Method resolve

src/node/services/onePasswordService.ts:129–203

(ref: string)

  }

  async resolve(ref: string): Promise<string | undefined> {
    if (!ref.startsWith(OP_REF_PREFIX)) {
      // Redact the value — if someone accidentally stored a raw API key
      // as an op reference, logging it would leak the credential.
      log.warn("Invalid 1Password reference (not an op:// URI)", {
        ref: `[redacted, length=${ref.length}]`,
      });
      return undefined;
    }

    const cached = this.cache.get(ref);
    const now = Date.now();
    if (cached && cached.expiresAt > now) {
      return cached.value;
    }
    if (cached) {
      this.cache.delete(ref);
    }

    // Decode percent-encoded segments for backward compatibility —
    // earlier versions of buildReference used encodeURIComponent, but
    // the 1Password SDK only accepts raw characters in op:// references.
    let decodedRef: string;
    try {
      decodedRef = decodeURIComponent(ref);
    } catch {
      decodedRef = ref;
    }

    const resolveWithClient = async (): Promise<string | undefined> => {
      const client = await this.getClient();
      const value = await withTimeout(
        client.secrets.resolve(decodedRef),
        RESOLVE_TIMEOUT_MS,
        `1Password resolution timed out after ${RESOLVE_TIMEOUT_MS}ms for ${ref}`
      );
      if (typeof value !== "string") {
        log.warn("[OnePasswordService] Resolved secret was not a string", {
          ref,
          type: typeof value,
        });
        return undefined;
      }

      this.cache.set(ref, {
        value,
        expiresAt: Date.now() + CACHE_TTL_MS,
      });
      return value;
    };

    try {
      return await resolveWithClient();
    } catch (error) {
      if (error instanceof DesktopSessionExpiredError) {
        this.client = null;
        this.initPromise = null;