@rafads/plugin-onepassword 1.5.38

package/dist/api/index.d.ts

@@ -0,0 +1,50 @@
+import { type OnePasswordPluginOptions } from "../sdk/plugin";
+import { OnePasswordExtensionService } from "./handlers";
+export { OnePasswordGroup } from "./group";
+export { OnePasswordHandlers, OnePasswordExtensionService } from "./handlers";
+export declare const onepasswordHttpPlugin: import("@rafads/sdk/core").ConfiguredPlugin<"onepassword", {
+    configure: (config: import("../promise").OnePasswordConfig) => import("effect/Effect").Effect<void, import("@rafads/sdk/core").StorageError, never>;
+    getConfig: () => import("effect/Effect").Effect<import("../sdk").RedactedOnePasswordConfig | null, import("@rafads/sdk/core").StorageError | import("../promise").OnePasswordError>;
+    removeConfig: () => import("effect/Effect").Effect<void, import("@rafads/sdk/core").StorageError, never>;
+    status: () => import("effect/Effect").Effect<{
+        readonly connected: boolean;
+        readonly error?: string | undefined;
+        readonly vaultName?: string | undefined;
+    }, import("@rafads/sdk/core").StorageError | import("../promise").OnePasswordError, never>;
+    listVaults: (auth: import("../promise").OnePasswordAuth) => import("effect/Effect").Effect<{
+        readonly id: string;
+        readonly name: string;
+    }[], import("../promise").OnePasswordError, never>;
+    resolve: (uri: string) => import("effect/Effect").Effect<string, import("@rafads/sdk/core").StorageError | import("../promise").OnePasswordError, never>;
+}, import("../sdk").OnePasswordStore, OnePasswordPluginOptions, typeof OnePasswordExtensionService, import("effect/Layer").Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "onepassword">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", OnePasswordExtensionService>>, import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"onepassword", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getConfig", "GET", "/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+    readonly auth: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literal<"desktop-app">;
+        readonly accountName: import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literal<"service-account">;
+    }>]>;
+    readonly vaultId: import("effect/Schema").String;
+    readonly name: import("effect/Schema").String;
+}>>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@rafads/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"configure", "PUT", "/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly auth: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literal<"desktop-app">;
+        readonly accountName: import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literal<"service-account">;
+        readonly token: import("effect/Schema").String;
+    }>]>;
+    readonly vaultId: import("effect/Schema").String;
+    readonly name: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Void>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@rafads/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"removeConfig", "DELETE", "/onepassword/config", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Void>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@rafads/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"status", "GET", "/onepassword/status", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly connected: import("effect/Schema").Boolean;
+    readonly vaultName: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly error: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@rafads/api").InternalError | typeof import("../promise").OnePasswordError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listVaults", "GET", "/onepassword/vaults", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    readonly authKind: import("effect/Schema").Literals<readonly ["desktop-app", "service-account"]>;
+    readonly account: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly vaults: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly id: import("effect/Schema").String;
+        readonly name: import("effect/Schema").String;
+    }>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@rafads/api").InternalError | typeof import("../promise").OnePasswordError>, never, never>, false>>;

package/dist/chunk-JNJOYLVW.js

@@ -0,0 +1,401 @@
+import {
+  ConnectionStatus,
+  OnePasswordAuth,
+  OnePasswordConfig,
+  OnePasswordError,
+  RedactedOnePasswordConfig,
+  Vault,
+  redactConfig
+} from "./chunk-OYHEG6OK.js";
+
+// src/sdk/service.ts
+import { Context, Duration, Effect, Semaphore } from "effect";
+import * as op from "@1password/op-js";
+var OnePasswordServiceTag = class extends Context.Service()("@rafads/plugin-onepassword/OnePasswordService") {
+};
+var DEFAULT_TIMEOUT_MS = 15e3;
+var MAX_ERROR_MESSAGE_LENGTH = 300;
+var SERVICE_ACCOUNT_TOKEN_RE = /ops_[A-Za-z0-9_-]+/g;
+var formatCause = (cause) => {
+  const maybeMessage = cause?.message;
+  const raw = (
+    // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: last-resort stringification of a non-Error throwable
+    typeof maybeMessage === "string" && maybeMessage.length > 0 ? maybeMessage : String(cause)
+  );
+  return raw.replace(SERVICE_ACCOUNT_TOKEN_RE, "[redacted 1Password token]").replace(/\s+/g, " ").trim();
+};
+var messageWithCause = (prefix, cause) => {
+  const causeMessage = formatCause(cause);
+  const message = causeMessage ? `${prefix}: ${causeMessage}` : prefix;
+  return message.length > MAX_ERROR_MESSAGE_LENGTH ? `${message.slice(0, MAX_ERROR_MESSAGE_LENGTH - 3)}...` : message;
+};
+var hasOnePasswordSdkShape = (value) => {
+  const sdk = value;
+  return typeof sdk?.createClient === "function" && typeof sdk.DesktopAuth === "function";
+};
+var invalidOnePasswordSdkError = () => new OnePasswordError({
+  operation: "sdk module load",
+  message: [
+    "Failed to load 1Password SDK: the packaged SDK module did not expose createClient and DesktopAuth.",
+    "Install the 1Password CLI (`op`) in /opt/homebrew/bin or /usr/local/bin and retry, or update Executor."
+  ].join(" ")
+});
+var loadOnePasswordSdk = () => Effect.tryPromise({
+  try: () => import("./onepassword-sdk-BT5LZEVG.js").then((module) => module.onePasswordSdk),
+  catch: (cause) => new OnePasswordError({
+    operation: "sdk module load",
+    message: messageWithCause("Failed to load 1Password SDK", cause)
+  })
+}).pipe(
+  Effect.flatMap(
+    (sdk) => hasOnePasswordSdkShape(sdk) ? Effect.succeed(sdk) : Effect.fail(invalidOnePasswordSdkError())
+  )
+);
+var makeTimeoutMessage = (operation, timeoutMs) => [
+  `${operation}: timed out after ${Math.floor(timeoutMs / 1e3)}s.`,
+  "Troubleshooting:",
+  "1. Make sure the 1Password desktop app is open and unlocked",
+  "2. Check for an approval prompt in the 1Password app \u2014 it may be behind other windows",
+  "3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings",
+  "4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)",
+  "5. Try quitting 1Password completely and reopening it, then retry"
+].join("\n");
+var timeoutWithOnePasswordError = (operation, timeoutMs) => Effect.timeoutOrElse({
+  duration: Duration.millis(timeoutMs),
+  orElse: () => Effect.fail(
+    new OnePasswordError({
+      operation,
+      message: makeTimeoutMessage(operation, timeoutMs)
+    })
+  )
+});
+var makeNativeSdkService = (auth, timeoutMs = DEFAULT_TIMEOUT_MS) => Effect.gen(function* () {
+  const sdk = yield* loadOnePasswordSdk().pipe(
+    timeoutWithOnePasswordError("sdk module load", timeoutMs)
+  );
+  const client = yield* Effect.tryPromise({
+    try: () => sdk.createClient({
+      auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token,
+      integrationName: "Executor",
+      integrationVersion: "0.0.0"
+    }),
+    catch: (cause) => new OnePasswordError({
+      operation: "client setup",
+      message: messageWithCause("Failed to set up 1Password client", cause)
+    })
+  }).pipe(timeoutWithOnePasswordError("client setup", timeoutMs));
+  const wrap = (fn, operation) => Effect.tryPromise({
+    try: fn,
+    catch: (cause) => new OnePasswordError({
+      operation,
+      message: messageWithCause(`1Password SDK ${operation} failed`, cause)
+    })
+  }).pipe(
+    timeoutWithOnePasswordError(operation, timeoutMs),
+    Effect.withSpan(`onepassword.sdk.${operation}`)
+  );
+  return OnePasswordServiceTag.of({
+    resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"),
+    listVaults: () => wrap(() => client.vaults.list({ decryptDetails: true }), "vault listing").pipe(
+      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title })))
+    ),
+    listItems: (vaultId) => wrap(() => client.items.list(vaultId), "item listing").pipe(
+      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
+    )
+  });
+}).pipe(Effect.withSpan("onepassword.sdk.make_service"));
+var cliAuthLock = Semaphore.makeUnsafe(1);
+var makeCliService = (auth) => Effect.sync(() => {
+  const wrapSync = (fn, operation) => cliAuthLock.withPermits(1)(
+    Effect.try({
+      try: () => {
+        if (auth.kind === "service-account") {
+          op.setGlobalFlags({});
+          op.setServiceAccount(auth.token);
+        } else {
+          op.setServiceAccount("");
+          op.setGlobalFlags({ account: auth.accountName });
+        }
+        return fn();
+      },
+      catch: (cause) => new OnePasswordError({
+        operation,
+        message: messageWithCause(`1Password CLI ${operation} failed`, cause)
+      })
+    })
+  ).pipe(Effect.withSpan(`onepassword.cli.${operation}`));
+  return OnePasswordServiceTag.of({
+    resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"),
+    listVaults: () => wrapSync(() => op.vault.list(), "vault listing").pipe(
+      Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name })))
+    ),
+    listItems: (vaultId) => wrapSync(() => op.item.list({ vault: vaultId }), "item listing").pipe(
+      Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title })))
+    )
+  });
+}).pipe(Effect.withSpan("onepassword.cli.make_service"));
+var isCliUnavailable = (error) => {
+  const message = error.message.toLowerCase();
+  return message.includes("enoent") || message.includes("not found") || message.includes("command not found") || message.includes("not installed") || message.includes("no such file") || message.includes("spawn op");
+};
+var chooseFallbackError = (cliError, sdkError) => isCliUnavailable(cliError) ? sdkError : cliError;
+var makeOnePasswordService = (auth, options) => {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (options?.preferSdk) {
+    return makeNativeSdkService(auth, timeoutMs);
+  }
+  return Effect.gen(function* () {
+    const cliService = yield* makeCliService(auth);
+    const sdkService = yield* Effect.cached(makeNativeSdkService(auth, timeoutMs));
+    const withSdkFallback = (cliEffect, sdkEffect) => cliEffect.pipe(
+      Effect.catch(
+        (cliError) => sdkService.pipe(
+          Effect.flatMap(sdkEffect),
+          Effect.mapError(
+            (sdkError) => chooseFallbackError(cliError, sdkError)
+          )
+        )
+      )
+    );
+    return OnePasswordServiceTag.of({
+      resolveSecret: (uri) => withSdkFallback(cliService.resolveSecret(uri), (service) => service.resolveSecret(uri)),
+      listVaults: () => withSdkFallback(cliService.listVaults(), (service) => service.listVaults()),
+      listItems: (vaultId) => withSdkFallback(cliService.listItems(vaultId), (service) => service.listItems(vaultId))
+    });
+  }).pipe(Effect.withSpan("onepassword.make_service"));
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect2, Schema } from "effect";
+import {
+  definePlugin,
+  StorageError,
+  ToolResult,
+  tool,
+  ProviderItemId,
+  ProviderKey
+} from "@rafads/sdk/core";
+var CREDENTIAL_FIELD = "credential";
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+var CONFIG_KEY = "config";
+var PROVIDER_KEY = ProviderKey.make("onepassword");
+var schemaToStaticToolSchema = (schema) => Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema));
+var OnePasswordConfigureInput = Schema.Struct({
+  auth: OnePasswordAuth,
+  vaultId: Schema.String,
+  name: Schema.String
+});
+var OnePasswordConfigureOutput = Schema.Struct({
+  configured: Schema.Boolean
+});
+var OnePasswordGetConfigOutput = Schema.Struct({
+  config: Schema.NullOr(RedactedOnePasswordConfig)
+});
+var OnePasswordListVaultsInput = OnePasswordAuth;
+var OnePasswordListVaultsOutput = Schema.Struct({
+  vaults: Schema.Array(Vault)
+});
+var OnePasswordRemoveConfigOutput = Schema.Struct({
+  removed: Schema.Boolean
+});
+var OnePasswordStatusOutput = ConnectionStatus;
+var OnePasswordConfigureInputStd = schemaToStaticToolSchema(OnePasswordConfigureInput);
+var OnePasswordConfigureOutputStd = schemaToStaticToolSchema(OnePasswordConfigureOutput);
+var OnePasswordGetConfigOutputStd = schemaToStaticToolSchema(OnePasswordGetConfigOutput);
+var OnePasswordListVaultsInputStd = schemaToStaticToolSchema(OnePasswordListVaultsInput);
+var OnePasswordListVaultsOutputStd = schemaToStaticToolSchema(OnePasswordListVaultsOutput);
+var OnePasswordRemoveConfigOutputStd = schemaToStaticToolSchema(OnePasswordRemoveConfigOutput);
+var OnePasswordStatusOutputStd = schemaToStaticToolSchema(OnePasswordStatusOutput);
+var decodeConfig = Schema.decodeUnknownEffect(Schema.fromJsonString(OnePasswordConfig));
+var blobStorageError = (operation) => (cause) => new StorageError({
+  message: `onepassword blob ${operation} failed`,
+  cause
+});
+var makeOnePasswordStore = (blobs) => ({
+  getConfig: () => blobs.get(CONFIG_KEY).pipe(
+    Effect2.mapError(blobStorageError("read")),
+    Effect2.flatMap((raw) => {
+      if (raw === null) return Effect2.succeed(null);
+      return decodeConfig(raw).pipe(
+        Effect2.mapError(
+          () => new OnePasswordError({
+            operation: "config decode",
+            message: "Failed to decode 1Password config"
+          })
+        )
+      );
+    })
+  ),
+  saveConfig: (config, owner) => blobs.put(
+    CONFIG_KEY,
+    JSON.stringify({
+      auth: config.auth,
+      vaultId: config.vaultId,
+      name: config.name
+    }),
+    { owner }
+  ).pipe(Effect2.mapError(blobStorageError("write"))),
+  deleteConfig: (owner) => blobs.delete(CONFIG_KEY, { owner }).pipe(Effect2.mapError(blobStorageError("delete")))
+});
+var resolveAuth = (auth) => auth.kind === "desktop-app" ? { kind: "desktop-app", accountName: auth.accountName } : { kind: "service-account", token: auth.token };
+var getServiceFromConfig = (config, timeoutMs, preferSdk) => makeOnePasswordService(resolveAuth(config.auth), { timeoutMs, preferSdk });
+var configuredVaultUri = (config, itemId) => {
+  if (!itemId.startsWith("op://")) {
+    return `op://${config.vaultId}/${itemId}/${CREDENTIAL_FIELD}`;
+  }
+  const match = itemId.match(/^op:\/\/([^/]+)\/.+/);
+  if (!match || match[1] !== config.vaultId) return null;
+  return itemId;
+};
+var makeProvider = (ctx, timeoutMs, preferSdk) => ({
+  key: PROVIDER_KEY,
+  writable: false,
+  get: (id) => ctx.storage.getConfig().pipe(
+    Effect2.flatMap((config) => {
+      if (!config) return Effect2.succeed(null);
+      const uri = configuredVaultUri(config, id);
+      if (uri === null) return Effect2.succeed(null);
+      return getServiceFromConfig(config, timeoutMs, preferSdk).pipe(
+        Effect2.flatMap((svc) => svc.resolveSecret(uri)),
+        Effect2.map((v) => v),
+        Effect2.orElseSucceed(() => null)
+      );
+    }),
+    Effect2.catch(() => Effect2.succeed(null))
+  ),
+  list: () => ctx.storage.getConfig().pipe(
+    Effect2.flatMap((config) => {
+      if (!config) return Effect2.succeed([]);
+      return getServiceFromConfig(config, timeoutMs, preferSdk).pipe(
+        Effect2.flatMap((svc) => svc.listItems(config.vaultId)),
+        Effect2.map(
+          (items) => items.map((item2) => ({ id: ProviderItemId.make(item2.id), name: item2.title }))
+        )
+      );
+    }),
+    Effect2.catch(() => Effect2.succeed([]))
+  )
+});
+var ownerForCtx = (ctx) => ctx.owner.subject === null ? "org" : "user";
+var makeOnePasswordExtension = (ctx, timeoutMs, preferSdk) => {
+  return {
+    configure: (config) => ctx.storage.saveConfig(config, ownerForCtx(ctx)),
+    getConfig: () => ctx.storage.getConfig().pipe(Effect2.map((config) => config ? redactConfig(config) : null)),
+    removeConfig: () => ctx.storage.deleteConfig(ownerForCtx(ctx)),
+    status: () => Effect2.gen(function* () {
+      const config = yield* ctx.storage.getConfig();
+      if (!config) {
+        return ConnectionStatus.make({
+          connected: false,
+          error: "Not configured"
+        });
+      }
+      const svc = yield* getServiceFromConfig(config, timeoutMs, preferSdk);
+      const vaults = yield* svc.listVaults();
+      const vault2 = vaults.find((v) => v.id === config.vaultId);
+      return ConnectionStatus.make({
+        connected: true,
+        vaultName: vault2?.title
+      });
+    }),
+    listVaults: (auth) => Effect2.gen(function* () {
+      const svc = yield* makeOnePasswordService(resolveAuth(auth), {
+        timeoutMs,
+        preferSdk
+      });
+      const vaults = yield* svc.listVaults();
+      return vaults.map((v) => Vault.make({ id: v.id, name: v.title })).sort((a, b) => a.name.localeCompare(b.name));
+    }),
+    resolve: (uri) => Effect2.gen(function* () {
+      const config = yield* ctx.storage.getConfig();
+      if (!config) {
+        return yield* new OnePasswordError({
+          operation: "resolve",
+          message: "1Password is not configured"
+        });
+      }
+      const scopedUri = configuredVaultUri(config, uri);
+      if (scopedUri === null) {
+        return yield* new OnePasswordError({
+          operation: "resolve",
+          message: "1Password secret URI is outside the configured vault"
+        });
+      }
+      const svc = yield* getServiceFromConfig(config, timeoutMs, preferSdk);
+      return yield* svc.resolveSecret(scopedUri);
+    })
+  };
+};
+var onepasswordPlugin = definePlugin((options) => {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const preferSdk = options?.preferSdk;
+  return {
+    id: "onepassword",
+    packageName: "@rafads/plugin-onepassword",
+    storage: ({ blobs }) => makeOnePasswordStore(blobs),
+    extension: (ctx) => makeOnePasswordExtension(ctx, timeoutMs, preferSdk),
+    staticIntegrations: (self) => [
+      {
+        id: "onepassword",
+        kind: "executor",
+        name: "1Password",
+        tools: [
+          tool({
+            name: "status",
+            description: "Check whether the 1Password credential provider is configured and can reach its selected vault. This returns status only, never secret values.",
+            outputSchema: OnePasswordStatusOutputStd,
+            execute: () => Effect2.map(self.status(), ToolResult.ok)
+          }),
+          tool({
+            name: "getConfig",
+            description: "Read the current 1Password provider configuration. This returns account/vault metadata only; service-account token values are never returned.",
+            outputSchema: OnePasswordGetConfigOutputStd,
+            execute: () => Effect2.map(self.getConfig(), (config) => ToolResult.ok({ config }))
+          }),
+          tool({
+            name: "listVaults",
+            description: "List available 1Password vaults before configuring the provider. For service-account auth, pass the service account token directly.",
+            inputSchema: OnePasswordListVaultsInputStd,
+            outputSchema: OnePasswordListVaultsOutputStd,
+            execute: (input) => Effect2.map(self.listVaults(input), (vaults) => ToolResult.ok({ vaults }))
+          }),
+          tool({
+            name: "configure",
+            description: "Configure the 1Password credential provider for the acting owner. Use desktop-app auth for local biometric access, or service-account auth with the token. The token is stored in the plugin's owner-partitioned config and never surfaced again.",
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Configure the 1Password credential provider"
+            },
+            inputSchema: OnePasswordConfigureInputStd,
+            outputSchema: OnePasswordConfigureOutputStd,
+            execute: (input) => Effect2.as(
+              self.configure({ auth: input.auth, vaultId: input.vaultId, name: input.name }),
+              ToolResult.ok({ configured: true })
+            )
+          }),
+          tool({
+            name: "removeConfig",
+            description: "Remove the 1Password provider configuration for the acting owner. Future 1Password secret resolution stops until reconfigured.",
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Remove the 1Password credential provider configuration"
+            },
+            outputSchema: OnePasswordRemoveConfigOutputStd,
+            execute: () => Effect2.as(self.removeConfig(), ToolResult.ok({ removed: true }))
+          })
+        ]
+      }
+    ],
+    credentialProviders: (ctx) => [makeProvider(ctx, timeoutMs, preferSdk)]
+  };
+});
+
+export {
+  OnePasswordServiceTag,
+  makeNativeSdkService,
+  makeCliService,
+  makeOnePasswordService,
+  makeOnePasswordStore,
+  onepasswordPlugin
+};
+//# sourceMappingURL=chunk-JNJOYLVW.js.map

package/dist/chunk-JNJOYLVW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/service.ts","../src/sdk/plugin.ts"],"sourcesContent":["import { Context, Duration, Effect, Semaphore } from \"effect\";\nimport * as op from \"@1password/op-js\";\n\nimport { OnePasswordError } from \"./errors\";\nimport type { OnePasswordSdkModule } from \"./onepassword-sdk\";\n\n// ---------------------------------------------------------------------------\n// Canonical service interface — all backends (SDK, CLI) implement this\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordVault {\n  readonly id: string;\n  readonly title: string;\n}\n\nexport interface OnePasswordItem {\n  readonly id: string;\n  readonly title: string;\n}\n\nexport interface OnePasswordService {\n  /** Resolve a secret by op:// URI */\n  readonly resolveSecret: (uri: string) => Effect.Effect<string, OnePasswordError>;\n\n  /** List accessible vaults */\n  readonly listVaults: () => Effect.Effect<ReadonlyArray<OnePasswordVault>, OnePasswordError>;\n\n  /** List items in a vault */\n  readonly listItems: (\n    vaultId: string,\n  ) => Effect.Effect<ReadonlyArray<OnePasswordItem>, OnePasswordError>;\n}\n\nexport class OnePasswordServiceTag extends Context.Service<\n  OnePasswordServiceTag,\n  OnePasswordService\n>()(\"@rafads/plugin-onepassword/OnePasswordService\") {}\n\n// ---------------------------------------------------------------------------\n// Resolved auth — raw credentials ready for any backend\n// ---------------------------------------------------------------------------\n\nexport type ResolvedAuth =\n  | { readonly kind: \"desktop-app\"; readonly accountName: string }\n  | { readonly kind: \"service-account\"; readonly token: string };\n\n// ---------------------------------------------------------------------------\n// SDK backend — uses @1password/sdk native IPC\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_TIMEOUT_MS = 15_000;\nconst MAX_ERROR_MESSAGE_LENGTH = 300;\nconst SERVICE_ACCOUNT_TOKEN_RE = /ops_[A-Za-z0-9_-]+/g;\n\nconst formatCause = (cause: unknown): string => {\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: normalizing untyped op-js/SDK throwables into OnePasswordError.message\n  const maybeMessage = (cause as { readonly message?: unknown } | null | undefined)?.message;\n  const raw =\n    // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: last-resort stringification of a non-Error throwable\n    typeof maybeMessage === \"string\" && maybeMessage.length > 0 ? maybeMessage : String(cause);\n  return raw\n    .replace(SERVICE_ACCOUNT_TOKEN_RE, \"[redacted 1Password token]\")\n    .replace(/\\s+/g, \" \")\n    .trim();\n};\n\nconst messageWithCause = (prefix: string, cause: unknown): string => {\n  const causeMessage = formatCause(cause);\n  const message = causeMessage ? `${prefix}: ${causeMessage}` : prefix;\n  return message.length > MAX_ERROR_MESSAGE_LENGTH\n    ? `${message.slice(0, MAX_ERROR_MESSAGE_LENGTH - 3)}...`\n    : message;\n};\n\nconst hasOnePasswordSdkShape = (value: unknown): value is OnePasswordSdkModule => {\n  const sdk = value as Partial<OnePasswordSdkModule> | null | undefined;\n  return typeof sdk?.createClient === \"function\" && typeof sdk.DesktopAuth === \"function\";\n};\n\nconst invalidOnePasswordSdkError = () =>\n  new OnePasswordError({\n    operation: \"sdk module load\",\n    message: [\n      \"Failed to load 1Password SDK: the packaged SDK module did not expose createClient and DesktopAuth.\",\n      \"Install the 1Password CLI (`op`) in /opt/homebrew/bin or /usr/local/bin and retry, or update Executor.\",\n    ].join(\" \"),\n  });\n\nconst loadOnePasswordSdk = (): Effect.Effect<OnePasswordSdkModule, OnePasswordError> =>\n  Effect.tryPromise({\n    try: () => import(\"./onepassword-sdk\").then((module) => module.onePasswordSdk),\n    catch: (cause) =>\n      new OnePasswordError({\n        operation: \"sdk module load\",\n        message: messageWithCause(\"Failed to load 1Password SDK\", cause),\n      }),\n  }).pipe(\n    Effect.flatMap((sdk) =>\n      hasOnePasswordSdkShape(sdk) ? Effect.succeed(sdk) : Effect.fail(invalidOnePasswordSdkError()),\n    ),\n  );\n\nconst makeTimeoutMessage = (operation: string, timeoutMs: number): string =>\n  [\n    `${operation}: timed out after ${Math.floor(timeoutMs / 1000)}s.`,\n    \"Troubleshooting:\",\n    \"1. Make sure the 1Password desktop app is open and unlocked\",\n    \"2. Check for an approval prompt in the 1Password app — it may be behind other windows\",\n    \"3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings\",\n    \"4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)\",\n    \"5. Try quitting 1Password completely and reopening it, then retry\",\n  ].join(\"\\n\");\n\nconst timeoutWithOnePasswordError = (operation: string, timeoutMs: number) =>\n  Effect.timeoutOrElse({\n    duration: Duration.millis(timeoutMs),\n    orElse: () =>\n      Effect.fail(\n        new OnePasswordError({\n          operation,\n          message: makeTimeoutMessage(operation, timeoutMs),\n        }),\n      ),\n  });\n\nexport const makeNativeSdkService = (\n  auth: ResolvedAuth,\n  timeoutMs: number = DEFAULT_TIMEOUT_MS,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  Effect.gen(function* () {\n    const sdk = yield* loadOnePasswordSdk().pipe(\n      timeoutWithOnePasswordError(\"sdk module load\", timeoutMs),\n    );\n\n    const client = yield* Effect.tryPromise({\n      try: () =>\n        sdk.createClient({\n          auth: auth.kind === \"desktop-app\" ? new sdk.DesktopAuth(auth.accountName) : auth.token,\n          integrationName: \"Executor\",\n          integrationVersion: \"0.0.0\",\n        }),\n      catch: (cause) =>\n        new OnePasswordError({\n          operation: \"client setup\",\n          message: messageWithCause(\"Failed to set up 1Password client\", cause),\n        }),\n    }).pipe(timeoutWithOnePasswordError(\"client setup\", timeoutMs));\n\n    const wrap = <A>(fn: () => Promise<A>, operation: string): Effect.Effect<A, OnePasswordError> =>\n      Effect.tryPromise({\n        try: fn,\n        catch: (cause) =>\n          new OnePasswordError({\n            operation,\n            message: messageWithCause(`1Password SDK ${operation} failed`, cause),\n          }),\n      }).pipe(\n        timeoutWithOnePasswordError(operation, timeoutMs),\n        Effect.withSpan(`onepassword.sdk.${operation}`),\n      );\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), \"secret resolution\"),\n\n      listVaults: () =>\n        wrap(() => client.vaults.list({ decryptDetails: true }), \"vault listing\").pipe(\n          Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title }))),\n        ),\n\n      listItems: (vaultId) =>\n        wrap(() => client.items.list(vaultId), \"item listing\").pipe(\n          Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))),\n        ),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.sdk.make_service\"));\n\n// ---------------------------------------------------------------------------\n// CLI backend — uses @1password/op-js (shells out to `op` CLI)\n// ---------------------------------------------------------------------------\n\nconst cliAuthLock = Semaphore.makeUnsafe(1);\n\nexport const makeCliService = (\n  auth: ResolvedAuth,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  Effect.sync(() => {\n    const wrapSync = <A>(fn: () => A, operation: string): Effect.Effect<A, OnePasswordError> =>\n      cliAuthLock\n        .withPermits(1)(\n          Effect.try({\n            try: () => {\n              if (auth.kind === \"service-account\") {\n                op.setGlobalFlags({});\n                op.setServiceAccount(auth.token);\n              } else {\n                op.setServiceAccount(\"\");\n                op.setGlobalFlags({ account: auth.accountName });\n              }\n              return fn();\n            },\n            catch: (cause) =>\n              new OnePasswordError({\n                operation,\n                message: messageWithCause(`1Password CLI ${operation} failed`, cause),\n              }),\n          }),\n        )\n        .pipe(Effect.withSpan(`onepassword.cli.${operation}`));\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), \"secret resolution\"),\n\n      listVaults: () =>\n        wrapSync(() => op.vault.list(), \"vault listing\").pipe(\n          Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name }))),\n        ),\n\n      listItems: (vaultId) =>\n        wrapSync(() => op.item.list({ vault: vaultId }), \"item listing\").pipe(\n          Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))),\n        ),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.cli.make_service\"));\n\n// ---------------------------------------------------------------------------\n// Smart factory — tries CLI first (avoids IPC hang), falls back to SDK\n// ---------------------------------------------------------------------------\n\nconst isCliUnavailable = (error: OnePasswordError): boolean => {\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OnePasswordError carries a typed `message`\n  const message = error.message.toLowerCase();\n  return (\n    message.includes(\"enoent\") ||\n    message.includes(\"not found\") ||\n    message.includes(\"command not found\") ||\n    message.includes(\"not installed\") ||\n    message.includes(\"no such file\") ||\n    message.includes(\"spawn op\")\n  );\n};\n\nconst chooseFallbackError = (\n  cliError: OnePasswordError,\n  sdkError: OnePasswordError,\n): OnePasswordError => (isCliUnavailable(cliError) ? sdkError : cliError);\n\nexport const makeOnePasswordService = (\n  auth: ResolvedAuth,\n  options?: { readonly preferSdk?: boolean; readonly timeoutMs?: number },\n): Effect.Effect<OnePasswordService, OnePasswordError> => {\n  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  if (options?.preferSdk) {\n    return makeNativeSdkService(auth, timeoutMs);\n  }\n\n  return Effect.gen(function* () {\n    const cliService = yield* makeCliService(auth);\n    const sdkService = yield* Effect.cached(makeNativeSdkService(auth, timeoutMs));\n\n    const withSdkFallback = <A>(\n      cliEffect: Effect.Effect<A, OnePasswordError>,\n      sdkEffect: (service: OnePasswordService) => Effect.Effect<A, OnePasswordError>,\n    ): Effect.Effect<A, OnePasswordError> =>\n      cliEffect.pipe(\n        Effect.catch((cliError: OnePasswordError) =>\n          sdkService.pipe(\n            Effect.flatMap(sdkEffect),\n            Effect.mapError((sdkError: OnePasswordError) =>\n              chooseFallbackError(cliError, sdkError),\n            ),\n          ),\n        ),\n      );\n\n    return OnePasswordServiceTag.of({\n      resolveSecret: (uri) =>\n        withSdkFallback(cliService.resolveSecret(uri), (service) => service.resolveSecret(uri)),\n\n      listVaults: () => withSdkFallback(cliService.listVaults(), (service) => service.listVaults()),\n\n      listItems: (vaultId) =>\n        withSdkFallback(cliService.listItems(vaultId), (service) => service.listItems(vaultId)),\n    });\n  }).pipe(Effect.withSpan(\"onepassword.make_service\"));\n};\n","import { Effect, Schema } from \"effect\";\n\nimport {\n  definePlugin,\n  StorageError,\n  ToolResult,\n  tool,\n  ProviderItemId,\n  ProviderKey,\n  type CredentialProvider,\n  type Owner,\n  type PluginCtx,\n  type PluginBlobStore,\n  type ProviderEntry,\n  type StaticToolSchema,\n  type StorageFailure,\n} from \"@rafads/sdk/core\";\n\nimport {\n  OnePasswordAuth,\n  OnePasswordConfig,\n  RedactedOnePasswordConfig,\n  Vault,\n  ConnectionStatus,\n  redactConfig,\n} from \"./types\";\nimport { OnePasswordError } from \"./errors\";\nimport { makeOnePasswordService, type ResolvedAuth, type OnePasswordService } from \"./service\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst CREDENTIAL_FIELD = \"credential\";\nconst DEFAULT_TIMEOUT_MS = 15_000;\nconst CONFIG_KEY = \"config\";\nconst PROVIDER_KEY = ProviderKey.make(\"onepassword\");\n\nconst schemaToStaticToolSchema = <A, I>(schema: Schema.Decoder<A, I>): StaticToolSchema<A, I> =>\n  Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema) as never) as StaticToolSchema<\n    A,\n    I\n  >;\n\nconst OnePasswordConfigureInput = Schema.Struct({\n  auth: OnePasswordAuth,\n  vaultId: Schema.String,\n  name: Schema.String,\n});\n\nconst OnePasswordConfigureOutput = Schema.Struct({\n  configured: Schema.Boolean,\n});\n\nconst OnePasswordGetConfigOutput = Schema.Struct({\n  config: Schema.NullOr(RedactedOnePasswordConfig),\n});\n\nconst OnePasswordListVaultsInput = OnePasswordAuth;\n\nconst OnePasswordListVaultsOutput = Schema.Struct({\n  vaults: Schema.Array(Vault),\n});\n\nconst OnePasswordRemoveConfigOutput = Schema.Struct({\n  removed: Schema.Boolean,\n});\n\nconst OnePasswordStatusOutput = ConnectionStatus;\n\nconst OnePasswordConfigureInputStd = schemaToStaticToolSchema<\n  typeof OnePasswordConfigureInput.Type,\n  typeof OnePasswordConfigureInput.Encoded\n>(OnePasswordConfigureInput);\nconst OnePasswordConfigureOutputStd = schemaToStaticToolSchema(OnePasswordConfigureOutput);\nconst OnePasswordGetConfigOutputStd = schemaToStaticToolSchema(OnePasswordGetConfigOutput);\nconst OnePasswordListVaultsInputStd = schemaToStaticToolSchema<\n  typeof OnePasswordListVaultsInput.Type,\n  typeof OnePasswordListVaultsInput.Encoded\n>(OnePasswordListVaultsInput);\nconst OnePasswordListVaultsOutputStd = schemaToStaticToolSchema(OnePasswordListVaultsOutput);\nconst OnePasswordRemoveConfigOutputStd = schemaToStaticToolSchema(OnePasswordRemoveConfigOutput);\nconst OnePasswordStatusOutputStd = schemaToStaticToolSchema(OnePasswordStatusOutput);\n\n// ---------------------------------------------------------------------------\n// Shared failure alias.\n//\n// Every extension method either touches storage (`ctx.storage` blobs) or\n// reaches the 1Password backend. Storage I/O surfaces as `StorageFailure`;\n// the HTTP edge (`withCapture`) translates `StorageError` to\n// `InternalError({ traceId })`. Domain problems (not configured, backend RPC\n// failure) stay as `OnePasswordError` and encode to 502 via the schema\n// annotation on the class.\n// ---------------------------------------------------------------------------\n\nexport type OnePasswordExtensionFailure = OnePasswordError | StorageFailure;\n\n// ---------------------------------------------------------------------------\n// Typed config store — single blob, JSON encoded, owner-partitioned. The\n// stored config carries the auth credential (desktop account name, or\n// service-account token) plus the selected vault. v1 keyed this by executor\n// scope; v2 partitions by `owner` — the plugin-owned config row owns the\n// partition, mirroring the connection model. Blob I/O failures surface as\n// `StorageError`; decode failures stay `OnePasswordError`.\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordStore {\n  readonly getConfig: () => Effect.Effect<\n    OnePasswordConfig | null,\n    StorageError | OnePasswordError\n  >;\n  readonly saveConfig: (\n    config: OnePasswordConfig,\n    owner: Owner,\n  ) => Effect.Effect<void, StorageError>;\n  readonly deleteConfig: (owner: Owner) => Effect.Effect<void, StorageError>;\n}\n\nconst decodeConfig = Schema.decodeUnknownEffect(Schema.fromJsonString(OnePasswordConfig));\n\nconst blobStorageError =\n  (operation: string) =>\n  (cause: unknown): StorageError =>\n    new StorageError({\n      message: `onepassword blob ${operation} failed`,\n      cause,\n    });\n\nexport const makeOnePasswordStore = (blobs: PluginBlobStore): OnePasswordStore => ({\n  getConfig: () =>\n    blobs.get(CONFIG_KEY).pipe(\n      Effect.mapError(blobStorageError(\"read\")),\n      Effect.flatMap((raw) => {\n        if (raw === null) return Effect.succeed(null);\n        return decodeConfig(raw).pipe(\n          Effect.mapError(\n            () =>\n              new OnePasswordError({\n                operation: \"config decode\",\n                message: \"Failed to decode 1Password config\",\n              }),\n          ),\n        );\n      }),\n    ),\n\n  saveConfig: (config, owner) =>\n    blobs\n      .put(\n        CONFIG_KEY,\n        JSON.stringify({\n          auth: config.auth,\n          vaultId: config.vaultId,\n          name: config.name,\n        }),\n        { owner },\n      )\n      .pipe(Effect.mapError(blobStorageError(\"write\"))),\n\n  deleteConfig: (owner) =>\n    blobs.delete(CONFIG_KEY, { owner }).pipe(Effect.mapError(blobStorageError(\"delete\"))),\n});\n\n// ---------------------------------------------------------------------------\n// Helpers — auth resolution + service construction\n// ---------------------------------------------------------------------------\n\nconst resolveAuth = (auth: OnePasswordAuth): ResolvedAuth =>\n  auth.kind === \"desktop-app\"\n    ? { kind: \"desktop-app\", accountName: auth.accountName }\n    : { kind: \"service-account\", token: auth.token };\n\nconst getServiceFromConfig = (\n  config: OnePasswordConfig,\n  timeoutMs: number,\n  preferSdk: boolean | undefined,\n): Effect.Effect<OnePasswordService, OnePasswordError> =>\n  makeOnePasswordService(resolveAuth(config.auth), { timeoutMs, preferSdk });\n\nconst configuredVaultUri = (config: OnePasswordConfig, itemId: string): string | null => {\n  if (!itemId.startsWith(\"op://\")) {\n    return `op://${config.vaultId}/${itemId}/${CREDENTIAL_FIELD}`;\n  }\n  const match = itemId.match(/^op:\\/\\/([^/]+)\\/.+/);\n  if (!match || match[1] !== config.vaultId) return null;\n  return itemId;\n};\n\n// ---------------------------------------------------------------------------\n// CredentialProvider — read-only, resolves op:// URIs or vaultId-based lookups.\n//\n// v2: `get(id)` receives only an opaque `ProviderItemId` — no scope. The id is\n// either a fully-qualified `op://vault/item/field` URI or a bare item id that\n// the stored config's vault scopes. The plugin's stored config supplies the\n// auth + vault binding; the provider never writes (writable: false).\n// ---------------------------------------------------------------------------\n\nconst makeProvider = (\n  ctx: PluginCtx<OnePasswordStore>,\n  timeoutMs: number,\n  preferSdk: boolean | undefined,\n): CredentialProvider => ({\n  key: PROVIDER_KEY,\n  writable: false,\n\n  get: (id: ProviderItemId): Effect.Effect<string | null, StorageFailure> =>\n    ctx.storage.getConfig().pipe(\n      Effect.flatMap((config) => {\n        if (!config) return Effect.succeed(null as string | null);\n\n        const uri = configuredVaultUri(config, id);\n        if (uri === null) return Effect.succeed(null as string | null);\n\n        return getServiceFromConfig(config, timeoutMs, preferSdk).pipe(\n          Effect.flatMap((svc) => svc.resolveSecret(uri)),\n          Effect.map((v): string | null => v),\n          Effect.orElseSucceed(() => null),\n        );\n      }),\n      Effect.catch(() => Effect.succeed(null as string | null)),\n    ),\n\n  list: (): Effect.Effect<readonly ProviderEntry[], StorageFailure> =>\n    ctx.storage.getConfig().pipe(\n      Effect.flatMap((config) => {\n        if (!config) return Effect.succeed([] as readonly ProviderEntry[]);\n        return getServiceFromConfig(config, timeoutMs, preferSdk).pipe(\n          Effect.flatMap((svc) => svc.listItems(config.vaultId)),\n          Effect.map((items): readonly ProviderEntry[] =>\n            items.map((item) => ({ id: ProviderItemId.make(item.id), name: item.title })),\n          ),\n        );\n      }),\n      Effect.catch(() => Effect.succeed([] as readonly ProviderEntry[])),\n    ),\n});\n\n// ---------------------------------------------------------------------------\n// Owner resolution — config is a single shared 1Password binding. We persist\n// it under the `user` partition when the executor is bound to a subject, else\n// the shared `org` partition.\n// ---------------------------------------------------------------------------\n\nconst ownerForCtx = (ctx: PluginCtx<OnePasswordStore>): Owner =>\n  ctx.owner.subject === null ? \"org\" : \"user\";\n\nconst makeOnePasswordExtension = (\n  ctx: PluginCtx<OnePasswordStore>,\n  timeoutMs: number,\n  preferSdk: boolean | undefined,\n) => {\n  return {\n    configure: (config: OnePasswordConfig) => ctx.storage.saveConfig(config, ownerForCtx(ctx)),\n\n    getConfig: (): Effect.Effect<\n      RedactedOnePasswordConfig | null,\n      StorageError | OnePasswordError\n    > =>\n      ctx.storage.getConfig().pipe(Effect.map((config) => (config ? redactConfig(config) : null))),\n\n    removeConfig: () => ctx.storage.deleteConfig(ownerForCtx(ctx)),\n\n    status: () =>\n      Effect.gen(function* () {\n        const config = yield* ctx.storage.getConfig();\n        if (!config) {\n          return ConnectionStatus.make({\n            connected: false,\n            error: \"Not configured\",\n          });\n        }\n        const svc = yield* getServiceFromConfig(config, timeoutMs, preferSdk);\n        const vaults = yield* svc.listVaults();\n        const vault = vaults.find((v) => v.id === config.vaultId);\n        return ConnectionStatus.make({\n          connected: true,\n          vaultName: vault?.title,\n        });\n      }),\n\n    listVaults: (auth: OnePasswordAuth) =>\n      Effect.gen(function* () {\n        const svc = yield* makeOnePasswordService(resolveAuth(auth), {\n          timeoutMs,\n          preferSdk,\n        });\n        const vaults = yield* svc.listVaults();\n        return vaults\n          .map((v) => Vault.make({ id: v.id, name: v.title }))\n          .sort((a, b) => a.name.localeCompare(b.name));\n      }),\n\n    resolve: (uri: string) =>\n      Effect.gen(function* () {\n        const config = yield* ctx.storage.getConfig();\n        if (!config) {\n          return yield* new OnePasswordError({\n            operation: \"resolve\",\n            message: \"1Password is not configured\",\n          });\n        }\n        const scopedUri = configuredVaultUri(config, uri);\n        if (scopedUri === null) {\n          return yield* new OnePasswordError({\n            operation: \"resolve\",\n            message: \"1Password secret URI is outside the configured vault\",\n          });\n        }\n        const svc = yield* getServiceFromConfig(config, timeoutMs, preferSdk);\n        return yield* svc.resolveSecret(scopedUri);\n      }),\n  };\n};\n\nexport type OnePasswordExtension = ReturnType<typeof makeOnePasswordExtension>;\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface OnePasswordPluginOptions {\n  /** Request timeout in ms (default: 15000) */\n  readonly timeoutMs?: number;\n  /** Force use of the native SDK instead of the CLI (default: false) */\n  readonly preferSdk?: boolean;\n}\n\nexport const onepasswordPlugin = definePlugin((options?: OnePasswordPluginOptions) => {\n  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const preferSdk = options?.preferSdk;\n\n  return {\n    id: \"onepassword\" as const,\n    packageName: \"@rafads/plugin-onepassword\",\n    storage: ({ blobs }) => makeOnePasswordStore(blobs),\n\n    extension: (ctx) => makeOnePasswordExtension(ctx, timeoutMs, preferSdk),\n\n    staticIntegrations: (self) => [\n      {\n        id: \"onepassword\",\n        kind: \"executor\",\n        name: \"1Password\",\n        tools: [\n          tool({\n            name: \"status\",\n            description:\n              \"Check whether the 1Password credential provider is configured and can reach its selected vault. This returns status only, never secret values.\",\n            outputSchema: OnePasswordStatusOutputStd,\n            execute: () => Effect.map(self.status(), ToolResult.ok),\n          }),\n          tool({\n            name: \"getConfig\",\n            description:\n              \"Read the current 1Password provider configuration. This returns account/vault metadata only; service-account token values are never returned.\",\n            outputSchema: OnePasswordGetConfigOutputStd,\n            execute: () => Effect.map(self.getConfig(), (config) => ToolResult.ok({ config })),\n          }),\n          tool({\n            name: \"listVaults\",\n            description:\n              \"List available 1Password vaults before configuring the provider. For service-account auth, pass the service account token directly.\",\n            inputSchema: OnePasswordListVaultsInputStd,\n            outputSchema: OnePasswordListVaultsOutputStd,\n            execute: (input) =>\n              Effect.map(self.listVaults(input), (vaults) => ToolResult.ok({ vaults })),\n          }),\n          tool({\n            name: \"configure\",\n            description:\n              \"Configure the 1Password credential provider for the acting owner. Use desktop-app auth for local biometric access, or service-account auth with the token. The token is stored in the plugin's owner-partitioned config and never surfaced again.\",\n            annotations: {\n              requiresApproval: true,\n              approvalDescription: \"Configure the 1Password credential provider\",\n            },\n            inputSchema: OnePasswordConfigureInputStd,\n            outputSchema: OnePasswordConfigureOutputStd,\n            execute: (input) =>\n              Effect.as(\n                self.configure({ auth: input.auth, vaultId: input.vaultId, name: input.name }),\n                ToolResult.ok({ configured: true }),\n              ),\n          }),\n          tool({\n            name: \"removeConfig\",\n            description:\n              \"Remove the 1Password provider configuration for the acting owner. Future 1Password secret resolution stops until reconfigured.\",\n            annotations: {\n              requiresApproval: true,\n              approvalDescription: \"Remove the 1Password credential provider configuration\",\n            },\n            outputSchema: OnePasswordRemoveConfigOutputStd,\n            execute: () => Effect.as(self.removeConfig(), ToolResult.ok({ removed: true })),\n          }),\n        ],\n      },\n    ],\n\n    credentialProviders: (ctx) => [makeProvider(ctx, timeoutMs, preferSdk)],\n  };\n  // HTTP transport (routes/handlers/extensionService) is layered on by\n  // the api-aware factory in `@rafads/plugin-onepassword/api`. Hosts\n  // that want the HTTP surface import the plugin from there; SDK-only\n  // consumers stay on this entry and avoid the server-only deps.\n});\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,SAAS,UAAU,QAAQ,iBAAiB;AACrD,YAAY,QAAQ;AAgCb,IAAM,wBAAN,cAAoC,QAAQ,QAGjD,EAAE,+CAA+C,EAAE;AAAC;AActD,IAAM,qBAAqB;AAC3B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AAEjC,IAAM,cAAc,CAAC,UAA2B;AAE9C,QAAM,eAAgB,OAA6D;AACnF,QAAM;AAAA;AAAA,IAEJ,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe,OAAO,KAAK;AAAA;AAC3F,SAAO,IACJ,QAAQ,0BAA0B,4BAA4B,EAC9D,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,IAAM,mBAAmB,CAAC,QAAgB,UAA2B;AACnE,QAAM,eAAe,YAAY,KAAK;AACtC,QAAM,UAAU,eAAe,GAAG,MAAM,KAAK,YAAY,KAAK;AAC9D,SAAO,QAAQ,SAAS,2BACpB,GAAG,QAAQ,MAAM,GAAG,2BAA2B,CAAC,CAAC,QACjD;AACN;AAEA,IAAM,yBAAyB,CAAC,UAAkD;AAChF,QAAM,MAAM;AACZ,SAAO,OAAO,KAAK,iBAAiB,cAAc,OAAO,IAAI,gBAAgB;AAC/E;AAEA,IAAM,6BAA6B,MACjC,IAAI,iBAAiB;AAAA,EACnB,WAAW;AAAA,EACX,SAAS;AAAA,IACP;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ,CAAC;AAEH,IAAM,qBAAqB,MACzB,OAAO,WAAW;AAAA,EAChB,KAAK,MAAM,OAAO,+BAAmB,EAAE,KAAK,CAAC,WAAW,OAAO,cAAc;AAAA,EAC7E,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,IACnB,WAAW;AAAA,IACX,SAAS,iBAAiB,gCAAgC,KAAK;AAAA,EACjE,CAAC;AACL,CAAC,EAAE;AAAA,EACD,OAAO;AAAA,IAAQ,CAAC,QACd,uBAAuB,GAAG,IAAI,OAAO,QAAQ,GAAG,IAAI,OAAO,KAAK,2BAA2B,CAAC;AAAA,EAC9F;AACF;AAEF,IAAM,qBAAqB,CAAC,WAAmB,cAC7C;AAAA,EACE,GAAG,SAAS,qBAAqB,KAAK,MAAM,YAAY,GAAI,CAAC;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEb,IAAM,8BAA8B,CAAC,WAAmB,cACtD,OAAO,cAAc;AAAA,EACnB,UAAU,SAAS,OAAO,SAAS;AAAA,EACnC,QAAQ,MACN,OAAO;AAAA,IACL,IAAI,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS,mBAAmB,WAAW,SAAS;AAAA,IAClD,CAAC;AAAA,EACH;AACJ,CAAC;AAEI,IAAM,uBAAuB,CAClC,MACA,YAAoB,uBAEpB,OAAO,IAAI,aAAa;AACtB,QAAM,MAAM,OAAO,mBAAmB,EAAE;AAAA,IACtC,4BAA4B,mBAAmB,SAAS;AAAA,EAC1D;AAEA,QAAM,SAAS,OAAO,OAAO,WAAW;AAAA,IACtC,KAAK,MACH,IAAI,aAAa;AAAA,MACf,MAAM,KAAK,SAAS,gBAAgB,IAAI,IAAI,YAAY,KAAK,WAAW,IAAI,KAAK;AAAA,MACjF,iBAAiB;AAAA,MACjB,oBAAoB;AAAA,IACtB,CAAC;AAAA,IACH,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB,WAAW;AAAA,MACX,SAAS,iBAAiB,qCAAqC,KAAK;AAAA,IACtE,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,4BAA4B,gBAAgB,SAAS,CAAC;AAE9D,QAAM,OAAO,CAAI,IAAsB,cACrC,OAAO,WAAW;AAAA,IAChB,KAAK;AAAA,IACL,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS,iBAAiB,iBAAiB,SAAS,WAAW,KAAK;AAAA,IACtE,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,4BAA4B,WAAW,SAAS;AAAA,IAChD,OAAO,SAAS,mBAAmB,SAAS,EAAE;AAAA,EAChD;AAEF,SAAO,sBAAsB,GAAG;AAAA,IAC9B,eAAe,CAAC,QAAQ,KAAK,MAAM,OAAO,QAAQ,QAAQ,GAAG,GAAG,mBAAmB;AAAA,IAEnF,YAAY,MACV,KAAK,MAAM,OAAO,OAAO,KAAK,EAAE,gBAAgB,KAAK,CAAC,GAAG,eAAe,EAAE;AAAA,MACxE,OAAO,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,IAC1E;AAAA,IAEF,WAAW,CAAC,YACV,KAAK,MAAM,OAAO,MAAM,KAAK,OAAO,GAAG,cAAc,EAAE;AAAA,MACrD,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,IACxE;AAAA,EACJ,CAAC;AACH,CAAC,EAAE,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAMzD,IAAM,cAAc,UAAU,WAAW,CAAC;AAEnC,IAAM,iBAAiB,CAC5B,SAEA,OAAO,KAAK,MAAM;AAChB,QAAM,WAAW,CAAI,IAAa,cAChC,YACG,YAAY,CAAC;AAAA,IACZ,OAAO,IAAI;AAAA,MACT,KAAK,MAAM;AACT,YAAI,KAAK,SAAS,mBAAmB;AACnC,UAAG,kBAAe,CAAC,CAAC;AACpB,UAAG,qBAAkB,KAAK,KAAK;AAAA,QACjC,OAAO;AACL,UAAG,qBAAkB,EAAE;AACvB,UAAG,kBAAe,EAAE,SAAS,KAAK,YAAY,CAAC;AAAA,QACjD;AACA,eAAO,GAAG;AAAA,MACZ;AAAA,MACA,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,QACnB;AAAA,QACA,SAAS,iBAAiB,iBAAiB,SAAS,WAAW,KAAK;AAAA,MACtE,CAAC;AAAA,IACL,CAAC;AAAA,EACH,EACC,KAAK,OAAO,SAAS,mBAAmB,SAAS,EAAE,CAAC;AAEzD,SAAO,sBAAsB,GAAG;AAAA,IAC9B,eAAe,CAAC,QAAQ,SAAS,MAAS,QAAK,MAAM,GAAG,GAAG,mBAAmB;AAAA,IAE9E,YAAY,MACV,SAAS,MAAS,SAAM,KAAK,GAAG,eAAe,EAAE;AAAA,MAC/C,OAAO,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IACzE;AAAA,IAEF,WAAW,CAAC,YACV,SAAS,MAAS,QAAK,KAAK,EAAE,OAAO,QAAQ,CAAC,GAAG,cAAc,EAAE;AAAA,MAC/D,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,IACxE;AAAA,EACJ,CAAC;AACH,CAAC,EAAE,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAMzD,IAAM,mBAAmB,CAAC,UAAqC;AAE7D,QAAM,UAAU,MAAM,QAAQ,YAAY;AAC1C,SACE,QAAQ,SAAS,QAAQ,KACzB,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,mBAAmB,KACpC,QAAQ,SAAS,eAAe,KAChC,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,UAAU;AAE/B;AAEA,IAAM,sBAAsB,CAC1B,UACA,aACsB,iBAAiB,QAAQ,IAAI,WAAW;AAEzD,IAAM,yBAAyB,CACpC,MACA,YACwD;AACxD,QAAM,YAAY,SAAS,aAAa;AAExC,MAAI,SAAS,WAAW;AACtB,WAAO,qBAAqB,MAAM,SAAS;AAAA,EAC7C;AAEA,SAAO,OAAO,IAAI,aAAa;AAC7B,UAAM,aAAa,OAAO,eAAe,IAAI;AAC7C,UAAM,aAAa,OAAO,OAAO,OAAO,qBAAqB,MAAM,SAAS,CAAC;AAE7E,UAAM,kBAAkB,CACtB,WACA,cAEA,UAAU;AAAA,MACR,OAAO;AAAA,QAAM,CAAC,aACZ,WAAW;AAAA,UACT,OAAO,QAAQ,SAAS;AAAA,UACxB,OAAO;AAAA,YAAS,CAAC,aACf,oBAAoB,UAAU,QAAQ;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEF,WAAO,sBAAsB,GAAG;AAAA,MAC9B,eAAe,CAAC,QACd,gBAAgB,WAAW,cAAc,GAAG,GAAG,CAAC,YAAY,QAAQ,cAAc,GAAG,CAAC;AAAA,MAExF,YAAY,MAAM,gBAAgB,WAAW,WAAW,GAAG,CAAC,YAAY,QAAQ,WAAW,CAAC;AAAA,MAE5F,WAAW,CAAC,YACV,gBAAgB,WAAW,UAAU,OAAO,GAAG,CAAC,YAAY,QAAQ,UAAU,OAAO,CAAC;AAAA,IAC1F,CAAC;AAAA,EACH,CAAC,EAAE,KAAK,OAAO,SAAS,0BAA0B,CAAC;AACrD;;;AC7RA,SAAS,UAAAA,SAAQ,cAAc;AAE/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AAiBP,IAAM,mBAAmB;AACzB,IAAMC,sBAAqB;AAC3B,IAAM,aAAa;AACnB,IAAM,eAAe,YAAY,KAAK,aAAa;AAEnD,IAAM,2BAA2B,CAAO,WACtC,OAAO,mBAAmB,OAAO,uBAAuB,MAAM,CAAU;AAK1E,IAAM,4BAA4B,OAAO,OAAO;AAAA,EAC9C,MAAM;AAAA,EACN,SAAS,OAAO;AAAA,EAChB,MAAM,OAAO;AACf,CAAC;AAED,IAAM,6BAA6B,OAAO,OAAO;AAAA,EAC/C,YAAY,OAAO;AACrB,CAAC;AAED,IAAM,6BAA6B,OAAO,OAAO;AAAA,EAC/C,QAAQ,OAAO,OAAO,yBAAyB;AACjD,CAAC;AAED,IAAM,6BAA6B;AAEnC,IAAM,8BAA8B,OAAO,OAAO;AAAA,EAChD,QAAQ,OAAO,MAAM,KAAK;AAC5B,CAAC;AAED,IAAM,gCAAgC,OAAO,OAAO;AAAA,EAClD,SAAS,OAAO;AAClB,CAAC;AAED,IAAM,0BAA0B;AAEhC,IAAM,+BAA+B,yBAGnC,yBAAyB;AAC3B,IAAM,gCAAgC,yBAAyB,0BAA0B;AACzF,IAAM,gCAAgC,yBAAyB,0BAA0B;AACzF,IAAM,gCAAgC,yBAGpC,0BAA0B;AAC5B,IAAM,iCAAiC,yBAAyB,2BAA2B;AAC3F,IAAM,mCAAmC,yBAAyB,6BAA6B;AAC/F,IAAM,6BAA6B,yBAAyB,uBAAuB;AAoCnF,IAAM,eAAe,OAAO,oBAAoB,OAAO,eAAe,iBAAiB,CAAC;AAExF,IAAM,mBACJ,CAAC,cACD,CAAC,UACC,IAAI,aAAa;AAAA,EACf,SAAS,oBAAoB,SAAS;AAAA,EACtC;AACF,CAAC;AAEE,IAAM,uBAAuB,CAAC,WAA8C;AAAA,EACjF,WAAW,MACT,MAAM,IAAI,UAAU,EAAE;AAAA,IACpBC,QAAO,SAAS,iBAAiB,MAAM,CAAC;AAAA,IACxCA,QAAO,QAAQ,CAAC,QAAQ;AACtB,UAAI,QAAQ,KAAM,QAAOA,QAAO,QAAQ,IAAI;AAC5C,aAAO,aAAa,GAAG,EAAE;AAAA,QACvBA,QAAO;AAAA,UACL,MACE,IAAI,iBAAiB;AAAA,YACnB,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACL;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEF,YAAY,CAAC,QAAQ,UACnB,MACG;AAAA,IACC;AAAA,IACA,KAAK,UAAU;AAAA,MACb,MAAM,OAAO;AAAA,MACb,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,IACf,CAAC;AAAA,IACD,EAAE,MAAM;AAAA,EACV,EACC,KAAKA,QAAO,SAAS,iBAAiB,OAAO,CAAC,CAAC;AAAA,EAEpD,cAAc,CAAC,UACb,MAAM,OAAO,YAAY,EAAE,MAAM,CAAC,EAAE,KAAKA,QAAO,SAAS,iBAAiB,QAAQ,CAAC,CAAC;AACxF;AAMA,IAAM,cAAc,CAAC,SACnB,KAAK,SAAS,gBACV,EAAE,MAAM,eAAe,aAAa,KAAK,YAAY,IACrD,EAAE,MAAM,mBAAmB,OAAO,KAAK,MAAM;AAEnD,IAAM,uBAAuB,CAC3B,QACA,WACA,cAEA,uBAAuB,YAAY,OAAO,IAAI,GAAG,EAAE,WAAW,UAAU,CAAC;AAE3E,IAAM,qBAAqB,CAAC,QAA2B,WAAkC;AACvF,MAAI,CAAC,OAAO,WAAW,OAAO,GAAG;AAC/B,WAAO,QAAQ,OAAO,OAAO,IAAI,MAAM,IAAI,gBAAgB;AAAA,EAC7D;AACA,QAAM,QAAQ,OAAO,MAAM,qBAAqB;AAChD,MAAI,CAAC,SAAS,MAAM,CAAC,MAAM,OAAO,QAAS,QAAO;AAClD,SAAO;AACT;AAWA,IAAM,eAAe,CACnB,KACA,WACA,eACwB;AAAA,EACxB,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,OACJ,IAAI,QAAQ,UAAU,EAAE;AAAA,IACtBA,QAAO,QAAQ,CAAC,WAAW;AACzB,UAAI,CAAC,OAAQ,QAAOA,QAAO,QAAQ,IAAqB;AAExD,YAAM,MAAM,mBAAmB,QAAQ,EAAE;AACzC,UAAI,QAAQ,KAAM,QAAOA,QAAO,QAAQ,IAAqB;AAE7D,aAAO,qBAAqB,QAAQ,WAAW,SAAS,EAAE;AAAA,QACxDA,QAAO,QAAQ,CAAC,QAAQ,IAAI,cAAc,GAAG,CAAC;AAAA,QAC9CA,QAAO,IAAI,CAAC,MAAqB,CAAC;AAAA,QAClCA,QAAO,cAAc,MAAM,IAAI;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,IACDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,IAAqB,CAAC;AAAA,EAC1D;AAAA,EAEF,MAAM,MACJ,IAAI,QAAQ,UAAU,EAAE;AAAA,IACtBA,QAAO,QAAQ,CAAC,WAAW;AACzB,UAAI,CAAC,OAAQ,QAAOA,QAAO,QAAQ,CAAC,CAA6B;AACjE,aAAO,qBAAqB,QAAQ,WAAW,SAAS,EAAE;AAAA,QACxDA,QAAO,QAAQ,CAAC,QAAQ,IAAI,UAAU,OAAO,OAAO,CAAC;AAAA,QACrDA,QAAO;AAAA,UAAI,CAAC,UACV,MAAM,IAAI,CAACC,WAAU,EAAE,IAAI,eAAe,KAAKA,MAAK,EAAE,GAAG,MAAMA,MAAK,MAAM,EAAE;AAAA,QAC9E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACDD,QAAO,MAAM,MAAMA,QAAO,QAAQ,CAAC,CAA6B,CAAC;AAAA,EACnE;AACJ;AAQA,IAAM,cAAc,CAAC,QACnB,IAAI,MAAM,YAAY,OAAO,QAAQ;AAEvC,IAAM,2BAA2B,CAC/B,KACA,WACA,cACG;AACH,SAAO;AAAA,IACL,WAAW,CAAC,WAA8B,IAAI,QAAQ,WAAW,QAAQ,YAAY,GAAG,CAAC;AAAA,IAEzF,WAAW,MAIT,IAAI,QAAQ,UAAU,EAAE,KAAKA,QAAO,IAAI,CAAC,WAAY,SAAS,aAAa,MAAM,IAAI,IAAK,CAAC;AAAA,IAE7F,cAAc,MAAM,IAAI,QAAQ,aAAa,YAAY,GAAG,CAAC;AAAA,IAE7D,QAAQ,MACNA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,OAAO,IAAI,QAAQ,UAAU;AAC5C,UAAI,CAAC,QAAQ;AACX,eAAO,iBAAiB,KAAK;AAAA,UAC3B,WAAW;AAAA,UACX,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,YAAM,MAAM,OAAO,qBAAqB,QAAQ,WAAW,SAAS;AACpE,YAAM,SAAS,OAAO,IAAI,WAAW;AACrC,YAAME,SAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,OAAO;AACxD,aAAO,iBAAiB,KAAK;AAAA,QAC3B,WAAW;AAAA,QACX,WAAWA,QAAO;AAAA,MACpB,CAAC;AAAA,IACH,CAAC;AAAA,IAEH,YAAY,CAAC,SACXF,QAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,uBAAuB,YAAY,IAAI,GAAG;AAAA,QAC3D;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,SAAS,OAAO,IAAI,WAAW;AACrC,aAAO,OACJ,IAAI,CAAC,MAAM,MAAM,KAAK,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EAClD,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,IAChD,CAAC;AAAA,IAEH,SAAS,CAAC,QACRA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,OAAO,IAAI,QAAQ,UAAU;AAC5C,UAAI,CAAC,QAAQ;AACX,eAAO,OAAO,IAAI,iBAAiB;AAAA,UACjC,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,YAAM,YAAY,mBAAmB,QAAQ,GAAG;AAChD,UAAI,cAAc,MAAM;AACtB,eAAO,OAAO,IAAI,iBAAiB;AAAA,UACjC,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,YAAM,MAAM,OAAO,qBAAqB,QAAQ,WAAW,SAAS;AACpE,aAAO,OAAO,IAAI,cAAc,SAAS;AAAA,IAC3C,CAAC;AAAA,EACL;AACF;AAeO,IAAM,oBAAoB,aAAa,CAAC,YAAuC;AACpF,QAAM,YAAY,SAAS,aAAaD;AACxC,QAAM,YAAY,SAAS;AAE3B,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,SAAS,CAAC,EAAE,MAAM,MAAM,qBAAqB,KAAK;AAAA,IAElD,WAAW,CAAC,QAAQ,yBAAyB,KAAK,WAAW,SAAS;AAAA,IAEtE,oBAAoB,CAAC,SAAS;AAAA,MAC5B;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,UACL,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,cAAc;AAAA,YACd,SAAS,MAAMC,QAAO,IAAI,KAAK,OAAO,GAAG,WAAW,EAAE;AAAA,UACxD,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,cAAc;AAAA,YACd,SAAS,MAAMA,QAAO,IAAI,KAAK,UAAU,GAAG,CAAC,WAAW,WAAW,GAAG,EAAE,OAAO,CAAC,CAAC;AAAA,UACnF,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,UACRA,QAAO,IAAI,KAAK,WAAW,KAAK,GAAG,CAAC,WAAW,WAAW,GAAG,EAAE,OAAO,CAAC,CAAC;AAAA,UAC5E,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,cACX,kBAAkB;AAAA,cAClB,qBAAqB;AAAA,YACvB;AAAA,YACA,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,UACRA,QAAO;AAAA,cACL,KAAK,UAAU,EAAE,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;AAAA,cAC7E,WAAW,GAAG,EAAE,YAAY,KAAK,CAAC;AAAA,YACpC;AAAA,UACJ,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,cACX,kBAAkB;AAAA,cAClB,qBAAqB;AAAA,YACvB;AAAA,YACA,cAAc;AAAA,YACd,SAAS,MAAMA,QAAO,GAAG,KAAK,aAAa,GAAG,WAAW,GAAG,EAAE,SAAS,KAAK,CAAC,CAAC;AAAA,UAChF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IAEA,qBAAqB,CAAC,QAAQ,CAAC,aAAa,KAAK,WAAW,SAAS,CAAC;AAAA,EACxE;AAKF,CAAC;","names":["Effect","DEFAULT_TIMEOUT_MS","Effect","item","vault"]}

package/dist/chunk-OYHEG6OK.js

@@ -0,0 +1,76 @@
+// src/sdk/types.ts
+import { Schema } from "effect";
+var DesktopAppAuth = Schema.Struct({
+  kind: Schema.Literal("desktop-app"),
+  /** 1Password account domain, e.g. "my.1password.com" */
+  accountName: Schema.String
+});
+var ServiceAccountAuth = Schema.Struct({
+  kind: Schema.Literal("service-account"),
+  /** The service account token. Persisted in the plugin's owner-partitioned
+   *  config blob — never surfaced to agents (`getConfig` redacts it). v1 stored
+   *  this behind a separate secret id; v2 has no secrets table, so the
+   *  plugin-owned config row carries it directly. */
+  token: Schema.String
+});
+var OnePasswordAuth = Schema.Union([DesktopAppAuth, ServiceAccountAuth]);
+var OnePasswordConfig = Schema.Struct({
+  auth: OnePasswordAuth,
+  /** Vault to scope operations to */
+  vaultId: Schema.String,
+  /** Human label */
+  name: Schema.String
+});
+var RedactedDesktopAppAuth = DesktopAppAuth;
+var RedactedServiceAccountAuth = Schema.Struct({
+  kind: Schema.Literal("service-account")
+});
+var RedactedOnePasswordAuth = Schema.Union([
+  RedactedDesktopAppAuth,
+  RedactedServiceAccountAuth
+]);
+var RedactedOnePasswordConfig = Schema.Struct({
+  auth: RedactedOnePasswordAuth,
+  vaultId: Schema.String,
+  name: Schema.String
+});
+var redactConfig = (config) => ({
+  auth: config.auth.kind === "desktop-app" ? { kind: "desktop-app", accountName: config.auth.accountName } : { kind: "service-account" },
+  vaultId: config.vaultId,
+  name: config.name
+});
+var Vault = Schema.Struct({
+  id: Schema.String,
+  name: Schema.String
+});
+var ConnectionStatus = Schema.Struct({
+  connected: Schema.Boolean,
+  vaultName: Schema.optional(Schema.String),
+  error: Schema.optional(Schema.String)
+});
+
+// src/sdk/errors.ts
+import { Schema as Schema2 } from "effect";
+var OnePasswordError = class extends Schema2.TaggedErrorClass()(
+  "OnePasswordError",
+  {
+    operation: Schema2.String,
+    message: Schema2.String
+  },
+  { httpApiStatus: 502 }
+) {
+};
+
+export {
+  DesktopAppAuth,
+  ServiceAccountAuth,
+  OnePasswordAuth,
+  OnePasswordConfig,
+  RedactedOnePasswordAuth,
+  RedactedOnePasswordConfig,
+  redactConfig,
+  Vault,
+  ConnectionStatus,
+  OnePasswordError
+};
+//# sourceMappingURL=chunk-OYHEG6OK.js.map

package/dist/chunk-OYHEG6OK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/types.ts","../src/sdk/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n// ---------------------------------------------------------------------------\n// Auth — how to talk to 1Password\n// ---------------------------------------------------------------------------\n\nexport const DesktopAppAuth = Schema.Struct({\n  kind: Schema.Literal(\"desktop-app\"),\n  /** 1Password account domain, e.g. \"my.1password.com\" */\n  accountName: Schema.String,\n});\nexport type DesktopAppAuth = typeof DesktopAppAuth.Type;\n\nexport const ServiceAccountAuth = Schema.Struct({\n  kind: Schema.Literal(\"service-account\"),\n  /** The service account token. Persisted in the plugin's owner-partitioned\n   *  config blob — never surfaced to agents (`getConfig` redacts it). v1 stored\n   *  this behind a separate secret id; v2 has no secrets table, so the\n   *  plugin-owned config row carries it directly. */\n  token: Schema.String,\n});\nexport type ServiceAccountAuth = typeof ServiceAccountAuth.Type;\n\nexport const OnePasswordAuth = Schema.Union([DesktopAppAuth, ServiceAccountAuth]);\nexport type OnePasswordAuth = typeof OnePasswordAuth.Type;\n\n// ---------------------------------------------------------------------------\n// Stored config — persisted via KV\n// ---------------------------------------------------------------------------\n\nexport const OnePasswordConfig = Schema.Struct({\n  auth: OnePasswordAuth,\n  /** Vault to scope operations to */\n  vaultId: Schema.String,\n  /** Human label */\n  name: Schema.String,\n});\nexport type OnePasswordConfig = typeof OnePasswordConfig.Type;\n\n// ---------------------------------------------------------------------------\n// Redacted config — what `getConfig` returns to agents / the UI. The\n// service-account token is stripped; only the auth kind + account metadata is\n// surfaced.\n// ---------------------------------------------------------------------------\n\nexport const RedactedDesktopAppAuth = DesktopAppAuth;\n\nexport const RedactedServiceAccountAuth = Schema.Struct({\n  kind: Schema.Literal(\"service-account\"),\n});\n\nexport const RedactedOnePasswordAuth = Schema.Union([\n  RedactedDesktopAppAuth,\n  RedactedServiceAccountAuth,\n]);\n\nexport const RedactedOnePasswordConfig = Schema.Struct({\n  auth: RedactedOnePasswordAuth,\n  vaultId: Schema.String,\n  name: Schema.String,\n});\nexport type RedactedOnePasswordConfig = typeof RedactedOnePasswordConfig.Type;\n\n/** Strip the service-account token from a stored config for external exposure. */\nexport const redactConfig = (config: OnePasswordConfig): RedactedOnePasswordConfig => ({\n  auth:\n    config.auth.kind === \"desktop-app\"\n      ? { kind: \"desktop-app\", accountName: config.auth.accountName }\n      : { kind: \"service-account\" },\n  vaultId: config.vaultId,\n  name: config.name,\n});\n\n// ---------------------------------------------------------------------------\n// Vault\n// ---------------------------------------------------------------------------\n\nexport const Vault = Schema.Struct({\n  id: Schema.String,\n  name: Schema.String,\n});\nexport type Vault = typeof Vault.Type;\n\n// ---------------------------------------------------------------------------\n// Connection status\n// ---------------------------------------------------------------------------\n\nexport const ConnectionStatus = Schema.Struct({\n  connected: Schema.Boolean,\n  vaultName: Schema.optional(Schema.String),\n  error: Schema.optional(Schema.String),\n});\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n","import { Schema } from \"effect\";\n\nexport class OnePasswordError extends Schema.TaggedErrorClass<OnePasswordError>()(\n  \"OnePasswordError\",\n  {\n    operation: Schema.String,\n    message: Schema.String,\n  },\n  { httpApiStatus: 502 },\n) {}\n"],"mappings":";AAAA,SAAS,cAAc;AAMhB,IAAM,iBAAiB,OAAO,OAAO;AAAA,EAC1C,MAAM,OAAO,QAAQ,aAAa;AAAA;AAAA,EAElC,aAAa,OAAO;AACtB,CAAC;AAGM,IAAM,qBAAqB,OAAO,OAAO;AAAA,EAC9C,MAAM,OAAO,QAAQ,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,OAAO,OAAO;AAChB,CAAC;AAGM,IAAM,kBAAkB,OAAO,MAAM,CAAC,gBAAgB,kBAAkB,CAAC;AAOzE,IAAM,oBAAoB,OAAO,OAAO;AAAA,EAC7C,MAAM;AAAA;AAAA,EAEN,SAAS,OAAO;AAAA;AAAA,EAEhB,MAAM,OAAO;AACf,CAAC;AASM,IAAM,yBAAyB;AAE/B,IAAM,6BAA6B,OAAO,OAAO;AAAA,EACtD,MAAM,OAAO,QAAQ,iBAAiB;AACxC,CAAC;AAEM,IAAM,0BAA0B,OAAO,MAAM;AAAA,EAClD;AAAA,EACA;AACF,CAAC;AAEM,IAAM,4BAA4B,OAAO,OAAO;AAAA,EACrD,MAAM;AAAA,EACN,SAAS,OAAO;AAAA,EAChB,MAAM,OAAO;AACf,CAAC;AAIM,IAAM,eAAe,CAAC,YAA0D;AAAA,EACrF,MACE,OAAO,KAAK,SAAS,gBACjB,EAAE,MAAM,eAAe,aAAa,OAAO,KAAK,YAAY,IAC5D,EAAE,MAAM,kBAAkB;AAAA,EAChC,SAAS,OAAO;AAAA,EAChB,MAAM,OAAO;AACf;AAMO,IAAM,QAAQ,OAAO,OAAO;AAAA,EACjC,IAAI,OAAO;AAAA,EACX,MAAM,OAAO;AACf,CAAC;AAOM,IAAM,mBAAmB,OAAO,OAAO;AAAA,EAC5C,WAAW,OAAO;AAAA,EAClB,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,OAAO,OAAO,SAAS,OAAO,MAAM;AACtC,CAAC;;;AC3FD,SAAS,UAAAA,eAAc;AAEhB,IAAM,mBAAN,cAA+BA,QAAO,iBAAmC;AAAA,EAC9E;AAAA,EACA;AAAA,IACE,WAAWA,QAAO;AAAA,IAClB,SAASA,QAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;","names":["Schema"]}