Function makeCliService

packages/plugins/onepassword/src/sdk/service.ts:209–281

(
  auth: ResolvedAuth,
  timeoutMs: number = DEFAULT_TIMEOUT_MS,
)

);

export const makeCliService = (
  auth: ResolvedAuth,
  timeoutMs: number = DEFAULT_TIMEOUT_MS,
): Effect.Effect<OnePasswordService, OnePasswordError> =>
  Effect.sync(() => {
    const run = (
      base: readonly string[],
      operation: string,
    ): Effect.Effect<string, OnePasswordError> => {
      const spawn = Effect.promise((signal) =>
        opCliExec({ args: cliArgs(auth, base), env: cliEnv(auth), timeoutMs, signal }),
      ).pipe(
        Effect.flatMap((result) => {
          if (result.ok) return Effect.succeed(result.stdout);
          return Effect.fail(
            result.timedOut
              ? new OnePasswordError({
                  operation,
                  message: makeTimeoutMessage(operation, timeoutMs),
                })
              : new OnePasswordError({
                  operation,
                  message: messageWithCause(`1Password CLI ${operation} failed`, result),
                }),
          );
        }),
      );
      return (auth.kind === "desktop-app" ? cliPromptLock.withPermits(1)(spawn) : spawn).pipe(
        Effect.withSpan(`onepassword.cli.${operation}`),
      );
    };

    const runJson = <A>(
      base: readonly string[],
      operation: string,
      decodeRows: (raw: string) => Effect.Effect<A, Schema.SchemaError>,
    ): Effect.Effect<A, OnePasswordError> =>
      run([...base, "--format=json"], operation).pipe(
        Effect.flatMap((raw) =>
          decodeRows(raw).pipe(
            Effect.mapError(
              (cause) =>
                new OnePasswordError({
                  operation,
                  message: messageWithCause(
                    `1Password CLI ${operation} returned unexpected output`,
                    cause,
                  ),
                }),
            ),
          ),
        ),
      );

    return OnePasswordServiceTag.of({
      // `op read` appends a trailing newline to the field value; strip it the
      // same way op-js's `read.parse` did so stored secrets stay unchanged.
      resolveSecret: (uri) =>