@opengeni/core 3.1.2 → 3.2.2

package/src/domain/vaults/vault-service.ts

@@ -56,8 +56,10 @@ import {
   ensureTaskVault,
   getSession,
   getSessionSecretsView,
+  getProviderVaultItemRef,
   getVault,
   getVaultItem,
+  isVaultError,
   listVaultFieldVersions,
   listVaultItems,
   listVaultsForSubject,
@@ -95,12 +97,21 @@ import { vaultErrorCodeForProvider } from "./provider-registry";
 import {
   LINKED_VAULT_OPEN_WAIT_MS,
   LINKED_VAULT_SEARCH_MAX_AGE_MS,
+  providerVaultFreshness,
+  refreshLinkedVaults,
   refreshStaleLinkedVaults,
 } from "./provider-sync";
 import {
   archiveProviderVaultItem,
+  assertProviderVaultAccepts,
+  assertProviderVaultReleases,
+  observeProviderItemVersion,
+  refuseProviderOperation,
+  savedNotListedError,
   writeProviderVaultItem,
+  writeProviderVaultItemOutcome,
   type ProviderWriteDeps,
+  type ProviderWriteOutcome,
 } from "./provider-writes";
 import { chooseSecretCandidate, createSecretResolver } from "./secret-resolver";
 import type { VaultRequestActor, VaultServiceDeps } from "./types";
@@ -423,6 +434,21 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
     return deps.encryptionKey;
   }
 
+  /**
+   * Restore and permanent deletion are Opengeni-hosted operations. Connected
+   * items are archived recoverably in their provider and restored there, so
+   * these refuse with the reason instead of reaching any provider.
+   */
+  async function refuseForConnectedItem(
+    context: VaultDbContext,
+    itemId: string,
+    operation: "restoreItem" | "deleteItem",
+  ): Promise<void> {
+    const item = await getVaultItem(deps.db, context, { itemId });
+    if (item.vaultSource === "opengeni") return;
+    refuseProviderOperation(await getVault(deps.db, context, { vaultId: item.vaultId }), operation);
+  }
+
   /**
    * Move or copy an item when either side is a connected (provider) vault.
    * Values never live in both stores' databases at once: each field is read
@@ -430,6 +456,25 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
    * written to the target through its own path, and a move then archives the
    * source so the old item stays recoverable. Opengeni-to-Opengeni moves keep
    * the single-statement database move, which preserves the item id.
+   *
+   * Everything the target must accept (item type, one-time password, files)
+   * and, for a move, a recoverable archive of the original is checked before
+   * any value is read or written. The original is archived only after the
+   * target confirmed the write; an unknown or failed target write leaves it
+   * untouched, and a confirmed copy whose original could not be archived is
+   * reported as saved, so the move is not repeated.
+   *
+   * A move out of a connected vault records the provider's version of the
+   * original from a fresh listing before anything is copied. A version that
+   * differs from the mirrored one (whose field list the copy follows) is
+   * refused with `provider_conflict` before anything is saved: the vault must
+   * be synced first. The original is listed again just before archiving; if
+   * the provider then reports another version, no longer lists it, or cannot
+   * be asked, the original is kept and the copy is reported as saved with
+   * `sourceArchived: false`. These are separate checks, not an atomic read:
+   * values are read live between them, and providers offer no conditional
+   * archive, so a change landing after the last check is still archived
+   * (recoverably). A provider that does not version items gets no drift check.
    */
   async function moveAcrossProviders(input: {
     context: VaultDbContext;
@@ -465,6 +510,53 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
         },
       );
     }
+    if (target.source !== "opengeni") {
+      await assertProviderVaultAccepts(input.providerWrites, target, source);
+    }
+    if (input.mode === "move" && source.vaultSource !== "opengeni") {
+      await assertProviderVaultReleases(input.providerWrites, sourceVault);
+    }
+    // The provider's version before anything is copied. It must equal the
+    // mirrored version the field list below comes from; an edit after this
+    // observation makes the pre-archive check differ and keeps the original.
+    // Values are read live afterwards, so this is not an atomic snapshot.
+    let pinned: { providerItemRef: string; version: string } | null = null;
+    if (input.mode === "move" && source.vaultSource !== "opengeni") {
+      const mirrored = await getProviderVaultItemRef(deps.db, input.context, {
+        vaultId: sourceVault.id,
+        itemId: source.id,
+      });
+      const { providerItemRef } = mirrored;
+      const observed = await observeProviderItemVersion(input.providerWrites, {
+        vault: sourceVault,
+        providerItemRef,
+      });
+      if (!observed.listed) {
+        throw new VaultError(
+          "vault_item_not_found",
+          `${source.name} is not listed in ${sourceVault.name} right now; sync the vault and try again`,
+          { itemId: source.id, vaultId: sourceVault.id },
+        );
+      }
+      if (observed.version !== null) {
+        if (
+          mirrored.providerVersion !== observed.version ||
+          mirrored.generation !== source.generation
+        ) {
+          throw new VaultError(
+            "provider_conflict",
+            `${source.name} changed in ${sourceVault.name} since Opengeni last synced it, so its fields here may be out of date. Nothing was moved: sync ${sourceVault.name}, then move it again.`,
+            {
+              itemId: source.id,
+              vaultId: sourceVault.id,
+              mirroredVersion: mirrored.providerVersion,
+              providerVersion: observed.version,
+            },
+          );
+        }
+        pinned = { providerItemRef, version: observed.version };
+      }
+    }
     const name = input.newName ?? source.name;
     const fields: FieldSource[] = [];
     for (const field of source.fields) {
@@ -493,14 +585,20 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
       ...(source.expiresAt ? { expiresAt: source.expiresAt } : {}),
       fields,
     };
-    let created: VaultItemRow;
+    let created: VaultItemRow | null = null;
+    let notListed: Extract<ProviderWriteOutcome, { status: "saved_not_listed" }> | null = null;
     if (target.source !== "opengeni") {
-      const itemId = await writeProviderVaultItem(input.providerWrites, {
+      // A failed or unknown target write throws here, before the original is touched.
+      const outcome = await writeProviderVaultItemOutcome(input.providerWrites, {
         vault: target,
         existing: null,
         change,
       });
-      created = await getVaultItem(deps.db, input.context, { itemId });
+      if (outcome.status === "listed") {
+        created = await getVaultItem(deps.db, input.context, { itemId: outcome.itemId });
+      } else {
+        notListed = outcome;
+      }
     } else {
       const write = await itemWrite(
         change,
@@ -515,16 +613,67 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
       });
     }
     if (input.mode === "move") {
-      if (source.vaultSource !== "opengeni") {
-        await archiveProviderVaultItem(input.providerWrites, {
-          vault: sourceVault,
-          itemId: source.id,
-        });
-      } else {
-        await archiveVaultItem(deps.db, input.context, { itemId: source.id });
+      try {
+        if (source.vaultSource !== "opengeni") {
+          if (pinned) await assertSourceUnchanged(input.providerWrites, sourceVault, pinned);
+          await archiveProviderVaultItem(input.providerWrites, {
+            vault: sourceVault,
+            itemId: source.id,
+          });
+        } else {
+          await archiveVaultItem(deps.db, input.context, { itemId: source.id });
+        }
+      } catch (error) {
+        const changed = isVaultError(error) && error.details?.sourceChanged === true;
+        throw new VaultError(
+          isVaultError(error) ? error.code : "provider_outcome_unknown",
+          changed
+            ? `Saved ${name} in ${target.name} with the values that were read, but the original in ${sourceVault.name} ${error.message}, so it was kept. Do not move it again: compare the two, then update the copy or archive the original in ${sourceVault.name}.`
+            : `Saved ${name} in ${target.name}, but archiving the original in ${sourceVault.name} did not complete${isVaultError(error) ? ` (${error.message})` : ""}. Do not move it again: check ${sourceVault.name} and archive the original there if it is still listed.`,
+          {
+            saved: true,
+            sourceArchived: false,
+            ...(changed ? { sourceChanged: true } : {}),
+            vaultId: target.id,
+            ...(created ? { itemId: created.id } : {}),
+            sourceItemId: source.id,
+            sourceVaultId: sourceVault.id,
+          },
+        );
       }
     }
-    return created;
+    if (notListed) {
+      const error = savedNotListedError(target, name, notListed);
+      throw new VaultError(error.code, error.message, {
+        ...error.details,
+        ...(input.mode === "move" ? { sourceArchived: true } : {}),
+      });
+    }
+    return created!;
+  }
+
+  /**
+   * Refuses (before archiving) an original the provider no longer reports at
+   * the version its values were copied from. A failed listing throws its own
+   * provider error, so the original is kept either way.
+   */
+  async function assertSourceUnchanged(
+    providerWrites: ProviderWriteDeps,
+    vault: VaultRow,
+    pinned: { providerItemRef: string; version: string },
+  ): Promise<void> {
+    const now = await observeProviderItemVersion(providerWrites, {
+      vault,
+      providerItemRef: pinned.providerItemRef,
+    });
+    if (now.listed && now.version === pinned.version) return;
+    throw new VaultError(
+      now.listed ? "vault_generation_conflict" : "vault_item_not_found",
+      now.listed
+        ? "changed after its values were read"
+        : "is no longer listed at the version that was read",
+      { sourceChanged: true, vaultId: vault.id },
+    );
   }
 
   function toItem(row: VaultItemRow): VaultItem {
@@ -550,7 +699,12 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
         // Providers charge the budget per call themselves.
         const budget = createProviderCallBudget(VAULT_LIMITS.providerReadsPerAttempt);
         const [value] = await provider.readFields(
-          { connectionId: read.providerConnectionId, budget },
+          // The durable epoch invalidates provider value caches after a refresh anywhere.
+          {
+            connectionId: read.providerConnectionId,
+            budget,
+            cacheEpoch: read.providerCacheEpoch ?? null,
+          },
           read.providerVaultRef ?? "",
           read.providerItemRef ?? "",
           [read.providerFieldRef ?? ""],
@@ -618,6 +772,10 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
     const vaults = await listVaultsForSubject(deps.db, principalContext(principal), {
       workspaceId: principal.workspaceId,
     });
+    return agentVaultFrom(vaults, nameOrId);
+  }
+
+  function agentVaultFrom(vaults: readonly VaultRow[], nameOrId: string): VaultRow {
     const byId = vaults.find((vault) => vault.id === nameOrId.toLowerCase());
     if (byId) return byId;
     const matches = vaults.filter((vault) => secretNameKey(vault.name) === secretNameKey(nameOrId));
@@ -874,13 +1032,16 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
     },
 
     async restoreItem(actor, workspaceId, itemId) {
-      return toItem(
-        await restoreVaultItem(deps.db, subjectContext(actor, workspaceId), { itemId }),
-      );
+      const context = subjectContext(actor, workspaceId);
+      await refuseForConnectedItem(context, itemId, "restoreItem");
+      return toItem(await restoreVaultItem(deps.db, context, { itemId }));
     },
 
     async deleteItemPermanently(actor, workspaceId, itemId) {
-      await deleteVaultItemPermanently(deps.db, subjectContext(actor, workspaceId), { itemId });
+      const context = subjectContext(actor, workspaceId);
+      // Never a permanent provider deletion: Archive is the only way an item leaves.
+      await refuseForConnectedItem(context, itemId, "deleteItem");
+      await deleteVaultItemPermanently(deps.db, context, { itemId });
     },
 
     async moveItem(actor, workspaceId, itemId, req) {
@@ -924,6 +1085,12 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
     async restoreFieldVersion(actor, workspaceId, itemId, fieldId, version) {
       const context = subjectContext(actor, workspaceId);
       const existing = await getVaultItem(deps.db, context, { itemId });
+      if (existing.vaultSource !== "opengeni") {
+        refuseProviderOperation(
+          await getVault(deps.db, context, { vaultId: existing.vaultId }),
+          "restoreFieldHistory",
+        );
+      }
       const field = existing.fields.find((candidate) => candidate.id === fieldId);
       if (!field) throw new VaultError("vault_field_not_found", "field not found", { fieldId });
       return toItem(
@@ -963,29 +1130,48 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
       let reachable = await listVaultsForSubject(deps.db, context, {
         workspaceId: principal.workspaceId,
       });
+      let scoped: VaultRow[] =
+        input.vault !== undefined ? [agentVaultFrom(reachable, input.vault)] : reachable;
       // Items added straight in a connected provider (1Password) appear here
-      // without anyone pressing Sync: stale mirrors refresh before the scan.
-      if (deps.providers) {
-        const changed = await refreshStaleLinkedVaults({
+      // without anyone pressing Sync: stale mirrors in the search's scope
+      // refresh before the scan. `refresh` (first page only) re-lists them and
+      // bypasses provider caches for later reads, never an active rate limit.
+      let refreshing = new Set<string>();
+      const connected = scoped.filter((vault) => vault.source !== "opengeni");
+      if (deps.providers && connected.length > 0) {
+        const report = await refreshLinkedVaults({
           db: deps.db,
           context,
-          vaults: reachable,
+          vaults: connected,
           providers: deps.providers,
           maxAgeMs: LINKED_VAULT_SEARCH_MAX_AGE_MS,
+          ...(input.refresh && input.cursor === undefined ? { force: true } : {}),
         });
-        if (changed.length > 0) {
+        refreshing = new Set(report.pending);
+        if (
+          report.outcomes.some((outcome) => outcome.state === "done" || outcome.state === "failed")
+        ) {
           reachable = await listVaultsForSubject(deps.db, context, {
             workspaceId: principal.workspaceId,
           });
+          scoped = scoped.map((vault) => reachable.find((row) => row.id === vault.id) ?? vault);
         }
       }
+      // Every page says which connected sources were checked, so an empty or
+      // short result is never mistaken for proof that a secret does not exist.
+      const checkedAt = new Date();
+      const freshnessOf = (vault: VaultRow) =>
+        providerVaultFreshness(vault, checkedAt, { refreshing: refreshing.has(vault.id) });
+      const sources = scoped.flatMap((vault) => {
+        const freshness = freshnessOf(vault);
+        return freshness ? [{ vaultId: vault.id, freshness }] : [];
+      });
+      const complete = sources.every((source) => source.freshness.state === "current");
       const byTier = (vaults: VaultRow[]) =>
         [...vaults].sort(
           (left, right) => left.tier - right.tier || left.name.localeCompare(right.name),
         );
-      const vaults = byTier(
-        input.vault !== undefined ? [await agentVault(principal, input.vault)] : reachable,
-      );
+      const vaults = byTier(scoped);
       const limit = input.limit ?? 20;
       const filters = agentSearchFilterKey(input);
       // Resume exactly after the last item the previous page examined.
@@ -1060,16 +1246,22 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
         nextCursor: next === null ? null : encodeAgentSearchCursor(next),
         ...(input.cursor === undefined
           ? {
-              vaults: byTier(reachable).map((vault) => ({
-                id: vault.id,
-                name: vault.name,
-                ownerKind: vault.ownerKind,
-                source: vault.source,
-                mode: vault.mode,
-                itemCount: vault.itemCount,
-              })),
+              vaults: byTier(reachable).map((vault) => {
+                const freshness = freshnessOf(vault);
+                return {
+                  id: vault.id,
+                  name: vault.name,
+                  ownerKind: vault.ownerKind,
+                  source: vault.source,
+                  mode: vault.mode,
+                  itemCount: vault.itemCount,
+                  ...(freshness ? { freshness } : {}),
+                };
+              }),
             }
           : {}),
+        complete,
+        sources,
       };
 
       function agentSearchResult(vault: VaultRow, row: VaultItemRow) {
@@ -1225,7 +1417,7 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
       const current = await getVaultItem(deps.db, context, { itemId: target.itemId });
       if (current.vaultSource !== "opengeni") {
         const vault = await getVault(deps.db, context, { vaultId: current.vaultId });
-        await archiveProviderVaultItem(
+        const { archiveKind } = await archiveProviderVaultItem(
           {
             db: deps.db,
             context,
@@ -1236,7 +1428,7 @@ export function createVaultService(deps: VaultServiceDeps): VaultService {
         );
         return {
           archived: true,
-          restoreHint: `A person can restore ${current.name} from the provider's archive.`,
+          restoreHint: `A person can restore ${current.name} from the ${archiveKind === "trash" ? "trash" : "archive"} in ${vault.name}'s provider; it reappears here after the next sync.`,
         };
       }
       const row = await archiveVaultItem(deps.db, context, {

package/src/domain/voice-input-billing.ts

@@ -201,7 +201,11 @@ export function createVoiceInputBilling(deps: {
         usage: input.usage,
         trustedDurationSeconds: input.billing.trustedDurationSeconds,
       });
-      const cost = calculateVoiceInputCost(input.pricing, usage);
+      const cost = calculateVoiceInputCost(
+        input.pricing,
+        usage,
+        deps.settings.creditMarginBpsOverride,
+      );
       return await settleVoiceInputUsage(deps.db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,

package/src/index.ts

@@ -40,6 +40,8 @@ export * from "./domain/realtime-voice-billing";
 // SessionWorkflowClient, DocumentIndexClient, ObjectStorageDependency).
 export * from "./dependencies";
 export * from "./domain/vaults/provider-registry";
+export * from "./domain/vaults/external-provider-connections";
+export * from "./domain/vaults/remote-provider-runtime";
 export * from "./domain/vaults/provider-sync";
 export * from "./workflow-wake-contract";
 export * from "./user-presence";