@opengeni/core 1.4.5-canary.38533733713001 → 2.0.1

package/dist/index.js

@@ -948,6 +948,7 @@ function preferredFikenConnection(connections) {
 // src/domain/vaults/provider-registry.ts
 import {
   getConnectionMetadata,
+  getProviderConnectionHomeWorkspace,
   loadConnectionCredentialForBroker
 } from "@opengeni/db";
 import {
@@ -994,12 +995,25 @@ async function loadOnePasswordConnectionToken(db, settings, input) {
     "provider_auth_invalid",
     "The 1Password connection for this vault was removed or is not available to you; reconnect 1Password"
   );
-  const connection = await getConnectionMetadata(
+  let homeWorkspaceId = input.workspaceId;
+  let connection = await getConnectionMetadata(
     db,
     input.workspaceId,
     input.connectionId,
     input.subjectId
   );
+  if (!connection) {
+    const home = await getProviderConnectionHomeWorkspace(
+      db,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId
+    );
+    if (home && home !== input.workspaceId) {
+      homeWorkspaceId = home;
+      connection = await getConnectionMetadata(db, home, input.connectionId, input.subjectId);
+    }
+  }
   if (!connection || !isOnePasswordConnection(connection)) throw unavailable();
   if (connection.status !== "active") {
     throw new VaultProviderError(
@@ -1009,7 +1023,7 @@ async function loadOnePasswordConnectionToken(db, settings, input) {
   }
   const personal = connection.subjectId !== null;
   const credential = await loadConnectionCredentialForBroker(db, settings, {
-    workspaceId: input.workspaceId,
+    workspaceId: homeWorkspaceId,
     connectionId: connection.id,
     providerDomain: ONEPASSWORD_PROVIDER_DOMAIN,
     kind: "api_key",
@@ -2189,7 +2203,7 @@ function nativeConnectionCapabilityRecommendations(options = {}) {
         kind: "api",
         source: "built_in",
         name: "Connected Machine",
-        description: "Run this chat on the person's own computer or server (Mac, Linux or Windows), and optionally let agents use their Chrome through the OpenGeni Browser extension.",
+        description: "Run this chat on the person's own computer or server (Mac, Linux or Windows), and optionally let agents use their Chrome through the Opengeni Browser extension.",
         category: "compute",
         tags: [
           "machine",
@@ -2217,7 +2231,7 @@ function nativeConnectionCapabilityRecommendations(options = {}) {
         tools: [{ kind: "mcp", id: "opengeni" }],
         runtime: {
           available: true,
-          notes: `The person runs a one-line connect command on their machine from the chat card. The OpenGeni Browser Chrome extension (${OPENGENI_BROWSER_EXTENSION_URL}) works only after the machine is connected.`
+          notes: `The person runs a one-line connect command on their machine from the chat card. The Opengeni Browser Chrome extension (${OPENGENI_BROWSER_EXTENSION_URL}) works only after the machine is connected.`
         },
         lifecycle: {
           status: "available",
@@ -6805,18 +6819,321 @@ import {
   parseTotpInput,
   referenceKey,
   SecretReferenceError,
-  VAULT_LIMITS
+  VAULT_LIMITS as VAULT_LIMITS2
 } from "@opengeni/contracts";
 import {
   decryptEnvironmentValue,
+  listVaultsForSubject,
   recordVaultSecretUse,
   resolveSecretReferenceCandidates
 } from "@opengeni/db";
 import {
   createProviderCallBudget,
   EMPTY_VAULT_PROVIDER_REGISTRY,
-  isVaultProviderError
+  isVaultProviderError as isVaultProviderError2
 } from "@opengeni/vaults";
+
+// src/domain/vaults/provider-sync.ts
+import {
+  isValidSecretName,
+  VAULT_DEFAULT_PRIMARY_FIELD,
+  VAULT_LIMITS
+} from "@opengeni/contracts";
+import {
+  getProviderVaultSyncTarget,
+  setVaultSyncStatus,
+  upsertProviderVaultItems
+} from "@opengeni/db";
+import {
+  isVaultProviderError,
+  VaultProviderError as VaultProviderError2
+} from "@opengeni/vaults";
+var PROVIDER_RATE_LIMIT_DEFAULT_BACKOFF_MS = 15 * 6e4;
+var FORBIDDEN_NAME_CHARACTERS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/g;
+function nameKey(name) {
+  return name.normalize("NFC").trim().toLowerCase();
+}
+function truncateChars(value, max) {
+  const chars = [...value];
+  return chars.length > max ? chars.slice(0, max).join("") : value;
+}
+function providerSecretName(raw, fallback = "Untitled") {
+  let name = truncateChars(
+    raw.normalize("NFC").replace(FORBIDDEN_NAME_CHARACTERS, "-").trim(),
+    VAULT_LIMITS.nameMaxChars
+  ).trim();
+  if (!name) name = fallback;
+  if (/^id:/iu.test(name)) name = `id-${name.slice(3)}`.trim() || fallback;
+  return isValidSecretName(name) ? name : fallback;
+}
+function uniqueProviderName(name, taken) {
+  let candidate = name;
+  for (let n = 2; taken.has(nameKey(candidate)); n += 1) {
+    const suffix = ` (${n})`;
+    candidate = `${truncateChars(name, VAULT_LIMITS.nameMaxChars - suffix.length).trimEnd()}${suffix}`;
+  }
+  taken.add(nameKey(candidate));
+  return candidate;
+}
+var PRIMARY_FIELD_FALLBACK = ["password", "value", "credential", "note"];
+function providerPrimaryFieldId(item) {
+  const candidates = item.fields.filter((field) => field.kind !== "totp");
+  const byName = (name) => candidates.find((field) => nameKey(field.name) === name)?.externalFieldId ?? null;
+  const typeDefault = VAULT_DEFAULT_PRIMARY_FIELD[item.type];
+  if (typeDefault) {
+    const found = byName(typeDefault.toLowerCase());
+    if (found) return found;
+  }
+  for (const name of PRIMARY_FIELD_FALLBACK) {
+    const found = byName(name);
+    if (found) return found;
+  }
+  if (item.type === "file") {
+    const file = candidates.find((field) => field.kind === "file");
+    if (file) return file.externalFieldId;
+  }
+  return candidates.find((field) => field.kind === "concealed")?.externalFieldId ?? null;
+}
+function planProviderMirror(items, contentVersion) {
+  const ordered = [...items].sort(
+    (a, b) => nameKey(a.name).localeCompare(nameKey(b.name)) || a.externalItemId.localeCompare(b.externalItemId)
+  );
+  const kept = ordered.slice(0, VAULT_LIMITS.itemsPerVault);
+  const takenItems = /* @__PURE__ */ new Set();
+  const mirrored = kept.map((item) => {
+    const name = uniqueProviderName(providerSecretName(item.name), takenItems);
+    const takenFields = /* @__PURE__ */ new Set();
+    const fields = item.fields.slice(0, VAULT_LIMITS.fieldsPerItem).map((field, position) => {
+      let fieldName = providerSecretName(
+        field.name,
+        field.kind === "totp" ? "one-time password" : "field"
+      );
+      if (nameKey(fieldName) === "otp") fieldName = "otp code";
+      return {
+        externalFieldId: field.externalFieldId,
+        name: uniqueProviderName(fieldName, takenFields),
+        kind: field.kind,
+        position
+      };
+    });
+    return {
+      externalItemId: item.externalItemId,
+      name,
+      providerName: item.name,
+      type: item.type,
+      websites: item.websites.filter((website) => website.length <= VAULT_LIMITS.websiteMaxChars).slice(0, VAULT_LIMITS.websitesPerItem),
+      fields,
+      primaryExternalFieldId: providerPrimaryFieldId({ type: item.type, fields: item.fields }),
+      hasTotp: item.fields.some((field) => field.kind === "totp"),
+      version: item.version,
+      updatedAt: item.updatedAt
+    };
+  });
+  return { contentVersion, items: mirrored, truncated: ordered.length - kept.length };
+}
+function providerSyncFailure(error, now) {
+  const code = isVaultProviderError(error) ? error.code : "provider_unavailable";
+  const message = isVaultProviderError(error) ? error.message : "the vault provider could not be reached";
+  if (code === "provider_rate_limited") {
+    const retryAfterMs = isVaultProviderError(error) && error.retryAfterMs && error.retryAfterMs > 0 ? error.retryAfterMs : PROVIDER_RATE_LIMIT_DEFAULT_BACKOFF_MS;
+    return {
+      syncStatus: "rate_limited",
+      syncErrorCode: code,
+      syncErrorMessage: message,
+      rateLimitedUntil: new Date(now.getTime() + retryAfterMs),
+      lastSyncedAt: null
+    };
+  }
+  return {
+    syncStatus: code === "provider_auth_expired" || code === "provider_auth_invalid" ? "auth_expired" : "error",
+    syncErrorCode: code,
+    syncErrorMessage: message,
+    rateLimitedUntil: null,
+    lastSyncedAt: null
+  };
+}
+async function syncProviderVault(input) {
+  const now = input.now ?? (() => /* @__PURE__ */ new Date());
+  const { target } = input;
+  if (target.rateLimitedUntil && target.rateLimitedUntil.getTime() > now().getTime() && !input.force) {
+    return { status: "skipped_rate_limited", rateLimitedUntil: target.rateLimitedUntil };
+  }
+  try {
+    const vaults = await input.provider.listVaults(input.ctx);
+    const vault = vaults.find((candidate) => candidate.externalVaultId === target.externalVaultId);
+    if (!vault) {
+      const failure = providerSyncFailure(
+        new VaultProviderError2(
+          "provider_not_found",
+          "the linked provider vault no longer exists or is no longer shared with this connection"
+        ),
+        now()
+      );
+      await input.store.setSyncStatus(failure);
+      return {
+        status: "failed",
+        syncStatus: failure.syncStatus,
+        code: failure.syncErrorCode,
+        rateLimitedUntil: null
+      };
+    }
+    if (!input.force && vault.contentVersion !== null && vault.contentVersion === target.mirroredContentVersion) {
+      await input.store.setSyncStatus({
+        syncStatus: "ok",
+        syncErrorCode: null,
+        syncErrorMessage: null,
+        rateLimitedUntil: null,
+        lastSyncedAt: now()
+      });
+      return { status: "unchanged", contentVersion: vault.contentVersion };
+    }
+    const items = await input.provider.listItems(input.ctx, target.externalVaultId);
+    const plan = planProviderMirror(items, vault.contentVersion);
+    await input.store.replaceMirror(plan);
+    await input.store.setSyncStatus({
+      syncStatus: "ok",
+      syncErrorCode: null,
+      syncErrorMessage: null,
+      rateLimitedUntil: null,
+      lastSyncedAt: now()
+    });
+    return {
+      status: "synced",
+      contentVersion: plan.contentVersion,
+      itemCount: plan.items.length,
+      truncated: plan.truncated
+    };
+  } catch (error) {
+    if (!isVaultProviderError(error)) throw error;
+    const failure = providerSyncFailure(error, now());
+    await input.store.setSyncStatus(failure);
+    return {
+      status: "failed",
+      syncStatus: failure.syncStatus,
+      code: failure.syncErrorCode,
+      rateLimitedUntil: failure.rateLimitedUntil
+    };
+  }
+}
+function databaseProviderMirrorStore(db, context, vaultId) {
+  return {
+    async replaceMirror(plan) {
+      await upsertProviderVaultItems(db, context, {
+        vaultId,
+        contentVersion: plan.contentVersion,
+        items: plan.items.map((item) => ({
+          providerItemRef: item.externalItemId,
+          providerVersion: item.version,
+          // Passkeys live only in hosted vaults (D20); providers never mirror them.
+          type: item.type === "passkey" ? "login" : item.type,
+          // The base name: the routine de-duplicates against the stored mirror
+          // so names stay sticky per provider item.
+          name: providerSecretName(item.providerName),
+          websites: item.websites,
+          primaryFieldRef: item.primaryExternalFieldId,
+          fields: item.fields.map((field) => ({
+            providerFieldRef: field.externalFieldId,
+            name: field.name,
+            kind: field.kind
+          }))
+        }))
+      });
+    },
+    async setSyncStatus(update) {
+      await setVaultSyncStatus(db, context, {
+        vaultId,
+        status: update.syncStatus,
+        errorCode: update.syncErrorCode,
+        errorMessage: update.syncErrorMessage,
+        rateLimitedUntil: update.rateLimitedUntil?.toISOString() ?? null
+      });
+    }
+  };
+}
+async function syncLinkedProviderVault(input) {
+  const target = await getProviderVaultSyncTarget(input.db, input.context, input.vaultId);
+  const store = databaseProviderMirrorStore(input.db, input.context, input.vaultId);
+  let provider;
+  try {
+    provider = await input.providers.forVault({
+      source: target.source,
+      providerConnectionId: target.providerConnectionId
+    });
+  } catch (error) {
+    if (!isVaultProviderError(error)) throw error;
+    const failure = providerSyncFailure(error, (input.now ?? (() => /* @__PURE__ */ new Date()))());
+    await store.setSyncStatus(failure);
+    return {
+      status: "failed",
+      syncStatus: failure.syncStatus,
+      code: failure.syncErrorCode,
+      rateLimitedUntil: failure.rateLimitedUntil
+    };
+  }
+  return await syncProviderVault({
+    provider,
+    ctx: {
+      connectionId: target.providerConnectionId,
+      budget: input.budget ?? { take() {
+      } }
+    },
+    target: {
+      externalVaultId: target.providerVaultRef,
+      mirroredContentVersion: target.providerContentVersion,
+      rateLimitedUntil: target.rateLimitedUntil ? new Date(target.rateLimitedUntil) : null
+    },
+    store,
+    ...input.now ? { now: input.now } : {},
+    ...input.force ? { force: true } : {}
+  });
+}
+var LINKED_VAULT_SEARCH_MAX_AGE_MS = 10 * 6e4;
+var LINKED_VAULT_MISS_MAX_AGE_MS = 2 * 6e4;
+var LINKED_VAULT_REFRESH_WAIT_MS = 8e3;
+function linkedVaultNeedsRefresh(vault, maxAgeMs, now) {
+  if (vault.source === "opengeni") return false;
+  if (vault.rateLimitedUntil && new Date(vault.rateLimitedUntil).getTime() > now.getTime()) {
+    return false;
+  }
+  const last = vault.syncStatus === "ok" || vault.syncStatus === "syncing" ? vault.lastSyncedAt : vault.updatedAt;
+  if (!last) return true;
+  return now.getTime() - new Date(last).getTime() >= maxAgeMs;
+}
+var linkedVaultRefreshes = /* @__PURE__ */ new Map();
+async function refreshStaleLinkedVaults(input) {
+  const now = (input.now ?? (() => /* @__PURE__ */ new Date()))();
+  const stale = input.vaults.filter((vault) => linkedVaultNeedsRefresh(vault, input.maxAgeMs, now));
+  if (stale.length === 0) return [];
+  const changed = [];
+  const runs = stale.map((vault) => {
+    let run = linkedVaultRefreshes.get(vault.id);
+    if (!run) {
+      run = syncLinkedProviderVault({
+        db: input.db,
+        context: input.context,
+        vaultId: vault.id,
+        providers: input.providers,
+        ...input.now ? { now: input.now } : {}
+      }).catch(() => null).finally(() => linkedVaultRefreshes.delete(vault.id));
+      linkedVaultRefreshes.set(vault.id, run);
+    }
+    return run.then((result) => {
+      if (result?.status === "synced") changed.push(vault.id);
+    });
+  });
+  let timer;
+  await Promise.race([
+    Promise.all(runs),
+    new Promise((resolve) => {
+      timer = setTimeout(resolve, input.waitMs ?? LINKED_VAULT_REFRESH_WAIT_MS);
+      timer.unref?.();
+    })
+  ]);
+  if (timer) clearTimeout(timer);
+  return [...changed];
+}
+
+// src/domain/vaults/secret-resolver.ts
 function lookupFor(reference, index) {
   return reference.target.form === "id" ? {
     index,
@@ -6971,12 +7288,12 @@ var attemptBudgets = /* @__PURE__ */ new Map();
 var ATTEMPT_BUDGET_CACHE_LIMIT = 4096;
 function sharedAttemptBudget(principal) {
   if (principal.kind !== "attempt") {
-    return createProviderCallBudget(VAULT_LIMITS.providerReadsPerAttempt);
+    return createProviderCallBudget(VAULT_LIMITS2.providerReadsPerAttempt);
   }
   const key = `${principal.attemptId}:${principal.executionGeneration}`;
   let budget = attemptBudgets.get(key);
   if (!budget) {
-    budget = createProviderCallBudget(VAULT_LIMITS.providerReadsPerAttempt);
+    budget = createProviderCallBudget(VAULT_LIMITS2.providerReadsPerAttempt);
     attemptBudgets.set(key, budget);
     while (attemptBudgets.size > ATTEMPT_BUDGET_CACHE_LIMIT) {
       attemptBudgets.delete(attemptBudgets.keys().next().value);
@@ -7005,20 +7322,40 @@ function createSecretResolver(deps, principal, opts) {
         null
       );
     }
-    const { meta, candidates } = await resolveSecretReferenceCandidates(deps.db, context, {
-      refs: references.map((reference, index) => lookupFor(reference, index))
-    });
-    const failures = [];
-    const chosen = [];
-    references.forEach((reference, index) => {
-      const outcome = chooseSecretCandidate(
-        reference,
-        candidates.filter((candidate) => candidate.refIndex === index),
-        meta
-      );
-      if ("failure" in outcome) failures.push(outcome.failure);
-      else chosen.push({ reference, candidate: outcome.candidate });
-    });
+    const choose = async () => {
+      const { meta: meta2, candidates } = await resolveSecretReferenceCandidates(deps.db, context, {
+        refs: references.map((reference, index) => lookupFor(reference, index))
+      });
+      const failures2 = [];
+      const chosen2 = [];
+      references.forEach((reference, index) => {
+        const outcome = chooseSecretCandidate(
+          reference,
+          candidates.filter((candidate) => candidate.refIndex === index),
+          meta2
+        );
+        if ("failure" in outcome) failures2.push(outcome.failure);
+        else chosen2.push({ reference, candidate: outcome.candidate });
+      });
+      return { meta: meta2, failures: failures2, chosen: chosen2 };
+    };
+    let { meta, failures, chosen } = await choose();
+    if (failures.some((failure) => failure.code === "not_found")) {
+      const registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId);
+      if (registry) {
+        const reachable = await listVaultsForSubject(deps.db, context, {
+          workspaceId: principal.workspaceId
+        });
+        const changed = await refreshStaleLinkedVaults({
+          db: deps.db,
+          context,
+          vaults: reachable,
+          providers: registry,
+          maxAgeMs: LINKED_VAULT_MISS_MAX_AGE_MS
+        });
+        if (changed.length > 0) ({ meta, failures, chosen } = await choose());
+      }
+    }
     const hasActingHuman = meta.humanExpected && meta.humanValid;
     if (failures.length > 0) {
       throw new SecretReferenceError(
@@ -7051,7 +7388,7 @@ function createSecretResolver(deps, principal, opts) {
           providerValues.set(`${first.itemId}|${value.externalFieldId}`, value.material);
         }
       } catch (error) {
-        const code = isVaultProviderError(error) ? providerFailureCode(error.code) : "provider_unavailable";
+        const code = isVaultProviderError2(error) ? providerFailureCode(error.code) : "provider_unavailable";
         for (const entry of group) {
           failures.push({
             raw: entry.reference.raw,
@@ -15483,261 +15820,6 @@ function createWebSearchBilling(deps) {
   };
 }
 
-// src/domain/vaults/provider-sync.ts
-import {
-  isValidSecretName,
-  VAULT_DEFAULT_PRIMARY_FIELD,
-  VAULT_LIMITS as VAULT_LIMITS2
-} from "@opengeni/contracts";
-import {
-  getProviderVaultSyncTarget,
-  setVaultSyncStatus,
-  upsertProviderVaultItems
-} from "@opengeni/db";
-import {
-  isVaultProviderError as isVaultProviderError2,
-  VaultProviderError as VaultProviderError2
-} from "@opengeni/vaults";
-var PROVIDER_RATE_LIMIT_DEFAULT_BACKOFF_MS = 15 * 6e4;
-var FORBIDDEN_NAME_CHARACTERS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/g;
-function nameKey(name) {
-  return name.normalize("NFC").trim().toLowerCase();
-}
-function truncateChars(value, max) {
-  const chars = [...value];
-  return chars.length > max ? chars.slice(0, max).join("") : value;
-}
-function providerSecretName(raw, fallback = "Untitled") {
-  let name = truncateChars(
-    raw.normalize("NFC").replace(FORBIDDEN_NAME_CHARACTERS, "-").trim(),
-    VAULT_LIMITS2.nameMaxChars
-  ).trim();
-  if (!name) name = fallback;
-  if (/^id:/iu.test(name)) name = `id-${name.slice(3)}`.trim() || fallback;
-  return isValidSecretName(name) ? name : fallback;
-}
-function uniqueProviderName(name, taken) {
-  let candidate = name;
-  for (let n = 2; taken.has(nameKey(candidate)); n += 1) {
-    const suffix = ` (${n})`;
-    candidate = `${truncateChars(name, VAULT_LIMITS2.nameMaxChars - suffix.length).trimEnd()}${suffix}`;
-  }
-  taken.add(nameKey(candidate));
-  return candidate;
-}
-var PRIMARY_FIELD_FALLBACK = ["password", "value", "credential", "note"];
-function providerPrimaryFieldId(item) {
-  const candidates = item.fields.filter((field) => field.kind !== "totp");
-  const byName = (name) => candidates.find((field) => nameKey(field.name) === name)?.externalFieldId ?? null;
-  const typeDefault = VAULT_DEFAULT_PRIMARY_FIELD[item.type];
-  if (typeDefault) {
-    const found = byName(typeDefault.toLowerCase());
-    if (found) return found;
-  }
-  for (const name of PRIMARY_FIELD_FALLBACK) {
-    const found = byName(name);
-    if (found) return found;
-  }
-  if (item.type === "file") {
-    const file = candidates.find((field) => field.kind === "file");
-    if (file) return file.externalFieldId;
-  }
-  return candidates.find((field) => field.kind === "concealed")?.externalFieldId ?? null;
-}
-function planProviderMirror(items, contentVersion) {
-  const ordered = [...items].sort(
-    (a, b) => nameKey(a.name).localeCompare(nameKey(b.name)) || a.externalItemId.localeCompare(b.externalItemId)
-  );
-  const kept = ordered.slice(0, VAULT_LIMITS2.itemsPerVault);
-  const takenItems = /* @__PURE__ */ new Set();
-  const mirrored = kept.map((item) => {
-    const name = uniqueProviderName(providerSecretName(item.name), takenItems);
-    const takenFields = /* @__PURE__ */ new Set();
-    const fields = item.fields.slice(0, VAULT_LIMITS2.fieldsPerItem).map((field, position) => {
-      let fieldName = providerSecretName(
-        field.name,
-        field.kind === "totp" ? "one-time password" : "field"
-      );
-      if (nameKey(fieldName) === "otp") fieldName = "otp code";
-      return {
-        externalFieldId: field.externalFieldId,
-        name: uniqueProviderName(fieldName, takenFields),
-        kind: field.kind,
-        position
-      };
-    });
-    return {
-      externalItemId: item.externalItemId,
-      name,
-      providerName: item.name,
-      type: item.type,
-      websites: item.websites.filter((website) => website.length <= VAULT_LIMITS2.websiteMaxChars).slice(0, VAULT_LIMITS2.websitesPerItem),
-      fields,
-      primaryExternalFieldId: providerPrimaryFieldId({ type: item.type, fields: item.fields }),
-      hasTotp: item.fields.some((field) => field.kind === "totp"),
-      version: item.version,
-      updatedAt: item.updatedAt
-    };
-  });
-  return { contentVersion, items: mirrored, truncated: ordered.length - kept.length };
-}
-function providerSyncFailure(error, now) {
-  const code = isVaultProviderError2(error) ? error.code : "provider_unavailable";
-  const message = isVaultProviderError2(error) ? error.message : "the vault provider could not be reached";
-  if (code === "provider_rate_limited") {
-    const retryAfterMs = isVaultProviderError2(error) && error.retryAfterMs && error.retryAfterMs > 0 ? error.retryAfterMs : PROVIDER_RATE_LIMIT_DEFAULT_BACKOFF_MS;
-    return {
-      syncStatus: "rate_limited",
-      syncErrorCode: code,
-      syncErrorMessage: message,
-      rateLimitedUntil: new Date(now.getTime() + retryAfterMs),
-      lastSyncedAt: null
-    };
-  }
-  return {
-    syncStatus: code === "provider_auth_expired" || code === "provider_auth_invalid" ? "auth_expired" : "error",
-    syncErrorCode: code,
-    syncErrorMessage: message,
-    rateLimitedUntil: null,
-    lastSyncedAt: null
-  };
-}
-async function syncProviderVault(input) {
-  const now = input.now ?? (() => /* @__PURE__ */ new Date());
-  const { target } = input;
-  if (target.rateLimitedUntil && target.rateLimitedUntil.getTime() > now().getTime() && !input.force) {
-    return { status: "skipped_rate_limited", rateLimitedUntil: target.rateLimitedUntil };
-  }
-  try {
-    const vaults = await input.provider.listVaults(input.ctx);
-    const vault = vaults.find((candidate) => candidate.externalVaultId === target.externalVaultId);
-    if (!vault) {
-      const failure = providerSyncFailure(
-        new VaultProviderError2(
-          "provider_not_found",
-          "the linked provider vault no longer exists or is no longer shared with this connection"
-        ),
-        now()
-      );
-      await input.store.setSyncStatus(failure);
-      return {
-        status: "failed",
-        syncStatus: failure.syncStatus,
-        code: failure.syncErrorCode,
-        rateLimitedUntil: null
-      };
-    }
-    if (!input.force && vault.contentVersion !== null && vault.contentVersion === target.mirroredContentVersion) {
-      await input.store.setSyncStatus({
-        syncStatus: "ok",
-        syncErrorCode: null,
-        syncErrorMessage: null,
-        rateLimitedUntil: null,
-        lastSyncedAt: now()
-      });
-      return { status: "unchanged", contentVersion: vault.contentVersion };
-    }
-    const items = await input.provider.listItems(input.ctx, target.externalVaultId);
-    const plan = planProviderMirror(items, vault.contentVersion);
-    await input.store.replaceMirror(plan);
-    await input.store.setSyncStatus({
-      syncStatus: "ok",
-      syncErrorCode: null,
-      syncErrorMessage: null,
-      rateLimitedUntil: null,
-      lastSyncedAt: now()
-    });
-    return {
-      status: "synced",
-      contentVersion: plan.contentVersion,
-      itemCount: plan.items.length,
-      truncated: plan.truncated
-    };
-  } catch (error) {
-    if (!isVaultProviderError2(error)) throw error;
-    const failure = providerSyncFailure(error, now());
-    await input.store.setSyncStatus(failure);
-    return {
-      status: "failed",
-      syncStatus: failure.syncStatus,
-      code: failure.syncErrorCode,
-      rateLimitedUntil: failure.rateLimitedUntil
-    };
-  }
-}
-function databaseProviderMirrorStore(db, context, vaultId) {
-  return {
-    async replaceMirror(plan) {
-      await upsertProviderVaultItems(db, context, {
-        vaultId,
-        contentVersion: plan.contentVersion,
-        items: plan.items.map((item) => ({
-          providerItemRef: item.externalItemId,
-          providerVersion: item.version,
-          // Passkeys live only in hosted vaults (D20); providers never mirror them.
-          type: item.type === "passkey" ? "login" : item.type,
-          // The base name: the routine de-duplicates against the stored mirror
-          // so names stay sticky per provider item.
-          name: providerSecretName(item.providerName),
-          websites: item.websites,
-          primaryFieldRef: item.primaryExternalFieldId,
-          fields: item.fields.map((field) => ({
-            providerFieldRef: field.externalFieldId,
-            name: field.name,
-            kind: field.kind
-          }))
-        }))
-      });
-    },
-    async setSyncStatus(update) {
-      await setVaultSyncStatus(db, context, {
-        vaultId,
-        status: update.syncStatus,
-        errorCode: update.syncErrorCode,
-        errorMessage: update.syncErrorMessage,
-        rateLimitedUntil: update.rateLimitedUntil?.toISOString() ?? null
-      });
-    }
-  };
-}
-async function syncLinkedProviderVault(input) {
-  const target = await getProviderVaultSyncTarget(input.db, input.context, input.vaultId);
-  const store = databaseProviderMirrorStore(input.db, input.context, input.vaultId);
-  let provider;
-  try {
-    provider = await input.providers.forVault({
-      source: target.source,
-      providerConnectionId: target.providerConnectionId
-    });
-  } catch (error) {
-    if (!isVaultProviderError2(error)) throw error;
-    const failure = providerSyncFailure(error, (input.now ?? (() => /* @__PURE__ */ new Date()))());
-    await store.setSyncStatus(failure);
-    return {
-      status: "failed",
-      syncStatus: failure.syncStatus,
-      code: failure.syncErrorCode,
-      rateLimitedUntil: failure.rateLimitedUntil
-    };
-  }
-  return await syncProviderVault({
-    provider,
-    ctx: {
-      connectionId: target.providerConnectionId,
-      budget: input.budget ?? { take() {
-      } }
-    },
-    target: {
-      externalVaultId: target.providerVaultRef,
-      mirroredContentVersion: target.providerContentVersion,
-      rateLimitedUntil: target.rateLimitedUntil ? new Date(target.rateLimitedUntil) : null
-    },
-    store,
-    ...input.now ? { now: input.now } : {},
-    ...input.force ? { force: true } : {}
-  });
-}
-
 // src/workflow-wake-contract.ts
 var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
 var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
@@ -18102,7 +18184,7 @@ import {
   getVaultItem,
   listVaultFieldVersions,
   listVaultItems,
-  listVaultsForSubject,
+  listVaultsForSubject as listVaultsForSubject2,
   vaultItemCursor,
   moveVaultItem,
   readVaultFieldCiphertext,
@@ -18173,7 +18255,7 @@ async function providerFieldWrites(fields, existing, resolveReference, generated
     if (input.fileBase64 !== void 0 || kind === "file") {
       throw new VaultError(
         "provider_unavailable",
-        "files in connected vaults are read-only in OpenGeni",
+        "files in connected vaults are read-only in Opengeni",
         { field: input.name }
       );
     }
@@ -18235,7 +18317,7 @@ async function refreshAndFind(deps, vault, providerItemRef) {
     if (error instanceof VaultError && error.code === "vault_item_not_found") {
       throw new VaultError(
         "provider_unavailable",
-        "saved in the provider; OpenGeni will show it after the next sync",
+        "saved in the provider; Opengeni will show it after the next sync",
         { vaultId: vault.id }
       );
     }
@@ -18246,7 +18328,7 @@ async function writeProviderVaultItem(deps, input) {
   const { vault, existing, change } = input;
   assertProviderVaultWritable(vault);
   if ((change.type ?? existing?.type) === "passkey") {
-    throw new VaultError("vault_permission_denied", "passkeys live only in OpenGeni vaults");
+    throw new VaultError("vault_permission_denied", "passkeys live only in Opengeni vaults");
   }
   let externalItemId;
   let expectedVersion;
@@ -18637,7 +18719,7 @@ function createVaultService(deps) {
     return session?.agent?.capabilities.secrets ?? true;
   }
   async function agentVault(principal, nameOrId) {
-    const vaults = await listVaultsForSubject(deps.db, principalContext(principal), {
+    const vaults = await listVaultsForSubject2(deps.db, principalContext(principal), {
       workspaceId: principal.workspaceId
     });
     const byId = vaults.find((vault) => vault.id === nameOrId.toLowerCase());
@@ -18729,14 +18811,14 @@ function createVaultService(deps) {
   }
   return {
     async list(actor, workspaceId) {
-      const rows = await listVaultsForSubject(deps.db, subjectContext(actor, workspaceId), {
+      const rows = await listVaultsForSubject2(deps.db, subjectContext(actor, workspaceId), {
         workspaceId
       });
       const authority = authorityOf(actor);
       return rows.map((row) => toVaultSummary(row, authority));
     },
     async get(actor, workspaceId, vaultId) {
-      const rows = await listVaultsForSubject(deps.db, subjectContext(actor, workspaceId), {
+      const rows = await listVaultsForSubject2(deps.db, subjectContext(actor, workspaceId), {
         workspaceId
       });
       const row = rows.find((candidate) => candidate.id === vaultId);
@@ -18935,9 +19017,23 @@ function createVaultService(deps) {
     },
     async searchForAgent(principal, input) {
       const context = principalContext(principal);
-      const reachable = await listVaultsForSubject(deps.db, context, {
+      let reachable = await listVaultsForSubject2(deps.db, context, {
         workspaceId: principal.workspaceId
       });
+      if (deps.providers) {
+        const changed = await refreshStaleLinkedVaults({
+          db: deps.db,
+          context,
+          vaults: reachable,
+          providers: deps.providers,
+          maxAgeMs: LINKED_VAULT_SEARCH_MAX_AGE_MS
+        });
+        if (changed.length > 0) {
+          reachable = await listVaultsForSubject2(deps.db, context, {
+            workspaceId: principal.workspaceId
+          });
+        }
+      }
       const byTier = (vaults2) => [...vaults2].sort(
         (left, right) => left.tier - right.tier || left.name.localeCompare(right.name)
       );
@@ -27870,6 +27966,9 @@ export {
   KnowledgeVectorCreditsDisabledError,
   KnowledgeVectorFundingError,
   KnowledgeVectorQueryRejectedError,
+  LINKED_VAULT_MISS_MAX_AGE_MS,
+  LINKED_VAULT_REFRESH_WAIT_MS,
+  LINKED_VAULT_SEARCH_MAX_AGE_MS,
   MAX_CHECKS_PER_RIG,
   MAX_CREDENTIAL_HOOKS_PER_RIG,
   MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,
@@ -28216,6 +28315,7 @@ export {
   knowledgeContextForAccess,
   knowledgeContextForGateway,
   legacySessionAgentCapabilities,
+  linkedVaultNeedsRefresh,
   listExternalActorWorkspaces,
   listFleet,
   listGitHubActionPolicyActors,
@@ -28342,6 +28442,7 @@ export {
   recordWorkspaceUsage,
   refreshCoreCodexModelEntitlements,
   refreshScheduledTaskAccess,
+  refreshStaleLinkedVaults,
   registerAutomationAdapter,
   registerProductUsageMetricBaselines,
   rejectSkill,