@opengeni/api-router 3.1.3-canary.38890816741001 → 3.2.2

package/src/routes/vaults.ts

@@ -311,7 +311,11 @@ export function registerVaultRoutes(app: Hono, deps: ApiRouteDeps): void {
       const payload = await parseRequestJson(c, MoveVaultItemRequest);
       const itemId = c.req.param("itemId")!;
       await itemInVault(actor, workspaceId, c.req.param("vaultId")!, itemId);
-      return c.json(await vaults().moveItem(actor, workspaceId, itemId, payload));
+      // A connected source or target is read, written and archived through this
+      // request's providers, like every other connected read and write.
+      return c.json(
+        await vaultsWithProviders(actor, workspaceId).moveItem(actor, workspaceId, itemId, payload),
+      );
     }),
   );
 

package/src/shutdown.ts

@@ -0,0 +1,54 @@
+type ShutdownSignal = "SIGINT" | "SIGTERM";
+type ShutdownProcess = {
+  on(signal: ShutdownSignal, handler: () => void): unknown;
+  off(signal: ShutdownSignal, handler: () => void): unknown;
+  exit(code: number): void;
+};
+
+/** Standalone process boundary; embedded hosts keep owning their explicit close(). */
+export function installApiShutdownHandlers(input: {
+  close: () => Promise<void>;
+  process?: ShutdownProcess;
+  timeoutMs?: number;
+  onFailure?: () => void;
+}): () => void {
+  const runtime = input.process ?? process;
+  let started = false;
+  let finished = false;
+  let deadline: ReturnType<typeof setTimeout> | undefined;
+  const dispose = () => {
+    runtime.off("SIGINT", shutdown);
+    runtime.off("SIGTERM", shutdown);
+  };
+  const finish = (code: number) => {
+    if (finished) return;
+    finished = true;
+    clearTimeout(deadline);
+    dispose();
+    if (code !== 0) {
+      try {
+        input.onFailure?.();
+      } catch {
+        /* Observability cannot prevent exit. */
+      }
+    }
+    runtime.exit(code);
+  };
+  function shutdown() {
+    if (started) return;
+    started = true;
+    deadline = setTimeout(() => finish(1), input.timeoutMs ?? 30_000);
+    deadline.unref?.();
+    // Catch synchronous close failures as well. Duplicate signals never start a
+    // second logout or race the connection pool's credential/session cleanup.
+    void Promise.resolve()
+      .then(input.close)
+      .then(
+        () => finish(0),
+        () => finish(1),
+      );
+  }
+  runtime.on("SIGINT", shutdown);
+  runtime.on("SIGTERM", shutdown);
+  return dispose;
+}

package/src/workspace-tool-gateway-secrets.ts

@@ -65,7 +65,9 @@ export function workspaceGatewaySecretArguments(input: {
   settings: Settings;
   grant: AccessGrant;
   /** Connected vaults (1Password, host) for the resolved acting subject. */
-  providersForSubject?: ((subjectId: string | null) => VaultProviderRegistry) | undefined;
+  providersForSubject?:
+    | ((subjectId: string | null, site?: SiteSecretContext | null) => VaultProviderRegistry)
+    | undefined;
 }): ToolGatewayArgumentResolver {
   const encryptionKey = environmentsEncryptionKeyBytes(input.settings) ?? null;
   return async (call) => {
@@ -92,7 +94,12 @@ export function workspaceGatewaySecretArguments(input: {
       workspaceGatewaySecretPrincipal(input.grant, site),
       {
         capabilityEnabled: true,
-        ...(input.providersForSubject ? { providersForSubject: input.providersForSubject } : {}),
+        ...(input.providersForSubject
+          ? {
+              providersForSubject: (subjectId: string | null) =>
+                input.providersForSubject!(subjectId, site),
+            }
+          : {}),
       },
     );
     const hook = createSecretArgumentResolver({

package/src/workspace-tool-gateway.ts

@@ -993,8 +993,12 @@ async function prepareWorkspaceToolGatewayForGrantInternal(
           db: routeDeps.db,
           settings: gatewaySettings,
           grant,
-          providersForSubject: (subjectId) =>
-            vaultProviderRegistryFor(routeDeps, { workspaceId: grant.workspaceId, subjectId }),
+          providersForSubject: (subjectId, site) =>
+            vaultProviderRegistryFor(routeDeps, {
+              workspaceId: grant.workspaceId,
+              subjectId,
+              ...(site ? { executionContext: { siteId: site.siteId } } : {}),
+            }),
         }),
         mapDefinition: (definition) => {
           // Raw/local providers have no native credential revision. The legacy