36 @@
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { Schema } from "effect";
+import { InternalError } from "@rafads/sdk/shared";
+import { OnePasswordError } from "../sdk/errors";
+export declare const OnePasswordGroup: HttpApiGroup.HttpApiGroup<"onepassword", HttpApiEndpoint.HttpApiEndpoint<"getConfig", "GET", "/onepassword/config", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.NullOr<Schema.Struct<{
+    readonly auth: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"desktop-app">;
+        readonly accountName: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"service-account">;
+    }>]>;
+    readonly vaultId: Schema.String;
+    readonly name: Schema.String;
+}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"configure", "PUT", "/onepassword/config", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly auth: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"desktop-app">;
+        readonly accountName: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"service-account">;
+        readonly token: Schema.String;
+    }>]>;
+    readonly vaultId: Schema.String;
+    readonly name: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeConfig", "DELETE", "/onepassword/config", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Void>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/onepassword/status", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly connected: Schema.Boolean;
+    readonly vaultName: Schema.optional<Schema.String>;
+    readonly error: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listVaults", "GET", "/onepassword/vaults", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authKind: Schema.Literals<readonly ["desktop-app", "service-account"]>;
+    readonly account: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly vaults: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OnePasswordError>, never, never>, false>;

package/dist/api/handlers.d.ts

@@ -0,0 +1,20 @@
+import { Context, Effect } from "effect";
+declare const OnePasswordExtensionService_base: Context.ServiceClass<OnePasswordExtensionService, "OnePasswordExtensionService", {
+    configure: (config: import("../promise").OnePasswordConfig) => Effect.Effect<void, import("@rafads/sdk").StorageError, never>;
+    getConfig: () => Effect.Effect<import("../sdk").RedactedOnePasswordConfig | null, import("@rafads/sdk").StorageError | import("../promise").OnePasswordError>;
+    removeConfig: () => Effect.Effect<void, import("@rafads/sdk").StorageError, never>;
+    status: () => Effect.Effect<{
+        readonly connected: boolean;
+        readonly error?: string | undefined;
+        readonly vaultName?: string | undefined;
+    }, import("@rafads/sdk").StorageError | import("../promise").OnePasswordError, never>;
+    listVaults: (auth: import("../promise").OnePasswordAuth) => Effect.Effect<{
+        readonly id: string;
+        readonly name: string;
+    }[], import("../promise").OnePasswordError, never>;
+    resolve: (uri: string) => Effect.Effect<string, import("@rafads/sdk").StorageError | import("../promise").OnePasswordError, never>;
+}>;
+export declare class OnePasswordExtensionService extends OnePasswordExtensionService_base {
+}
+export declare const OnePasswordHandlers: import("effect/Layer").Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", OnePasswordExtensionService>>;
+export {};