vaultkeeper 0.3.0 → 1.0.0

package/dist/one-password-worker.js

@@ -0,0 +1,80 @@
+import { createClient, DesktopAuth, DesktopSessionExpiredError } from '@1password/sdk';
+
+// src/backend/one-password-worker.ts
+var TAG = "vaultkeeper";
+var PASSWORD_FIELD_TITLE = "password";
+var INTEGRATION_NAME = "vaultkeeper";
+var INTEGRATION_VERSION = "0.4.0";
+function writeSuccess(value) {
+  const response = { value };
+  process.stdout.write(JSON.stringify(response));
+}
+function writeFailure(error, code) {
+  const response = { error, code };
+  process.stdout.write(JSON.stringify(response));
+}
+async function main() {
+  const [, , accountName, vaultId, secretId] = process.argv;
+  if (accountName === void 0 || vaultId === void 0 || secretId === void 0) {
+    writeFailure("Worker invoked with missing arguments", "INTERNAL");
+    process.exit(1);
+  }
+  let client;
+  try {
+    client = await createClient({
+      auth: new DesktopAuth(accountName),
+      integrationName: INTEGRATION_NAME,
+      integrationVersion: INTEGRATION_VERSION
+    });
+  } catch (err) {
+    if (err instanceof DesktopSessionExpiredError) {
+      writeFailure("1Password session has expired", "LOCKED");
+    } else {
+      writeFailure(`Authentication failed: ${String(err)}`, "AUTH_DENIED");
+    }
+    process.exit(1);
+  }
+  let overviews;
+  try {
+    overviews = await client.items.list(vaultId);
+  } catch (err) {
+    writeFailure(`Failed to list items: ${String(err)}`, "INTERNAL");
+    process.exit(1);
+  }
+  let targetId;
+  for (const overview of overviews) {
+    if (overview.title === secretId && overview.tags.includes(TAG)) {
+      targetId = overview.id;
+      break;
+    }
+  }
+  if (targetId === void 0) {
+    writeFailure(`Secret not found: ${secretId}`, "NOT_FOUND");
+    process.exit(1);
+  }
+  let item;
+  try {
+    item = await client.items.get(vaultId, targetId);
+  } catch (err) {
+    writeFailure(`Failed to retrieve item: ${String(err)}`, "NOT_FOUND");
+    process.exit(1);
+  }
+  let secretValue;
+  for (const field of item.fields) {
+    if (field.title === PASSWORD_FIELD_TITLE) {
+      secretValue = field.value;
+      break;
+    }
+  }
+  if (secretValue === void 0) {
+    writeFailure(`Item found but missing password field: ${secretId}`, "NOT_FOUND");
+    process.exit(1);
+  }
+  writeSuccess(secretValue);
+}
+main().catch((err) => {
+  writeFailure(`Unexpected worker error: ${String(err)}`, "INTERNAL");
+  process.exit(1);
+});
+//# sourceMappingURL=one-password-worker.js.map
+//# sourceMappingURL=one-password-worker.js.map

package/dist/one-password-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/backend/one-password-worker.ts"],"names":[],"mappings":";;;AAkBA,IAAM,GAAA,GAAM,aAAA;AACZ,IAAM,oBAAA,GAAuB,UAAA;AAC7B,IAAM,gBAAA,GAAmB,aAAA;AACzB,IAAM,mBAAA,GAAsB,OAAA;AAW5B,SAAS,aAAa,KAAA,EAAqB;AACzC,EAAA,MAAM,QAAA,GAA4B,EAAE,KAAA,EAAM;AAC1C,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAC/C;AAEA,SAAS,YAAA,CAAa,OAAe,IAAA,EAAoB;AACvD,EAAA,MAAM,QAAA,GAA4B,EAAE,KAAA,EAAO,IAAA,EAAK;AAChD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAC/C;AAEA,eAAe,IAAA,GAAsB;AACnC,EAAA,MAAM,KAAK,aAAa,OAAA,EAAS,QAAQ,IAAI,OAAA,CAAQ,IAAA;AAErD,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,KAAY,MAAA,IAAa,aAAa,MAAA,EAAW;AAChF,IAAA,YAAA,CAAa,yCAAyC,UAAU,CAAA;AAChE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,YAAA,CAAa;AAAA,MAC1B,IAAA,EAAM,IAAI,WAAA,CAAY,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,gBAAA;AAAA,MACjB,kBAAA,EAAoB;AAAA,KACrB,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,0BAAA,EAA4B;AAC7C,MAAA,YAAA,CAAa,iCAAiC,QAAQ,CAAA;AAAA,IACxD,CAAA,MAAO;AACL,MAAA,YAAA,CAAa,CAAA,uBAAA,EAA0B,MAAA,CAAO,GAAG,CAAC,IAAI,aAAa,CAAA;AAAA,IACrE;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAAA,EAC7C,SAAS,GAAA,EAAK;AACZ,IAAA,YAAA,CAAa,CAAA,sBAAA,EAAyB,MAAA,CAAO,GAAG,CAAC,IAAI,UAAU,CAAA;AAC/D,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,IAAA,IAAI,SAAS,KAAA,KAAU,QAAA,IAAY,SAAS,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9D,MAAA,QAAA,GAAW,QAAA,CAAS,EAAA;AACpB,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,YAAA,CAAa,CAAA,kBAAA,EAAqB,QAAQ,CAAA,CAAA,EAAI,WAAW,CAAA;AACzD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,SAAS,QAAQ,CAAA;AAAA,EACjD,SAAS,GAAA,EAAK;AACZ,IAAA,YAAA,CAAa,CAAA,yBAAA,EAA4B,MAAA,CAAO,GAAG,CAAC,IAAI,WAAW,CAAA;AACnE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,KAAA,MAAW,KAAA,IAAS,KAAK,MAAA,EAAQ;AAC/B,IAAA,IAAI,KAAA,CAAM,UAAU,oBAAA,EAAsB;AACxC,MAAA,WAAA,GAAc,KAAA,CAAM,KAAA;AACpB,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,YAAA,CAAa,CAAA,uCAAA,EAA0C,QAAQ,CAAA,CAAA,EAAI,WAAW,CAAA;AAC9E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,YAAA,CAAa,WAAW,CAAA;AAC1B;AAEA,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC7B,EAAA,YAAA,CAAa,CAAA,yBAAA,EAA4B,MAAA,CAAO,GAAG,CAAC,IAAI,UAAU,CAAA;AAClE,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB,CAAC,CAAA","file":"one-password-worker.js","sourcesContent":["/**\n * Per-access worker script for the 1Password SDK backend.\n *\n * @remarks\n * This script is spawned as a child process by `OnePasswordBackend` when\n * `accessMode` is set to `'per-access'`. It creates a fresh SDK client\n * (which triggers a biometric prompt via the desktop app), retrieves a single\n * secret, writes the result to stdout as JSON, then exits immediately.\n *\n * argv layout:\n *   node one-password-worker.js <accountName> <vaultId> <secretId>\n *\n * stdout on success: `{ \"value\": \"<secret>\" }`\n * stdout on failure: `{ \"error\": \"<message>\", \"code\": \"<code>\" }`\n */\n\nimport { createClient, DesktopAuth, DesktopSessionExpiredError } from '@1password/sdk'\n\nconst TAG = 'vaultkeeper'\nconst PASSWORD_FIELD_TITLE = 'password'\nconst INTEGRATION_NAME = 'vaultkeeper'\nconst INTEGRATION_VERSION = '0.4.0'\n\ninterface SuccessResponse {\n  value: string\n}\n\ninterface FailureResponse {\n  error: string\n  code: string\n}\n\nfunction writeSuccess(value: string): void {\n  const response: SuccessResponse = { value }\n  process.stdout.write(JSON.stringify(response))\n}\n\nfunction writeFailure(error: string, code: string): void {\n  const response: FailureResponse = { error, code }\n  process.stdout.write(JSON.stringify(response))\n}\n\nasync function main(): Promise<void> {\n  const [, , accountName, vaultId, secretId] = process.argv\n\n  if (accountName === undefined || vaultId === undefined || secretId === undefined) {\n    writeFailure('Worker invoked with missing arguments', 'INTERNAL')\n    process.exit(1)\n  }\n\n  let client\n  try {\n    client = await createClient({\n      auth: new DesktopAuth(accountName),\n      integrationName: INTEGRATION_NAME,\n      integrationVersion: INTEGRATION_VERSION,\n    })\n  } catch (err) {\n    if (err instanceof DesktopSessionExpiredError) {\n      writeFailure('1Password session has expired', 'LOCKED')\n    } else {\n      writeFailure(`Authentication failed: ${String(err)}`, 'AUTH_DENIED')\n    }\n    process.exit(1)\n  }\n\n  let overviews\n  try {\n    overviews = await client.items.list(vaultId)\n  } catch (err) {\n    writeFailure(`Failed to list items: ${String(err)}`, 'INTERNAL')\n    process.exit(1)\n  }\n\n  let targetId: string | undefined\n  for (const overview of overviews) {\n    if (overview.title === secretId && overview.tags.includes(TAG)) {\n      targetId = overview.id\n      break\n    }\n  }\n\n  if (targetId === undefined) {\n    writeFailure(`Secret not found: ${secretId}`, 'NOT_FOUND')\n    process.exit(1)\n  }\n\n  let item\n  try {\n    item = await client.items.get(vaultId, targetId)\n  } catch (err) {\n    writeFailure(`Failed to retrieve item: ${String(err)}`, 'NOT_FOUND')\n    process.exit(1)\n  }\n\n  let secretValue: string | undefined\n  for (const field of item.fields) {\n    if (field.title === PASSWORD_FIELD_TITLE) {\n      secretValue = field.value\n      break\n    }\n  }\n\n  if (secretValue === undefined) {\n    writeFailure(`Item found but missing password field: ${secretId}`, 'NOT_FOUND')\n    process.exit(1)\n  }\n\n  writeSuccess(secretValue)\n}\n\nmain().catch((err: unknown) => {\n  writeFailure(`Unexpected worker error: ${String(err)}`, 'INTERNAL')\n  process.exit(1)\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vaultkeeper",
-  "version": "0.3.0",
+  "version": "1.0.0",
   "description": "Unified, policy-enforced secret storage across OS backends",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -31,6 +31,7 @@
     "access": "public"
   },
   "dependencies": {
+    "@1password/sdk": "^0.4.0",
     "jose": "^6.0.0"
   },
   "devDependencies": {