Class ServiceAccount

Readonlyauth

Readonlyconfig

ReadonlysaId

Readonlysync

principal

• get principal(): string

  Returns string

close

• close(): void

  Wipes the keyset, vault keys and secret (best effort).

  Returns void

edit

• edit<T>(idOrName: string, fn: (db: Kdbx) => T | Promise<T>): Promise<T>

  Changes a vault (needs write): fn edits the latest copy, then it is uploaded with the conditional PUT and merge/retry loop. If the upload fails the cached copy is dropped, so a failed edit is never read back. Edits of one vault run one at a time.

  Type Parameters

  • T

  Parameters

  • idOrName: string
  • fn: (db: Kdbx) => T | Promise<T>

  Returns Promise<T>

inject

• inject(template: string): Promise<{ secrets: string[]; text: string }>

  Replaces every ov:// reference in a template (ov inject / run --env-file).

  Parameters

  • template: string

  Returns Promise<{ secrets: string[]; text: string }>

listVaults

• listVaults(refresh?: boolean): Promise<SaVault[]>

  Vaults granted to this SA, with names decrypted.

  Parameters

  • refresh: boolean = false

  Returns Promise<SaVault[]>

openVault

• openVault(idOrName: string, refresh?: boolean): Promise<Kdbx>

  Downloads and opens a vault (cached; refresh downloads again).

  Parameters

  • idOrName: string
  • refresh: boolean = false

  Returns Promise<Kdbx>

pull

• pull(idOrName: string): Promise<Kdbx>

  Brings the cached copy up to date: a HEAD with the last ETag, and a download only when the server has a newer version (for long-running processes such as ov connect). Opens the vault if needed.

  Parameters

  • idOrName: string

  Returns Promise<Kdbx>

read

• read(ref: string): Promise<string>

  Reads ov://<vault>/<entry>/<field>.

  Parameters

  • ref: string

  Returns Promise<string>

vault

• vault(idOrName: string): Promise<SaVault>

  Finds a vault by id or (unique) name.

  Parameters

  • idOrName: string

  Returns Promise<SaVault>

write

• write(ref: string, value: string, opts?: { create?: boolean }): Promise<void>

  Writes a field (needs write) with the conditional PUT and merge/retry loop.

  Parameters

  • ref: string
  • value: string
  • opts: { create?: boolean } = {}

  Returns Promise<void>

StaticfromToken

• fromToken(
      token: string,
      http?: HttpOptions & { config?: OpenVireoConfiguration },
  ): Promise<ServiceAccount>

  Exchanges the token's secret and unwraps the keyset (token → kek → master → keyset).

  Parameters

  • token: string
  • http: HttpOptions & { config?: OpenVireoConfiguration } = {}

  Returns Promise<ServiceAccount>