@opengeni/core 1.4.5-canary.38533006839001 → 2.0.1

package/dist/domain/vaults/provider-registry.d.ts

@@ -41,9 +41,12 @@ export type OnePasswordVaultProviderFactory = (input: {
 }) => Promise<VaultProvider>;
 export declare function onePasswordCredentialBundle(token: string): Record<string, unknown>;
 /**
- * Decrypts the token of one 1Password connection the caller can see
- * (workspace-shared, or personal to `subjectId`). The token goes only to the
- * provider factory; it is never logged or returned to a client.
+ * Decrypts the token of one 1Password connection the caller can use from
+ * `workspaceId`: one in this workspace (shared, or personal to `subjectId`),
+ * or one added in another workspace that still serves vaults reached here
+ * (the caller's own personal connection, or a shared connection behind an
+ * organization vault). The token goes only to the provider factory; it is
+ * never logged or returned to a client.
  */
 export declare function loadOnePasswordConnectionToken(db: Database, settings: Settings, input: {
     workspaceId: string;

package/dist/domain/vaults/provider-sync.d.ts

@@ -90,7 +90,7 @@ export declare function providerPrimaryFieldId(item: Pick<ProviderItemMeta, "typ
 /**
  * Deterministic mirror projection. Items are ordered by provider name then
  * external id before de-duplication, so the same provider state always yields
- * the same OpenGeni names; field names are de-duplicated within each item.
+ * the same Opengeni names; field names are de-duplicated within each item.
  */
 export declare function planProviderMirror(items: readonly ProviderItemMeta[], contentVersion: string | null): ProviderMirrorPlan;
 /** Sync status for a provider failure; rate limits persist `rateLimitedUntil`. */
@@ -125,3 +125,46 @@ export declare function syncLinkedProviderVault(input: {
     force?: boolean;
     now?: () => Date;
 }): Promise<ProviderVaultSyncResult>;
+/** How stale a linked vault's mirror may be before a search refreshes it. */
+export declare const LINKED_VAULT_SEARCH_MAX_AGE_MS: number;
+/** How stale it may be before a reference that found nothing refreshes it. */
+export declare const LINKED_VAULT_MISS_MAX_AGE_MS: number;
+/** How long a search or resolution waits for refreshes before answering. */
+export declare const LINKED_VAULT_REFRESH_WAIT_MS = 8000;
+/** The vault fields a freshness check needs (a `VaultRow` has them all). */
+export type LinkedVaultFreshness = {
+    id: string;
+    source: string;
+    syncStatus: VaultSyncStatus;
+    lastSyncedAt: string | null;
+    rateLimitedUntil: string | null;
+    updatedAt: string;
+};
+/**
+ * Whether a linked vault's mirror is older than `maxAgeMs`. A vault whose last
+ * sync failed counts from that failure (it is recorded as `updatedAt`), so a
+ * broken connection is retried once per `maxAgeMs`, not on every call. A vault
+ * under a provider rate limit is never stale until the limit lifts.
+ */
+export declare function linkedVaultNeedsRefresh(vault: LinkedVaultFreshness, maxAgeMs: number, now: Date): boolean;
+/**
+ * Bring stale linked vault mirrors up to date, so items added in the provider
+ * (for example straight in 1Password) are found without anyone pressing Sync.
+ *
+ * Each refresh is the ordinary non-forced sync: one `listVaults` call, and an
+ * item listing only when the provider says the vault changed. Refreshes of the
+ * same vault share one call per process. The caller waits at most `waitMs`;
+ * slower refreshes finish in the background and record their own status.
+ * Never throws: failures are recorded as the vault's sync status.
+ *
+ * Returns the ids of the vaults whose mirror changed before the wait ended.
+ */
+export declare function refreshStaleLinkedVaults(input: {
+    db: Database;
+    context: VaultDbContext;
+    vaults: readonly LinkedVaultFreshness[];
+    providers: VaultProviderRegistry;
+    maxAgeMs: number;
+    waitMs?: number;
+    now?: () => Date;
+}): Promise<string[]>;

package/dist/domain/vaults/provider-writes.d.ts

@@ -5,7 +5,7 @@ import { type ProviderCallBudget, type VaultProviderRegistry } from "@opengeni/v
  * Edits of items in a read-write connected vault (OP-3): the change is written
  * to the provider (1Password `items.get` → patch → `items.put`, with the
  * mirrored version as the expected version), then the metadata mirror is
- * refreshed. Values never touch OpenGeni storage.
+ * refreshed. Values never touch Opengeni storage.
  */
 /** One field change; the REST `VaultFieldInput` and the agent `secret_save` field both fit. */
 export interface ProviderFieldChange {

package/dist/goal-admission.d.ts

@@ -115,7 +115,6 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         onePasswordFakeTokens: boolean;
         integrationsEnabled: boolean;
         integrationsStateSecret?: string | undefined;
-        integrationsOauthShortStateEnabled: boolean;
         integrationsAllowPrivateNetworkTargets: boolean;
         privacyOnlyMeAllowed: boolean;
         privacyWorkspaceDefaultRequired: boolean;