cloudcruise 1.1.0 → 1.2.0

package/dist/CloudCruise.d.ts

@@ -1,4 +1,5 @@
 import { VaultClient } from './vault/VaultClient.js';
+import { SecretProvidersClient } from './secretProviders/SecretProvidersClient.js';
 import { WorkflowsClient } from './workflows/WorkflowsClient.js';
 import { RunsClient } from './runs/RunsClient.js';
 import { WebhookClient } from './webhook/WebhookClient.js';
@@ -16,6 +17,7 @@ export declare class CloudCruise {
     private readonly baseUrl;
     private readonly encryptionKey;
     readonly vault: VaultClient;
+    readonly secretProviders: SecretProvidersClient;
     readonly workflows: WorkflowsClient;
     readonly runs: RunsClient;
     readonly webhook: WebhookClient;

package/dist/CloudCruise.js

@@ -1,5 +1,6 @@
 import { getEnv } from './utils/env.js';
 import { VaultClient } from './vault/VaultClient.js';
+import { SecretProvidersClient } from './secretProviders/SecretProvidersClient.js';
 import { WorkflowsClient } from './workflows/WorkflowsClient.js';
 import { RunsClient } from './runs/RunsClient.js';
 import { WebhookClient } from './webhook/WebhookClient.js';
@@ -39,6 +40,7 @@ export class CloudCruise {
     baseUrl;
     encryptionKey;
     vault;
+    secretProviders;
     workflows;
     runs;
     webhook;
@@ -61,6 +63,7 @@ export class CloudCruise {
         // Initialize namespace clients
         this.connectionManager = new ConnectionManager(this.baseUrl, this.apiKey);
         this.vault = new VaultClient(this.makeRequest.bind(this), this.encryptionKey);
+        this.secretProviders = new SecretProvidersClient(this.makeRequest.bind(this));
         this.workflows = new WorkflowsClient(this.makeRequest.bind(this));
         this.runs = new RunsClient(this.connectionManager, this.makeRequest.bind(this), this.workflows);
         this.webhook = new WebhookClient();

package/dist/index.d.ts

@@ -5,10 +5,11 @@
 export { CloudCruise } from './CloudCruise.js';
 export type { CloudCruiseParams } from './CloudCruise.js';
 export { VaultClient } from './vault/VaultClient.js';
+export { SecretProvidersClient } from './secretProviders/SecretProvidersClient.js';
 export { WorkflowsClient } from './workflows/WorkflowsClient.js';
 export { RunsClient } from './runs/RunsClient.js';
 export { WebhookClient } from './webhook/WebhookClient.js';
-export type { VaultEntry, GetVaultEntriesFilters, ProxyConfig, VaultPostPutHeadersInBody } from './vault/types.js';
+export type { VaultEntry, GetVaultEntriesFilters, ProxyConfig, VaultPostPutHeadersInBody, SecretProvider, SecretProviderItem, SecretProviderType } from './vault/types.js';
 export type { Workflow, WorkflowInputSchema, WorkflowMetadata } from './workflows/types.js';
 export type { DryRun, Metadata, RunSpecificWebhook, PayloadWebhook, StartRunRequest, StartRunResponse, UserInteractionData, VideoUrl, SignedFileUrl, SignedScreenshotUrl, RunError, WorkflowError, RunResult, GetRunResult, WebhookEvent, WebhookReplayResponse, RunHandle, RunStreamOptions, SseEventName, SseMessage, RunEventEnvelope, RunHandleEventMap } from './runs/types.js';
 export { EventType } from './events/types.js';

package/dist/index.js

@@ -4,6 +4,7 @@
  */
 export { CloudCruise } from './CloudCruise.js';
 export { VaultClient } from './vault/VaultClient.js';
+export { SecretProvidersClient } from './secretProviders/SecretProvidersClient.js';
 export { WorkflowsClient } from './workflows/WorkflowsClient.js';
 export { RunsClient } from './runs/RunsClient.js';
 export { WebhookClient } from './webhook/WebhookClient.js';

package/dist/secretProviders/SecretProvidersClient.d.ts

@@ -0,0 +1,7 @@
+import type { SecretProvider, SecretProviderItem } from '../vault/types.js';
+export declare class SecretProvidersClient {
+    private readonly makeRequest;
+    constructor(makeRequest: <T = any>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: any) => Promise<T>);
+    list(): Promise<SecretProvider[]>;
+    listItems(secretProviderId: string): Promise<SecretProviderItem[]>;
+}

package/dist/secretProviders/SecretProvidersClient.js

@@ -0,0 +1,17 @@
+export class SecretProvidersClient {
+    makeRequest;
+    constructor(makeRequest) {
+        this.makeRequest = makeRequest;
+    }
+    async list() {
+        const response = await this.makeRequest('GET', '/secret-providers');
+        return Array.isArray(response) ? response : [response];
+    }
+    async listItems(secretProviderId) {
+        if (!secretProviderId) {
+            throw new Error('secretProviderId is required');
+        }
+        const response = await this.makeRequest('GET', `/secret-providers/${encodeURIComponent(secretProviderId)}/items`);
+        return Array.isArray(response) ? response : [response];
+    }
+}

package/dist/vault/VaultClient.d.ts

@@ -32,14 +32,10 @@ export declare class VaultClient {
      * Updates an existing vault entry
      * @param updates - Vault entry updates including required fields
      * @param updates.permissioned_user_id - Required: User identifier for the vault entry
-     * @param updates.user_name - Required: Username or email
-     * @param updates.password - Required: User password
      * @param updates.domain - Required: Target domain for the credentials
      */
     update(updates: Partial<VaultEntry> & {
         permissioned_user_id: string;
-        user_name: string;
-        password: string;
         domain: string;
     }): Promise<VaultEntry>;
     /**

package/dist/vault/VaultClient.js

@@ -1,4 +1,28 @@
 import { encryptSensitiveFields, decryptSensitiveFields } from './utils.js';
+function validateProviderPayload(entry) {
+    const hasProviderId = entry.secret_provider_id !== undefined && entry.secret_provider_id !== null;
+    const hasSecretRef = entry.secret_ref !== undefined && entry.secret_ref !== null;
+    if (hasProviderId !== hasSecretRef) {
+        throw new Error('secret_provider_id and secret_ref must be provided together');
+    }
+    if (entry.secret_cache_ttl_seconds !== undefined && entry.secret_cache_ttl_seconds !== null) {
+        if (!Number.isInteger(entry.secret_cache_ttl_seconds) || entry.secret_cache_ttl_seconds < 0) {
+            throw new Error('secret_cache_ttl_seconds must be a non-negative integer');
+        }
+        if (!hasProviderId) {
+            throw new Error('secret_cache_ttl_seconds requires secret_provider_id and secret_ref');
+        }
+    }
+    if (hasProviderId) {
+        const conflicts = ['user_name', 'password', 'tfa_secret'].filter(field => entry[field] !== undefined && entry[field] !== null);
+        if (conflicts.length > 0) {
+            throw new Error(`provider-backed vault entries cannot include ${conflicts.join(', ')}`);
+        }
+    }
+}
+function isProviderBackedPayload(entry) {
+    return entry.secret_provider_id != null && entry.secret_ref != null;
+}
 export class VaultClient {
     makeRequest;
     encryptionKey;
@@ -15,6 +39,7 @@ export class VaultClient {
             permissioned_user_id,
             ...options
         };
+        validateProviderPayload(entry);
         let processedEntry = { ...entry };
         // Encrypt sensitive fields
         processedEntry = await encryptSensitiveFields(processedEntry, this.encryptionKey);
@@ -78,8 +103,6 @@ export class VaultClient {
      * Updates an existing vault entry
      * @param updates - Vault entry updates including required fields
      * @param updates.permissioned_user_id - Required: User identifier for the vault entry
-     * @param updates.user_name - Required: Username or email
-     * @param updates.password - Required: User password
      * @param updates.domain - Required: Target domain for the credentials
      */
     async update(updates) {
@@ -87,15 +110,18 @@ export class VaultClient {
         if (!updates.permissioned_user_id) {
             throw new Error('permissioned_user_id is required for vault updates');
         }
-        if (!updates.user_name) {
-            throw new Error('user_name is required for vault updates');
-        }
-        if (!updates.password) {
-            throw new Error('password is required for vault updates');
-        }
         if (!updates.domain) {
             throw new Error('domain is required for vault updates');
         }
+        validateProviderPayload(updates);
+        if (!isProviderBackedPayload(updates)) {
+            if (!updates.user_name) {
+                throw new Error('user_name is required for vault updates');
+            }
+            if (!updates.password) {
+                throw new Error('password is required for vault updates');
+            }
+        }
         let processedEntry = { ...updates };
         // Encrypt sensitive fields
         processedEntry = await encryptSensitiveFields(processedEntry, this.encryptionKey);

package/dist/vault/types.d.ts

@@ -17,6 +17,9 @@ export interface VaultEntry {
     user_id?: string;
     password?: string;
     user_name?: string;
+    secret_provider_id?: string | null;
+    secret_ref?: string | null;
+    secret_cache_ttl_seconds?: number | null;
     tfa_secret?: string;
     user_agent?: string;
     user_alias?: string;
@@ -50,6 +53,19 @@ export interface GetVaultEntriesFilters {
     domain?: string;
     decryptCredentials?: boolean;
 }
+export type SecretProviderType = '1password';
+export interface SecretProvider {
+    id: string;
+    provider_type: SecretProviderType;
+    name: string;
+    cache_ttl_seconds?: number | null;
+}
+export interface SecretProviderItem {
+    id: string;
+    title: string;
+    ref: string;
+    vaultName?: string | null;
+}
 /**
  * The current 2FA code for a vault entry. `expires_in_seconds` is present for
  * authenticator (TOTP) codes; `received_at` is present for email codes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudcruise",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "The official CloudCruise JS/TS client.",
   "homepage": "https://github.com/CloudCruise/cloudcruise-js#readme",
   "bugs": {