@opengeni/api-router 3.1.3-canary.38890816741001 → 3.2.2

package/dist/{chunk-OT56OY4V.js → chunk-PQBHZ2YH.js}

@@ -13789,7 +13789,90 @@ function registerSessionHistoryImportRoutes(app, deps) {
 }
 
 // src/routes/vault-providers.ts
+import { isDeepStrictEqual } from "util";
 import { HTTPException as HTTPException20 } from "hono/http-exception";
+
+// src/integrations/external-vault-providers.ts
+import { pinnedFetch } from "@opengeni/network";
+import { VaultProviderError } from "@opengeni/vaults";
+function createNativeExternalVaultFactories(settings, options = {}) {
+  const factories = {
+    keeper: keeperFactory(settings, options.keeper ?? {})
+  };
+  const cliPath = settings.protonPassCliPath;
+  if (cliPath) factories.protonpass = protonPassFactory(cliPath, options.protonpass ?? {});
+  return factories;
+}
+async function closeNativeExternalVaultProviders() {
+  const pools = [...protonPools.values()];
+  protonPools.clear();
+  await Promise.all(pools.map(async (pool) => (await pool.catch(() => null))?.close()));
+}
+function mismatch() {
+  throw new VaultProviderError(
+    "provider_unavailable",
+    "The configured adapter does not match this connection."
+  );
+}
+function nativeKeeperFetch(settings, pinned = {}) {
+  return (input, init) => pinnedFetch(input, init, settings, {
+    ...pinned,
+    label: "Keeper Secrets Manager",
+    requireHttpsOutsideLocalTest: true
+  });
+}
+function keeperFactory(settings, seams) {
+  const fetch2 = nativeKeeperFetch(settings);
+  return async (input) => {
+    const credentials = input.credentials;
+    if (credentials.provider !== "keeper") mismatch();
+    const persist = input.persistCredentials;
+    const { openKeeperConnection } = await import("@opengeni/vaults-keeper");
+    const opened = await openKeeperConnection({
+      credentials: "oneTimeToken" in credentials ? {
+        oneTimeToken: credentials.oneTimeToken,
+        ...credentials.hostname ? { hostname: credentials.hostname } : {}
+      } : { configuration: credentials.configuration },
+      // Without it openKeeperConnection refuses: a redeemed token or rotated
+      // key must never live only in memory.
+      ...persist ? {
+        persistConfiguration: (configuration) => persist({ provider: "keeper", configuration })
+      } : {},
+      ...input.operations ? { operations: input.operations } : {},
+      // Cancels a pending bootstrap; a stored configuration opens without a request.
+      ...input.signal ? { signal: input.signal } : {},
+      fetch: fetch2,
+      ...seams
+    });
+    const stored = {
+      provider: "keeper",
+      configuration: opened.configuration
+    };
+    return { provider: opened.provider, credentials: stored };
+  };
+}
+var protonPools = /* @__PURE__ */ new Map();
+function protonPassFactory(binaryPath, seams) {
+  return async (input) => {
+    const credentials = input.credentials;
+    if (credentials.provider !== "protonpass") mismatch();
+    let pool = protonPools.get(binaryPath);
+    if (!pool) {
+      pool = import("@opengeni/vaults-protonpass").then(
+        ({ createProtonPassProviderPool }) => createProtonPassProviderPool({ ...seams, binaryPath })
+      );
+      protonPools.set(binaryPath, pool);
+      pool.catch(() => protonPools.delete(binaryPath));
+    }
+    const provider = (await pool).provider(credentials.token, {
+      ...input.connectionId === void 0 ? {} : { connectionId: input.connectionId },
+      ...input.operations ? { operations: input.operations } : {}
+    });
+    return { provider, credentials: { provider: "protonpass", token: credentials.token } };
+  };
+}
+
+// src/routes/vault-providers.ts
 import {
   CreateManagedProviderVaultRequest,
   DisconnectOnePasswordResponse,
@@ -13800,15 +13883,22 @@ import {
   OnePasswordConnectionSummary,
   ProviderVaultMeta,
   ReplaceOnePasswordTokenRequest,
+  InstallVaultProviderRequest,
+  InstallVaultProviderResponse,
+  ListVaultProviderConnectionsResponse,
+  ReplaceVaultProviderCredentialsRequest,
+  DisconnectVaultProviderResponse,
   VAULT_ERROR_HTTP_STATUS
 } from "@opengeni/contracts";
 import {
   ONEPASSWORD_CREDENTIAL_ROLE,
   ONEPASSWORD_PROVIDER_DOMAIN,
   createWorkspaceVaultProviderRegistry,
+  createRemoteExternalVaultFactories,
   externalActorContinuationForAuthorization as externalActorContinuationForAuthorization4,
   hasPermission as hasPermission6,
   isVaultError,
+  VaultError,
   providerSecretName,
   requirePermission as requirePermission2,
   syncLinkedProviderVault,
@@ -13820,7 +13910,15 @@ import {
   onePasswordConnectionMetadata,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization4,
   requireEnvironmentEncryption as requireEnvironmentEncryption3,
-  vaultErrorCodeForProvider
+  vaultErrorCodeForProvider,
+  externalVaultConnectionDetails,
+  externalVaultConnectionMetadata,
+  externalVaultProviderDomain,
+  externalVaultProviderForConnection,
+  isExternalVaultConnection,
+  StoredVaultProviderCredentials,
+  loadExternalVaultConnection,
+  pendingVaultCredentialBundle
 } from "@opengeni/core";
 import {
   createConnection,
@@ -13829,6 +13927,7 @@ import {
   getConnectionMetadata,
   getVault,
   linkProviderVault,
+  preflightProviderVaultLink,
   listConnectionsMetadata,
   listVaultsForSubject,
   revokeConnection,
@@ -13836,7 +13935,10 @@ import {
 } from "@opengeni/db";
 import {
   isVaultProviderError,
-  VaultProviderError
+  VaultProviderError as VaultProviderError2,
+  createProviderCallBudget,
+  listProviderVaults,
+  providerOperations
 } from "@opengeni/vaults";
 
 // src/connection-ownership.ts
@@ -14059,8 +14161,54 @@ function vaultProviderRegistryFor(deps, input) {
     workspaceId: input.workspaceId,
     subjectId: input.subjectId,
     hostVaultProvider: deps.connectionCredentials?.vaultProvider ?? null,
-    onePasswordVaultProvider: deps.onePasswordVaultProvider === null ? null : onePasswordFactoryFor(deps)
-  });
+    onePasswordVaultProvider: deps.onePasswordVaultProvider === null ? null : onePasswordFactoryFor(deps),
+    externalVaultProviders: externalVaultFactoriesFor(deps),
+    ...input.executionContext ? { executionContext: input.executionContext } : {}
+  });
+}
+var defaultExternalVaultFactories = /* @__PURE__ */ new WeakMap();
+function externalVaultFactoriesFor(deps) {
+  if (deps.externalVaultProviders !== void 0) return deps.externalVaultProviders ?? {};
+  let factories = defaultExternalVaultFactories.get(deps);
+  if (!factories) {
+    factories = {
+      ...createRemoteExternalVaultFactories(deps.settings),
+      ...createNativeExternalVaultFactories(deps.settings)
+    };
+    defaultExternalVaultFactories.set(deps, factories);
+  }
+  return factories;
+}
+async function providerForConnection(deps, input) {
+  const connection = await getConnectionMetadata(
+    deps.db,
+    input.workspaceId,
+    input.connectionId,
+    input.subjectId
+  );
+  if (connection && isOnePasswordConnection(connection)) {
+    return { ...await onePasswordProviderForConnection(deps, input), source: "onepassword" };
+  }
+  if (!connection || !isExternalVaultConnection(connection) || connection.status === "revoked") {
+    throw new HTTPException20(404, { message: "Vault connection not found" });
+  }
+  const details = externalVaultConnectionDetails(connection.metadata);
+  const factory = externalVaultFactoriesFor(deps)[details.provider];
+  if (!factory)
+    throw new VaultProviderError2(
+      "provider_unavailable",
+      "This vault provider is not available in this deployment."
+    );
+  return {
+    source: details.provider,
+    provider: await externalVaultProviderForConnection({
+      ...input,
+      db: deps.db,
+      settings: deps.settings,
+      provider: details.provider,
+      factory
+    })
+  };
 }
 function vaultContextFor(authorization, workspaceId) {
   return {
@@ -14132,7 +14280,7 @@ function vaultRouteError(c, error, write = false) {
 function findProviderVault(vaults, externalVaultId) {
   const found = vaults.find((vault) => vault.externalVaultId === externalVaultId);
   if (!found) {
-    throw new VaultProviderError(
+    throw new VaultProviderError2(
       "provider_not_found",
       "that vault does not exist or is not shared with this connection"
     );
@@ -14145,7 +14293,7 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
     const rows3 = await listVaultsForSubject(db, context, { workspaceId });
     return new Map(
       rows3.filter(
-        (row) => row.source === "onepassword" && row.providerConnectionId === connectionId && row.providerVaultRef
+        (row) => row.source !== "opengeni" && row.providerConnectionId === connectionId && row.providerVaultRef
       ).map((row) => [row.providerVaultRef, row.id])
     );
   });
@@ -14181,7 +14329,7 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
         planTier: payload.planTier,
         allowFakeTokens: settings.onePasswordFakeTokens
       });
-      vaults = await provider.listVaults(routeProviderContext(null));
+      vaults = await listProviderVaults(provider, routeProviderContext(null));
     } catch (error) {
       return providerErrorResponse(c, error);
     }
@@ -14244,13 +14392,13 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
     );
     const { grant } = authorization;
     try {
-      const { provider } = await onePasswordProviderForConnection(deps, {
+      const { provider } = await providerForConnection(deps, {
         workspaceId,
         connectionId,
         subjectId: grant.subjectId
       });
       const [vaults, linked] = await Promise.all([
-        provider.listVaults(routeProviderContext(connectionId)),
+        listProviderVaults(provider, routeProviderContext(connectionId)),
         linkedVaults({
           workspaceId,
           connectionId,
@@ -14263,7 +14411,9 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
             externalVaultId: vault.externalVaultId,
             name: vault.name,
             itemCount: vault.itemCount,
-            linkedVaultId: linked.get(vault.externalVaultId) ?? null
+            linkedVaultId: linked.get(vault.externalVaultId) ?? null,
+            writeAccess: vault.writeAccess ?? "unknown",
+            operations: providerOperations(provider.capabilities(), vault)
           })
         )
       });
@@ -14282,33 +14432,38 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
     const context = vaultContextFor(authorization, workspaceId);
     try {
       let provider;
-      if (payload.provider === "onepassword") {
+      if (payload.provider !== "host") {
         if (!payload.connectionId) {
-          throw new HTTPException20(422, { message: "connectionId is required for 1Password" });
+          throw new HTTPException20(422, {
+            message: "connectionId is required for a connected provider"
+          });
         }
-        ({ provider } = await onePasswordProviderForConnection(deps, {
+        const resolved = await providerForConnection(deps, {
           workspaceId,
           connectionId: payload.connectionId,
           subjectId: authorization.grant.subjectId
-        }));
+        });
+        if (resolved.source !== payload.provider)
+          throw new HTTPException20(422, { message: "Connection provider does not match" });
+        provider = resolved.provider;
       } else {
         const host = deps.connectionCredentials?.vaultProvider;
         if (!host) {
-          throw new VaultProviderError(
+          throw new VaultProviderError2(
             "provider_unavailable",
             "this deployment has no host vault provider"
           );
         }
         provider = host;
       }
-      const connectionId = payload.provider === "onepassword" ? payload.connectionId : null;
+      const connectionId = payload.provider !== "host" ? payload.connectionId : null;
       const providerVault = findProviderVault(
-        await provider.listVaults(routeProviderContext(connectionId)),
+        await listProviderVaults(provider, routeProviderContext(connectionId)),
         payload.externalVaultId
       );
       const row = await linkProviderVault(db, context, {
         ownerKind: payload.ownerKind,
-        name: payload.name ?? providerSecretName(providerVault.name, "1Password vault"),
+        name: payload.name ?? providerSecretName(providerVault.name, "Connected vault"),
         source: payload.provider,
         providerConnectionId: connectionId,
         providerVaultRef: providerVault.externalVaultId,
@@ -14344,7 +14499,8 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
         providers: vaultProviderRegistryFor(deps, {
           workspaceId,
           subjectId: authorization.grant.subjectId
-        })
+        }),
+        force: true
       });
       const rateLimitedUntil = result2.status === "skipped_rate_limited" || result2.status === "failed" && result2.rateLimitedUntil ? result2.rateLimitedUntil : null;
       if (rateLimitedUntil) {
@@ -14368,45 +14524,100 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
       throw new HTTPException20(403, { message: "missing permission: account:admin" });
     }
     const context = vaultContextFor(authorization, workspaceId);
+    let created;
+    let linked;
+    let sharingFailure;
     try {
+      const { connection, metadata } = await requireOnePasswordConnection(
+        deps,
+        authorization,
+        workspaceId,
+        connectionId
+      );
+      const ownership = connection.subjectId !== null ? "user" : metadata.ownership;
+      if (ownership !== payload.ownerKind || ownership === "user" && connection.subjectId !== authorization.grant.subjectId) {
+        throw new VaultError(
+          "vault_permission_denied",
+          `A ${ownership} 1Password connection backs only ${ownership} vaults`,
+          { connectionId, connectionOwnership: ownership, ownerKind: payload.ownerKind }
+        );
+      }
+      const link = {
+        ownerKind: payload.ownerKind,
+        name: payload.name,
+        source: "onepassword",
+        providerConnectionId: connectionId,
+        mode: "read_write",
+        allowOrganization: isAccountAdmin(authorization)
+      };
+      await preflightProviderVaultLink(db, context, link);
       const { provider } = await onePasswordProviderForConnection(deps, {
         workspaceId,
         connectionId,
         subjectId: authorization.grant.subjectId
       });
       if (!provider.createVault || !provider.capabilities().createVault) {
-        throw new VaultProviderError(
+        throw new VaultProviderError2(
           "provider_unavailable",
           "this 1Password connection cannot create vaults"
         );
       }
-      const created = await provider.createVault(routeProviderContext(connectionId), {
-        name: payload.name,
-        description: "Managed by Opengeni",
-        allowAdminsAccess: true,
-        ...payload.groupId ? { groupId: payload.groupId } : {}
-      });
-      const row = await linkProviderVault(db, context, {
-        ownerKind: payload.ownerKind,
-        name: payload.name,
-        source: "onepassword",
-        providerConnectionId: connectionId,
-        providerVaultRef: created.externalVaultId,
-        mode: "read_write",
-        allowOrganization: isAccountAdmin(authorization)
+      const { OnePasswordVaultCreatedError } = await loadOnePasswordModule();
+      try {
+        created = await provider.createVault(routeProviderContext(connectionId), {
+          name: payload.name,
+          description: "Managed by Opengeni",
+          allowAdminsAccess: true,
+          ...payload.groupId ? { groupId: payload.groupId } : {}
+        });
+      } catch (error) {
+        if (error instanceof OnePasswordVaultCreatedError) {
+          created = error.createdVault;
+          sharingFailure = error;
+        } else if (isVaultProviderError(error)) {
+          throw error;
+        } else {
+          throw new VaultProviderError2(
+            "provider_outcome_unknown",
+            "1Password did not confirm vault creation; it may have been applied. Check the connection's vault list before creating again."
+          );
+        }
+      }
+      linked = await linkProviderVault(db, context, {
+        ...link,
+        providerVaultRef: created.externalVaultId
       });
       await syncLinkedProviderVault({
         db,
         context,
-        vaultId: row.id,
+        vaultId: linked.id,
         providers: vaultProviderRegistryFor(deps, {
           workspaceId,
           subjectId: authorization.grant.subjectId
         }),
         force: true
       });
-      return c.json(await vaultSummaryFor(deps, authorization, workspaceId, row.id), 201);
+      if (sharingFailure) throw sharingFailure;
+      return c.json(await vaultSummaryFor(deps, authorization, workspaceId, linked.id), 201);
     } catch (error) {
+      if (created) {
+        const local = isVaultError(error) ? error : vaultErrorFromDatabase(error);
+        const code = local?.code ?? (isVaultProviderError(error) ? vaultErrorCodeForProvider(error.code, "write") : "provider_unavailable");
+        const message = linked ? sharingFailure ? "The vault was created and linked, but its group access could not be confirmed. Check sharing in 1Password. Do not create it again." : "The vault was created and linked, but its refresh could not be confirmed. Refresh the linked vault. Do not create it again." : "The vault was created in 1Password, but its local link could not be confirmed. Use Link on the existing provider vault after resolving the local refusal. Do not create it again.";
+        return vaultRouteError(
+          c,
+          new VaultError(code, message, {
+            created: true,
+            // A lost DB acknowledgement is not proof that the link rolled back.
+            linked: linked ? true : local ? false : null,
+            connectionId,
+            externalVaultId: created.externalVaultId,
+            ...linked ? { vaultId: linked.id } : {},
+            ...sharingFailure ? { groupGrantConfirmed: false } : {}
+          }),
+          true
+        );
+      }
       return vaultRouteError(c, error, true);
     }
   });
@@ -14472,7 +14683,7 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
         planTier,
         allowFakeTokens: settings.onePasswordFakeTokens
       });
-      vaults = await provider.listVaults(routeProviderContext(connectionId));
+      vaults = await listProviderVaults(provider, routeProviderContext(connectionId));
     } catch (error) {
       return providerErrorResponse(c, error);
     }
@@ -14578,10 +14789,515 @@ function registerVaultProviderRoutes(app, deps, options = {}) {
     }
     return c.json(DisconnectOnePasswordResponse.parse({ unlinkedVaultIds }));
   });
+  app.get("/v1/workspaces/:workspaceId/vault-providers/connections", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization4(
+      c,
+      deps,
+      workspaceId,
+      "secrets:list"
+    );
+    const factories = externalVaultFactoriesFor(deps);
+    const rows3 = await listConnectionsMetadata(db, workspaceId, authorization.grant.subjectId);
+    const connections = rows3.filter((row) => row.status !== "revoked").flatMap((row) => {
+      if (isOnePasswordConnection(row)) {
+        return [
+          {
+            ...onePasswordConnectionSummary(authorization, row),
+            provider: "onepassword",
+            // The published legacy 1Password port has no granular override.
+            operations: providerOperations({
+              write: true,
+              createVault: true,
+              totp: true,
+              files: false,
+              groupGrants: true,
+              passkeys: false
+            }),
+            available: deps.onePasswordVaultProvider !== null
+          }
+        ];
+      }
+      if (!isExternalVaultConnection(row)) return [];
+      const details = externalVaultConnectionDetails(row.metadata);
+      return [
+        {
+          id: row.id,
+          provider: details.provider,
+          ownership: details.ownership,
+          accountName: details.accountName,
+          label: details.label,
+          verifiedAt: details.verifiedAt,
+          createdAt: row.createdAt,
+          createdBySubjectId: row.createdBySubjectId,
+          canManage: canManageExternal(authorization, row, details),
+          operations: details.operations,
+          available: Boolean(factories[details.provider]),
+          verificationStatus: details.verificationStatus ?? "ready"
+        }
+      ];
+    });
+    const providers = ["onepassword", "external", "protonpass", "keeper", "bitwarden"].map((provider) => {
+      const available = provider === "onepassword" ? deps.onePasswordVaultProvider !== null : Boolean(factories[provider]);
+      return { provider, available, reason: available ? null : "not_enabled" };
+    });
+    return c.json(ListVaultProviderConnectionsResponse.parse({ connections, providers }));
+  });
+  app.post("/v1/workspaces/:workspaceId/vault-providers/connections", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireSetupAuthority(c, workspaceId);
+    const { grant } = authorization;
+    const payload = await parseRequestJson(c, InstallVaultProviderRequest);
+    requireOwnership(authorization, payload.ownership);
+    const key2 = requireEnvironmentEncryption3(settings);
+    if (!externalVaultFactoriesFor(deps)[payload.credentials.provider]) {
+      return vaultRouteError(
+        c,
+        new VaultProviderError2(
+          "provider_unavailable",
+          "This vault provider is not available in this deployment."
+        )
+      );
+    }
+    const details = {
+      version: 1,
+      provider: payload.credentials.provider,
+      ownership: payload.ownership,
+      accountId: null,
+      accountName: null,
+      label: payload.label ?? null,
+      verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      verificationStatus: "pending",
+      operations: providerOperations({
+        write: false,
+        createVault: false,
+        totp: false,
+        files: false,
+        groupGrants: false,
+        passkeys: false
+      })
+    };
+    const continuation = externalActorContinuationForAuthorization4(authorization);
+    const connection = await db.transaction(async (tx) => {
+      await requireConnectOwnerAuthority(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        personalOwnerVerified: isPersonalConnectionOwnerPrincipal(authorization),
+        ...continuation ? { externalContinuation: continuation } : {}
+      });
+      return createConnection(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: payload.ownership === "user" ? grant.subjectId : null,
+        providerDomain: externalVaultProviderDomain(details.provider),
+        kind: "api_key",
+        status: "needs_reauth",
+        credentialEncrypted: encryptEnvironmentValue2(key2, "{}"),
+        grantedScopes: [],
+        expiresAt: null,
+        metadata: externalVaultConnectionMetadata(details),
+        createdBySubjectId: grant.subjectId
+      });
+    });
+    try {
+      const result2 = await finishExternalSetup({
+        authorization,
+        workspaceId,
+        connection,
+        credentials: payload.credentials,
+        currentCredentials: null,
+        isNew: true
+      });
+      return c.json(result2.body, result2.status);
+    } catch (error) {
+      return vaultRouteError(c, error);
+    }
+  });
+  app.put(
+    "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/credentials",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const connectionId = c.req.param("connectionId");
+      const authorization = await requireSetupAuthority(c, workspaceId);
+      const { grant } = authorization;
+      const connection = await getConnectionMetadata(
+        db,
+        workspaceId,
+        connectionId,
+        grant.subjectId
+      );
+      if (!connection || !isExternalVaultConnection(connection) || connection.status === "revoked") {
+        throw new HTTPException20(404, { message: "Vault connection not found" });
+      }
+      const details = externalVaultConnectionDetails(connection.metadata);
+      if (!canManageExternal(authorization, connection, details))
+        throw new HTTPException20(403, { message: "You cannot change this vault connection" });
+      requireOwnership(authorization, details.ownership);
+      const payload = await parseRequestJson(c, ReplaceVaultProviderCredentialsRequest);
+      if (payload.credentials.provider !== details.provider)
+        throw new HTTPException20(422, { message: "Connection provider does not match" });
+      try {
+        const loaded = await loadExternalVaultConnection(db, settings, {
+          workspaceId,
+          connectionId,
+          subjectId: grant.subjectId,
+          provider: details.provider,
+          allowPendingVerification: true
+        });
+        const result2 = await finishExternalSetup({
+          authorization,
+          workspaceId,
+          connection: loaded.connection,
+          credentials: payload.credentials,
+          currentCredentials: loaded.currentCredentials,
+          pendingCredentials: loaded.pendingCredentials,
+          isNew: false
+        });
+        return c.json(result2.body, result2.status);
+      } catch (error) {
+        return vaultRouteError(c, error);
+      }
+    }
+  );
+  app.post(
+    "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/verify",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const connectionId = c.req.param("connectionId");
+      const authorization = await requireSetupAuthority(c, workspaceId);
+      const connection = await getConnectionMetadata(
+        db,
+        workspaceId,
+        connectionId,
+        authorization.grant.subjectId
+      );
+      if (!connection || !isExternalVaultConnection(connection) || connection.status === "revoked")
+        throw new HTTPException20(404, { message: "Vault connection not found" });
+      const details = externalVaultConnectionDetails(connection.metadata);
+      if (!canManageExternal(authorization, connection, details))
+        throw new HTTPException20(403, { message: "You cannot verify this vault connection" });
+      requireOwnership(authorization, details.ownership);
+      try {
+        const loaded = await loadExternalVaultConnection(db, settings, {
+          workspaceId,
+          connectionId,
+          subjectId: authorization.grant.subjectId,
+          provider: details.provider,
+          allowPendingVerification: true
+        });
+        const result2 = await finishExternalSetup({
+          authorization,
+          workspaceId,
+          connection: loaded.connection,
+          credentials: loaded.credentials,
+          currentCredentials: loaded.currentCredentials,
+          pendingCredentials: loaded.pendingCredentials,
+          isNew: false
+        });
+        return c.json(result2.body, result2.status);
+      } catch (error) {
+        return vaultRouteError(c, error);
+      }
+    }
+  );
+  app.delete("/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const connectionId = c.req.param("connectionId");
+    const authorization = await requireSetupAuthority(c, workspaceId);
+    const { grant } = authorization;
+    const connection = await getConnectionMetadata(db, workspaceId, connectionId, grant.subjectId);
+    if (!connection || connection.status === "revoked")
+      throw new HTTPException20(404, { message: "Vault connection not found" });
+    if (isOnePasswordConnection(connection)) {
+      requireManageOnePasswordConnection(
+        authorization,
+        connection,
+        onePasswordConnectionMetadata(connection.metadata)
+      );
+    } else {
+      const details = externalVaultConnectionDetails(connection.metadata);
+      if (!details || !isExternalVaultConnection(connection))
+        throw new HTTPException20(404, { message: "Vault connection not found" });
+      if (!canManageExternal(authorization, connection, details))
+        throw new HTTPException20(403, { message: "You cannot disconnect this vault connection" });
+    }
+    try {
+      const unlinkedVaultIds = await db.transaction(async (tx) => {
+        const context = vaultContextFor(authorization, workspaceId);
+        const rows3 = await listVaultsForSubject(tx, context, { workspaceId });
+        const unlinked = [];
+        for (const row of rows3.filter(
+          (candidate) => candidate.providerConnectionId === connectionId
+        )) {
+          await deleteVault(tx, context, {
+            vaultId: row.id,
+            confirmName: row.name,
+            allowOrganization: isAccountAdmin(authorization)
+          });
+          unlinked.push(row.id);
+        }
+        const revoked = await revokeConnection(
+          tx,
+          workspaceId,
+          connectionId,
+          grant.subjectId,
+          connection.version
+        );
+        if (!revoked)
+          throw new HTTPException20(409, {
+            message: "This vault connection changed. Reload it before disconnecting."
+          });
+        return unlinked;
+      });
+      return c.json(DisconnectVaultProviderResponse.parse({ unlinkedVaultIds }));
+    } catch (error) {
+      return vaultRouteError(c, error);
+    }
+  });
+  async function requireSetupAuthority(c, workspaceId) {
+    const authorization = await requireAccessGrantAuthorization4(
+      c,
+      deps,
+      workspaceId,
+      "connections:write"
+    );
+    requirePermission2(authorization.grant, "secrets:write");
+    return authorization;
+  }
+  function requireOwnership(authorization, ownership) {
+    if (ownership === "organization" && !isAccountAdmin(authorization))
+      throw new HTTPException20(403, { message: "missing permission: account:admin" });
+    if (ownership === "user" && !isPersonalConnectionOwnerPrincipal(authorization))
+      throw new HTTPException20(403, {
+        message: "Only a signed-in person can manage a personal vault connection"
+      });
+  }
+  function canManageExternal(authorization, connection, details) {
+    const grant = authorization.grant;
+    return hasPermission6(grant.permissions, "connections:write", grant.permissionMode) && hasPermission6(grant.permissions, "secrets:write", grant.permissionMode) && (connection.subjectId !== null ? connection.subjectId === grant.subjectId && isPersonalConnectionOwnerPrincipal(authorization) : details.ownership !== "organization" || isAccountAdmin(authorization));
+  }
+  function catalogVault(provider, vault, linkedVaultId) {
+    return {
+      externalVaultId: vault.externalVaultId,
+      name: vault.name,
+      itemCount: vault.itemCount,
+      linkedVaultId,
+      writeAccess: vault.writeAccess ?? "unknown",
+      operations: providerOperations(provider.capabilities(), vault)
+    };
+  }
+  async function finishExternalSetup(input) {
+    const { authorization, workspaceId } = input;
+    const { grant } = authorization;
+    const key2 = requireEnvironmentEncryption3(settings);
+    const details = externalVaultConnectionDetails(input.connection.metadata);
+    const context = vaultContextFor(authorization, workspaceId);
+    const linked = await linkedVaultRows(context, workspaceId, input.connection.id);
+    let connection = input.connection;
+    let saved = false;
+    let hasPending = Boolean(input.pendingCredentials);
+    let rejectedAccount;
+    let storedBundle = input.pendingCredentials ? pendingVaultCredentialBundle(input.currentCredentials, input.pendingCredentials) : input.currentCredentials ?? {};
+    const continuation = externalActorContinuationForAuthorization4(authorization);
+    const persist = async (credentials, ready) => {
+      const unchangedCurrent = input.currentCredentials !== null && isDeepStrictEqual(credentials, input.currentCredentials);
+      const pending2 = !ready && !unchangedCurrent;
+      const nextMetadata = ready ?? {
+        ...details,
+        verificationStatus: pending2 ? "pending" : "ready"
+      };
+      const nextBundle = pending2 ? pendingVaultCredentialBundle(input.currentCredentials, credentials) : credentials;
+      const nextStatus = pending2 ? connection.status : "active";
+      const previousDetails = externalVaultConnectionDetails(connection.metadata);
+      const generationChanged = !isDeepStrictEqual(nextBundle, storedBundle) || nextStatus !== connection.status || !isDeepStrictEqual(previousDetails?.operations, nextMetadata.operations);
+      if (!generationChanged && isDeepStrictEqual(previousDetails, nextMetadata)) {
+        saved = true;
+        hasPending = pending2;
+        return;
+      }
+      const updated = await db.transaction(async (tx) => {
+        await requireConnectOwnerAuthority(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          personalOwnerVerified: isPersonalConnectionOwnerPrincipal(authorization),
+          ...continuation ? { externalContinuation: continuation } : {}
+        });
+        return updateConnection(tx, {
+          workspaceId,
+          connectionId: connection.id,
+          visibleToSubjectId: grant.subjectId,
+          expectedVersion: connection.version,
+          status: nextStatus,
+          ...generationChanged ? { credentialEncrypted: encryptEnvironmentValue2(key2, JSON.stringify(nextBundle)) } : {},
+          metadata: { ...connection.metadata, ...externalVaultConnectionMetadata(nextMetadata) },
+          updatedBySubjectId: grant.subjectId
+        });
+      });
+      if (!updated)
+        throw new HTTPException20(409, {
+          message: "This vault connection changed. Reload it before continuing setup."
+        });
+      connection = updated;
+      saved = true;
+      hasPending = pending2;
+      storedBundle = nextBundle;
+    };
+    try {
+      const checked = await prepareExternal(
+        input.credentials,
+        authorization,
+        workspaceId,
+        connection.id,
+        persist
+      );
+      const sameAccount = details.accountId !== null ? checked.accountId === details.accountId : linked.length === 0 || linked.every(
+        (row) => checked.vaults.some((vault) => vault.externalVaultId === row.providerVaultRef)
+      );
+      if (!sameAccount) {
+        rejectedAccount = new VaultProviderError2(
+          "provider_conflict",
+          "These credentials do not reach the same account and linked vaults. Connect them separately instead."
+        );
+        throw rejectedAccount;
+      }
+      const ready = {
+        ...details,
+        accountId: checked.accountId ?? details.accountId,
+        accountName: checked.accountName,
+        operations: checked.operations,
+        verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        verificationStatus: "ready"
+      };
+      await persist(checked.credentials, ready);
+      const providers = vaultProviderRegistryFor(deps, { workspaceId, subjectId: grant.subjectId });
+      for (const row of linked) {
+        await syncLinkedProviderVault({
+          db,
+          context,
+          vaultId: row.id,
+          providers,
+          force: true
+        }).catch(() => void 0);
+      }
+      const linkedIds = new Map(linked.map((row) => [row.providerVaultRef, row.id]));
+      return {
+        status: input.isNew ? 201 : 200,
+        body: InstallVaultProviderResponse.parse({
+          connectionId: connection.id,
+          provider: details.provider,
+          accountName: ready.accountName,
+          operations: ready.operations,
+          vaults: checked.vaults.map(
+            (vault) => catalogVault(checked.provider, vault, linkedIds.get(vault.externalVaultId) ?? null)
+          )
+        })
+      };
+    } catch (error) {
+      if (rejectedAccount && error === rejectedAccount && hasPending) {
+        if (input.currentCredentials) {
+          await persist(input.currentCredentials, { ...details, verificationStatus: "ready" });
+        } else {
+          await revokeConnection(
+            db,
+            workspaceId,
+            connection.id,
+            grant.subjectId,
+            connection.version
+          );
+        }
+        throw error;
+      }
+      if (saved && hasPending && isVaultProviderError(error)) {
+        return {
+          status: 202,
+          body: InstallVaultProviderResponse.parse({
+            connectionId: connection.id,
+            provider: details.provider,
+            accountName: details.accountName,
+            operations: details.operations,
+            vaults: [],
+            discoveryPending: true,
+            errorCode: error.code
+          })
+        };
+      }
+      if (!saved && input.isNew) {
+        await revokeConnection(db, workspaceId, connection.id, grant.subjectId, connection.version);
+      }
+      throw error;
+    }
+  }
+  async function prepareExternal(credentials, authorization, workspaceId, connectionId, persistCredentials) {
+    const factory = externalVaultFactoriesFor(deps)[credentials.provider];
+    if (!factory)
+      throw new VaultProviderError2(
+        "provider_unavailable",
+        "This vault provider is not available in this deployment."
+      );
+    let rotated;
+    const signal = AbortSignal.timeout(3e4);
+    const prepared = await factory({
+      credentials,
+      ...connectionId ? { connectionId } : {},
+      signal,
+      persistCredentials: async (next) => {
+        const parsed = StoredVaultProviderCredentials.safeParse(next);
+        if (!parsed.success || parsed.data.provider !== credentials.provider)
+          throw new VaultProviderError2(
+            "provider_unavailable",
+            "The provider returned invalid connection state."
+          );
+        rotated = parsed.data;
+        await persistCredentials(parsed.data);
+      }
+    });
+    if (prepared.provider.id !== credentials.provider)
+      throw new VaultProviderError2(
+        "provider_unavailable",
+        "The configured adapter does not match this connection."
+      );
+    const preparedCredentials = StoredVaultProviderCredentials.safeParse(prepared.credentials);
+    if (!preparedCredentials.success || preparedCredentials.data.provider !== credentials.provider)
+      throw new VaultProviderError2(
+        "provider_unavailable",
+        "The provider returned invalid connection state."
+      );
+    if (!rotated) await persistCredentials(preparedCredentials.data);
+    const ctx = {
+      connectionId,
+      budget: createProviderCallBudget(50),
+      signal,
+      forceRefresh: true,
+      authority: {
+        accountId: authorization.grant.accountId,
+        workspaceId,
+        connectionWorkspaceId: workspaceId,
+        subjectId: authorization.grant.subjectId
+      }
+    };
+    const validated = await prepared.provider.validate(ctx);
+    const vaults = await listProviderVaults(prepared.provider, ctx);
+    const stored = StoredVaultProviderCredentials.safeParse(rotated ?? prepared.credentials);
+    if (!stored.success || stored.data.provider !== credentials.provider)
+      throw new VaultProviderError2(
+        "provider_unavailable",
+        "The provider returned invalid connection state."
+      );
+    return {
+      provider: prepared.provider,
+      credentials: stored.data,
+      vaults,
+      accountId: validated.accountId ?? null,
+      accountName: validated.accountName,
+      operations: providerOperations(prepared.provider.capabilities())
+    };
+  }
   async function linkedVaultRows(context, workspaceId, connectionId) {
     const rows3 = await listVaultsForSubject(db, context, { workspaceId });
     return rows3.filter(
-      (row) => row.source === "onepassword" && row.providerConnectionId === connectionId && row.providerVaultRef !== null
+      (row) => row.source !== "opengeni" && row.providerConnectionId === connectionId && row.providerVaultRef !== null
     );
   }
 }
@@ -15017,12 +15733,12 @@ import {
 } from "@opengeni/contracts";
 import {
   encryptEnvironmentValue as encryptEnvironmentValue3,
-  VaultError
+  VaultError as VaultError2
 } from "@opengeni/db";
 function encrypted(key2, plaintext) {
   const valueSize = Buffer.byteLength(plaintext, "utf8");
   if (valueSize > VAULT_LIMITS.textValueMaxBytes) {
-    throw new VaultError(
+    throw new VaultError2(
       "secret_value_too_large",
       `the value is larger than ${VAULT_LIMITS.textValueMaxBytes} bytes`,
       { limit: VAULT_LIMITS.textValueMaxBytes }
@@ -15039,7 +15755,7 @@ function prepareSecretAnswers(settings, answers, source) {
   }
   const key2 = environmentsEncryptionKeyBytes3(settings);
   if (!key2) {
-    throw new VaultError(
+    throw new VaultError2(
       "encryption_key_missing",
       "vaults require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"
     );
@@ -17934,7 +18650,7 @@ async function projectWorkspaceArtifactMutationProvenance(response, canReadSessi
 }
 
 // src/integrations/social-api.ts
-import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES4, pinnedFetch as pinnedFetch3, readResponseJsonBounded as readResponseJsonBounded3 } from "@opengeni/network";
+import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES4, pinnedFetch as pinnedFetch4, readResponseJsonBounded as readResponseJsonBounded3 } from "@opengeni/network";
 
 // src/integrations/social-oauth.ts
 import { withOrganizationIntegrationAcquisition as withOrganizationIntegrationAcquisition2 } from "@opengeni/db/organization-integration-policy";
@@ -18002,7 +18718,7 @@ import {
   RequestDeadlineError,
   isLocalTestEnvironment,
   parseMcpOAuthChallenge,
-  pinnedFetch,
+  pinnedFetch as pinnedFetch2,
   readResponseJsonBounded,
   resolveMcpOAuthDiscovery,
   validateHttpUrl
@@ -20425,7 +21141,7 @@ async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
   let response;
   try {
     const endpoint = oauthEndpointUrl(rawUrl, settings, "OAuth endpoint");
-    response = await pinnedFetch(endpoint, init, settings, {
+    response = await pinnedFetch2(endpoint, init, settings, {
       label: "OAuth discovery",
       requireHttpsOutsideLocalTest: true
     });
@@ -20572,7 +21288,7 @@ import {
   getConnectAttempt as getConnectAttempt2
 } from "@opengeni/db";
 import { createSignedState as createSignedState3, readSignedState as readSignedState3 } from "@opengeni/github";
-import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES3, pinnedFetch as pinnedFetch2, readResponseJsonBounded as readResponseJsonBounded2 } from "@opengeni/network";
+import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES3, pinnedFetch as pinnedFetch3, readResponseJsonBounded as readResponseJsonBounded2 } from "@opengeni/network";
 import { Buffer as Buffer3 } from "buffer";
 import { createHash as createHash8, randomBytes as randomBytes4 } from "crypto";
 import { HTTPException as HTTPException28 } from "hono/http-exception";
@@ -20613,7 +21329,7 @@ function socialProviderFetch(deps, url, init, label) {
   if (deps.providerFetch) {
     return deps.providerFetch(url, init, label);
   }
-  return pinnedFetch2(url, init, deps.settings, {
+  return pinnedFetch3(url, init, deps.settings, {
     label,
     requireHttpsOutsideLocalTest: true
   });
@@ -21460,7 +22176,7 @@ function socialApiHeaders(bundle) {
 async function socialApiRequest(deps, ref, bundle, url, init) {
   const requestInit = { ...init, signal: AbortSignal.timeout(SOCIAL_TIMEOUT_MS) };
   const label = `social ${bundle.provider} API`;
-  const response = deps.providerFetch ? await deps.providerFetch(url.toString(), requestInit, label) : await pinnedFetch3(url.toString(), requestInit, deps.settings, {
+  const response = deps.providerFetch ? await deps.providerFetch(url.toString(), requestInit, label) : await pinnedFetch4(url.toString(), requestInit, deps.settings, {
     label,
     requireHttpsOutsideLocalTest: true
   });
@@ -34305,7 +35021,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -34313,6 +35032,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -34330,6 +35050,28 @@ var ACTION_CATALOG = [
     "request": [],
     "response": []
   },
+  {
+    "id": "DELETE /v1/workspaces/:workspaceId/vault-providers/connections/:connectionId",
+    "method": "DELETE",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId",
+    "request": [],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "DELETE /v1/workspaces/:workspaceId/vaults/:vaultId",
     "method": "DELETE",
@@ -34337,7 +35079,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -34345,6 +35090,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -34535,7 +35281,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -34543,6 +35292,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -34834,8 +35584,11 @@ var ACTION_CATALOG = [
     ],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "EnsureWorkspaceResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -34843,6 +35596,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -35098,7 +35852,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -35106,6 +35863,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -35116,7 +35874,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -35124,6 +35885,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -35262,7 +36024,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -35270,6 +36035,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -35311,6 +36077,28 @@ var ACTION_CATALOG = [
       "ToolGatewayDeclarationsResponse"
     ]
   },
+  {
+    "id": "GET /v1/workspaces/:workspaceId/vault-providers/connections",
+    "method": "GET",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections",
+    "request": [],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "GET /v1/workspaces/:workspaceId/vaults",
     "method": "GET",
@@ -35318,7 +36106,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -35326,6 +36117,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -35336,7 +36128,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -35344,6 +36139,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -35373,7 +36169,22 @@ var ACTION_CATALOG = [
     "method": "GET",
     "path": "/v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance",
     "request": [],
-    "response": []
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
   },
   {
     "id": "GET /v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance/state",
@@ -35387,7 +36198,22 @@ var ACTION_CATALOG = [
     "method": "GET",
     "path": "/v1/workspaces/external/:workspaceSource/:workspaceExternalId/usage",
     "request": [],
-    "response": []
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
   },
   {
     "id": "GET /v1/workspaces/external/:workspaceSource/:workspaceExternalId/usage/me",
@@ -35609,7 +36435,10 @@ var ACTION_CATALOG = [
       "ConnectionMetadata",
       "ConnectionResponse",
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -35617,6 +36446,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -36379,7 +37209,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -36387,6 +37220,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary",
       "Workspace"
     ]
@@ -36710,7 +37544,21 @@ var ACTION_CATALOG = [
       "ImportArchivedSessionRequest"
     ],
     "response": [
-      "ImportArchivedSessionResponse"
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "ImportArchivedSessionResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
     ]
   },
   {
@@ -38125,7 +38973,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38133,6 +38984,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38258,7 +39110,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38266,6 +39121,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38276,7 +39132,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38284,6 +39143,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38535,6 +39395,52 @@ var ACTION_CATALOG = [
       "ToolGatewayTargetApprovalResponse"
     ]
   },
+  {
+    "id": "POST /v1/workspaces/:workspaceId/vault-providers/connections",
+    "method": "POST",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections",
+    "request": [
+      "InstallVaultProviderRequest"
+    ],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
+  {
+    "id": "POST /v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/verify",
+    "method": "POST",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/verify",
+    "request": [],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "POST /v1/workspaces/:workspaceId/vaults",
     "method": "POST",
@@ -38542,7 +39448,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38550,6 +39459,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38602,7 +39512,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38610,6 +39523,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38820,7 +39734,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38828,6 +39745,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38861,7 +39779,10 @@ var ACTION_CATALOG = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -38869,6 +39790,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -38879,12 +39801,51 @@ var ACTION_CATALOG = [
     "request": [],
     "response": []
   },
+  {
+    "id": "PUT /v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/credentials",
+    "method": "PUT",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/credentials",
+    "request": [
+      "ReplaceVaultProviderCredentialsRequest"
+    ],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "PUT /v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance",
     "method": "PUT",
     "path": "/v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance",
     "request": [],
-    "response": []
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
   },
   {
     "id": "PUT /v1/workspaces/external/:workspaceSource/:workspaceExternalId/members/:subjectId/allowance",
@@ -40882,7 +41843,10 @@ var ACTION_CATALOG = [
     ],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -40890,6 +41854,7 @@ var ACTION_CATALOG = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary",
       "Workspace"
     ]
@@ -41038,7 +42003,7 @@ var ACTION_CATALOG = [
 ];
 
 // src/mcp/action-schema-imports.gen.ts
-import { AcceptOrganizationInvitationRequest, AcceptOrganizationRecoveryCustodyRequest, AcknowledgeStreamRequest, ActivateCodexRealtimeConnectionRequest, ActivateCompanyProfileRevisionRequest, ActivatePreferenceRegistryRevisionRequest, ActivateWorkspaceInstructionPolicyRequest, AddDocumentRequest, AddWorkspaceMemberRequest, AgentInstructionReviewRequest, AgentLearningContext, ApiIntegrationOAuthStartRequest, AppendArchivedSessionEventsRequest as AppendArchivedSessionEventsRequest2, ApplySessionGoalRevisionRequest, ApproveSlackUserLinkAccessRequest, ArtifactCatalogKind, AtlassianLifecycleActionRequest, AttachViewerRequest, BeginSessionRealtimeRequest, BrowserActionRequest, BrowserDomReadRequest, BrowserDownloadSaveRequest, BrowserOpenTargetRequest, BrowserSessionAttachmentRequest, BrowserSessionLifecycleRequest, ChangeMachineAudienceRequest, ChangePreferenceRegistryScopeRequest, ClaudeSubscriptionOAuthCompleteRequest, ClaudeSubscriptionOAuthStartRequest, ClaudeSubscriptionSetupTokenRequest as ClaudeSubscriptionSetupTokenRequest2, ClearWorkspaceAllowanceRequest, CodexAppsDesignationRequest as CodexAppsDesignationRequest2, CodexRealtimeWebrtcRequest, CodexSourceRequest as CodexSourceRequest2, CompanyProfileDiffRequest, ComputerActionRequest, ComputerNativeCallRequest, ComputerSessionAttachmentRequest, ComputerSessionLifecycleRequest, ConfigureOrganizationRecoveryPolicyRequest, CorrectPreferenceRegistryRequest, CreateAdditionalOrganizationRequest, CreateApiKeyRequest, CreateAutomationSourceRequest, CreateAutomationTriggerRequest, CreateBillingPortalRequest, CreateBrowserIdentityRequest, CreateBrowserSessionRequest, CreateCapabilityCatalogItemRequest, CreateChannelRequest, CreateCheckoutRequest, CreateComputerSessionRequest, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFeedbackRequest, CreateFileUploadRequest as CreateFileUploadRequest2, CreateInteractionInterventionRequest, CreateKnowledgeDropRequest, CreateNetworkRouteRequest, CreateOrganizationApiKeyRequest, CreateOrganizationInvitationRequest, CreateOrganizationProviderCustomModelRequest, CreateOrganizationRequest, CreateOrganizationServiceAccountRequest, CreateOrganizationWebhookRequest, CreateOrganizationWorkspaceRequest, CreatePersonalApiKeyRequest, CreatePrReviewAppRegistrationRequest, CreatePrReviewRepositoryBindingRequest, CreatePreferenceRegistryProposalRequest, CreateRigRequest, CreateScheduledTaskRequest as CreateScheduledTaskRequest2, CreateSessionRequest, CreateSiteAuthConnectionRequest, CreateWorkspaceArtifactRequest, CreateWorkspaceGatewayCustomModelRequest as CreateWorkspaceGatewayCustomModelRequest2, CreateWorkspaceInstructionPolicyDraftRequest, CreateWorkspaceInstructionPolicyOnboardingProposalRequest, CreateWorkspaceOpenRouterCustomModelRequest, CreateWorkspaceOpperCustomModelRequest, CreateWorkspaceRequest, CreateWorkspaceWebhookRequest, DeactivatePreferenceRegistryRequest, DeleteOrganizationProviderCustomModelRequest, DeleteSessionQueueItemRequest, DeleteWorkspaceGatewayCustomModelRequest as DeleteWorkspaceGatewayCustomModelRequest2, DeleteWorkspaceOpenRouterCustomModelRequest, DeleteWorkspaceOpperCustomModelRequest, DeviceEnrollmentApproveRequest, DisableOrganizationRecoveryPolicyRequest, EditSessionQueueItemRequest, EnableCapabilityRequest, EndSessionRealtimeRequest, EnsureWorkspaceRequest, ExternalAuthInteractiveRequest, ExternalAuthRunRequest, FikenInstallRequest as FikenInstallRequest2, FikenOAuthStartRequest, FileListRequest as FileListRequest2, ForkSessionRequest, FsDeleteRequest, FsListBatchRequest, FsListRequest, FsMkdirRequest, FsMoveRequest, FsReadRequest, FsWriteRequest, GatewayRealtimeConnectRequest, GetMyUsageRequest, GetUsageRequest, GitDiffRequest, GitLogRequest, GitReadBatchRequest, GitShowRequest, GitStatusRequest, GrantSessionAdminAccessRequest, GrantWorkspaceCreditsRequest, ImportArchivedSessionRequest as ImportArchivedSessionRequest2, ImportLegacyWorkspaceInstructionPolicyDraftRequest, InboxItem, InboxSettings, InsightsRange, InstallApiIntegrationRequest, InstallLibrarySkillRequest, InstallPluginRequest, InstallSkillRequest, IssueUserResourceGrantRequest, KnowledgeEntryBatchReviewRequest, KnowledgeEntryListRequest as KnowledgeEntryListRequest3, KnowledgeEntryRestoreRequest, KnowledgeEntryReviewRequest, KnowledgeEntrySaveRequest as KnowledgeEntrySaveRequest2, KnowledgeReviewBatchListRequest, KnowledgeSavePreparationRequest as KnowledgeSavePreparationRequest2, MachineAudiencePreviewRequest, McpConnectionDecision, MemberNotificationsSetting, MemorySlackPublicationActionRequest, MintEnrollTokenRequest, ModelConnectionAccessPolicy, MoveDocumentRequest, MoveSessionQueueItemRequest, MutateIntegrationFacetRequest, OAuthStartRequest, OpenGeniSlackBotInstallRequest, OpenMachinePrivacySettingsRequest, OrganizationModelProviderKind, OrganizationRecoveryOperationCommandRequest, OrganizationUsagePeriod, PrepareSlackUserLinkAccessRequest, PreviewApiIntegrationRequest, PreviewPluginRequest, PreviewSkillImportRequest, ProposeRigChangeRequest, PtyCloseRequest, PtyOpenRequest, PtyResizeRequest, PtyWriteRequest, PublishBrowserRevisionRequest, PublishSandboxFileArtifactRequest, PublishWorkspaceArtifactVersionRequest, PutOrganizationCredentialProviderRequest, PutOrganizationWorkspaceMemberRequest, PutWorkspaceCredentialProviderRequest, ReclassifyDocumentAuthorityRequest, RefreshScheduledTaskAccessRequest, RejectPreferenceRegistryProposalRequest, RejectSessionGoalRevisionRequest, RemoveEnrollmentRequest, RenewSessionRealtimeRequest, ReorderChannelsRequest, ReportAuthRunRequest, ResolveInteractionInterventionRequest, RetryOrganizationUserSetupDeliveryRequest, RevokeOrganizationInvitationRequest, RevokeOrganizationModelProviderConnectionRequest, RevokeOrganizationWorkspaceMemberRequest, RollbackCompanyProfileRequest, RollbackSessionGoalRevisionRequest, RollbackWorkspaceArtifactRequest, RollbackWorkspaceInstructionPolicyRequest, RotateSessionMcpCredentialsRequest, RunDocumentDefaultCollectionBackfillRequest, SandboxRecoveryRequest, SaveAtlassianSourcesRequest as SaveAtlassianSourcesRequest2, SaveComposerDraftRequest, SaveNewSessionDraftRequest, SessionCodexAccountPinRequest, SessionControlRequest, SessionHumanInputRequest, SessionInboxMute, SessionMessageSearchRequest, SessionRetryRequest, SessionScopeSubjectId, SessionStatus, SessionVisibility, SetMemberAllowanceRequest, SetSessionModelAccountChoiceRequest, SetSessionUsageLimitRequest, SetWorkspaceAllowanceRequest, SetWorkspaceArtifactStatusRequest, SetWorkspaceDefaultRigRequest, SiteDataCollectionDefinitionRequest as SiteDataCollectionDefinitionRequest3, SiteDataImportRequest as SiteDataImportRequest3, SiteDataQueryRequest as SiteDataQueryRequest3, SiteDataWriteRequest as SiteDataWriteRequest3, SiteLimitProfile, SitePublishWarningFix as SitePublishWarningFix2, SiteSqlExportFormat as SiteSqlExportFormat3, SiteSqlImportRequest as SiteSqlImportRequest3, SiteSqlMigrationRequest as SiteSqlMigrationRequest2, SiteSqlQueryDefinitionRequest as SiteSqlQueryDefinitionRequest3, SiteSqlRunRequest as SiteSqlRunRequest3, SiteSqlSettingsRequest as SiteSqlSettingsRequest2, SiteSqlStatementRequest as SiteSqlStatementRequest3, SiteTakedownRequest, SlackUserLinkAccessMutationRequest, SocialOAuthStartRequest, StartAuthRunRequest, StartOrganizationRecoveryOperationRequest, SteerSessionQueueItemRequest, SubmitComposerDraftRequest, SubscriptionAccountRenameRequest as SubscriptionAccountRenameRequest2, SubscriptionAccountToggleRequest as SubscriptionAccountToggleRequest3, SubscriptionConnectPollRequest, SubscriptionRotationSettingsRequest as SubscriptionRotationSettingsRequest3, SupergrokConnectStartRequest, SupersedePreferenceRegistryRequest, SwapActiveSandboxRequest, SyncSessionRealtimeLedgerRequest, TerminalExecRequest, TriggerAutomationManuallyRequest, UninstallApiIntegrationRequest, UninstallPluginRequest, UninstallSkillRequest, UpdateAutomationSourceRequest, UpdateAutomationTriggerRequest, UpdateBrowserIdentityRequest, UpdateChannelRequest, UpdateCompanyProfileAgentPolicyRequest, UpdateCompanyProfileRequest, UpdateConnectionRequest, UpdateConnectorToolPermissionsRequest, UpdateGitHubActionPolicyRequest, UpdateMachineOperationPolicyRequest, UpdateMemorySlackPublicationConfigurationRequest, UpdateModelAccountPreferencesRequest, UpdateNetworkRouteRequest, UpdateOpenGeniSlackBotOrganizationAccess, UpdateOrganizationAgentAdminAccessRequest, UpdateOrganizationApiKeyRequest, UpdateOrganizationIntegrationPolicyRequest, UpdateOrganizationMcpConnectionRequest, UpdateOrganizationMemberRequest, UpdateOrganizationModelAccountSettingsRequest, UpdateOrganizationModelDefaultsRequest, UpdateOrganizationNameRequest, UpdateOrganizationPrivacySettingsRequest, UpdateOrganizationPrivateSessionSettingsRequest, UpdateOrganizationRetentionPolicyRequest, UpdateOrganizationServiceAccountRequest, UpdateOrganizationWebhookRequest, UpdateOrganizationWorkspaceRequest, UpdatePrReviewAppRegistrationRequest, UpdatePrReviewRepositoryBindingRequest, UpdateRigRequest, UpdateScheduledTaskRequest, UpdateSessionAgentRequest, UpdateSessionArchiveRequest, UpdateSessionAttentionRequest, UpdateSessionChannelRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpToolPermissionsRequest, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionRetentionRequest, UpdateSessionSkillsRequest, UpdateSessionToolPolicyRequest, UpdateSessionVisibilityRequest, UpdateSiteAuthConnectionRequest, UpdateSlackChannelRoutesRequest, UpdateVideoGenerationPolicyRequest, UpdateWorkspaceArtifactVisibilityRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelAccountSettingsRequest, UpdateWorkspaceModelPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, UpdateWorkspaceWebhookRequest, UpsertIntegrationFacetRequest, UpsertOrganizationModelProviderConnectionRequest, UpsertSitePublicationRequest as UpsertSitePublicationRequest2, VerifyAuthRunRequest, ViewerHeartbeatRequest, WorkClaimSubjectType, WorkspaceInstructionPolicyDiffRequest, WorkspacePauseTimerRequest } from "@opengeni/contracts";
+import { AcceptOrganizationInvitationRequest, AcceptOrganizationRecoveryCustodyRequest, AcknowledgeStreamRequest, ActivateCodexRealtimeConnectionRequest, ActivateCompanyProfileRevisionRequest, ActivatePreferenceRegistryRevisionRequest, ActivateWorkspaceInstructionPolicyRequest, AddDocumentRequest, AddWorkspaceMemberRequest, AgentInstructionReviewRequest, AgentLearningContext, ApiIntegrationOAuthStartRequest, AppendArchivedSessionEventsRequest as AppendArchivedSessionEventsRequest2, ApplySessionGoalRevisionRequest, ApproveSlackUserLinkAccessRequest, ArtifactCatalogKind, AtlassianLifecycleActionRequest, AttachViewerRequest, BeginSessionRealtimeRequest, BrowserActionRequest, BrowserDomReadRequest, BrowserDownloadSaveRequest, BrowserOpenTargetRequest, BrowserSessionAttachmentRequest, BrowserSessionLifecycleRequest, ChangeMachineAudienceRequest, ChangePreferenceRegistryScopeRequest, ClaudeSubscriptionOAuthCompleteRequest, ClaudeSubscriptionOAuthStartRequest, ClaudeSubscriptionSetupTokenRequest as ClaudeSubscriptionSetupTokenRequest2, ClearWorkspaceAllowanceRequest, CodexAppsDesignationRequest as CodexAppsDesignationRequest2, CodexRealtimeWebrtcRequest, CodexSourceRequest as CodexSourceRequest2, CompanyProfileDiffRequest, ComputerActionRequest, ComputerNativeCallRequest, ComputerSessionAttachmentRequest, ComputerSessionLifecycleRequest, ConfigureOrganizationRecoveryPolicyRequest, CorrectPreferenceRegistryRequest, CreateAdditionalOrganizationRequest, CreateApiKeyRequest, CreateAutomationSourceRequest, CreateAutomationTriggerRequest, CreateBillingPortalRequest, CreateBrowserIdentityRequest, CreateBrowserSessionRequest, CreateCapabilityCatalogItemRequest, CreateChannelRequest, CreateCheckoutRequest, CreateComputerSessionRequest, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFeedbackRequest, CreateFileUploadRequest as CreateFileUploadRequest2, CreateInteractionInterventionRequest, CreateKnowledgeDropRequest, CreateNetworkRouteRequest, CreateOrganizationApiKeyRequest, CreateOrganizationInvitationRequest, CreateOrganizationProviderCustomModelRequest, CreateOrganizationRequest, CreateOrganizationServiceAccountRequest, CreateOrganizationWebhookRequest, CreateOrganizationWorkspaceRequest, CreatePersonalApiKeyRequest, CreatePrReviewAppRegistrationRequest, CreatePrReviewRepositoryBindingRequest, CreatePreferenceRegistryProposalRequest, CreateRigRequest, CreateScheduledTaskRequest as CreateScheduledTaskRequest2, CreateSessionRequest, CreateSiteAuthConnectionRequest, CreateWorkspaceArtifactRequest, CreateWorkspaceGatewayCustomModelRequest as CreateWorkspaceGatewayCustomModelRequest2, CreateWorkspaceInstructionPolicyDraftRequest, CreateWorkspaceInstructionPolicyOnboardingProposalRequest, CreateWorkspaceOpenRouterCustomModelRequest, CreateWorkspaceOpperCustomModelRequest, CreateWorkspaceRequest, CreateWorkspaceWebhookRequest, DeactivatePreferenceRegistryRequest, DeleteOrganizationProviderCustomModelRequest, DeleteSessionQueueItemRequest, DeleteWorkspaceGatewayCustomModelRequest as DeleteWorkspaceGatewayCustomModelRequest2, DeleteWorkspaceOpenRouterCustomModelRequest, DeleteWorkspaceOpperCustomModelRequest, DeviceEnrollmentApproveRequest, DisableOrganizationRecoveryPolicyRequest, EditSessionQueueItemRequest, EnableCapabilityRequest, EndSessionRealtimeRequest, EnsureWorkspaceRequest, ExternalAuthInteractiveRequest, ExternalAuthRunRequest, FikenInstallRequest as FikenInstallRequest2, FikenOAuthStartRequest, FileListRequest as FileListRequest2, ForkSessionRequest, FsDeleteRequest, FsListBatchRequest, FsListRequest, FsMkdirRequest, FsMoveRequest, FsReadRequest, FsWriteRequest, GatewayRealtimeConnectRequest, GetMyUsageRequest, GetUsageRequest, GitDiffRequest, GitLogRequest, GitReadBatchRequest, GitShowRequest, GitStatusRequest, GrantSessionAdminAccessRequest, GrantWorkspaceCreditsRequest, ImportArchivedSessionRequest as ImportArchivedSessionRequest2, ImportLegacyWorkspaceInstructionPolicyDraftRequest, InboxItem, InboxSettings, InsightsRange, InstallApiIntegrationRequest, InstallLibrarySkillRequest, InstallPluginRequest, InstallSkillRequest, InstallVaultProviderRequest as InstallVaultProviderRequest2, IssueUserResourceGrantRequest, KnowledgeEntryBatchReviewRequest, KnowledgeEntryListRequest as KnowledgeEntryListRequest3, KnowledgeEntryRestoreRequest, KnowledgeEntryReviewRequest, KnowledgeEntrySaveRequest as KnowledgeEntrySaveRequest2, KnowledgeReviewBatchListRequest, KnowledgeSavePreparationRequest as KnowledgeSavePreparationRequest2, MachineAudiencePreviewRequest, McpConnectionDecision, MemberNotificationsSetting, MemorySlackPublicationActionRequest, MintEnrollTokenRequest, ModelConnectionAccessPolicy, MoveDocumentRequest, MoveSessionQueueItemRequest, MutateIntegrationFacetRequest, OAuthStartRequest, OpenGeniSlackBotInstallRequest, OpenMachinePrivacySettingsRequest, OrganizationModelProviderKind, OrganizationRecoveryOperationCommandRequest, OrganizationUsagePeriod, PrepareSlackUserLinkAccessRequest, PreviewApiIntegrationRequest, PreviewPluginRequest, PreviewSkillImportRequest, ProposeRigChangeRequest, PtyCloseRequest, PtyOpenRequest, PtyResizeRequest, PtyWriteRequest, PublishBrowserRevisionRequest, PublishSandboxFileArtifactRequest, PublishWorkspaceArtifactVersionRequest, PutOrganizationCredentialProviderRequest, PutOrganizationWorkspaceMemberRequest, PutWorkspaceCredentialProviderRequest, ReclassifyDocumentAuthorityRequest, RefreshScheduledTaskAccessRequest, RejectPreferenceRegistryProposalRequest, RejectSessionGoalRevisionRequest, RemoveEnrollmentRequest, RenewSessionRealtimeRequest, ReorderChannelsRequest, ReplaceVaultProviderCredentialsRequest as ReplaceVaultProviderCredentialsRequest2, ReportAuthRunRequest, ResolveInteractionInterventionRequest, RetryOrganizationUserSetupDeliveryRequest, RevokeOrganizationInvitationRequest, RevokeOrganizationModelProviderConnectionRequest, RevokeOrganizationWorkspaceMemberRequest, RollbackCompanyProfileRequest, RollbackSessionGoalRevisionRequest, RollbackWorkspaceArtifactRequest, RollbackWorkspaceInstructionPolicyRequest, RotateSessionMcpCredentialsRequest, RunDocumentDefaultCollectionBackfillRequest, SandboxRecoveryRequest, SaveAtlassianSourcesRequest as SaveAtlassianSourcesRequest2, SaveComposerDraftRequest, SaveNewSessionDraftRequest, SessionCodexAccountPinRequest, SessionControlRequest, SessionHumanInputRequest, SessionInboxMute, SessionMessageSearchRequest, SessionRetryRequest, SessionScopeSubjectId, SessionStatus, SessionVisibility, SetMemberAllowanceRequest, SetSessionModelAccountChoiceRequest, SetSessionUsageLimitRequest, SetWorkspaceAllowanceRequest, SetWorkspaceArtifactStatusRequest, SetWorkspaceDefaultRigRequest, SiteDataCollectionDefinitionRequest as SiteDataCollectionDefinitionRequest3, SiteDataImportRequest as SiteDataImportRequest3, SiteDataQueryRequest as SiteDataQueryRequest3, SiteDataWriteRequest as SiteDataWriteRequest3, SiteLimitProfile, SitePublishWarningFix as SitePublishWarningFix2, SiteSqlExportFormat as SiteSqlExportFormat3, SiteSqlImportRequest as SiteSqlImportRequest3, SiteSqlMigrationRequest as SiteSqlMigrationRequest2, SiteSqlQueryDefinitionRequest as SiteSqlQueryDefinitionRequest3, SiteSqlRunRequest as SiteSqlRunRequest3, SiteSqlSettingsRequest as SiteSqlSettingsRequest2, SiteSqlStatementRequest as SiteSqlStatementRequest3, SiteTakedownRequest, SlackUserLinkAccessMutationRequest, SocialOAuthStartRequest, StartAuthRunRequest, StartOrganizationRecoveryOperationRequest, SteerSessionQueueItemRequest, SubmitComposerDraftRequest, SubscriptionAccountRenameRequest as SubscriptionAccountRenameRequest2, SubscriptionAccountToggleRequest as SubscriptionAccountToggleRequest3, SubscriptionConnectPollRequest, SubscriptionRotationSettingsRequest as SubscriptionRotationSettingsRequest3, SupergrokConnectStartRequest, SupersedePreferenceRegistryRequest, SwapActiveSandboxRequest, SyncSessionRealtimeLedgerRequest, TerminalExecRequest, TriggerAutomationManuallyRequest, UninstallApiIntegrationRequest, UninstallPluginRequest, UninstallSkillRequest, UpdateAutomationSourceRequest, UpdateAutomationTriggerRequest, UpdateBrowserIdentityRequest, UpdateChannelRequest, UpdateCompanyProfileAgentPolicyRequest, UpdateCompanyProfileRequest, UpdateConnectionRequest, UpdateConnectorToolPermissionsRequest, UpdateGitHubActionPolicyRequest, UpdateMachineOperationPolicyRequest, UpdateMemorySlackPublicationConfigurationRequest, UpdateModelAccountPreferencesRequest, UpdateNetworkRouteRequest, UpdateOpenGeniSlackBotOrganizationAccess, UpdateOrganizationAgentAdminAccessRequest, UpdateOrganizationApiKeyRequest, UpdateOrganizationIntegrationPolicyRequest, UpdateOrganizationMcpConnectionRequest, UpdateOrganizationMemberRequest, UpdateOrganizationModelAccountSettingsRequest, UpdateOrganizationModelDefaultsRequest, UpdateOrganizationNameRequest, UpdateOrganizationPrivacySettingsRequest, UpdateOrganizationPrivateSessionSettingsRequest, UpdateOrganizationRetentionPolicyRequest, UpdateOrganizationServiceAccountRequest, UpdateOrganizationWebhookRequest, UpdateOrganizationWorkspaceRequest, UpdatePrReviewAppRegistrationRequest, UpdatePrReviewRepositoryBindingRequest, UpdateRigRequest, UpdateScheduledTaskRequest, UpdateSessionAgentRequest, UpdateSessionArchiveRequest, UpdateSessionAttentionRequest, UpdateSessionChannelRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpToolPermissionsRequest, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionRetentionRequest, UpdateSessionSkillsRequest, UpdateSessionToolPolicyRequest, UpdateSessionVisibilityRequest, UpdateSiteAuthConnectionRequest, UpdateSlackChannelRoutesRequest, UpdateVideoGenerationPolicyRequest, UpdateWorkspaceArtifactVisibilityRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelAccountSettingsRequest, UpdateWorkspaceModelPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, UpdateWorkspaceWebhookRequest, UpsertIntegrationFacetRequest, UpsertOrganizationModelProviderConnectionRequest, UpsertSitePublicationRequest as UpsertSitePublicationRequest2, VerifyAuthRunRequest, ViewerHeartbeatRequest, WorkClaimSubjectType, WorkspaceInstructionPolicyDiffRequest, WorkspacePauseTimerRequest } from "@opengeni/contracts";
 var ACTION_REQUEST_SCHEMAS = {
   AcceptOrganizationInvitationRequest,
   AcceptOrganizationRecoveryCustodyRequest,
@@ -41166,6 +42131,7 @@ var ACTION_REQUEST_SCHEMAS = {
   InstallLibrarySkillRequest,
   InstallPluginRequest,
   InstallSkillRequest,
+  InstallVaultProviderRequest: InstallVaultProviderRequest2,
   IssueUserResourceGrantRequest,
   KnowledgeEntryBatchReviewRequest,
   KnowledgeEntryListRequest: KnowledgeEntryListRequest3,
@@ -41211,6 +42177,7 @@ var ACTION_REQUEST_SCHEMAS = {
   RemoveEnrollmentRequest,
   RenewSessionRealtimeRequest,
   ReorderChannelsRequest,
+  ReplaceVaultProviderCredentialsRequest: ReplaceVaultProviderCredentialsRequest2,
   ReportAuthRunRequest,
   ResolveInteractionInterventionRequest,
   RetryOrganizationUserSetupDeliveryRequest,
@@ -41348,6 +42315,31 @@ var PROVIDERS = {
   supergrok: "SuperGrok (xAI)"
 };
 var RULES = [
+  {
+    method: "GET",
+    pattern: /\/vault-providers\/connections$/,
+    text: () => "List connected password managers and deployment availability: 1Password, Proton Pass, Keeper, Bitwarden and external vaults. Returns connection metadata and setup status, not secret values; does not contact providers."
+  },
+  {
+    method: "POST",
+    pattern: /\/vault-providers\/connections$/,
+    text: () => "Connect Proton Pass, Keeper Secrets Manager, a customer-controlled Bitwarden bridge or an external vault. Set ownership and provider-specific credentials. Saved-but-pending setup returns a connection ID; register it with a remote host if needed, then verify using the saved credentials."
+  },
+  {
+    method: "PUT",
+    pattern: /\/vault-providers\/connections\/:connectionId\/credentials$/,
+    text: () => "Replace a connected password manager's credentials without changing its vault links. The same upstream account must verify successfully; pending verification keeps the previously working credential. Never repeat a consumed Keeper one-time token."
+  },
+  {
+    method: "POST",
+    pattern: /\/vault-providers\/connections\/:connectionId\/verify$/,
+    text: () => "Finish a pending vault connection using its already saved credentials. Checks the provider and discovers available vaults without resubmitting a Keeper bootstrap token or remote signing key."
+  },
+  {
+    method: "DELETE",
+    pattern: /\/vault-providers\/connections\/:connectionId$/,
+    text: () => "Disconnect a password manager and unlink its local vault mirrors. Removes Opengeni's stored access; never deletes upstream vaults or items."
+  },
   {
     method: "GET",
     pattern: /\/(codex|claude|supergrok)\/accounts$/,
@@ -48129,7 +49121,9 @@ function workspaceGatewaySecretArguments(input) {
       workspaceGatewaySecretPrincipal(input.grant, site),
       {
         capabilityEnabled: true,
-        ...input.providersForSubject ? { providersForSubject: input.providersForSubject } : {}
+        ...input.providersForSubject ? {
+          providersForSubject: (subjectId) => input.providersForSubject(subjectId, site)
+        } : {}
       }
     );
     const hook = createSecretArgumentResolver({
@@ -48854,7 +49848,11 @@ async function prepareWorkspaceToolGatewayForGrantInternal(routeDeps, grant, all
           db: routeDeps.db,
           settings: gatewaySettings,
           grant,
-          providersForSubject: (subjectId) => vaultProviderRegistryFor(routeDeps, { workspaceId: grant.workspaceId, subjectId })
+          providersForSubject: (subjectId, site) => vaultProviderRegistryFor(routeDeps, {
+            workspaceId: grant.workspaceId,
+            subjectId,
+            ...site ? { executionContext: { siteId: site.siteId } } : {}
+          })
         }),
         mapDefinition: (definition) => {
           if (options.target && definition.approvalAuthorityDigest === void 0) {
@@ -51271,7 +52269,7 @@ import {
 } from "@opengeni/contracts";
 import {
   DestinationPolicyError as DestinationPolicyError2,
-  pinnedFetch as pinnedFetch4
+  pinnedFetch as pinnedFetch5
 } from "@opengeni/network";
 var RESPONSE_EXCERPT_BYTES = 1024;
 var PROVIDER_RESPONSE_BYTES = 5 * 1024 * 1024;
@@ -51393,7 +52391,7 @@ async function sendIntegrationEndpointTest(input) {
   const base = { request: input.body, credentials: null };
   let response;
   try {
-    response = await (input.fetch ?? pinnedFetch4)(
+    response = await (input.fetch ?? pinnedFetch5)(
       input.url,
       {
         method: "POST",
@@ -88509,6 +89507,7 @@ import {
   listOwnConnectionAccountsForGrant,
   hasReservedFikenMetadata,
   ONEPASSWORD_CREDENTIAL_ROLE as ONEPASSWORD_CREDENTIAL_ROLE2,
+  EXTERNAL_VAULT_CREDENTIAL_ROLE,
   hasReservedOpenGeniSlackBotMetadata,
   isOpenGeniSlackBotConnection as isOpenGeniSlackBotConnection3,
   openGeniSlackBotMetadata as openGeniSlackBotMetadata2,
@@ -88574,7 +89573,7 @@ import {
 import { createSignedState as createSignedState10, readSignedState as readSignedState9 } from "@opengeni/github";
 import {
   OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES5,
-  pinnedFetch as pinnedFetch5,
+  pinnedFetch as pinnedFetch6,
   readResponseJsonBounded as readResponseJsonBounded10
 } from "@opengeni/network";
 import { HTTPException as HTTPException62 } from "hono/http-exception";
@@ -89145,7 +90144,7 @@ async function verifyProviderIdentity(deps, definition, token) {
 }
 async function providerFetch3(deps, url, init) {
   try {
-    return await pinnedFetch5(
+    return await pinnedFetch6(
       url,
       {
         ...init,
@@ -90630,6 +91629,7 @@ function registerConnectionRoutes(app, deps) {
             c.req.param("connectionId"),
             grant.subjectId
           );
+          assertNotReservedExternalVaultMetadata(existing?.metadata);
           if (existing && isOpenGeniSlackBotConnection3(existing)) {
             const destination = ConnectorDocumentDestinationSelection.safeParse(
               payload.metadata?.documentDestination
@@ -90863,6 +91863,7 @@ function registerConnectionRoutes(app, deps) {
     if (!existing) {
       throw new HTTPException64(404, { message: "connection not found" });
     }
+    assertNotReservedExternalVaultMetadata(existing.metadata);
     const expectedVersion = c.req.query("expectedVersion");
     if (expectedVersion !== void 0) {
       if (!/^[1-9]\d*$/.test(expectedVersion) || !Number.isSafeInteger(Number(expectedVersion))) {
@@ -91305,12 +92306,20 @@ function assertNotReservedFikenMetadata(metadata) {
   }
 }
 function assertNotReservedOnePasswordMetadata(metadata) {
+  assertNotReservedExternalVaultMetadata(metadata);
   if (metadata?.credentialRole === ONEPASSWORD_CREDENTIAL_ROLE2) {
     throw new HTTPException64(422, {
       message: "1Password connections are created by the verified 1Password install flow"
     });
   }
 }
+function assertNotReservedExternalVaultMetadata(metadata) {
+  if (metadata?.credentialRole === EXTERNAL_VAULT_CREDENTIAL_ROLE || metadata?.vaultProvider !== void 0) {
+    throw new HTTPException64(422, {
+      message: "Vault connections are managed through the verified vault connection flow"
+    });
+  }
+}
 function assertNotReservedApiIntegrationOAuthMetadata(metadata) {
   if (metadata?.credentialRole === API_INTEGRATION_OAUTH_CREDENTIAL_ROLE3) {
     throw new HTTPException64(422, {
@@ -97677,7 +98686,7 @@ import {
   requireSessionAuthorization as requireSessionAuthorization11,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError10,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError9,
-  VaultError as VaultError2,
+  VaultError as VaultError3,
   vaultErrorFromDatabase as vaultErrorFromDatabase4
 } from "@opengeni/core";
 var PREFIX = "/v1/workspaces/:workspaceId";
@@ -97696,7 +98705,7 @@ function requireRevealAuthority(grant) {
     return;
   }
   if (grant.principalKind !== "human_session" || grant.serviceInitiator) {
-    throw new VaultError2(
+    throw new VaultError3(
       "vault_reveal_requires_human",
       "revealing a value needs a person signed in, or an API key with secrets:read"
     );
@@ -97762,7 +98771,7 @@ function registerVaultRoutes(app, deps) {
   async function itemInVault(actor, workspaceId, vaultId, itemId) {
     const item = await vaults().getItem(actor, workspaceId, itemId);
     if (item.vaultId !== vaultId) {
-      throw new VaultError2("vault_item_not_found", "item not found", { itemId });
+      throw new VaultError3("vault_item_not_found", "item not found", { itemId });
     }
     return item;
   }
@@ -97908,7 +98917,9 @@ function registerVaultRoutes(app, deps) {
       const payload = await parseRequestJson(c, MoveVaultItemRequest);
       const itemId = c.req.param("itemId");
       await itemInVault(actor, workspaceId, c.req.param("vaultId"), itemId);
-      return c.json(await vaults().moveItem(actor, workspaceId, itemId, payload));
+      return c.json(
+        await vaultsWithProviders(actor, workspaceId).moveItem(actor, workspaceId, itemId, payload)
+      );
     })
   );
   app.post(
@@ -97947,7 +98958,7 @@ function registerVaultRoutes(app, deps) {
       );
       const fieldId = c.req.param("fieldId");
       if (!item.fields.some((field) => field.id === fieldId)) {
-        throw new VaultError2("vault_field_not_found", "field not found", { fieldId });
+        throw new VaultError3("vault_field_not_found", "field not found", { fieldId });
       }
       return c.json({ versions: await vaults().listFieldVersions(actor, workspaceId, fieldId) });
     })
@@ -106929,7 +107940,7 @@ function createVaultInteractionSecretsPort(deps) {
       return createSecretResolver2({ db: deps.db, encryptionKey }, principal, {
         capabilityEnabled: await secretsEnabled(principal),
         ...providersFor ? {
-          providersForSubject: (subjectId) => providersFor(principal.workspaceId, subjectId)
+          providersForSubject: (subjectId) => providersFor(principal.workspaceId, subjectId, principal)
         } : {}
       });
     },
@@ -111181,7 +112192,7 @@ import { HTTPException as HTTPException94 } from "hono/http-exception";
 
 // src/integrations/pr-review-provider.ts
 import {
-  pinnedFetch as pinnedFetch6,
+  pinnedFetch as pinnedFetch7,
   readResponseJsonBounded as readResponseJsonBounded12,
   readResponseTextBounded as readResponseTextBounded3
 } from "@opengeni/network";
@@ -111273,7 +112284,7 @@ async function providerJson2(input, url, headers) {
       headers: { accept: "application/json", ...headers },
       signal
     };
-    response = input.fetchImpl ? await input.fetchImpl(url, requestInit) : await pinnedFetch6(url, requestInit, input.settings, {
+    response = input.fetchImpl ? await input.fetchImpl(url, requestInit) : await pinnedFetch7(url, requestInit, input.settings, {
       label: `${input.provider} PR Review repository verification`,
       requireHttpsOutsideLocalTest: true
     });
@@ -144701,7 +145712,17 @@ function createAppComposition(deps) {
   const interactionSecrets = createVaultInteractionSecretsPort({
     db: routeDeps.db,
     encryptionKey: environmentsEncryptionKeyBytes14(routeDeps.settings) ?? null,
-    providersFor: (workspaceId, subjectId) => vaultProviderRegistryFor(routeDeps, { workspaceId, subjectId })
+    providersFor: (workspaceId, subjectId, principal) => vaultProviderRegistryFor(routeDeps, {
+      workspaceId,
+      subjectId,
+      ...principal ? {
+        executionContext: {
+          sessionId: principal.sessionId,
+          turnId: principal.turnId,
+          attemptId: principal.attemptId
+        }
+      } : {}
+    })
   });
   registerBrowserSessionRoutes(app, routeDeps, { interactionSecrets });
   registerComputerSessionRoutes(app, routeDeps, { interactionSecrets });
@@ -146289,6 +147310,7 @@ export {
   apiRequestBindingsForTransportPeer,
   reconcileScreenControlOnHello,
   withAccessGrantSessionRlsContext,
+  closeNativeExternalVaultProviders,
   SlackBotProviderError,
   createOpenGeniSlackBotInteractionClient,
   startTemporalScheduleCleanupPump,
@@ -146329,4 +147351,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-OT56OY4V.js.map
+//# sourceMappingURL=chunk-PQBHZ2YH.js.map