@opengeni/core 3.1.3-canary.38890816741001 → 3.3.0

package/dist/domain/vaults/provider-writes.d.ts

@@ -1,11 +1,20 @@
-import { type VaultFieldInput, type VaultFieldKind, type VaultItemType } from "@opengeni/contracts";
-import { type Database, type VaultDbContext, type VaultFieldRow, type VaultRow } from "@opengeni/db";
-import { type ProviderCallBudget, type VaultProviderRegistry } from "@opengeni/vaults";
+import { type VaultFieldInput, type VaultFieldKind, type VaultItemType, type VaultProviderOperations } from "@opengeni/contracts";
+import { VaultError, type Database, type VaultDbContext, type VaultFieldRow, type VaultRow } from "@opengeni/db";
+import { type ProviderCallBudget, type VaultProvider, type VaultProviderRegistry } from "@opengeni/vaults";
+import { type ProviderVaultSyncResult } from "./provider-sync.js";
 /**
- * Edits of items in a read-write connected vault (OP-3): the change is written
- * to the provider (1Password `items.get` → patch → `items.put`, with the
- * mirrored version as the expected version), then the metadata mirror is
- * refreshed. Values never touch Opengeni storage.
+ * Edits of items in a read-write connected vault (OP-3, external vaults §10):
+ * the change is written to the provider (with the mirrored version as the
+ * expected version), then the metadata mirror is refreshed. Values never
+ * touch Opengeni storage.
+ *
+ * Every write is checked against the vault's effective operations first (the
+ * provider's current capabilities, narrowed by what it last reported for the
+ * vault and by the link mode), before any reference is resolved or value
+ * generated. A provider mutation is never retried: when its outcome is
+ * unknown the caller is told to check the vault, and a write that succeeded
+ * but could not be listed yet is reported as saved, never as a failure that
+ * invites saving it again.
  */
 /** One field change; the REST `VaultFieldInput` and the agent `secret_save` field both fit. */
 export interface ProviderFieldChange {
@@ -33,10 +42,38 @@ export interface ProviderWriteDeps {
     resolveReference: (raw: string) => Promise<string>;
     budget?: ProviderCallBudget;
 }
+/** An operation a connected vault may not allow; reported in `vault_read_only` details. */
+export type ProviderWriteOperation = "createItem" | "updateItem" | "removeField" | "createTotp" | "updateTotp" | "archiveItem" | "deleteItem" | "restoreItem" | "writeFiles" | "restoreFieldHistory";
+/** The result of a provider write once the mirror was refreshed. */
+export type ProviderWriteOutcome = {
+    status: "listed";
+    itemId: string;
+} | {
+    /**
+     * The provider confirmed the write, but the refreshed mirror does not
+     * show it yet (for example the refresh was rate limited). It must not be
+     * saved again; it appears after the next successful sync.
+     */
+    status: "saved_not_listed";
+    vaultId: string;
+    sync: ProviderVaultSyncResult["status"] | "error";
+};
 /** A connected vault the caller may change items in. */
 export declare function assertProviderVaultWritable(vault: VaultRow): void;
-/** Create (existing = null) or update an item in a connected read-write vault; returns its item id. */
-export declare function writeProviderVaultItem(deps: ProviderWriteDeps, input: {
+/**
+ * What a connected vault allows now: the provider's current capabilities,
+ * narrowed by the operations it last reported for this vault (a read-only
+ * share, for example) and by the link mode. Permanent deletion is never
+ * allowed.
+ */
+export declare function effectiveProviderOperations(vault: VaultRow, provider: Pick<VaultProvider, "capabilities"> | null): VaultProviderOperations;
+/** Refuses a provider operation Opengeni never performs, with the reason. */
+export declare function refuseProviderOperation(vault: VaultRow, operation: Extract<ProviderWriteOperation, "deleteItem" | "restoreItem" | "restoreFieldHistory">): never;
+/**
+ * Create (existing = null) or update an item in a connected read-write vault
+ * and report whether the refreshed mirror lists it.
+ */
+export declare function writeProviderVaultItemOutcome(deps: ProviderWriteDeps, input: {
     vault: VaultRow;
     existing: {
         itemId: string;
@@ -49,9 +86,62 @@ export declare function writeProviderVaultItem(deps: ProviderWriteDeps, input: {
     change: ProviderItemChange;
     /** Receives the names of fields whose values were generated. */
     generated?: string[];
-}): Promise<string>;
-/** Archive an item in a connected read-write vault (the provider keeps it recoverable). */
+}): Promise<ProviderWriteOutcome>;
+/** Thrown when a confirmed provider write is not listed yet: it must not be saved again. */
+export declare function savedNotListedError(vault: VaultRow, itemName: string, outcome: Extract<ProviderWriteOutcome, {
+    status: "saved_not_listed";
+}>): VaultError;
+/**
+ * Create (existing = null) or update an item in a connected read-write vault;
+ * returns its item id. A confirmed write that is not listed yet throws
+ * `provider_inventory_incomplete` with `details.saved = true`.
+ */
+export declare function writeProviderVaultItem(deps: ProviderWriteDeps, input: Parameters<typeof writeProviderVaultItemOutcome>[1]): Promise<string>;
+/** Whether an item can leave this vault recoverably (moves need it before anything is written). */
+export declare function providerArchiveKind(vault: VaultRow, provider: Pick<VaultProvider, "capabilities"> | null): "archive" | "trash" | null;
+/**
+ * Refuses, before any value is read or written, an item a connected vault
+ * cannot receive as a new item (its type, a one-time password, or a file).
+ */
+export declare function assertProviderVaultAccepts(deps: ProviderWriteDeps, vault: VaultRow, item: {
+    type: VaultItemType;
+    fields: ReadonlyArray<{
+        kind: VaultFieldKind;
+    }>;
+}): Promise<void>;
+/**
+ * Refuses a move out of a connected vault that cannot archive the original
+ * recoverably (copy instead); returns where the original will go.
+ */
+export declare function assertProviderVaultReleases(deps: ProviderWriteDeps, vault: VaultRow): Promise<"archive" | "trash">;
+/** What a fresh provider listing says about one mirrored item. */
+export type ProviderItemObservation = {
+    listed: true;
+    version: string | null;
+} | {
+    listed: false;
+    consistent: boolean;
+};
+/**
+ * The provider's current version of one item, from a fresh listing of its
+ * vault (provider caches bypassed). `version` is null when the provider does
+ * not version items. A provider failure is thrown as a `VaultError`.
+ *
+ * The provider contract has no conditional (compare-and-archive) operation,
+ * so this only narrows the window between reading an item and archiving it;
+ * it cannot close it.
+ */
+export declare function observeProviderItemVersion(deps: ProviderWriteDeps, input: {
+    vault: VaultRow;
+    providerItemRef: string;
+}): Promise<ProviderItemObservation>;
+/**
+ * Archive an item in a connected read-write vault. Only a recoverable archive
+ * (the provider's archive or trash) is ever used; permanent deletion is not.
+ */
 export declare function archiveProviderVaultItem(deps: ProviderWriteDeps, input: {
     vault: VaultRow;
     itemId: string;
-}): Promise<void>;
+}): Promise<{
+    archiveKind: "archive" | "trash";
+}>;

package/dist/domain/vaults/remote-provider-runtime.d.ts

@@ -0,0 +1,7 @@
+import type { Settings } from "@opengeni/config";
+import { pinnedFetch, type OutboundNetworkSettings } from "@opengeni/network";
+import { type RemoteVaultTransport } from "@opengeni/vaults";
+import type { ExternalVaultProviderFactories } from "./external-provider-connections.js";
+/** Shared by API and worker. No credential-bearing request uses ambient fetch. */
+export declare function createPinnedRemoteVaultTransport(settings: OutboundNetworkSettings, fetchImpl?: typeof pinnedFetch): RemoteVaultTransport;
+export declare function createRemoteExternalVaultFactories(settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">): ExternalVaultProviderFactories;

package/dist/domain/vaults/secret-resolver.d.ts

@@ -4,9 +4,19 @@
  * chosen here (archived dropped, lowest tier, names over aliases, otherwise
  * ambiguous), provider values are fetched, hosted values decrypted, and the
  * batch is recorded. A call resolves all of its references or none (I2).
+ *
+ * A reference that finds nothing first refreshes the connected vaults that
+ * could change the answer: those that could hold it at the priority tier that
+ * decided the lookup or above, even when a hosted item matched without the
+ * field. When one of those could not be checked (unreachable, rate limited,
+ * needing reconnection or still refreshing), the failure names that source
+ * instead of reporting the secret missing, so no missing-secret ask card is
+ * made for a secret that may exist (external vaults §9). Hosted and
+ * explicitly named healthy vaults are never blocked by unrelated outages, and
+ * lower-priority vaults never block a miss a higher tier decided.
  */
 import { type SecretPrincipal, type SecretReference, type SecretReferenceFailure, type SecretResolver } from "@opengeni/contracts";
-import { type SecretReferenceCandidate, type SecretResolutionMeta } from "@opengeni/db";
+import { type SecretReferenceCandidate, type SecretResolutionMeta, type VaultRow } from "@opengeni/db";
 import { type ProviderCallBudget, type VaultProviderRegistry } from "@opengeni/vaults";
 import type { VaultServiceDeps } from "./types.js";
 export type SecretResolverOptions = {
@@ -31,4 +41,22 @@ export declare function chooseSecretCandidate(reference: SecretReference, candid
 } | {
     failure: SecretReferenceFailure;
 };
+/**
+ * The connected vaults whose mirror decides a reference that found nothing.
+ *
+ * Where the item could be: the vault a three-segment reference names; for two
+ * segments the named vault when the first segment names one (else every
+ * connected vault, since it may be `Item/field`); every connected vault for a
+ * bare item name; none for an ID.
+ *
+ * When some item matched but lacks the field (or the one-time password), the
+ * lookup keeps the highest-priority tier, so only vaults at that tier or above
+ * can change the answer: the connected vaults of matched items there that lack
+ * the field, and the connected vaults that could hold the item there but have
+ * no match yet. A hosted match never hides a higher-priority connected vault
+ * whose provider gained the item or its one-time password, and a vault of a
+ * lower-priority tier that is out of date or unavailable never turns a
+ * definite miss into an unchecked one.
+ */
+export declare function relevantProviderVaults(reference: SecretReference, candidates: readonly SecretReferenceCandidate[], reachable: readonly VaultRow[]): VaultRow[];
 export declare function createSecretResolver(deps: VaultServiceDeps, principal: SecretPrincipal, opts: SecretResolverOptions): SecretResolver;

package/dist/goal-admission.d.ts

@@ -114,6 +114,7 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         ogtoolPackageSpec?: string | undefined;
         environmentsEncryptionKey?: string | undefined;
         onePasswordFakeTokens: boolean;
+        protonPassCliPath?: string | undefined;
         integrationsEnabled: boolean;
         integrationsStateSecret?: string | undefined;
         integrationsAllowPrivateNetworkTargets: boolean;
@@ -225,6 +226,7 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         voiceInputOpenaiPricingJson?: string | undefined;
         voiceInputAzurePricingJson?: string | undefined;
         voiceInputCodexExperimentalEnabled: boolean;
+        creditMarginBpsOverride?: number | undefined;
         modelPricingJson: string;
         modelCatalogSource: "code" | "database";
         modelCostPolicyJson: string;

package/dist/index.d.ts

@@ -12,6 +12,8 @@ export * from "./domain/web-search-billing.js";
 export * from "./domain/realtime-voice-billing.js";
 export * from "./dependencies.js";
 export * from "./domain/vaults/provider-registry.js";
+export * from "./domain/vaults/external-provider-connections.js";
+export * from "./domain/vaults/remote-provider-runtime.js";
 export * from "./domain/vaults/provider-sync.js";
 export * from "./workflow-wake-contract.js";
 export * from "./user-presence.js";
@@ -83,6 +85,7 @@ export * from "./domain/organization-membership-lifecycle.js";
 export * from "./application/new-session-drafts.js";
 export * from "./application/composer-submit.js";
 export * from "./application/session-commands.js";
+export * from "./application/site-session-cancellation.js";
 export * from "./application/archived-session-imports.js";
 export * from "./application/session-tenancy.js";
 export * from "./application/organization-privacy.js";