@kentcdodds/onepassword

/**
 * Package overview and setup guidance for the 1Password Connect sealed
 * secret provider and optional Fly Connect Server deploy helpers. Use when
 * an agent needs bind/setup/deploy steps — not for reading vault values
 * (those flow only through the sealed ./secretProvider).
 *
 * @param _input - Optional unused input
 * @returns Package identity, placeholder grammar, bind checklist, and Connect-on-Fly exports
 *
 * @example
 * import onepassword from 'kody:@kentcdodds/onepassword'
 *
 * const overview = await onepassword()
 */
export default async function getOverview(_input?: Record<string, unknown>) {
	return {
		name: '@kentcdodds/onepassword',
		providerId: '1password',
		sealedExport: './secretProvider',
		placeholder: '{{secret/1password:i/<item-id>/password}}',
		canonicalRef: 'i/<item-id>/<field>',
		connectFly: {
			exports: ['./connect', './connect/source', './connect/deployment-guide', './connect/deploy-fly'],
			defaultAppName: 'kody-onepassword-connect',
			defaultUrl: 'https://kody-onepassword-connect.fly.dev',
			images: ['1password/connect-api:latest', '1password/connect-sync:latest'],
			kodySecrets: [
				'flyApiToken',
				'ONEPASSWORD_CONNECT_OP_SESSION',
				'ONEPASSWORD_CONNECT_TOKEN',
			],
			requiredFlyHosts: ['api.machines.dev', 'api.fly.io'],
		},
		notes: [
			'./secretProvider is sealed: only the platform fetch boundary may invoke it.',
			'Prefer item-id refs (UUID or 26-char Connect id) so secretProviderLock / grants work without a vault call.',
			'Bind via secretProviderBind after saving ONEPASSWORD_CONNECT_TOKEN as a user secret.',
			'Config needs connectHost (or connectUrl / baseUrl) pointing at your Connect Server.',
			'Host allowlist from item websites and URL fields; empty hosts fail closed (Secure Notes need a Website or URL field).',
			'Deploy Connect on Fly with kody:@kentcdodds/onepassword/connect/deploy-fly after ONEPASSWORD_CONNECT_OP_SESSION (Base64 credentials) exists with api.machines.dev + api.fly.io host approval.',
			'Do not Base64 inside package code — save Base64 as ONEPASSWORD_CONNECT_OP_SESSION. Raw ONEPASSWORD_CONNECT_CREDENTIALS_JSON is not used as Fly OP_SESSION.',
		],
		bind: {
			provider: '1password',
			door_secret_name: 'ONEPASSWORD_CONNECT_TOKEN',
			configExample: { connectHost: 'https://kody-onepassword-connect.fly.dev' },
			package_id: '7603a38f-6d3f-44e4-beca-b10196b38008',
		},
		secretPrefills: {
			opSession:
				'https://kody.codes/account/secrets/new?name=ONEPASSWORD_CONNECT_OP_SESSION&description=Base64%20encoding%20of%201password-credentials.json%20(not%20raw%20JSON).%20Fly%20Connect%20reads%20this%20as%20OP_SESSION%20via%20connect%2Fdeploy-fly%20setSecrets.&allowedHosts=api.machines.dev%2Capi.fly.io&scope=user',
			flyApiTokenHosts:
				'https://kody.codes/account/secrets/new?name=flyApiToken&description=Fly.io%20API%20token%20for%20Machines%20API%20and%20GraphQL%20(api.machines.dev%20%2B%20api.fly.io)&allowedHosts=api.machines.dev%2Capi.fly.io%2Cdocs.machines.dev%2Cfly.io&scope=user',
			connectToken:
				'https://kody.codes/account/secrets/new?name=ONEPASSWORD_CONNECT_TOKEN&description=1Password%20Connect%20Server%20token%20(Authorization%3A%20Bearer)%20used%20as%20the%20door%20key%20for%20the%201password%20secret%20provider%20and%20API%20smoke%20tests&allowedHosts=kody-onepassword-connect.fly.dev&scope=user',
		},
	}
}