@opengeni/core 3.1.3-canary.38890816741001 → 3.3.0

package/dist/index.js

@@ -156,6 +156,7 @@ import {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import {
   currentSessionRlsActorIdentityKey,
+  currentSiteViewerRlsContext,
   getSessionAuthorityProjection,
   getSessionAuthorizationTargetProjection,
   getSession as getSession2,
@@ -395,7 +396,8 @@ function relatedSessionAccessForAgentAttempt(actor, targetSessionId) {
 function sessionRlsActorForAuthorization(authorization) {
   return authorization.actor.kind === "agent_attempt" ? {
     subjectId: authorization.actor.subjectId,
-    initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId
+    initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId,
+    agentRootSessionId: authorization.actor.callerRootSessionId
   } : { subjectId: authorization.actor.subjectId };
 }
 async function withResolvedSessionAuthorization(authorization, fn) {
@@ -426,6 +428,13 @@ async function requireSessionAuthorization(deps, grant, input) {
   if (!authority && input.surface !== "core") {
     throw new SessionAuthorizationDeniedError("not_found");
   }
+  if (authority?.siteAccessRootId) {
+    const viewer = currentSiteViewerRlsContext();
+    const resolved = await resolveSessionAuthorizationActor(deps.db, grant, reads);
+    const actor2 = resolved.actor;
+    const allowed = actor2.kind === "agent_attempt" ? authority.siteOwnerSubjectId !== null && authority.siteOwnerSubjectId === actor2.initiatingHumanSubjectId || actor2.callerRootSessionId === authority.rootSessionId && authority.siteAccessRootId === authority.rootSessionId : authority.siteOwnerSubjectId === actor2.subjectId || actor2.subjectId === `site:${authority.siteId}` && viewer?.siteId === authority.siteId && viewer.principal === authority.siteViewerPrincipal;
+    if (!allowed) throw new SessionAuthorizationDeniedError("not_found");
+  }
   const siteOrigin = currentSiteSessionOrigin();
   if (siteOrigin && authority && !input.operation.endsWith(".read")) {
     const session = await getSession2(deps.db, grant.workspaceId, input.sessionId);
@@ -1011,10 +1020,10 @@ import { requireSession as requireSession3, requireWorkspace as requireWorkspace
 // src/domain/capabilities.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { isDeepStrictEqual } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import { withLockedCapabilityInstallation } from "@opengeni/db/capability-reconciliation";
 import {
-  environmentsEncryptionKeyBytes,
+  environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2,
   findIntegrationsOauthClient,
   parseIntegrationsOauthClientsJson
 } from "@opengeni/config";
@@ -1041,7 +1050,7 @@ import {
   encryptVariableSetValue,
   getCapabilityCatalogItem,
   getCapabilityInstallation,
-  getConnectionMetadata as getConnectionMetadata2,
+  getConnectionMetadata as getConnectionMetadata3,
   readCodexCutoverDisposition,
   resolveSubscriptionCoreCodexAppsDesignation,
   rlsContextForWorkspace,
@@ -1099,14 +1108,263 @@ function preferredFikenConnection(connections) {
 
 // src/domain/vaults/provider-registry.ts
 import {
+  getConnectionMetadata as getConnectionMetadata2,
+  getProviderConnectionHomeWorkspace as getProviderConnectionHomeWorkspace2,
+  loadConnectionCredentialForBroker as loadConnectionCredentialForBroker2
+} from "@opengeni/db";
+import {
+  createVaultProviderRegistry,
+  VaultProviderError as VaultProviderError2
+} from "@opengeni/vaults";
+
+// src/domain/vaults/external-provider-connections.ts
+import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { isDeepStrictEqual } from "util";
+import {
+  ExternalVaultProviderKind,
+  VaultProviderCredentials,
+  VaultProviderOperations
+} from "@opengeni/contracts";
+import {
+  encryptEnvironmentValue,
   getConnectionMetadata,
   getProviderConnectionHomeWorkspace,
-  loadConnectionCredentialForBroker
+  loadConnectionCredentialForBroker,
+  updateConnection
 } from "@opengeni/db";
 import {
-  createVaultProviderRegistry,
+  providerOperations,
   VaultProviderError
 } from "@opengeni/vaults";
+import { z } from "zod";
+var EXTERNAL_VAULT_CREDENTIAL_ROLE = "external_vault_provider";
+var ExternalVaultConnectionDetails = z.object({
+  version: z.literal(1),
+  provider: ExternalVaultProviderKind,
+  ownership: z.enum(["user", "workspace", "organization"]),
+  accountId: z.string().min(1).max(300).nullable(),
+  accountName: z.string().max(300).nullable(),
+  label: z.string().max(120).nullable(),
+  verifiedAt: z.string().datetime(),
+  operations: VaultProviderOperations,
+  verificationStatus: z.enum(["ready", "pending"]).optional()
+}).strict();
+function externalVaultProviderDomain(provider) {
+  return `vault:${provider}`;
+}
+function externalVaultConnectionDetails(metadata) {
+  if (metadata?.credentialRole !== EXTERNAL_VAULT_CREDENTIAL_ROLE) return null;
+  const result = ExternalVaultConnectionDetails.safeParse(metadata.vaultProvider);
+  return result.success ? result.data : null;
+}
+function isExternalVaultConnection(connection) {
+  const details = externalVaultConnectionDetails(connection.metadata);
+  return details !== null && connection.kind === "api_key" && connection.providerDomain === externalVaultProviderDomain(details.provider) && details.ownership === "user" === (connection.subjectId !== null);
+}
+var StoredVaultProviderCredentials = z.union([
+  VaultProviderCredentials.options[0],
+  VaultProviderCredentials.options[1],
+  VaultProviderCredentials.options[2],
+  z.object({
+    provider: z.literal("keeper"),
+    configuration: z.record(z.string().max(100), z.string().max(65536)).refine((value) => Object.keys(value).length <= 32)
+  }).strict()
+]);
+var PendingVaultCredentialEnvelope = z.object({
+  vaultCredentialEnvelope: z.literal(1),
+  current: StoredVaultProviderCredentials.nullable(),
+  pending: StoredVaultProviderCredentials
+}).strict();
+function pendingVaultCredentialBundle(current, pending) {
+  return { vaultCredentialEnvelope: 1, current, pending };
+}
+function externalVaultConnectionMetadata(details) {
+  return {
+    credentialRole: EXTERNAL_VAULT_CREDENTIAL_ROLE,
+    vaultProvider: ExternalVaultConnectionDetails.parse(details)
+  };
+}
+function unavailable() {
+  return new VaultProviderError(
+    "provider_auth_invalid",
+    "This vault connection was removed or is not available to you. Reconnect it in Vaults."
+  );
+}
+async function loadExternalVaultConnection(db, settings, input) {
+  let connection = await getConnectionMetadata(
+    db,
+    input.workspaceId,
+    input.connectionId,
+    input.subjectId
+  );
+  if (!connection) {
+    const home = await getProviderConnectionHomeWorkspace(
+      db,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId
+    );
+    if (home && home !== input.workspaceId)
+      connection = await getConnectionMetadata(db, home, input.connectionId, input.subjectId);
+  }
+  if (!connection || !isExternalVaultConnection(connection)) throw unavailable();
+  const details = externalVaultConnectionDetails(connection.metadata);
+  if (details.provider !== input.provider) throw unavailable();
+  if (connection.status !== "active" && !(input.allowPendingVerification && (connection.status === "needs_reauth" || connection.status === "error")))
+    throw new VaultProviderError(
+      "provider_auth_expired",
+      "This vault connection needs to be reconnected."
+    );
+  if (connection.subjectId !== null && connection.subjectId !== input.subjectId)
+    throw unavailable();
+  const loaded = await loadConnectionCredentialForBroker(db, settings, {
+    workspaceId: connection.workspaceId,
+    connectionId: connection.id,
+    providerDomain: externalVaultProviderDomain(input.provider),
+    kind: "api_key",
+    ...connection.subjectId !== null ? { allowSubjectOwned: true, subjectId: input.subjectId } : {}
+  });
+  if (!loaded || loaded.status !== connection.status || loaded.version !== connection.version || loaded.accountId !== connection.accountId || loaded.subjectId !== connection.subjectId || loaded.providerDomain !== connection.providerDomain || loaded.kind !== "api_key" || externalVaultConnectionDetails(loaded.metadata)?.provider !== input.provider)
+    throw unavailable();
+  const envelope = PendingVaultCredentialEnvelope.safeParse(loaded.credential);
+  const raw = envelope.success ? input.allowPendingVerification ? envelope.data.pending : envelope.data.current : loaded.credential;
+  const parsed = StoredVaultProviderCredentials.safeParse(raw);
+  if (!parsed.success || parsed.data.provider !== input.provider) throw unavailable();
+  if (envelope.success && (envelope.data.pending.provider !== input.provider || envelope.data.current !== null && envelope.data.current.provider !== input.provider))
+    throw unavailable();
+  return {
+    connection,
+    details,
+    credentials: parsed.data,
+    currentCredentials: envelope.success ? envelope.data.current : parsed.data,
+    pendingCredentials: envelope.success ? envelope.data.pending : null
+  };
+}
+function bindVaultProviderAuthority(provider, input) {
+  async function context(ctx) {
+    ctx.signal?.throwIfAborted();
+    await input.revalidate();
+    ctx.signal?.throwIfAborted();
+    return { ...ctx, connectionId: input.connectionId, authority: { ...input.authority } };
+  }
+  return {
+    id: provider.id,
+    capabilities: () => ({
+      ...provider.capabilities(),
+      operations: providerOperations(provider.capabilities(), { operations: input.operations })
+    }),
+    validate: async (ctx) => provider.validate(await context(ctx)),
+    listVaults: async (ctx) => provider.listVaults(await context(ctx)),
+    listItems: async (ctx, vaultId) => provider.listItems(await context(ctx), vaultId),
+    readFields: async (ctx, vaultId, itemId, fields) => provider.readFields(await context(ctx), vaultId, itemId, fields),
+    writeItem: async (ctx, vaultId, item) => provider.writeItem(await context(ctx), vaultId, item),
+    archiveItem: async (ctx, vaultId, itemId) => provider.archiveItem(await context(ctx), vaultId, itemId),
+    ...provider.listVaultPage ? { listVaultPage: async (ctx, page) => provider.listVaultPage(await context(ctx), page) } : {},
+    ...provider.listItemPage ? {
+      listItemPage: async (ctx, vaultId, page) => provider.listItemPage(await context(ctx), vaultId, page)
+    } : {},
+    ...provider.createVault ? { createVault: async (ctx, value) => provider.createVault(await context(ctx), value) } : {}
+  };
+}
+async function externalVaultProviderForConnection(input) {
+  const loaded = await loadExternalVaultConnection(input.db, input.settings, input);
+  let connection = loaded.connection;
+  const prepared = await input.factory({
+    credentials: loaded.credentials,
+    connectionId: connection.id,
+    signal: AbortSignal.timeout(3e4),
+    operations: loaded.details.operations,
+    persistCredentials: async (next) => {
+      const parsed = StoredVaultProviderCredentials.safeParse(next);
+      if (!parsed.success || parsed.data.provider !== loaded.details.provider) throw unavailable();
+      const credentials = parsed.data;
+      const key = environmentsEncryptionKeyBytes(input.settings);
+      if (!key)
+        throw new VaultProviderError(
+          "provider_unavailable",
+          "Vault credential encryption is unavailable."
+        );
+      const updated = await updateConnection(input.db, {
+        workspaceId: connection.workspaceId,
+        connectionId: connection.id,
+        visibleToSubjectId: input.subjectId,
+        expectedVersion: connection.version,
+        credentialEncrypted: encryptEnvironmentValue(
+          key,
+          JSON.stringify(
+            loaded.pendingCredentials ? pendingVaultCredentialBundle(credentials, loaded.pendingCredentials) : credentials
+          )
+        )
+      });
+      if (updated) {
+        connection = updated;
+        return;
+      }
+      const live = await loadExternalVaultConnection(input.db, input.settings, input);
+      if (isDeepStrictEqual(
+        rotationConnectionIdentity(live.connection),
+        rotationConnectionIdentity(connection)
+      ) && isDeepStrictEqual(live.currentCredentials, credentials) && isDeepStrictEqual(live.pendingCredentials, loaded.pendingCredentials)) {
+        connection = live.connection;
+        return;
+      }
+      throw new VaultProviderError(
+        "provider_conflict",
+        "This vault connection changed while its credentials were renewed."
+      );
+    }
+  });
+  if (prepared.provider.id !== input.provider) throw unavailable();
+  return bindVaultProviderAuthority(prepared.provider, {
+    connectionId: connection.id,
+    authority: {
+      accountId: connection.accountId,
+      workspaceId: input.workspaceId,
+      connectionWorkspaceId: connection.workspaceId,
+      subjectId: input.subjectId,
+      ...input.executionContext
+    },
+    operations: loaded.details.operations,
+    revalidate: async () => {
+      if (connection.workspaceId !== input.workspaceId) {
+        const home = await getProviderConnectionHomeWorkspace(
+          input.db,
+          input.workspaceId,
+          connection.id,
+          input.subjectId
+        );
+        if (home !== connection.workspaceId) throw unavailable();
+      }
+      const live = await getConnectionMetadata(
+        input.db,
+        connection.workspaceId,
+        connection.id,
+        input.subjectId
+      );
+      if (!live || !isExternalVaultConnection(live) || live.status !== "active" || live.accountId !== connection.accountId || live.subjectId !== connection.subjectId || live.providerDomain !== connection.providerDomain)
+        throw unavailable();
+      if (live.version !== connection.version)
+        throw new VaultProviderError(
+          "provider_conflict",
+          "This vault connection changed. Reload it before starting another operation."
+        );
+    }
+  });
+}
+function rotationConnectionIdentity(connection) {
+  const {
+    version: _version,
+    connectionAuthorityGeneration: _authorityGeneration,
+    updatedAt: _updatedAt,
+    updatedBySubjectId: _updatedBy,
+    lastUsedAt: _lastUsedAt,
+    lastRefreshAt: _lastRefreshAt,
+    ...identity
+  } = connection;
+  return identity;
+}
+
+// src/domain/vaults/provider-registry.ts
 function vaultErrorCodeForProvider(code, operation) {
   if (code === "provider_not_found") {
     return operation === "read" ? "vault_field_not_found" : "vault_not_found";
@@ -1143,19 +1401,19 @@ function onePasswordCredentialBundle(token) {
   return { token };
 }
 async function loadOnePasswordConnectionToken(db, settings, input) {
-  const unavailable = () => new VaultProviderError(
+  const unavailable2 = () => new VaultProviderError2(
     "provider_auth_invalid",
     "The 1Password connection for this vault was removed or is not available to you; reconnect 1Password"
   );
   let homeWorkspaceId = input.workspaceId;
-  let connection = await getConnectionMetadata(
+  let connection = await getConnectionMetadata2(
     db,
     input.workspaceId,
     input.connectionId,
     input.subjectId
   );
   if (!connection) {
-    const home = await getProviderConnectionHomeWorkspace(
+    const home = await getProviderConnectionHomeWorkspace2(
       db,
       input.workspaceId,
       input.connectionId,
@@ -1163,18 +1421,18 @@ async function loadOnePasswordConnectionToken(db, settings, input) {
     );
     if (home && home !== input.workspaceId) {
       homeWorkspaceId = home;
-      connection = await getConnectionMetadata(db, home, input.connectionId, input.subjectId);
+      connection = await getConnectionMetadata2(db, home, input.connectionId, input.subjectId);
     }
   }
-  if (!connection || !isOnePasswordConnection(connection)) throw unavailable();
+  if (!connection || !isOnePasswordConnection(connection)) throw unavailable2();
   if (connection.status !== "active") {
-    throw new VaultProviderError(
+    throw new VaultProviderError2(
       "provider_auth_expired",
       "The 1Password connection needs a new service account token"
     );
   }
   const personal = connection.subjectId !== null;
-  const credential = await loadConnectionCredentialForBroker(db, settings, {
+  const credential = await loadConnectionCredentialForBroker2(db, settings, {
     workspaceId: homeWorkspaceId,
     connectionId: connection.id,
     providerDomain: ONEPASSWORD_PROVIDER_DOMAIN,
@@ -1182,7 +1440,7 @@ async function loadOnePasswordConnectionToken(db, settings, input) {
     ...personal ? { allowSubjectOwned: true, subjectId: connection.subjectId } : {}
   });
   const token = credential?.credential?.token;
-  if (!credential || typeof token !== "string" || !token) throw unavailable();
+  if (!credential || typeof token !== "string" || !token) throw unavailable2();
   return { token, metadata: onePasswordConnectionMetadata(connection.metadata) };
 }
 function createWorkspaceVaultProviderRegistry(input) {
@@ -1192,7 +1450,7 @@ function createWorkspaceVaultProviderRegistry(input) {
     ...factory ? {
       async onepassword(connectionId) {
         if (!connectionId) {
-          throw new VaultProviderError(
+          throw new VaultProviderError2(
             "provider_unavailable",
             "This 1Password vault has no connection"
           );
@@ -1209,7 +1467,29 @@ function createWorkspaceVaultProviderRegistry(input) {
         });
       }
     } : {},
-    ...host ? { host: async () => host } : {}
+    ...host ? { host: async () => host } : {},
+    ...Object.fromEntries(
+      Object.entries(input.externalVaultProviders ?? {}).map(([provider, providerFactory]) => [
+        provider,
+        async (connectionId) => {
+          if (!connectionId || !providerFactory)
+            throw new VaultProviderError2(
+              "provider_unavailable",
+              "This vault has no available connection."
+            );
+          return externalVaultProviderForConnection({
+            db: input.db,
+            settings: input.settings,
+            workspaceId: input.workspaceId,
+            subjectId: input.subjectId,
+            connectionId,
+            provider,
+            factory: providerFactory,
+            ...input.executionContext ? { executionContext: input.executionContext } : {}
+          });
+        }
+      ])
+    )
   });
 }
 
@@ -1440,7 +1720,7 @@ async function prepareCapabilityEnable(input) {
             item,
             installationConfig
           );
-          if (!current || !isDeepStrictEqual(current, unchanged)) {
+          if (!current || !isDeepStrictEqual2(current, unchanged)) {
             throw new HTTPException5(409, {
               message: "Capability installation changed; reload before reconciling"
             });
@@ -1494,7 +1774,7 @@ async function validateVerifiedMcpConnection(input, item) {
   const ref = input.payload.connectionRef;
   if (!proof || !ref || item.endpointUrl !== proof.endpointUrl || ref.resource !== proof.endpointUrl)
     throw new HTTPException5(409, { message: "MCP verification no longer matches the connection" });
-  const connection = await getConnectionMetadata2(
+  const connection = await getConnectionMetadata3(
     input.db,
     input.workspaceId,
     proof.id,
@@ -1521,7 +1801,7 @@ async function unchangedMcpInstallation(input, item, requestedConfig) {
   const config = { ...requestedConfig, ...connectionRef ? { connectionRef } : {} };
   const { mcpConnectivity: _storedConnectivity, ...storedMetadata } = existing.metadata;
   const { mcpConnectivity: _requestedConnectivity, ...requestedMetadata } = input.payload.metadata;
-  if (!isDeepStrictEqual(config, storedConfig) || !isDeepStrictEqual(requestedMetadata, storedMetadata))
+  if (!isDeepStrictEqual2(config, storedConfig) || !isDeepStrictEqual2(requestedMetadata, storedMetadata))
     return null;
   const provided = normalizedMcpCredentialHeaders(input.payload.headers);
   if (provided) {
@@ -1529,7 +1809,7 @@ async function unchangedMcpInstallation(input, item, requestedConfig) {
       { ...input, payload: { ...input.payload, headers: {} } },
       item
     );
-    if (!isDeepStrictEqual(provided, stored2)) return null;
+    if (!isDeepStrictEqual2(provided, stored2)) return null;
   }
   return existing;
 }
@@ -1630,7 +1910,7 @@ async function validateMcpCapabilityConnectionRef(input, item, ref) {
     assertNativeMcpConnectionRef(normalized);
     return normalized;
   }
-  let connection = normalized.connectionId ? await getConnectionMetadata2(
+  let connection = normalized.connectionId ? await getConnectionMetadata3(
     input.db,
     input.workspaceId,
     normalized.connectionId,
@@ -1712,7 +1992,7 @@ function requiredCapabilityHeaders(metadata) {
   return value.filter((name) => typeof name === "string" && name.trim().length > 0).map((name) => name.trim());
 }
 function requireCapabilityHeaderEncryption(settings) {
-  const key = environmentsEncryptionKeyBytes(settings);
+  const key = environmentsEncryptionKeyBytes2(settings);
   if (!key) {
     throw new HTTPException5(503, {
       message: "MCP credential headers require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"
@@ -2001,7 +2281,7 @@ function settingsWithMcpCapabilityServers(settings, enabled) {
   if (enabled.length === 0) {
     return settings;
   }
-  const encryptionKey = environmentsEncryptionKeyBytes(settings);
+  const encryptionKey = environmentsEncryptionKeyBytes2(settings);
   const existingIds = new Set(settings.mcpServers.map((server) => server.id));
   const dynamicServers = enabled.filter((server) => !existingIds.has(server.id)).flatMap((server) => {
     const headers = decryptedCapabilityHeaders(server, encryptionKey);
@@ -3040,7 +3320,7 @@ import {
   getSessionTurnPersonalConnectionDelegations,
   getSessionTurnMcpAccountBindings,
   getSessionTurnConnectionAccountIntent,
-  getConnectionMetadata as getConnectionMetadata3,
+  getConnectionMetadata as getConnectionMetadata4,
   getSocialConnection,
   listConnectionsMetadata as listConnectionsMetadata2,
   listSocialConnections as listSocialConnections2,
@@ -3478,7 +3758,7 @@ async function listOwnConnectionMetadata(db, input) {
   );
   const connections = [];
   for (const account of accounts) {
-    const connection = await getConnectionMetadata3(
+    const connection = await getConnectionMetadata4(
       db,
       account.originWorkspaceId,
       account.connectionId,
@@ -3941,7 +4221,7 @@ async function visibleMcpAccountConnections(db, input) {
 async function visibleMcpAccountConnectionsByIds(db, input) {
   const workspace = [];
   for (const connectionId of new Set(input.workspaceConnectionIds)) {
-    const connection = await getConnectionMetadata3(db, input.workspaceId, connectionId, null);
+    const connection = await getConnectionMetadata4(db, input.workspaceId, connectionId, null);
     if (connection && connection.subjectId === null) workspace.push(connection);
   }
   const personalIds = new Set(input.personalConnectionIds);
@@ -4159,11 +4439,12 @@ import {
   listWorkspacesForSubject,
   findActiveApiKeyByHash,
   getWorkspaceGrant,
+  subjectHasLiveWorkspaceAuthorityInScope,
   requireWorkspace,
   resolveNamedManagedPersonalWorkspaceGrant
 } from "@opengeni/db";
 import { HTTPException as HTTPException8 } from "hono/http-exception";
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/access/service-initiator.ts
 import { ServiceTurnInitiatorContext } from "@opengeni/contracts";
@@ -4273,19 +4554,20 @@ function requireExplicitPermissionDelegation(grant, requested) {
   }
 }
 var canonicalLocalHumanContexts = /* @__PURE__ */ new WeakSet();
-var delegatedHumanAuthorizationSchema = z.object({
-  organizationId: z.string().uuid(),
-  subjectId: z.string().max(1024).regex(/^user:[^\s\u0000-\u001f\u007f]+$/),
-  permissions: z.array(Permission),
+var delegatedHumanAuthorizationSchema = z2.object({
+  organizationId: z2.string().uuid(),
+  subjectId: z2.string().max(1024).regex(/^user:[^\s\u0000-\u001f\u007f]+$/),
+  permissions: z2.array(Permission),
   workspaceScope: OrganizationWorkspaceScope
 });
 var delegatedHumanRequests = /* @__PURE__ */ new WeakMap();
 var delegatedHumanContexts = /* @__PURE__ */ new WeakMap();
-var delegatedHumanProfileSchema = z.object({
-  id: z.string(),
-  name: z.string().nullable(),
-  email: z.string(),
-  emailVerified: z.boolean().optional()
+var verifiedSiteViewerProofs = /* @__PURE__ */ new WeakSet();
+var delegatedHumanProfileSchema = z2.object({
+  id: z2.string(),
+  name: z2.string().nullable(),
+  email: z2.string(),
+  emailVerified: z2.boolean().optional()
 });
 var delegatedHumanProfiles = /* @__PURE__ */ new WeakMap();
 var verifiedDelegatedHumanAuthorizations = /* @__PURE__ */ new WeakMap();
@@ -4310,6 +4592,27 @@ function stampDelegatedHumanAuthorization(request, input) {
   Object.freeze(proof.permissions);
   delegatedHumanRequests.set(request, Object.freeze(proof));
 }
+function stampSiteViewerSessionAuthorization(request, input) {
+  if (input.subjectId.startsWith("user:")) {
+    stampDelegatedHumanAuthorization(request, {
+      ...input,
+      workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] }
+    });
+    return;
+  }
+  if (delegatedHumanRequests.has(request) || accessResolvedRequests.has(request))
+    throw new HTTPException8(403, { message: "request access authorization already resolved" });
+  const parsed = delegatedHumanAuthorizationSchema.extend({
+    subjectId: z2.string().max(1024).regex(/^external_user:[^\s\u0000-\u001f\u007f]+$/)
+  }).parse({ ...input, workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] } });
+  if (parsed.workspaceScope.kind !== "selected") throw new Error("Site workspace scope required");
+  Object.freeze(parsed.permissions);
+  Object.freeze(parsed.workspaceScope.workspaceIds);
+  Object.freeze(parsed.workspaceScope);
+  const proof = Object.freeze(parsed);
+  verifiedSiteViewerProofs.add(proof);
+  delegatedHumanRequests.set(request, proof);
+}
 var PERSONAL_API_KEY_TOKEN_PREFIX = "ogp_";
 async function stampPersonalApiKeyRequest(request, deps) {
   const authorization = request.headers.get("authorization");
@@ -4991,6 +5294,55 @@ async function resolveDelegatedHumanAccessContext(deps, proof) {
       message: "delegated humans require native organization access"
     });
   }
+  if (verifiedSiteViewerProofs.has(proof)) {
+    const workspaceId = proof.workspaceScope.kind === "selected" && proof.workspaceScope.workspaceIds.length === 1 ? proof.workspaceScope.workspaceIds[0] : null;
+    if (!workspaceId)
+      throw new HTTPException8(403, { message: "Site viewer workspace unavailable" });
+    const grant = await withWorkspaceSubjectRls(
+      deps.db,
+      workspaceId,
+      proof.subjectId,
+      async (tx) => {
+        if (!await subjectHasLiveWorkspaceAuthorityInScope(tx, {
+          accountId: proof.organizationId,
+          workspaceId,
+          subjectId: proof.subjectId
+        }))
+          return null;
+        return getWorkspaceGrant(tx, proof.subjectId, workspaceId, {
+          principalKind: "human_session"
+        });
+      }
+    );
+    if (!grant || grant.accountId !== proof.organizationId)
+      throw new HTTPException8(403, { message: "Site viewer membership unavailable" });
+    const bounded = Object.freeze({
+      ...grant,
+      permissionMode: "explicit",
+      permissions: Object.freeze(
+        explicitPermissions(
+          Permission.options.filter(
+            (permission) => hasPermission(grant.permissions, permission) && hasPermission(proof.permissions, permission, "explicit")
+          )
+        )
+      )
+    });
+    const accountGrant2 = Object.freeze({
+      accountId: proof.organizationId,
+      subjectId: proof.subjectId,
+      permissions: Object.freeze([])
+    });
+    const context2 = Object.freeze({
+      mode: "managed",
+      subjectId: proof.subjectId,
+      accountGrants: Object.freeze([accountGrant2]),
+      workspaceGrants: Object.freeze([bounded]),
+      defaultAccountId: proof.organizationId,
+      defaultWorkspaceId: workspaceId
+    });
+    delegatedHumanContexts.set(context2, proof);
+    return context2;
+  }
   const userId = proof.subjectId.slice("user:".length);
   const profiles = await getManagedUserProfilesByIds(deps.db, [userId]);
   const parsedProfile = delegatedHumanProfileSchema.safeParse(
@@ -5525,6 +5877,7 @@ async function fileOwnerContextForAgent(deps, grant, permission) {
     },
     subjectId: grant.subjectId,
     initiatingHumanSubjectId: attempt.initiatingHumanSubjectId,
+    agentRootSessionId: attempt.callerRootSessionId,
     privateFileOwnerSubjectId: snapshot.defaultScope === "personal" ? snapshot.subjectId : null
   };
 }
@@ -6494,7 +6847,7 @@ function sessionUsageLimitRefusalFromError(error) {
 }
 
 // src/sandbox/fleet.ts
-import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3 } from "@opengeni/config";
 import {
   agentCapabilityEnabled
 } from "@opengeni/contracts";
@@ -7026,6 +7379,7 @@ import {
   isValidTotpInput,
   parseTotpInput,
   referenceKey,
+  secretNameKey,
   SecretReferenceError,
   VAULT_LIMITS as VAULT_LIMITS2
 } from "@opengeni/contracts";
@@ -7049,14 +7403,42 @@ import {
 } from "@opengeni/contracts";
 import {
   getProviderVaultSyncTarget,
-  setVaultSyncStatus,
-  upsertProviderVaultItems
+  isVaultError,
+  setVaultSyncStatus
 } from "@opengeni/db";
 import {
   isVaultProviderError,
-  VaultProviderError as VaultProviderError2
+  providerOperations as providerOperations2,
+  readProviderItemInventory,
+  readProviderVaultInventory,
+  VaultProviderError as VaultProviderError3
 } from "@opengeni/vaults";
 var PROVIDER_RATE_LIMIT_DEFAULT_BACKOFF_MS = 15 * 6e4;
+function incompleteInventory() {
+  return new VaultProviderError3(
+    "provider_inventory_incomplete",
+    `This vault has more than ${VAULT_LIMITS.itemsPerVault} items, more than Opengeni mirrors. The previous inventory was kept.`
+  );
+}
+function oversizedItem() {
+  return new VaultProviderError3(
+    "provider_inventory_incomplete",
+    `An item in this vault has more than ${VAULT_LIMITS.fieldsPerItem} fields or ${VAULT_LIMITS.websitesPerItem} websites (or a website over ${VAULT_LIMITS.websiteMaxChars} characters), more than Opengeni mirrors. The previous inventory was kept.`
+  );
+}
+function unprovenInventory(listing) {
+  return new VaultProviderError3(
+    "provider_inventory_incomplete",
+    listing === "items" ? "The provider listed this vault in several pages without a snapshot, so Opengeni cannot tell which items were removed. The previous inventory was kept." : "The provider listed its vaults in several pages without a snapshot and this vault was not among them, so Opengeni cannot confirm it was removed."
+  );
+}
+function assertMirrorable(item) {
+  if (!Array.isArray(item.fields) || !Array.isArray(item.websites) || item.fields.length > VAULT_LIMITS.fieldsPerItem || item.websites.length > VAULT_LIMITS.websitesPerItem || item.websites.some(
+    (website) => typeof website !== "string" || website.length > VAULT_LIMITS.websiteMaxChars
+  )) {
+    throw oversizedItem();
+  }
+}
 var FORBIDDEN_NAME_CHARACTERS = /[/{}#\\\u0000-\u001f\u007f-\u009f]/g;
 function nameKey(name) {
   return name.normalize("NFC").trim().toLowerCase();
@@ -7103,15 +7485,16 @@ function providerPrimaryFieldId(item) {
   return candidates.find((field) => field.kind === "concealed")?.externalFieldId ?? null;
 }
 function planProviderMirror(items, contentVersion) {
+  if (items.length > VAULT_LIMITS.itemsPerVault) throw incompleteInventory();
+  for (const item of items) assertMirrorable(item);
   const ordered = [...items].sort(
     (a, b) => nameKey(a.name).localeCompare(nameKey(b.name)) || a.externalItemId.localeCompare(b.externalItemId)
   );
-  const kept = ordered.slice(0, VAULT_LIMITS.itemsPerVault);
   const takenItems = /* @__PURE__ */ new Set();
-  const mirrored = kept.map((item) => {
+  const mirrored = ordered.map((item) => {
     const name = uniqueProviderName(providerSecretName(item.name), takenItems);
     const takenFields = /* @__PURE__ */ new Set();
-    const fields = item.fields.slice(0, VAULT_LIMITS.fieldsPerItem).map((field, position) => {
+    const fields = item.fields.map((field, position) => {
       let fieldName = providerSecretName(
         field.name,
         field.kind === "totp" ? "one-time password" : "field"
@@ -7129,7 +7512,7 @@ function planProviderMirror(items, contentVersion) {
       name,
       providerName: item.name,
       type: item.type,
-      websites: item.websites.filter((website) => website.length <= VAULT_LIMITS.websiteMaxChars).slice(0, VAULT_LIMITS.websitesPerItem),
+      websites: [...item.websites],
       fields,
       primaryExternalFieldId: providerPrimaryFieldId({ type: item.type, fields: item.fields }),
       hasTotp: item.fields.some((field) => field.kind === "totp"),
@@ -7137,7 +7520,32 @@ function planProviderMirror(items, contentVersion) {
       updatedAt: item.updatedAt
     };
   });
-  return { contentVersion, items: mirrored, truncated: ordered.length - kept.length };
+  return { contentVersion, items: mirrored, truncated: 0 };
+}
+function validTime(value) {
+  if (typeof value !== "string" || value.length > 64) return null;
+  const time = Date.parse(value);
+  return Number.isFinite(time) ? time : null;
+}
+function aggregateProviderFreshness(observations, checkedAt) {
+  if (observations.length === 0) return null;
+  let cache = false;
+  let unknown = false;
+  let unknownTime = false;
+  let oldest = null;
+  for (const observation of observations) {
+    const source = observation?.source;
+    if (source === "cache") cache = true;
+    else if (source !== "live") unknown = true;
+    const time = validTime(observation?.sourceSyncedAt);
+    if (time !== null) oldest = oldest === null ? time : Math.min(oldest, time);
+    else if (source !== "live") unknownTime = true;
+  }
+  const syncedAt = unknownTime || oldest === null ? null : new Date(Math.min(oldest, checkedAt.getTime()));
+  return {
+    source: cache ? "cache" : unknown ? "unknown" : "live",
+    sourceSyncedAt: syncedAt ? syncedAt.toISOString() : null
+  };
 }
 function providerSyncFailure(error, now) {
   const code = isVaultProviderError(error) ? error.code : "provider_unavailable";
@@ -7160,24 +7568,59 @@ function providerSyncFailure(error, now) {
     lastSyncedAt: null
   };
 }
+async function providerStep(call) {
+  try {
+    return await call();
+  } catch (error) {
+    if (isVaultProviderError(error)) throw error;
+    throw new VaultProviderError3(
+      "provider_unavailable",
+      "the vault provider could not be reached or gave an invalid answer"
+    );
+  }
+}
 async function syncProviderVault(input) {
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
   const { target } = input;
-  if (target.rateLimitedUntil && target.rateLimitedUntil.getTime() > now().getTime() && !input.force) {
+  if (target.rateLimitedUntil && target.rateLimitedUntil.getTime() > now().getTime()) {
     return { status: "skipped_rate_limited", rateLimitedUntil: target.rateLimitedUntil };
   }
+  const observations = [];
+  const outer = input.ctx.onFreshness;
+  const ctx = {
+    ...input.ctx,
+    ...target.cacheEpoch !== void 0 && input.ctx.cacheEpoch === void 0 ? { cacheEpoch: target.cacheEpoch } : {},
+    ...input.force ? { forceRefresh: true } : {},
+    onFreshness(freshness) {
+      observations.push(freshness);
+      outer?.(freshness);
+    }
+  };
+  const succeeded = () => {
+    const checkedAt = now();
+    return {
+      syncStatus: "ok",
+      syncErrorCode: null,
+      syncErrorMessage: null,
+      rateLimitedUntil: null,
+      lastSyncedAt: checkedAt,
+      freshness: aggregateProviderFreshness(observations, checkedAt)
+    };
+  };
   try {
-    const vaults = await input.provider.listVaults(input.ctx);
-    const vault = vaults.find((candidate) => candidate.externalVaultId === target.externalVaultId);
+    const vaults = await providerStep(() => readProviderVaultInventory(input.provider, ctx));
+    const vault = vaults.items.find(
+      (candidate) => candidate.externalVaultId === target.externalVaultId
+    );
     if (!vault) {
       const failure = providerSyncFailure(
-        new VaultProviderError2(
+        vaults.consistent ? new VaultProviderError3(
           "provider_not_found",
           "the linked provider vault no longer exists or is no longer shared with this connection"
-        ),
+        ) : unprovenInventory("vaults"),
         now()
       );
-      await input.store.setSyncStatus(failure);
+      if (!await input.store.settleRefresh(failure)) return { status: "superseded" };
       return {
         status: "failed",
         syncStatus: failure.syncStatus,
@@ -7185,26 +7628,19 @@ async function syncProviderVault(input) {
         rateLimitedUntil: null
       };
     }
+    const operations = providerOperations2(input.provider.capabilities(), vault);
     if (!input.force && vault.contentVersion !== null && vault.contentVersion === target.mirroredContentVersion) {
-      await input.store.setSyncStatus({
-        syncStatus: "ok",
-        syncErrorCode: null,
-        syncErrorMessage: null,
-        rateLimitedUntil: null,
-        lastSyncedAt: now()
-      });
+      if (!await input.store.settleRefresh({ ...succeeded(), operations }))
+        return { status: "superseded" };
       return { status: "unchanged", contentVersion: vault.contentVersion };
     }
-    const items = await input.provider.listItems(input.ctx, target.externalVaultId);
-    const plan = planProviderMirror(items, vault.contentVersion);
-    await input.store.replaceMirror(plan);
-    await input.store.setSyncStatus({
-      syncStatus: "ok",
-      syncErrorCode: null,
-      syncErrorMessage: null,
-      rateLimitedUntil: null,
-      lastSyncedAt: now()
-    });
+    const inventory = await providerStep(
+      () => readProviderItemInventory(input.provider, ctx, target.externalVaultId)
+    );
+    if (!inventory.consistent) throw unprovenInventory("items");
+    const plan = planProviderMirror(inventory.items, vault.contentVersion);
+    if (!await input.store.settleRefresh({ ...succeeded(), operations }, plan))
+      return { status: "superseded" };
     return {
       status: "synced",
       contentVersion: plan.contentVersion,
@@ -7214,7 +7650,7 @@ async function syncProviderVault(input) {
   } catch (error) {
     if (!isVaultProviderError(error)) throw error;
     const failure = providerSyncFailure(error, now());
-    await input.store.setSyncStatus(failure);
+    if (!await input.store.settleRefresh(failure)) return { status: "superseded" };
     return {
       status: "failed",
       syncStatus: failure.syncStatus,
@@ -7223,11 +7659,10 @@ async function syncProviderVault(input) {
     };
   }
 }
-function databaseProviderMirrorStore(db, context, vaultId) {
+function databaseProviderMirrorStore(db, context, vaultId, expectedCacheEpoch) {
   return {
-    async replaceMirror(plan) {
-      await upsertProviderVaultItems(db, context, {
-        vaultId,
+    async settleRefresh(update, plan) {
+      const mirror = plan ? {
         contentVersion: plan.contentVersion,
         items: plan.items.map((item) => ({
           providerItemRef: item.externalItemId,
@@ -7245,22 +7680,41 @@ function databaseProviderMirrorStore(db, context, vaultId) {
             kind: field.kind
           }))
         }))
-      });
-    },
-    async setSyncStatus(update) {
-      await setVaultSyncStatus(db, context, {
-        vaultId,
-        status: update.syncStatus,
-        errorCode: update.syncErrorCode,
-        errorMessage: update.syncErrorMessage,
-        rateLimitedUntil: update.rateLimitedUntil?.toISOString() ?? null
-      });
+      } : void 0;
+      try {
+        await setVaultSyncStatus(db, context, {
+          vaultId,
+          expectedCacheEpoch,
+          ...mirror ? { mirror } : {},
+          status: update.syncStatus,
+          errorCode: update.syncErrorCode,
+          errorMessage: update.syncErrorMessage,
+          rateLimitedUntil: update.rateLimitedUntil?.toISOString() ?? null,
+          ...update.operations !== void 0 ? { operations: update.operations } : {},
+          ...update.freshness !== void 0 ? { freshness: update.freshness } : {}
+        });
+        return true;
+      } catch (error) {
+        if (isVaultError(error) && error.code === "provider_conflict" && error.details?.superseded === true)
+          return false;
+        throw error;
+      }
     }
   };
 }
 async function syncLinkedProviderVault(input) {
   const target = await getProviderVaultSyncTarget(input.db, input.context, input.vaultId);
-  const store = databaseProviderMirrorStore(input.db, input.context, input.vaultId);
+  const store = databaseProviderMirrorStore(
+    input.db,
+    input.context,
+    input.vaultId,
+    target.providerCacheEpoch ?? "0"
+  );
+  const now = input.now ?? (() => /* @__PURE__ */ new Date());
+  const rateLimitedUntil = target.rateLimitedUntil ? new Date(target.rateLimitedUntil) : null;
+  if (rateLimitedUntil && rateLimitedUntil.getTime() > now().getTime()) {
+    return { status: "skipped_rate_limited", rateLimitedUntil };
+  }
   let provider;
   try {
     provider = await input.providers.forVault({
@@ -7269,8 +7723,8 @@ async function syncLinkedProviderVault(input) {
     });
   } catch (error) {
     if (!isVaultProviderError(error)) throw error;
-    const failure = providerSyncFailure(error, (input.now ?? (() => /* @__PURE__ */ new Date()))());
-    await store.setSyncStatus(failure);
+    const failure = providerSyncFailure(error, now());
+    if (!await store.settleRefresh(failure)) return { status: "superseded" };
     return {
       status: "failed",
       syncStatus: failure.syncStatus,
@@ -7283,12 +7737,16 @@ async function syncLinkedProviderVault(input) {
     ctx: {
       connectionId: target.providerConnectionId,
       budget: input.budget ?? { take() {
-      } }
+      } },
+      cacheEpoch: target.providerCacheEpoch ?? null,
+      ...input.signal ? { signal: input.signal } : {},
+      ...input.onFreshness ? { onFreshness: input.onFreshness } : {}
     },
     target: {
       externalVaultId: target.providerVaultRef,
       mirroredContentVersion: target.providerContentVersion,
-      rateLimitedUntil: target.rateLimitedUntil ? new Date(target.rateLimitedUntil) : null
+      rateLimitedUntil,
+      cacheEpoch: target.providerCacheEpoch ?? null
     },
     store,
     ...input.now ? { now: input.now } : {},
@@ -7299,6 +7757,7 @@ var LINKED_VAULT_SEARCH_MAX_AGE_MS = 10 * 6e4;
 var LINKED_VAULT_MISS_MAX_AGE_MS = 2 * 6e4;
 var LINKED_VAULT_REFRESH_WAIT_MS = 8e3;
 var LINKED_VAULT_OPEN_WAIT_MS = 3e3;
+var LINKED_VAULT_REFRESH_TIMEOUT_MS = 6e4;
 function linkedVaultNeedsRefresh(vault, maxAgeMs, now) {
   if (vault.source === "opengeni") return false;
   if (vault.rateLimitedUntil && new Date(vault.rateLimitedUntil).getTime() > now.getTime()) {
@@ -7308,38 +7767,124 @@ function linkedVaultNeedsRefresh(vault, maxAgeMs, now) {
   if (!last) return true;
   return now.getTime() - new Date(last).getTime() >= maxAgeMs;
 }
+function isoOrNull(value) {
+  const time = validTime(value);
+  return time === null ? null : new Date(time).toISOString();
+}
+function providerVaultFreshness(vault, now, options = {}) {
+  if (vault.source === "opengeni") return void 0;
+  const stored2 = vault.providerFreshness ?? null;
+  const failed = vault.syncStatus !== "ok" && vault.syncStatus !== "syncing";
+  const base = {
+    lastCheckedAt: isoOrNull(vault.lastSyncedAt),
+    sourceSyncedAt: isoOrNull(stored2?.sourceSyncedAt),
+    source: stored2?.source === "live" || stored2?.source === "cache" ? stored2.source : "unknown",
+    errorCode: failed && vault.syncErrorCode ? vault.syncErrorCode.slice(0, 100) : null,
+    retryAt: null
+  };
+  if (options.refreshing || vault.syncStatus === "syncing") return { state: "refreshing", ...base };
+  if (vault.syncStatus === "rate_limited") {
+    const retryAt = isoOrNull(vault.rateLimitedUntil);
+    if (retryAt !== null && Date.parse(retryAt) > now.getTime()) {
+      return { state: "unavailable", ...base, retryAt };
+    }
+    return { state: "stale", ...base };
+  }
+  if (failed) return { state: "unavailable", ...base };
+  const checked = base.lastCheckedAt === null ? null : Date.parse(base.lastCheckedAt);
+  const maxAgeMs = options.maxAgeMs ?? LINKED_VAULT_SEARCH_MAX_AGE_MS;
+  if (checked === null || now.getTime() - checked >= maxAgeMs) return { state: "stale", ...base };
+  return { state: "current", ...base };
+}
+function vaultRefreshScopeKey(context) {
+  if (context.kind === "subject") {
+    return `${context.accountId}|${context.workspaceId}|subject|${context.subjectId}`;
+  }
+  const principal = context.principal;
+  switch (principal.kind) {
+    case "attempt":
+      return `${principal.accountId}|${principal.workspaceId}|attempt|${principal.attemptId}|${principal.executionGeneration}`;
+    case "site_viewer":
+      return `${principal.accountId}|${principal.workspaceId}|site|${principal.siteId}|${principal.siteVersion}|${principal.subjectId}`;
+    case "human":
+      return `${principal.accountId}|${principal.workspaceId}|human|${principal.subjectId}|${principal.viaApiKey ? "key" : principal.verifiedHuman ? "verified" : "unverified"}`;
+  }
+}
 var linkedVaultRefreshes = /* @__PURE__ */ new Map();
-async function refreshStaleLinkedVaults(input) {
+async function refreshLinkedVaults(input) {
   const now = (input.now ?? (() => /* @__PURE__ */ new Date()))();
-  const stale = input.vaults.filter((vault) => linkedVaultNeedsRefresh(vault, input.maxAgeMs, now));
-  if (stale.length === 0) return [];
+  const maxAgeMs = input.maxAgeMs ?? LINKED_VAULT_SEARCH_MAX_AGE_MS;
+  const scope = vaultRefreshScopeKey(input.context);
+  const outcomes = /* @__PURE__ */ new Map();
   const changed = [];
-  const runs = stale.map((vault) => {
-    let run = linkedVaultRefreshes.get(vault.id);
+  const runs = [];
+  for (const vault of input.vaults) {
+    if (outcomes.has(vault.id)) continue;
+    const limited = vault.rateLimitedUntil !== null && new Date(vault.rateLimitedUntil).getTime() > now.getTime();
+    const due = vault.source !== "opengeni" && !limited && (input.force || linkedVaultNeedsRefresh(vault, maxAgeMs, now));
+    const outcome = {
+      vaultId: vault.id,
+      state: due ? "pending" : "not_due",
+      result: null
+    };
+    outcomes.set(vault.id, outcome);
+    if (!due) continue;
+    const key = `${scope}|${vault.id}|${input.force ? "force" : "stale"}`;
+    let run = linkedVaultRefreshes.get(key);
     if (!run) {
-      run = syncLinkedProviderVault({
-        db: input.db,
-        context: input.context,
-        vaultId: vault.id,
-        providers: input.providers,
-        ...input.now ? { now: input.now } : {}
-      }).catch(() => null).finally(() => linkedVaultRefreshes.delete(vault.id));
-      linkedVaultRefreshes.set(vault.id, run);
+      let timer;
+      run = Promise.race([
+        syncLinkedProviderVault({
+          db: input.db,
+          context: input.context,
+          vaultId: vault.id,
+          providers: input.providers,
+          signal: AbortSignal.timeout(LINKED_VAULT_REFRESH_TIMEOUT_MS),
+          ...input.force ? { force: true } : {},
+          ...input.now ? { now: input.now } : {}
+        }),
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(null), LINKED_VAULT_REFRESH_TIMEOUT_MS);
+          timer.unref?.();
+        })
+      ]).catch(() => {
+        outcome.state = "failed";
+        return null;
+      }).finally(() => {
+        if (timer) clearTimeout(timer);
+        linkedVaultRefreshes.delete(key);
+      });
+      linkedVaultRefreshes.set(key, run);
     }
-    return run.then((result) => {
-      if (result?.status === "synced") changed.push(vault.id);
-    });
-  });
-  let timer;
-  await Promise.race([
-    Promise.all(runs),
-    new Promise((resolve) => {
-      timer = setTimeout(resolve, input.waitMs ?? LINKED_VAULT_REFRESH_WAIT_MS);
-      timer.unref?.();
-    })
-  ]);
-  if (timer) clearTimeout(timer);
-  return [...changed];
+    runs.push(
+      run.then((result) => {
+        if (outcome.state === "pending") outcome.state = result ? "done" : "failed";
+        outcome.result = result;
+        if (result?.status === "synced") changed.push(vault.id);
+      })
+    );
+  }
+  if (runs.length > 0) {
+    let timer;
+    await Promise.race([
+      Promise.all(runs),
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, input.waitMs ?? LINKED_VAULT_REFRESH_WAIT_MS);
+        timer.unref?.();
+      })
+    ]);
+    if (timer) clearTimeout(timer);
+  }
+  const list = [...outcomes.values()].map((outcome) => ({ ...outcome }));
+  return {
+    outcomes: list,
+    changed: [...changed],
+    pending: list.filter((outcome) => outcome.state === "pending").map((outcome) => outcome.vaultId)
+  };
+}
+async function refreshStaleLinkedVaults(input) {
+  const report = await refreshLinkedVaults(input);
+  return report.changed;
 }
 
 // src/domain/vaults/secret-resolver.ts
@@ -7473,6 +8018,51 @@ function providerFailureCode(code) {
   if (code === "provider_permission_denied") return "denied";
   return "provider_unavailable";
 }
+function relevantProviderVaults(reference, candidates, reachable) {
+  const connected = reachable.filter((vault) => vault.source !== "opengeni");
+  if (connected.length === 0) return [];
+  const where = possibleProviderVaults(reference, reachable, connected);
+  const live = candidates.filter((candidate) => !candidate.archived);
+  if (live.length === 0) return where;
+  const deciding = Math.min(...live.map((candidate) => candidate.tier));
+  const lacking = new Set(
+    live.filter(
+      (candidate) => candidate.tier <= deciding && candidate.source !== "opengeni" && (candidate.missing === "field" || candidate.missing === "totp_field")
+    ).map((candidate) => candidate.vaultId)
+  );
+  const matched = new Set(live.map((candidate) => candidate.vaultId));
+  const unmatched = new Set(
+    where.filter((vault) => vault.tier <= deciding && !matched.has(vault.id)).map((vault) => vault.id)
+  );
+  return connected.filter((vault) => lacking.has(vault.id) || unmatched.has(vault.id));
+}
+function possibleProviderVaults(reference, reachable, connected) {
+  if (reference.target.form !== "path") return [];
+  const segments = reference.target.segments;
+  if (segments.length === 1) return [...connected];
+  const nameKey2 = secretNameKey(segments[0]);
+  const named = reachable.filter((vault) => secretNameKey(vault.name) === nameKey2);
+  if (segments.length === 2 && named.length === 0) return [...connected];
+  return named.filter((vault) => vault.source !== "opengeni");
+}
+function uncheckedSourceFailure(reference, unchecked) {
+  const authExpired = unchecked.filter(({ vault }) => vault.syncStatus === "auth_expired");
+  const rateLimited = unchecked.filter(
+    ({ freshness }) => freshness.state === "unavailable" && freshness.retryAt !== null
+  );
+  const [code, named, why] = authExpired.length > 0 ? ["provider_auth_expired", authExpired, "needs to be reconnected"] : rateLimited.length > 0 ? ["provider_rate_limited", rateLimited, "is rate limited by its provider"] : [
+    "provider_unavailable",
+    unchecked,
+    unchecked.every(({ freshness }) => freshness.state === "refreshing") ? "is still refreshing" : "could not be checked"
+  ];
+  const names = named.slice(0, 3).map(({ vault }) => vault.name).join(", ");
+  const retryAt = rateLimited.map(({ freshness }) => freshness.retryAt).sort().at(0);
+  return {
+    raw: reference.raw,
+    code,
+    message: `not found in the vaults that could be checked, but ${names} ${why}, so it may be there` + (code === "provider_rate_limited" && retryAt ? `; try again after ${retryAt}` : "; try again later")
+  };
+}
 function decodeBase64(value) {
   return new Uint8Array(Buffer.from(value, "base64"));
 }
@@ -7535,35 +8125,74 @@ function createSecretResolver(deps, principal, opts) {
       const { meta: meta2, candidates } = await resolveSecretReferenceCandidates(deps.db, context, {
         refs: references.map((reference, index) => lookupFor(reference, index))
       });
-      const failures2 = [];
-      const chosen2 = [];
-      references.forEach((reference, index) => {
-        const outcome = chooseSecretCandidate(
-          reference,
-          candidates.filter((candidate) => candidate.refIndex === index),
-          meta2
-        );
-        if ("failure" in outcome) failures2.push(outcome.failure);
-        else chosen2.push({ reference, candidate: outcome.candidate });
+      const outcomes2 = references.map((reference, index) => {
+        const own = candidates.filter((candidate) => candidate.refIndex === index);
+        return { reference, candidates: own, outcome: chooseSecretCandidate(reference, own, meta2) };
       });
-      return { meta: meta2, failures: failures2, chosen: chosen2 };
+      return { meta: meta2, outcomes: outcomes2 };
     };
-    let { meta, failures, chosen } = await choose();
-    if (failures.some((failure) => failure.code === "not_found")) {
-      const registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId);
-      if (registry) {
-        const reachable = await listVaultsForSubject(deps.db, context, {
-          workspaceId: principal.workspaceId
-        });
-        const changed = await refreshStaleLinkedVaults({
+    let { meta, outcomes } = await choose();
+    let registry;
+    const providers = () => {
+      if (registry === void 0) {
+        registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId) ?? null;
+      }
+      return registry;
+    };
+    const misses = () => outcomes.filter(
+      (entry) => "failure" in entry.outcome && entry.outcome.failure.code === "not_found"
+    );
+    let reachable = null;
+    let refreshing = /* @__PURE__ */ new Set();
+    if (misses().length > 0) {
+      reachable = await listVaultsForSubject(deps.db, context, {
+        workspaceId: principal.workspaceId
+      });
+      const relevant = /* @__PURE__ */ new Map();
+      for (const entry of misses()) {
+        for (const vault of relevantProviderVaults(entry.reference, entry.candidates, reachable)) {
+          relevant.set(vault.id, vault);
+        }
+      }
+      const refreshProviders = relevant.size > 0 ? providers() : null;
+      if (refreshProviders) {
+        const report = await refreshLinkedVaults({
           db: deps.db,
           context,
-          vaults: reachable,
-          providers: registry,
+          vaults: [...relevant.values()],
+          providers: refreshProviders,
           maxAgeMs: LINKED_VAULT_MISS_MAX_AGE_MS
         });
-        if (changed.length > 0) ({ meta, failures, chosen } = await choose());
+        refreshing = new Set(report.pending);
+        if (report.changed.length > 0 || report.outcomes.some((outcome) => outcome.result?.status === "superseded"))
+          ({ meta, outcomes } = await choose());
+        if (report.outcomes.some((outcome) => outcome.state === "done" || outcome.state === "failed")) {
+          reachable = await listVaultsForSubject(deps.db, context, {
+            workspaceId: principal.workspaceId
+          });
+        }
+      }
+    }
+    const failures = [];
+    const chosen = [];
+    const checkedAt = /* @__PURE__ */ new Date();
+    for (const entry of outcomes) {
+      if ("candidate" in entry.outcome) {
+        chosen.push({ reference: entry.reference, candidate: entry.outcome.candidate });
+        continue;
+      }
+      let failure = entry.outcome.failure;
+      if (failure.code === "not_found" && reachable) {
+        const unchecked = relevantProviderVaults(entry.reference, entry.candidates, reachable).map((vault) => ({
+          vault,
+          freshness: providerVaultFreshness(vault, checkedAt, {
+            maxAgeMs: LINKED_VAULT_MISS_MAX_AGE_MS,
+            refreshing: refreshing.has(vault.id)
+          })
+        })).filter(({ freshness }) => freshness.state !== "current");
+        if (unchecked.length > 0) failure = uncheckedSourceFailure(entry.reference, unchecked);
       }
+      failures.push(failure);
     }
     const hasActingHuman = meta.humanExpected && meta.humanValid;
     if (failures.length > 0) {
@@ -7582,13 +8211,16 @@ function createSecretResolver(deps, principal, opts) {
     for (const group of providerGroups.values()) {
       const first = group[0].candidate;
       try {
-        const registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId) ?? EMPTY_VAULT_PROVIDER_REGISTRY;
-        const provider = await registry.forVault({
+        const provider = await (providers() ?? EMPTY_VAULT_PROVIDER_REGISTRY).forVault({
           source: first.source,
           providerConnectionId: first.providerConnectionId
         });
         const values = await provider.readFields(
-          { connectionId: first.providerConnectionId, budget },
+          {
+            connectionId: first.providerConnectionId,
+            budget,
+            cacheEpoch: first.providerCacheEpoch ?? null
+          },
           first.providerVaultRef ?? "",
           first.providerItemRef ?? "",
           [...new Set(group.map((entry) => entry.candidate.providerFieldRef ?? ""))]
@@ -7602,7 +8234,7 @@ function createSecretResolver(deps, principal, opts) {
           failures.push({
             raw: entry.reference.raw,
             code,
-            message: code === "provider_rate_limited" ? "the connected vault is rate limited; try again later" : code === "provider_auth_expired" ? "the connected vault needs to be reconnected" : "the connected vault is unavailable"
+            message: code === "provider_rate_limited" ? "the connected vault is rate limited; try again later" : code === "provider_auth_expired" ? "the connected vault needs to be reconnected" : code === "not_found" ? "the connected vault no longer has this item" : "the connected vault is unavailable"
           });
         }
       }
@@ -8416,7 +9048,7 @@ async function swapActiveSandbox(services, ctx, target, workingDir) {
 async function createRunOnSecretResolver(services, attempt, providersForSubject) {
   const session = await getSession3(services.db, attempt.workspaceId, attempt.sessionId);
   return createSecretResolver(
-    { db: services.db, encryptionKey: environmentsEncryptionKeyBytes2(services.settings) ?? null },
+    { db: services.db, encryptionKey: environmentsEncryptionKeyBytes3(services.settings) ?? null },
     { kind: "attempt", ...attempt },
     {
       capabilityEnabled: session?.agent ? agentCapabilityEnabled(session.agent.capabilities, "secrets") : true,
@@ -8439,7 +9071,8 @@ function runOnOperationAdmission(services, enrollment) {
     operationResourcePolicy: enrollment.operationPolicy,
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
-    transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true
+    transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true
   };
 }
 function hasSecretFileReference(carry) {
@@ -10603,10 +11236,10 @@ async function validateSubmittedTimelineAnnotations(db, workspaceId, sessionId,
 }
 
 // src/domain/encryption-key.ts
-import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3 } from "@opengeni/config";
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes4 } from "@opengeni/config";
 import { HTTPException as HTTPException19 } from "hono/http-exception";
 function requireEnvironmentEncryption(settings) {
-  const key = environmentsEncryptionKeyBytes3(settings);
+  const key = environmentsEncryptionKeyBytes4(settings);
   if (!key) {
     throw new HTTPException19(503, {
       message: "secrets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"
@@ -10630,7 +11263,7 @@ import {
   areOpenGeniSlackBotScopesAccepted
 } from "@opengeni/contracts";
 import {
-  getConnectionMetadata as getConnectionMetadata4,
+  getConnectionMetadata as getConnectionMetadata5,
   availableSlackBotConnectionMetadata,
   requireWorkspace as requireWorkspace4
 } from "@opengeni/db";
@@ -10651,7 +11284,7 @@ function hasReservedOpenGeniSlackBotSessionMetadata(metadata) {
   );
 }
 async function requireOpenGeniSlackBotConnection(db, workspaceId, connectionId) {
-  const local = await getConnectionMetadata4(db, workspaceId, connectionId, null);
+  const local = await getConnectionMetadata5(db, workspaceId, connectionId, null);
   const workspace = await requireWorkspace4(db, workspaceId);
   const connection = local ?? (await availableSlackBotConnectionMetadata(db, { accountId: workspace.accountId, workspaceId })).find((candidate) => candidate.id === connectionId) ?? null;
   if (!connection || !isOpenGeniSlackBotConnection(connection)) {
@@ -12621,9 +13254,9 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   const payload = CreateSessionRequest.parse(rawPayload);
   await assertSiteAgentMayChooseCompute(unresolvedDeps.db, grant, payload);
   if (payload.firstPartyMcpTools) {
-    const unavailable = deploymentUnavailableFirstPartyMcpTools(unresolvedDeps.settings);
+    const unavailable2 = deploymentUnavailableFirstPartyMcpTools(unresolvedDeps.settings);
     payload.firstPartyMcpTools = payload.firstPartyMcpTools.filter(
-      (tool) => !unavailable.has(tool)
+      (tool) => !unavailable2.has(tool)
     );
   }
   const surface = resolveTurnSurface({
@@ -15710,7 +16343,10 @@ function createRealtimeVoiceBilling(deps) {
         };
       }
       const attribution = input.callerSubjectId === facts.ownerSubjectId ? input.attribution : { kind: "unknown" };
-      const cost = realtimeVoiceMinuteCreditMicros(voice.pricing);
+      const cost = realtimeVoiceMinuteCreditMicros(
+        voice.pricing,
+        deps.settings.creditMarginBpsOverride
+      );
       const minutes = facts.connections.flatMap(
         (connection) => Array.from(
           { length: realtimeVoiceStartedMinutes(connection.startedAt, connection.observedUntil) },
@@ -15898,7 +16534,11 @@ function createVoiceInputBilling(deps) {
         usage: input.usage,
         trustedDurationSeconds: input.billing.trustedDurationSeconds
       });
-      const cost = calculateVoiceInputCost(input.pricing, usage);
+      const cost = calculateVoiceInputCost(
+        input.pricing,
+        usage,
+        deps.settings.creditMarginBpsOverride
+      );
       return await settleVoiceInputUsage(deps.db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -16106,22 +16746,137 @@ function createWebSearchBilling(deps) {
   };
 }
 
-// src/workflow-wake-contract.ts
-var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
-var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
-var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID = "opengeni-session-workflow-wake-dispatcher";
-var SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL = "dispatchRequested";
-var SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 1e4;
-var TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;
-
-// src/user-presence.ts
-import { recordUserActivityPresence } from "@opengeni/db";
-var USER_PRESENCE_THROTTLE_MS = 6e4;
-var USER_PRESENCE_FLUSH_DELAY_MS = 5e3;
-var USER_PRESENCE_MAX_TRACKED = 5e4;
-var USER_PRESENCE_SUBJECT = /^user:[A-Za-z0-9_-]{8,128}$/;
-var PRESENCE_FLUSH_METRIC = {
-  name: "opengeni_user_presence_flushes_total",
+// src/domain/vaults/remote-provider-runtime.ts
+import {
+  DestinationPolicyError,
+  ResponseBodyLimitError,
+  isLocalTestEnvironment,
+  pinnedFetch as pinnedFetch2,
+  readResponseTextBounded,
+  validateHttpUrl
+} from "@opengeni/network";
+import {
+  RemoteVaultTransportError,
+  VaultProviderError as VaultProviderError4,
+  createRemoteVaultProvider
+} from "@opengeni/vaults";
+function createPinnedRemoteVaultTransport(settings, fetchImpl = pinnedFetch2) {
+  return {
+    async post(request) {
+      if (request.signal?.aborted) throw new RemoteVaultTransportError("aborted", false);
+      const controller = new AbortController();
+      let timedOut = false;
+      const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+      }, request.timeoutMs);
+      const onAbort = () => controller.abort();
+      request.signal?.addEventListener("abort", onAbort, { once: true });
+      let rejectAborted;
+      try {
+        const aborted = new Promise((_resolve, reject) => {
+          rejectAborted = () => reject(new RemoteVaultTransportError(timedOut ? "timeout" : "aborted", true));
+          controller.signal.addEventListener("abort", rejectAborted, { once: true });
+          if (controller.signal.aborted) rejectAborted();
+        });
+        const exchange = async () => {
+          const response = await fetchImpl(
+            request.url,
+            {
+              method: "POST",
+              headers: { ...request.headers },
+              body: request.body,
+              redirect: "manual",
+              signal: controller.signal
+            },
+            settings,
+            { label: "Vault provider", requireHttpsOutsideLocalTest: true }
+          );
+          if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => void 0);
+            throw new RemoteVaultTransportError("redirect", true);
+          }
+          return {
+            status: response.status,
+            headers: response.headers,
+            body: await readResponseTextBounded(
+              response,
+              request.maxResponseBytes,
+              "Vault provider",
+              { signal: controller.signal }
+            )
+          };
+        };
+        return await Promise.race([exchange(), aborted]);
+      } catch (error) {
+        if (error instanceof RemoteVaultTransportError) throw error;
+        if (error instanceof DestinationPolicyError)
+          throw new RemoteVaultTransportError("refused", false);
+        if (error instanceof ResponseBodyLimitError)
+          throw new RemoteVaultTransportError("too_large", true);
+        throw new RemoteVaultTransportError(
+          timedOut ? "timeout" : controller.signal.aborted ? "aborted" : "network",
+          true
+        );
+      } finally {
+        clearTimeout(timer);
+        request.signal?.removeEventListener("abort", onAbort);
+        if (rejectAborted) controller.signal.removeEventListener("abort", rejectAborted);
+      }
+    }
+  };
+}
+function createRemoteExternalVaultFactories(settings) {
+  const transport = createPinnedRemoteVaultTransport(settings);
+  const factory = async ({
+    credentials,
+    operations
+  }) => {
+    if (credentials.provider !== "external" && credentials.provider !== "bitwarden")
+      throw new VaultProviderError4("provider_auth_invalid", "Vault provider does not match.");
+    let endpoint2;
+    try {
+      endpoint2 = validateHttpUrl(credentials.endpoint, {
+        allowLoopbackHttp: isLocalTestEnvironment(settings.environment),
+        label: "Vault provider"
+      });
+    } catch {
+      throw new VaultProviderError4(
+        "provider_auth_invalid",
+        "Use an HTTPS vault endpoint without URL credentials or a fragment."
+      );
+    }
+    return {
+      credentials: { ...credentials, endpoint: endpoint2 },
+      provider: createRemoteVaultProvider({
+        provider: credentials.provider,
+        endpoint: endpoint2,
+        signingSecret: credentials.signingSecret,
+        transport,
+        allowInsecureHttp: isLocalTestEnvironment(settings.environment),
+        ...operations ? { operations } : {}
+      })
+    };
+  };
+  return { external: factory, bitwarden: factory };
+}
+
+// src/workflow-wake-contract.ts
+var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
+var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
+var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID = "opengeni-session-workflow-wake-dispatcher";
+var SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL = "dispatchRequested";
+var SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 1e4;
+var TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;
+
+// src/user-presence.ts
+import { recordUserActivityPresence } from "@opengeni/db";
+var USER_PRESENCE_THROTTLE_MS = 6e4;
+var USER_PRESENCE_FLUSH_DELAY_MS = 5e3;
+var USER_PRESENCE_MAX_TRACKED = 5e4;
+var USER_PRESENCE_SUBJECT = /^user:[A-Za-z0-9_-]{8,128}$/;
+var PRESENCE_FLUSH_METRIC = {
+  name: "opengeni_user_presence_flushes_total",
   help: "Batched user presence writes from this API process by outcome."
 };
 function createUserPresenceRecorder(options) {
@@ -16916,7 +17671,7 @@ import { RotateSessionMcpCredentialsRequest } from "@opengeni/contracts";
 import {
   encryptVariableSetValue as encryptVariableSetValue3,
   getWorkspaceGrant as getWorkspaceGrant3,
-  subjectHasLiveWorkspaceAuthorityInScope
+  subjectHasLiveWorkspaceAuthorityInScope as subjectHasLiveWorkspaceAuthorityInScope2
 } from "@opengeni/db";
 import {
   rotateSessionMcpCredentialsAtomically,
@@ -17061,7 +17816,7 @@ async function rotateSessionMcpCredentialsForRequest(deps, authorization, sessio
           } else if (!hasVerifiedOwningUserAuthorization(authorization)) {
             throw new HTTPException24(403, { message: "credential rotation authority changed" });
           }
-          if (!await subjectHasLiveWorkspaceAuthorityInScope(tx, scope)) {
+          if (!await subjectHasLiveWorkspaceAuthorityInScope2(tx, scope)) {
             throw new HTTPException24(403, { message: "credential rotation authority changed" });
           }
         }
@@ -17182,7 +17937,7 @@ async function executeConnectOperation(input) {
 
 // src/application/prepared-mcp-connection.ts
 import { createHash as createHash3 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 import {
   CapabilityCatalogItem as CapabilityCatalogItem2,
   McpServerConnectionRef,
@@ -17266,7 +18021,7 @@ async function prepareMcpConnectionActivation(input) {
       const installation = await prepared.commit(db);
       const savedRef = McpServerConnectionRef.safeParse(installation.config.connectionRef);
       const retainedExactPin = savedRef.success && savedRef.data.authoritySource !== "host" && savedRef.data.connectionId === connection.id && savedRef.data.providerDomain === connectionRef.providerDomain && (savedRef.data.subjectScope ?? "workspace") === connectionRef.subjectScope && (savedRef.data.kind ?? connection.kind) === connection.kind && (!savedRef.data.resource || savedRef.data.resource === endpoint2);
-      if (installation.status !== "active" || !retainedExactPin && !isDeepStrictEqual2(installation.config.connectionRef, connectionRef)) {
+      if (installation.status !== "active" || !retainedExactPin && !isDeepStrictEqual3(installation.config.connectionRef, connectionRef)) {
         throw new HTTPException26(409, {
           message: "MCP account selection changed; review the existing connection before setup"
         });
@@ -17977,7 +18732,7 @@ function sha256Hex2(bytes) {
 }
 
 // src/domain/skill-search.ts
-import { pinnedFetch as pinnedFetch2, readResponseJsonBounded } from "@opengeni/network";
+import { pinnedFetch as pinnedFetch3, readResponseJsonBounded } from "@opengeni/network";
 var PublicSkillSearchError = class extends Error {
   constructor(code, message, retryAfterSeconds = null) {
     super(message);
@@ -17992,7 +18747,7 @@ var maxResponseBytes = 256 * 1024;
 var maxResults = 20;
 var ownerPattern = /^[a-z0-9](?:[a-z0-9-]{0,38})$/iu;
 var segmentPattern = /^[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?$/iu;
-function createPublicSkillSearchClient(settings, fetcher = pinnedFetch2) {
+function createPublicSkillSearchClient(settings, fetcher = pinnedFetch3) {
   return {
     async search(input) {
       const query = input.query.trim();
@@ -18119,7 +18874,7 @@ function parseRetryAfter(value) {
 
 // src/domain/github-skill-source.ts
 import { HTTPException as HTTPException28 } from "hono/http-exception";
-import { pinnedFetch as pinnedFetch3, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded } from "@opengeni/network";
+import { pinnedFetch as pinnedFetch4, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded as readResponseTextBounded2 } from "@opengeni/network";
 import {
   PORTABLE_SKILL_MAX_FILES as PORTABLE_SKILL_MAX_FILES2,
   PORTABLE_SKILL_MAX_FILE_BYTES as PORTABLE_SKILL_MAX_FILE_BYTES2,
@@ -18220,7 +18975,7 @@ function createGitHubSkillSourceClient(settings, requestJson = (path, maxBytes,
 }
 async function downloadSkillSnapshot(settings, owner, repository, slug) {
   const signal = AbortSignal.timeout(githubRequestTimeoutMs);
-  const response = await pinnedFetch3(
+  const response = await pinnedFetch4(
     `https://skills.sh/api/download/${[owner, repository, slug].map(encodeURIComponent).join("/")}`,
     { headers: { accept: "application/json" }, credentials: "omit", redirect: "manual", signal },
     settings,
@@ -18255,7 +19010,7 @@ async function githubJson(settings, path, maxBytes, label) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), githubRequestTimeoutMs);
   try {
-    const response = await pinnedFetch3(
+    const response = await pinnedFetch4(
       `${githubApiBase}${path}`,
       {
         method: "GET",
@@ -18270,7 +19025,7 @@ async function githubJson(settings, path, maxBytes, label) {
       { label, requireHttpsOutsideLocalTest: true }
     );
     if (!response.ok) {
-      await readResponseTextBounded(response, 8192, `${label} error`).catch(() => void 0);
+      await readResponseTextBounded2(response, 8192, `${label} error`).catch(() => void 0);
       if (response.status === 404) throw new Error(`${label} was not found or is not public`);
       if (response.status === 403 || response.status === 429) {
         throw new HTTPException28(429, {
@@ -18298,18 +19053,70 @@ function stringValue(value) {
 
 // src/domain/vaults/index.ts
 import { buildMissingSecretAskCard as buildMissingSecretAskCard2 } from "@opengeni/contracts";
-import { isVaultError, VaultError as VaultError3, vaultErrorFromDatabase } from "@opengeni/db";
+import { isVaultError as isVaultError3, VaultError as VaultError3, vaultErrorFromDatabase } from "@opengeni/db";
 
 // src/domain/vaults/mapping.ts
 import {
   formatSecretReference as formatSecretReference2,
-  secretNameKey
+  secretNameKey as secretNameKey2,
+  VaultProviderOperations as VaultProviderOperations2
 } from "@opengeni/contracts";
 import {
   decryptEnvironmentValue as decryptEnvironmentValue2
 } from "@opengeni/db";
+function withoutProviderWrites(operations) {
+  return {
+    ...operations,
+    createItemTypes: [],
+    updateItem: false,
+    removeField: false,
+    archiveItem: false,
+    archiveKind: "none",
+    deleteItem: false,
+    restoreItem: false,
+    writeFiles: false,
+    createTotp: false,
+    updateTotp: false,
+    createVault: false,
+    restoreFieldHistory: false
+  };
+}
+function intersectProviderOperations(left, right) {
+  const archiveItem = left.archiveItem && right.archiveItem && left.archiveKind === right.archiveKind && left.archiveKind !== "none";
+  return {
+    createItemTypes: left.createItemTypes.filter(
+      (type) => type !== "passkey" && right.createItemTypes.includes(type)
+    ),
+    updateItem: left.updateItem && right.updateItem,
+    removeField: left.removeField && right.removeField,
+    archiveItem,
+    archiveKind: archiveItem ? left.archiveKind : "none",
+    deleteItem: false,
+    restoreItem: left.restoreItem && right.restoreItem,
+    readFiles: left.readFiles && right.readFiles,
+    writeFiles: left.writeFiles && right.writeFiles,
+    createTotp: left.createTotp && right.createTotp,
+    updateTotp: left.updateTotp && right.updateTotp,
+    createVault: left.createVault && right.createVault,
+    restoreFieldHistory: left.restoreFieldHistory && right.restoreFieldHistory
+  };
+}
+function storedProviderOperations(row) {
+  if (row.source === "opengeni" || !row.providerOperations) return null;
+  const parsed = VaultProviderOperations2.safeParse(row.providerOperations);
+  return parsed.success ? providerOperationsForMode(parsed.data, row.mode) : null;
+}
+function providerOperationsForMode(operations, mode) {
+  const normalized = intersectProviderOperations(operations, operations);
+  return mode === "read_write" ? normalized : withoutProviderWrites(normalized);
+}
+function providerAllowsAnyWrite(operations) {
+  if (!operations) return true;
+  return operations.createItemTypes.length > 0 || operations.updateItem || operations.archiveItem;
+}
 function vaultCanWrite(row, authority) {
   if (row.mode !== "read_write" || !authority.write) return false;
+  if (!providerAllowsAnyWrite(storedProviderOperations(row))) return false;
   if (row.ownerKind === "user") return row.ownedByCaller;
   return true;
 }
@@ -18325,7 +19132,11 @@ function vaultCanManage(row, authority) {
       return authority.write;
   }
 }
-function toVaultSummary(row, authority) {
+function toVaultSummary(row, authority, options = {}) {
+  const operations = storedProviderOperations(row);
+  const freshness = providerVaultFreshness(row, options.now ?? /* @__PURE__ */ new Date(), {
+    ...options.refreshing ? { refreshing: true } : {}
+  });
   return {
     id: row.id,
     workspaceId: row.workspaceId,
@@ -18342,6 +19153,8 @@ function toVaultSummary(row, authority) {
     lastSyncedAt: row.lastSyncedAt,
     rateLimitedUntil: row.rateLimitedUntil,
     providerConnectionId: row.providerConnectionId,
+    ...operations ? { providerOperations: operations } : {},
+    ...freshness ? { freshness } : {},
     availability: row.availability,
     isDefault: row.isDefault,
     itemCount: Number(row.itemCount),
@@ -18381,7 +19194,7 @@ function vaultItemReferences(item) {
 }
 function usernameOf(row, key) {
   const field = row.fields.find(
-    (candidate) => candidate.kind === "text" && secretNameKey(candidate.name) === "username"
+    (candidate) => candidate.kind === "text" && secretNameKey2(candidate.name) === "username"
   );
   return field ? decryptOrNull(key, field.valueEncrypted) : null;
 }
@@ -18418,7 +19231,7 @@ function toVaultItemField(item, field, key) {
 }
 function toVaultItem(row, key) {
   const textField = (name) => {
-    const field = row.fields.find((candidate) => secretNameKey(candidate.name) === name);
+    const field = row.fields.find((candidate) => secretNameKey2(candidate.name) === name);
     return field ? decryptOrNull(key, field.valueEncrypted) : null;
   };
   const credentialId = row.type === "passkey" ? textField("credentialid") ?? "" : "";
@@ -18441,68 +19254,25 @@ function toVaultItem(row, key) {
   };
 }
 
-// src/domain/vaults/vault-service.ts
-import { createHash as createHash6 } from "crypto";
-import {
-  generatePassword as generatePassword2,
-  isValidTotpInput as isValidTotpInput3,
-  parseSecretReference,
-  parseTotpInput as parseTotpInput2,
-  secretNameKey as secretNameKey3,
-  SecretReferenceError as SecretReferenceError2,
-  totpCodeSync,
-  totpRemainingMs,
-  systemSecretClock,
-  VAULT_LIMITS as VAULT_LIMITS3
-} from "@opengeni/contracts";
-import {
-  archiveVaultItem,
-  createVault,
-  decryptEnvironmentValue as decryptEnvironmentValue3,
-  deleteVault,
-  deleteVaultItemPermanently,
-  encryptEnvironmentValue,
-  ensureDefaultVault,
-  ensureTaskVault,
-  getSession as getSession6,
-  getSessionSecretsView,
-  getVault,
-  getVaultItem,
-  listVaultFieldVersions,
-  listVaultItems,
-  listVaultsForSubject as listVaultsForSubject2,
-  vaultItemCursor,
-  moveVaultItem,
-  readVaultFieldCiphertext,
-  resolveSecretReferenceCandidates as resolveSecretReferenceCandidates2,
-  restoreVaultItem,
-  setSessionVaultPolicy,
-  updateVault,
-  upsertVaultItem,
-  VaultError as VaultError2
-} from "@opengeni/db";
-import {
-  createProviderCallBudget as createProviderCallBudget2,
-  EMPTY_VAULT_PROVIDER_REGISTRY as EMPTY_VAULT_PROVIDER_REGISTRY2,
-  isVaultProviderError as isVaultProviderError4
-} from "@opengeni/vaults";
-
 // src/domain/vaults/provider-writes.ts
+import { randomUUID } from "crypto";
 import {
   generatePassword,
   isValidTotpInput as isValidTotpInput2,
-  secretNameKey as secretNameKey2
+  secretNameKey as secretNameKey3
 } from "@opengeni/contracts";
 import {
   getProviderVaultItemRef,
   VaultError
 } from "@opengeni/db";
 import {
-  isVaultProviderError as isVaultProviderError3
+  isVaultProviderError as isVaultProviderError3,
+  providerOperations as providerOperations3,
+  readProviderItemInventory as readProviderItemInventory2
 } from "@opengeni/vaults";
 var TEXT_FIELD_NAMES = ["username", "user", "email", "login", "account"];
 function defaultKind(name) {
-  return TEXT_FIELD_NAMES.includes(secretNameKey2(name)) ? "text" : "concealed";
+  return TEXT_FIELD_NAMES.includes(secretNameKey3(name)) ? "text" : "concealed";
 }
 function assertProviderVaultWritable(vault) {
   if (vault.source === "opengeni") {
@@ -18515,11 +19285,43 @@ function assertProviderVaultWritable(vault) {
     throw new VaultError("vault_not_found", "vault not found", { vaultId: vault.id });
   }
 }
-async function providerFieldWrites(fields, existing, resolveReference, generated) {
-  const writes = [];
-  for (const input of fields) {
+var NO_PROVIDER_OPERATIONS = withoutProviderWrites({
+  createItemTypes: [],
+  updateItem: false,
+  removeField: false,
+  archiveItem: false,
+  archiveKind: "none",
+  deleteItem: false,
+  restoreItem: false,
+  readFiles: false,
+  writeFiles: false,
+  createTotp: false,
+  updateTotp: false,
+  createVault: false,
+  restoreFieldHistory: false
+});
+function effectiveProviderOperations(vault, provider) {
+  if (vault.source === "opengeni") return NO_PROVIDER_OPERATIONS;
+  const stored2 = storedProviderOperations(vault);
+  const live = provider ? providerOperations3(provider.capabilities()) : null;
+  const operations = live && stored2 ? intersectProviderOperations(live, stored2) : stored2 ?? live;
+  return operations ? providerOperationsForMode(operations, vault.mode) : NO_PROVIDER_OPERATIONS;
+}
+function refuse(vault, operation, message, details = {}) {
+  throw new VaultError("vault_read_only", message, { vaultId: vault.id, operation, ...details });
+}
+function refuseProviderOperation(vault, operation) {
+  const messages = {
+    deleteItem: `Opengeni never permanently deletes items in ${vault.name}. Archive the item, or delete it in the provider itself.`,
+    restoreItem: `Items archived in ${vault.name} are restored in the provider itself; the restored item appears after the next sync.`,
+    restoreFieldHistory: `${vault.name} keeps field history in the provider; restore an earlier value there.`
+  };
+  return refuse(vault, operation, messages[operation]);
+}
+function planFieldWrites(vault, operations, creating, fields, existing) {
+  return fields.map((input) => {
     const current = existing.find(
-      (field) => input.fieldId !== void 0 && field.id === input.fieldId || secretNameKey2(field.name) === secretNameKey2(input.name)
+      (field) => input.fieldId !== void 0 && field.id === input.fieldId || secretNameKey3(field.name) === secretNameKey3(input.name)
     );
     const kind = input.kind ?? current?.kind ?? defaultKind(input.name);
     const base = {
@@ -18527,24 +19329,51 @@ async function providerFieldWrites(fields, existing, resolveReference, generated
       name: input.name,
       kind
     };
-    if (input.remove) {
-      writes.push({ ...base, remove: true });
-      continue;
-    }
     if (input.restoreVersion !== void 0) {
-      throw new VaultError(
-        "provider_unavailable",
-        "connected vaults keep their history in the provider; restore it there",
-        { field: input.name }
-      );
+      return refuseProviderOperation(vault, "restoreFieldHistory");
     }
-    if (input.fileBase64 !== void 0 || kind === "file") {
+    if (input.fileBase64 !== void 0 || kind === "file" || current?.kind === "file") {
       throw new VaultError(
         "provider_unavailable",
         "files in connected vaults are read-only in Opengeni",
-        { field: input.name }
+        { field: input.name, vaultId: vault.id, operation: "writeFiles" }
       );
     }
+    const totp = kind === "totp" || current?.kind === "totp";
+    if (input.remove) {
+      if (!operations.removeField) {
+        refuse(vault, "removeField", `${vault.name} does not allow removing fields here`, {
+          field: input.name
+        });
+      }
+      if (totp && !operations.updateTotp) {
+        refuse(vault, "updateTotp", `${vault.name} does not allow changing one-time passwords`, {
+          field: input.name
+        });
+      }
+      return { input, base, kind };
+    }
+    if (totp) {
+      const allowed = creating ? operations.createTotp : operations.updateTotp;
+      if (!allowed) {
+        refuse(
+          vault,
+          creating ? "createTotp" : "updateTotp",
+          `${vault.name} does not allow ${creating ? "saving" : "changing"} one-time passwords`,
+          { field: input.name }
+        );
+      }
+    }
+    return { input, base, kind };
+  });
+}
+async function providerFieldValues(planned, resolveReference, generated) {
+  const writes = [];
+  for (const { input, base, kind } of planned) {
+    if (input.remove) {
+      writes.push({ ...base, remove: true });
+      continue;
+    }
     let value;
     if (input.generate !== void 0) {
       value = generatePassword(input.generate);
@@ -18574,6 +19403,16 @@ function providerFailure(error) {
   }
   throw error;
 }
+function mutationFailure(vault, error, what) {
+  if (isVaultProviderError3(error) && error.code !== "provider_outcome_unknown") {
+    return providerFailure(error);
+  }
+  throw new VaultError(
+    "provider_outcome_unknown",
+    `${vault.name} did not confirm ${what}. It may have been applied: check the vault before trying again.`,
+    { vaultId: vault.id }
+  );
+}
 async function providerFor(deps, vault) {
   try {
     return await deps.providers.forVault({
@@ -18584,38 +19423,68 @@ async function providerFor(deps, vault) {
     return providerFailure(error);
   }
 }
+function mutationContext(deps, vault) {
+  return {
+    connectionId: vault.providerConnectionId,
+    budget: deps.budget ?? { take() {
+    } },
+    cacheEpoch: vault.providerCacheEpoch ?? null,
+    // Read-before-write must see the provider's current item, never a cached copy.
+    forceRefresh: true,
+    idempotencyKey: randomUUID()
+  };
+}
+async function refreshAfterWrite(deps, vault) {
+  try {
+    const result = await syncLinkedProviderVault({
+      db: deps.db,
+      context: deps.context,
+      vaultId: vault.id,
+      providers: deps.providers,
+      force: true,
+      ...deps.budget ? { budget: deps.budget } : {}
+    });
+    return result.status;
+  } catch {
+    return "error";
+  }
+}
 async function refreshAndFind(deps, vault, providerItemRef) {
-  await syncLinkedProviderVault({
-    db: deps.db,
-    context: deps.context,
-    vaultId: vault.id,
-    providers: deps.providers,
-    force: true,
-    ...deps.budget ? { budget: deps.budget } : {}
-  });
+  const sync = await refreshAfterWrite(deps, vault);
   try {
     const ref = await getProviderVaultItemRef(deps.db, deps.context, {
       vaultId: vault.id,
       providerItemRef
     });
-    return ref.itemId;
+    return { status: "listed", itemId: ref.itemId };
   } catch (error) {
     if (error instanceof VaultError && error.code === "vault_item_not_found") {
-      throw new VaultError(
-        "provider_unavailable",
-        "saved in the provider; Opengeni will show it after the next sync",
-        { vaultId: vault.id }
-      );
+      return { status: "saved_not_listed", vaultId: vault.id, sync };
     }
     throw error;
   }
 }
-async function writeProviderVaultItem(deps, input) {
+async function writeProviderVaultItemOutcome(deps, input) {
   const { vault, existing, change } = input;
   assertProviderVaultWritable(vault);
-  if ((change.type ?? existing?.type) === "passkey") {
+  const type = change.type ?? existing?.type ?? "login";
+  if (type === "passkey") {
     throw new VaultError("vault_permission_denied", "passkeys live only in Opengeni vaults");
   }
+  const provider = await providerFor(deps, vault);
+  const operations = effectiveProviderOperations(vault, provider);
+  if (existing) {
+    if (!operations.updateItem) {
+      refuse(vault, "updateItem", `${vault.name} does not allow changing items here`);
+    }
+  } else if (!operations.createItemTypes.includes(type)) {
+    refuse(
+      vault,
+      "createItem",
+      operations.createItemTypes.length === 0 ? `${vault.name} does not allow creating items here` : `${vault.name} cannot hold ${type} items; it accepts ${operations.createItemTypes.join(", ")}`,
+      { itemType: type, allowedItemTypes: operations.createItemTypes }
+    );
+  }
   let externalItemId;
   let expectedVersion;
   if (existing) {
@@ -18632,60 +19501,190 @@ async function writeProviderVaultItem(deps, input) {
     externalItemId = ref.providerItemRef;
     expectedVersion = ref.providerVersion;
   }
-  const fields = await providerFieldWrites(
+  const planned = planFieldWrites(
+    vault,
+    operations,
+    existing === null,
     change.fields ?? [],
-    existing?.fields ?? [],
-    deps.resolveReference,
-    input.generated ?? []
+    existing?.fields ?? []
   );
-  const provider = await providerFor(deps, vault);
+  const fields = await providerFieldValues(planned, deps.resolveReference, input.generated ?? []);
+  const name = change.name ?? existing?.name ?? "";
   let written;
   try {
-    written = await provider.writeItem(
-      { connectionId: vault.providerConnectionId, budget: deps.budget ?? { take() {
-      } } },
-      vault.providerVaultRef ?? "",
+    written = await provider.writeItem(mutationContext(deps, vault), vault.providerVaultRef ?? "", {
+      ...externalItemId ? { externalItemId, expectedVersion: expectedVersion ?? null } : {},
+      name,
+      type,
+      websites: change.websites ?? existing?.websites ?? [],
+      fields
+    });
+  } catch (error) {
+    return mutationFailure(vault, error, existing ? `the change to ${name}` : `saving ${name}`);
+  }
+  return await refreshAndFind(deps, vault, written.externalItemId);
+}
+function savedNotListedError(vault, itemName, outcome) {
+  return new VaultError(
+    "provider_inventory_incomplete",
+    `Saved ${itemName} in ${vault.name}, but Opengeni could not list it yet. Do not save it again: it appears after the next successful sync.`,
+    { saved: true, vaultId: outcome.vaultId, itemName, sync: outcome.sync }
+  );
+}
+async function writeProviderVaultItem(deps, input) {
+  const outcome = await writeProviderVaultItemOutcome(deps, input);
+  if (outcome.status === "listed") return outcome.itemId;
+  throw savedNotListedError(
+    input.vault,
+    input.change.name ?? input.existing?.name ?? "the item",
+    outcome
+  );
+}
+function providerArchiveKind(vault, provider) {
+  const operations = effectiveProviderOperations(vault, provider);
+  if (!operations.archiveItem) return null;
+  return operations.archiveKind === "archive" || operations.archiveKind === "trash" ? operations.archiveKind : null;
+}
+async function assertProviderVaultAccepts(deps, vault, item) {
+  assertProviderVaultWritable(vault);
+  if (item.type === "passkey") {
+    throw new VaultError("vault_permission_denied", "passkeys live only in Opengeni vaults");
+  }
+  if (item.fields.some((field) => field.kind === "file")) {
+    throw new VaultError(
+      "provider_unavailable",
+      "files in connected vaults are read-only in Opengeni; copy the item into an Opengeni vault instead",
+      { vaultId: vault.id, operation: "writeFiles" }
+    );
+  }
+  const operations = effectiveProviderOperations(vault, await providerFor(deps, vault));
+  if (!operations.createItemTypes.includes(item.type)) {
+    refuse(
+      vault,
+      "createItem",
+      operations.createItemTypes.length === 0 ? `${vault.name} does not allow creating items here` : `${vault.name} cannot hold ${item.type} items; it accepts ${operations.createItemTypes.join(", ")}`,
+      { itemType: item.type, allowedItemTypes: operations.createItemTypes }
+    );
+  }
+  if (item.fields.some((field) => field.kind === "totp") && !operations.createTotp) {
+    refuse(vault, "createTotp", `${vault.name} does not allow saving one-time passwords`);
+  }
+}
+async function assertProviderVaultReleases(deps, vault) {
+  assertProviderVaultWritable(vault);
+  const archiveKind = providerArchiveKind(vault, await providerFor(deps, vault));
+  if (archiveKind === null) {
+    refuse(
+      vault,
+      "archiveItem",
+      `${vault.name} cannot archive the original recoverably, so the item cannot be moved out of it; copy it instead`
+    );
+  }
+  return archiveKind;
+}
+async function observeProviderItemVersion(deps, input) {
+  const { vault } = input;
+  const provider = await providerFor(deps, vault);
+  try {
+    const inventory = await readProviderItemInventory2(
+      provider,
       {
-        ...externalItemId ? { externalItemId, expectedVersion: expectedVersion ?? null } : {},
-        name: change.name ?? existing?.name ?? "",
-        type: change.type ?? existing?.type ?? "login",
-        websites: change.websites ?? existing?.websites ?? [],
-        fields
-      }
+        connectionId: vault.providerConnectionId,
+        budget: deps.budget ?? { take() {
+        } },
+        cacheEpoch: vault.providerCacheEpoch ?? null,
+        forceRefresh: true
+      },
+      vault.providerVaultRef ?? ""
     );
+    const item = inventory.items.find((meta) => meta.externalItemId === input.providerItemRef);
+    if (!item) return { listed: false, consistent: inventory.consistent };
+    return {
+      listed: true,
+      version: typeof item.version === "string" && item.version.length > 0 ? item.version : null
+    };
   } catch (error) {
-    return providerFailure(error);
+    if (isVaultProviderError3(error)) {
+      throw new VaultError(vaultErrorCodeForProvider(error.code, "vault"), error.message, {
+        vaultId: vault.id,
+        ...error.retryAfterMs ? { retryAfterMs: error.retryAfterMs } : {}
+      });
+    }
+    throw error;
   }
-  return await refreshAndFind(deps, vault, written.externalItemId);
 }
 async function archiveProviderVaultItem(deps, input) {
-  assertProviderVaultWritable(input.vault);
+  const { vault } = input;
+  assertProviderVaultWritable(vault);
   const ref = await getProviderVaultItemRef(deps.db, deps.context, {
-    vaultId: input.vault.id,
+    vaultId: vault.id,
     itemId: input.itemId
   });
-  const provider = await providerFor(deps, input.vault);
+  const provider = await providerFor(deps, vault);
+  const archiveKind = providerArchiveKind(vault, provider);
+  if (archiveKind === null) {
+    refuse(vault, "archiveItem", `${vault.name} does not allow archiving items here`);
+  }
   try {
     await provider.archiveItem(
-      { connectionId: input.vault.providerConnectionId, budget: deps.budget ?? { take() {
-      } } },
-      input.vault.providerVaultRef ?? "",
+      mutationContext(deps, vault),
+      vault.providerVaultRef ?? "",
       ref.providerItemRef
     );
   } catch (error) {
-    providerFailure(error);
+    mutationFailure(vault, error, "archiving the item");
   }
-  await syncLinkedProviderVault({
-    db: deps.db,
-    context: deps.context,
-    vaultId: input.vault.id,
-    providers: deps.providers,
-    force: true,
-    ...deps.budget ? { budget: deps.budget } : {}
-  });
+  await refreshAfterWrite(deps, vault);
+  return { archiveKind };
 }
 
 // src/domain/vaults/vault-service.ts
+import { createHash as createHash6 } from "crypto";
+import {
+  generatePassword as generatePassword2,
+  isValidTotpInput as isValidTotpInput3,
+  parseSecretReference,
+  parseTotpInput as parseTotpInput2,
+  secretNameKey as secretNameKey4,
+  SecretReferenceError as SecretReferenceError2,
+  totpCodeSync,
+  totpRemainingMs,
+  systemSecretClock,
+  VAULT_LIMITS as VAULT_LIMITS3
+} from "@opengeni/contracts";
+import {
+  archiveVaultItem,
+  createVault,
+  decryptEnvironmentValue as decryptEnvironmentValue3,
+  deleteVault,
+  deleteVaultItemPermanently,
+  encryptEnvironmentValue as encryptEnvironmentValue2,
+  ensureDefaultVault,
+  ensureTaskVault,
+  getSession as getSession6,
+  getSessionSecretsView,
+  getProviderVaultItemRef as getProviderVaultItemRef2,
+  getVault,
+  getVaultItem,
+  isVaultError as isVaultError2,
+  listVaultFieldVersions,
+  listVaultItems,
+  listVaultsForSubject as listVaultsForSubject2,
+  vaultItemCursor,
+  moveVaultItem,
+  readVaultFieldCiphertext,
+  resolveSecretReferenceCandidates as resolveSecretReferenceCandidates2,
+  restoreVaultItem,
+  setSessionVaultPolicy,
+  updateVault,
+  upsertVaultItem,
+  VaultError as VaultError2
+} from "@opengeni/db";
+import {
+  createProviderCallBudget as createProviderCallBudget2,
+  EMPTY_VAULT_PROVIDER_REGISTRY as EMPTY_VAULT_PROVIDER_REGISTRY2,
+  isVaultProviderError as isVaultProviderError4
+} from "@opengeni/vaults";
 function subjectContext(actor, workspaceId) {
   return {
     kind: "subject",
@@ -18722,13 +19721,13 @@ function requireKey(deps) {
   return deps.encryptionKey;
 }
 function defaultFieldKind(name) {
-  return ["username", "user", "email", "login", "account", "rpid"].includes(secretNameKey3(name)) ? "text" : "concealed";
+  return ["username", "user", "email", "login", "account", "rpid"].includes(secretNameKey4(name)) ? "text" : "concealed";
 }
 function createVaultService(deps) {
   const clock = deps.clock ?? systemSecretClock;
   async function fieldWrite(input, existing, resolveReference, generated) {
     const current = existing?.fields.find(
-      (field) => input.fieldId !== void 0 && field.id === input.fieldId || secretNameKey3(field.name) === secretNameKey3(input.name)
+      (field) => input.fieldId !== void 0 && field.id === input.fieldId || secretNameKey4(field.name) === secretNameKey4(input.name)
     );
     const name = current?.name ?? input.name;
     const write = { name };
@@ -18781,7 +19780,7 @@ function createVaultService(deps) {
     return {
       ...write,
       kind,
-      valueEncrypted: encryptEnvironmentValue(requireKey(deps), plaintext),
+      valueEncrypted: encryptEnvironmentValue2(requireKey(deps), plaintext),
       valueSize: size
     };
   }
@@ -18848,6 +19847,11 @@ function createVaultService(deps) {
   function key() {
     return deps.encryptionKey;
   }
+  async function refuseForConnectedItem(context, itemId, operation) {
+    const item = await getVaultItem(deps.db, context, { itemId });
+    if (item.vaultSource === "opengeni") return;
+    refuseProviderOperation(await getVault(deps.db, context, { vaultId: item.vaultId }), operation);
+  }
   async function moveAcrossProviders(input) {
     const source = await getVaultItem(deps.db, input.context, { itemId: input.itemId });
     const target = await getVault(deps.db, input.context, { vaultId: input.targetVaultId });
@@ -18873,6 +19877,46 @@ function createVaultService(deps) {
         }
       );
     }
+    if (target.source !== "opengeni") {
+      await assertProviderVaultAccepts(input.providerWrites, target, source);
+    }
+    if (input.mode === "move" && source.vaultSource !== "opengeni") {
+      await assertProviderVaultReleases(input.providerWrites, sourceVault);
+    }
+    let pinned = null;
+    if (input.mode === "move" && source.vaultSource !== "opengeni") {
+      const mirrored = await getProviderVaultItemRef2(deps.db, input.context, {
+        vaultId: sourceVault.id,
+        itemId: source.id
+      });
+      const { providerItemRef } = mirrored;
+      const observed = await observeProviderItemVersion(input.providerWrites, {
+        vault: sourceVault,
+        providerItemRef
+      });
+      if (!observed.listed) {
+        throw new VaultError2(
+          "vault_item_not_found",
+          `${source.name} is not listed in ${sourceVault.name} right now; sync the vault and try again`,
+          { itemId: source.id, vaultId: sourceVault.id }
+        );
+      }
+      if (observed.version !== null) {
+        if (mirrored.providerVersion !== observed.version || mirrored.generation !== source.generation) {
+          throw new VaultError2(
+            "provider_conflict",
+            `${source.name} changed in ${sourceVault.name} since Opengeni last synced it, so its fields here may be out of date. Nothing was moved: sync ${sourceVault.name}, then move it again.`,
+            {
+              itemId: source.id,
+              vaultId: sourceVault.id,
+              mirroredVersion: mirrored.providerVersion,
+              providerVersion: observed.version
+            }
+          );
+        }
+        pinned = { providerItemRef, version: observed.version };
+      }
+    }
     const name = input.newName ?? source.name;
     const fields = [];
     for (const field of source.fields) {
@@ -18899,14 +19943,19 @@ function createVaultService(deps) {
       ...source.expiresAt ? { expiresAt: source.expiresAt } : {},
       fields
     };
-    let created;
+    let created = null;
+    let notListed = null;
     if (target.source !== "opengeni") {
-      const itemId = await writeProviderVaultItem(input.providerWrites, {
+      const outcome = await writeProviderVaultItemOutcome(input.providerWrites, {
         vault: target,
         existing: null,
         change
       });
-      created = await getVaultItem(deps.db, input.context, { itemId });
+      if (outcome.status === "listed") {
+        created = await getVaultItem(deps.db, input.context, { itemId: outcome.itemId });
+      } else {
+        notListed = outcome;
+      }
     } else {
       const write = await itemWrite(
         change,
@@ -18921,17 +19970,54 @@ function createVaultService(deps) {
       });
     }
     if (input.mode === "move") {
-      if (source.vaultSource !== "opengeni") {
-        await archiveProviderVaultItem(input.providerWrites, {
-          vault: sourceVault,
-          itemId: source.id
-        });
-      } else {
-        await archiveVaultItem(deps.db, input.context, { itemId: source.id });
+      try {
+        if (source.vaultSource !== "opengeni") {
+          if (pinned) await assertSourceUnchanged(input.providerWrites, sourceVault, pinned);
+          await archiveProviderVaultItem(input.providerWrites, {
+            vault: sourceVault,
+            itemId: source.id
+          });
+        } else {
+          await archiveVaultItem(deps.db, input.context, { itemId: source.id });
+        }
+      } catch (error) {
+        const changed = isVaultError2(error) && error.details?.sourceChanged === true;
+        throw new VaultError2(
+          isVaultError2(error) ? error.code : "provider_outcome_unknown",
+          changed ? `Saved ${name} in ${target.name} with the values that were read, but the original in ${sourceVault.name} ${error.message}, so it was kept. Do not move it again: compare the two, then update the copy or archive the original in ${sourceVault.name}.` : `Saved ${name} in ${target.name}, but archiving the original in ${sourceVault.name} did not complete${isVaultError2(error) ? ` (${error.message})` : ""}. Do not move it again: check ${sourceVault.name} and archive the original there if it is still listed.`,
+          {
+            saved: true,
+            sourceArchived: false,
+            ...changed ? { sourceChanged: true } : {},
+            vaultId: target.id,
+            ...created ? { itemId: created.id } : {},
+            sourceItemId: source.id,
+            sourceVaultId: sourceVault.id
+          }
+        );
       }
     }
+    if (notListed) {
+      const error = savedNotListedError(target, name, notListed);
+      throw new VaultError2(error.code, error.message, {
+        ...error.details,
+        ...input.mode === "move" ? { sourceArchived: true } : {}
+      });
+    }
     return created;
   }
+  async function assertSourceUnchanged(providerWrites, vault, pinned) {
+    const now = await observeProviderItemVersion(providerWrites, {
+      vault,
+      providerItemRef: pinned.providerItemRef
+    });
+    if (now.listed && now.version === pinned.version) return;
+    throw new VaultError2(
+      now.listed ? "vault_generation_conflict" : "vault_item_not_found",
+      now.listed ? "changed after its values were read" : "is no longer listed at the version that was read",
+      { sourceChanged: true, vaultId: vault.id }
+    );
+  }
   function toItem(row) {
     return toVaultItem(row, key());
   }
@@ -18951,7 +20037,12 @@ function createVaultService(deps) {
         });
         const budget = createProviderCallBudget2(VAULT_LIMITS3.providerReadsPerAttempt);
         const [value] = await provider.readFields(
-          { connectionId: read.providerConnectionId, budget },
+          // The durable epoch invalidates provider value caches after a refresh anywhere.
+          {
+            connectionId: read.providerConnectionId,
+            budget,
+            cacheEpoch: read.providerCacheEpoch ?? null
+          },
           read.providerVaultRef ?? "",
           read.providerItemRef ?? "",
           [read.providerFieldRef ?? ""]
@@ -19008,9 +20099,12 @@ function createVaultService(deps) {
     const vaults = await listVaultsForSubject2(deps.db, principalContext(principal), {
       workspaceId: principal.workspaceId
     });
+    return agentVaultFrom(vaults, nameOrId);
+  }
+  function agentVaultFrom(vaults, nameOrId) {
     const byId = vaults.find((vault) => vault.id === nameOrId.toLowerCase());
     if (byId) return byId;
-    const matches = vaults.filter((vault) => secretNameKey3(vault.name) === secretNameKey3(nameOrId));
+    const matches = vaults.filter((vault) => secretNameKey4(vault.name) === secretNameKey4(nameOrId));
     if (matches.length === 0) {
       throw new VaultError2("vault_not_found", `no reachable vault is named ${nameOrId}`);
     }
@@ -19237,12 +20331,14 @@ function createVaultService(deps) {
       await archiveVaultItem(deps.db, context, { itemId });
     },
     async restoreItem(actor, workspaceId, itemId) {
-      return toItem(
-        await restoreVaultItem(deps.db, subjectContext(actor, workspaceId), { itemId })
-      );
+      const context = subjectContext(actor, workspaceId);
+      await refuseForConnectedItem(context, itemId, "restoreItem");
+      return toItem(await restoreVaultItem(deps.db, context, { itemId }));
     },
     async deleteItemPermanently(actor, workspaceId, itemId) {
-      await deleteVaultItemPermanently(deps.db, subjectContext(actor, workspaceId), { itemId });
+      const context = subjectContext(actor, workspaceId);
+      await refuseForConnectedItem(context, itemId, "deleteItem");
+      await deleteVaultItemPermanently(deps.db, context, { itemId });
     },
     async moveItem(actor, workspaceId, itemId, req) {
       const crossed = await moveAcrossProviders({
@@ -19282,6 +20378,12 @@ function createVaultService(deps) {
     async restoreFieldVersion(actor, workspaceId, itemId, fieldId, version) {
       const context = subjectContext(actor, workspaceId);
       const existing = await getVaultItem(deps.db, context, { itemId });
+      if (existing.vaultSource !== "opengeni") {
+        refuseProviderOperation(
+          await getVault(deps.db, context, { vaultId: existing.vaultId }),
+          "restoreFieldHistory"
+        );
+      }
       const field = existing.fields.find((candidate) => candidate.id === fieldId);
       if (!field) throw new VaultError2("vault_field_not_found", "field not found", { fieldId });
       return toItem(
@@ -19318,26 +20420,37 @@ function createVaultService(deps) {
       let reachable = await listVaultsForSubject2(deps.db, context, {
         workspaceId: principal.workspaceId
       });
-      if (deps.providers) {
-        const changed = await refreshStaleLinkedVaults({
+      let scoped = input.vault !== void 0 ? [agentVaultFrom(reachable, input.vault)] : reachable;
+      let refreshing = /* @__PURE__ */ new Set();
+      const connected = scoped.filter((vault) => vault.source !== "opengeni");
+      if (deps.providers && connected.length > 0) {
+        const report = await refreshLinkedVaults({
           db: deps.db,
           context,
-          vaults: reachable,
+          vaults: connected,
           providers: deps.providers,
-          maxAgeMs: LINKED_VAULT_SEARCH_MAX_AGE_MS
+          maxAgeMs: LINKED_VAULT_SEARCH_MAX_AGE_MS,
+          ...input.refresh && input.cursor === void 0 ? { force: true } : {}
         });
-        if (changed.length > 0) {
+        refreshing = new Set(report.pending);
+        if (report.outcomes.some((outcome) => outcome.state === "done" || outcome.state === "failed")) {
           reachable = await listVaultsForSubject2(deps.db, context, {
             workspaceId: principal.workspaceId
           });
+          scoped = scoped.map((vault) => reachable.find((row) => row.id === vault.id) ?? vault);
         }
       }
+      const checkedAt = /* @__PURE__ */ new Date();
+      const freshnessOf = (vault) => providerVaultFreshness(vault, checkedAt, { refreshing: refreshing.has(vault.id) });
+      const sources = scoped.flatMap((vault) => {
+        const freshness = freshnessOf(vault);
+        return freshness ? [{ vaultId: vault.id, freshness }] : [];
+      });
+      const complete = sources.every((source) => source.freshness.state === "current");
       const byTier = (vaults2) => [...vaults2].sort(
         (left, right) => left.tier - right.tier || left.name.localeCompare(right.name)
       );
-      const vaults = byTier(
-        input.vault !== void 0 ? [await agentVault(principal, input.vault)] : reachable
-      );
+      const vaults = byTier(scoped);
       const limit = input.limit ?? 20;
       const filters = agentSearchFilterKey(input);
       let startIndex = 0;
@@ -19403,15 +20516,21 @@ function createVaultService(deps) {
         truncated: next !== null,
         nextCursor: next === null ? null : encodeAgentSearchCursor(next),
         ...input.cursor === void 0 ? {
-          vaults: byTier(reachable).map((vault) => ({
-            id: vault.id,
-            name: vault.name,
-            ownerKind: vault.ownerKind,
-            source: vault.source,
-            mode: vault.mode,
-            itemCount: vault.itemCount
-          }))
-        } : {}
+          vaults: byTier(reachable).map((vault) => {
+            const freshness = freshnessOf(vault);
+            return {
+              id: vault.id,
+              name: vault.name,
+              ownerKind: vault.ownerKind,
+              source: vault.source,
+              mode: vault.mode,
+              itemCount: vault.itemCount,
+              ...freshness ? { freshness } : {}
+            };
+          })
+        } : {},
+        complete,
+        sources
       };
       function agentSearchResult(vault, row) {
         const summary = toVaultItemSummary(row, key());
@@ -19446,7 +20565,7 @@ function createVaultService(deps) {
         q: input.item,
         limit: VAULT_LIMITS3.searchResultsMax
       });
-      const existing = existingPage.items.find((item) => secretNameKey3(item.name) === secretNameKey3(input.item)) ?? null;
+      const existing = existingPage.items.find((item) => secretNameKey4(item.name) === secretNameKey4(input.item)) ?? null;
       if (input.mode === "create" && existing) {
         throw new VaultError2(
           "vault_item_name_conflict",
@@ -19554,7 +20673,7 @@ function createVaultService(deps) {
       const current = await getVaultItem(deps.db, context, { itemId: target.itemId });
       if (current.vaultSource !== "opengeni") {
         const vault = await getVault(deps.db, context, { vaultId: current.vaultId });
-        await archiveProviderVaultItem(
+        const { archiveKind } = await archiveProviderVaultItem(
           {
             db: deps.db,
             context,
@@ -19565,7 +20684,7 @@ function createVaultService(deps) {
         );
         return {
           archived: true,
-          restoreHint: `A person can restore ${current.name} from the provider's archive.`
+          restoreHint: `A person can restore ${current.name} from the ${archiveKind === "trash" ? "trash" : "archive"} in ${vault.name}'s provider; it reappears here after the next sync.`
         };
       }
       const row = await archiveVaultItem(deps.db, context, {
@@ -20040,39 +21159,39 @@ import {
   AutomationSessionTemplate,
   OPENGENI_PR_REVIEW_SESSION_ROLE
 } from "@opengeni/contracts";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var PR_REVIEW_AUTOMATION_ADAPTER_ID = "source-control.pull-request.v1";
-var PrReviewSourceConfiguration = z2.object({
-  provider: z2.enum(["github", "gitlab", "azure_devops"]),
-  providerBaseUrl: z2.string().url().max(2048),
-  registrationId: z2.string().uuid(),
-  webhookUsername: z2.string().min(1).max(512).nullable().default(null)
+var PrReviewSourceConfiguration = z3.object({
+  provider: z3.enum(["github", "gitlab", "azure_devops"]),
+  providerBaseUrl: z3.string().url().max(2048),
+  registrationId: z3.string().uuid(),
+  webhookUsername: z3.string().min(1).max(512).nullable().default(null)
 }).strict();
-var PrReviewTriggerParameters = z2.object({
-  registrationId: z2.string().uuid(),
-  repositoryBindingId: z2.string().uuid(),
-  provider: z2.enum(["github", "gitlab", "azure_devops"]),
-  repositoryUri: z2.string().url().max(2048),
-  repositoryFullName: z2.string().min(1).max(1024),
-  providerRepositoryId: z2.string().min(1).max(512),
-  installationId: z2.string().min(1).max(512).nullable(),
-  projectId: z2.string().min(1).max(512).nullable(),
-  model: z2.string().min(1).max(512).nullable(),
-  additionalInstructions: z2.string().max(16384).nullable()
+var PrReviewTriggerParameters = z3.object({
+  registrationId: z3.string().uuid(),
+  repositoryBindingId: z3.string().uuid(),
+  provider: z3.enum(["github", "gitlab", "azure_devops"]),
+  repositoryUri: z3.string().url().max(2048),
+  repositoryFullName: z3.string().min(1).max(1024),
+  providerRepositoryId: z3.string().min(1).max(512),
+  installationId: z3.string().min(1).max(512).nullable(),
+  projectId: z3.string().min(1).max(512).nullable(),
+  model: z3.string().min(1).max(512).nullable(),
+  additionalInstructions: z3.string().max(16384).nullable()
 }).strict();
-var PrReviewEventPayload = z2.object({
-  provider: z2.enum(["github", "gitlab", "azure_devops"]),
-  eventName: z2.string().max(200),
-  action: z2.string().max(200),
-  providerRepositoryId: z2.string().max(512).nullable(),
-  installationId: z2.string().max(512).nullable(),
-  projectId: z2.string().max(512).nullable(),
-  pullRequestId: z2.string().max(512).nullable(),
-  headSha: z2.string().regex(/^[0-9a-f]{40}$/).nullable(),
-  baseSha: z2.string().regex(/^[0-9a-f]{40}$/).nullable(),
-  headRef: z2.string().max(1024).nullable(),
-  baseRef: z2.string().max(1024).nullable(),
-  ignoredReason: z2.string().max(200).nullable()
+var PrReviewEventPayload = z3.object({
+  provider: z3.enum(["github", "gitlab", "azure_devops"]),
+  eventName: z3.string().max(200),
+  action: z3.string().max(200),
+  providerRepositoryId: z3.string().max(512).nullable(),
+  installationId: z3.string().max(512).nullable(),
+  projectId: z3.string().max(512).nullable(),
+  pullRequestId: z3.string().max(512).nullable(),
+  headSha: z3.string().regex(/^[0-9a-f]{40}$/).nullable(),
+  baseSha: z3.string().regex(/^[0-9a-f]{40}$/).nullable(),
+  headRef: z3.string().max(1024).nullable(),
+  baseRef: z3.string().max(1024).nullable(),
+  ignoredReason: z3.string().max(200).nullable()
 }).strict();
 var OPENGENI_PR_REVIEW_SKILL = {
   name: "pr-review",
@@ -21044,7 +22163,7 @@ import {
   saveAgentLearningSettings as saveAgentLearningSettings2,
   dbSql,
   deleteScheduledTask,
-  getConnectionMetadata as getConnectionMetadata5,
+  getConnectionMetadata as getConnectionMetadata6,
   getEnrollment as getEnrollment3,
   getLiveEnrollmentConnection as getLiveEnrollmentConnection3,
   getKnowledgeSourceForSyncAuthority,
@@ -21070,7 +22189,7 @@ import {
 import { HTTPException as HTTPException32 } from "hono/http-exception";
 import { GOOGLE_DRIVE_PUBLICATION_SERVER_ID as GOOGLE_DRIVE_PUBLICATION_SERVER_ID3 } from "@opengeni/contracts/google-drive";
 import { PERSONAL_GITHUB_CONNECTION_SURFACE_ID as PERSONAL_GITHUB_CONNECTION_SURFACE_ID3 } from "@opengeni/contracts/personal-github";
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 
 // src/domain/scheduled-task-audience.ts
 import {
@@ -21185,7 +22304,7 @@ async function resolveScheduledTaskVisibility(input) {
 
 // src/domain/scheduled-task-account-audit.ts
 import { recordAuditEvent as recordAuditEvent2 } from "@opengeni/db";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 var SCHEDULED_TASK_ACCOUNT_CHOICES_AUDIT_ACTION = "scheduled_task.account_choices_changed";
 function choicesOf(config) {
   return {
@@ -21205,7 +22324,7 @@ function scheduledTaskAccountChoiceChanges(before, after) {
   const next = choicesOf(after);
   const changes = {};
   for (const key of ["pinnedAccounts", "pinnedAccountsRequired", "connectors"]) {
-    if (!isDeepStrictEqual3(prior[key], next[key]))
+    if (!isDeepStrictEqual4(prior[key], next[key]))
       changes[key] = { before: prior[key], after: next[key] };
   }
   return Object.keys(changes).length > 0 ? changes : null;
@@ -22193,7 +23312,7 @@ async function validatedScheduledTaskUpdateWithoutAudience(input) {
     throw new HTTPException32(422, { message: "Source ingestion uses an ordinary agent task" });
   }
   const knowledgeSource = input.payload.agentConfig?.knowledgeSource ?? scheduledTaskKnowledgeSource(input.existing);
-  if (knowledgeSource && requestedKnowledgeSource && !isDeepStrictEqual4(requestedKnowledgeSource, existingKnowledgeSource)) {
+  if (knowledgeSource && requestedKnowledgeSource && !isDeepStrictEqual5(requestedKnowledgeSource, existingKnowledgeSource)) {
     await validateKnowledgeSourceSyncAction({
       db: input.db,
       grant: input.grant,
@@ -22330,7 +23449,7 @@ async function validatedScheduledTaskUpdateWithoutAudience(input) {
     const pins = nextRunMode === "existing_session" ? [] : input.payload.pinnedAccounts ?? input.existing.agentConfig.pinnedAccounts ?? [];
     const required = input.payload.pinnedAccountsRequired ?? input.existing.agentConfig.pinnedAccountsRequired === true;
     const next = withScheduledTaskPins(base, pins, required);
-    if (update.agentConfig || !isDeepStrictEqual4(next, input.existing.agentConfig))
+    if (update.agentConfig || !isDeepStrictEqual5(next, input.existing.agentConfig))
       update.agentConfig = next;
   }
   const nextAgentConfig = {
@@ -22359,7 +23478,7 @@ async function validatedScheduledTaskUpdateWithoutAudience(input) {
     verifySlackChannel: input.verifySlackChannel
   });
   const authorityTargetChanged = nextRunMode !== input.existing.runMode || nextTargetSessionId !== input.existing.targetSessionId || input.payload.variableSetId !== void 0 && input.payload.variableSetId !== input.existing.variableSetId || input.payload.rigId !== void 0 && input.payload.rigId !== input.existing.rigId;
-  const materialExecutionChange = authorityTargetChanged || pinsProvided || !isDeepStrictEqual4(nextAgentConfig, input.existing.agentConfig) || input.payload.action !== void 0 && !isDeepStrictEqual4(input.payload.action, input.existing.action) || input.payload.schedule !== void 0 && !isDeepStrictEqual4(input.payload.schedule, input.existing.schedule) || input.payload.overlapPolicy !== void 0 && input.payload.overlapPolicy !== input.existing.overlapPolicy || input.payload.metadata !== void 0 && !isDeepStrictEqual4(input.payload.metadata, input.existing.metadata) || input.existing.status === "paused" && input.payload.status === "active";
+  const materialExecutionChange = authorityTargetChanged || pinsProvided || !isDeepStrictEqual5(nextAgentConfig, input.existing.agentConfig) || input.payload.action !== void 0 && !isDeepStrictEqual5(input.payload.action, input.existing.action) || input.payload.schedule !== void 0 && !isDeepStrictEqual5(input.payload.schedule, input.existing.schedule) || input.payload.overlapPolicy !== void 0 && input.payload.overlapPolicy !== input.existing.overlapPolicy || input.payload.metadata !== void 0 && !isDeepStrictEqual5(input.payload.metadata, input.existing.metadata) || input.existing.status === "paused" && input.payload.status === "active";
   if (materialExecutionChange && nextRunMode !== "existing_session" && (!materializedReusable || nextAgentConfig.model !== input.existing.agentConfig.model)) {
     const beforeUpdateCommit = workspaceCustomModelCommitGuard({
       settings: input.settings,
@@ -22512,7 +23631,7 @@ async function validatedScheduledTaskUpdateWithoutAudience(input) {
     rigId: input.payload.rigId !== void 0 ? input.payload.rigId : input.existing.rigId,
     agentConfig: update.agentConfig ?? input.existing.agentConfig
   });
-  if (!knowledgeSource && !(materializedReusable && isDeepStrictEqual4(nextAgentConfig.machineTarget, input.existing.agentConfig.machineTarget) && nextAgentConfig.sandboxBackend === input.existing.agentConfig.sandboxBackend)) {
+  if (!knowledgeSource && !(materializedReusable && isDeepStrictEqual5(nextAgentConfig.machineTarget, input.existing.agentConfig.machineTarget) && nextAgentConfig.sandboxBackend === input.existing.agentConfig.sandboxBackend)) {
     await validateScheduledTaskMachineTarget({
       settings: input.settings,
       db: input.db,
@@ -22590,7 +23709,7 @@ async function validateKnowledgeSourceSyncAction(input) {
       message: "knowledge source authority or generation changed"
     });
   }
-  const connection = await getConnectionMetadata5(
+  const connection = await getConnectionMetadata6(
     input.db,
     input.grant.workspaceId,
     input.action.connection.connectionId,
@@ -22681,7 +23800,7 @@ async function requireUnchangedScheduledTaskForCompensation(db, expected) {
   );
   if (!current) throw new ScheduledTaskHeadChangedError();
   const { deletedAt, ...task } = current;
-  if (deletedAt !== null || !isDeepStrictEqual4(task, expected))
+  if (deletedAt !== null || !isDeepStrictEqual5(task, expected))
     throw new ScheduledTaskHeadChangedError();
 }
 async function syncUpdatedScheduledTask(input) {
@@ -22748,7 +23867,7 @@ async function validateScheduledTaskAgentConfig(input) {
       },
       toolsProvided: true
     };
-  const unchangedCreationField = (key) => input.retainedCreationConfig !== void 0 && isDeepStrictEqual4(input.payload.agentConfig[key], input.retainedCreationConfig[key]);
+  const unchangedCreationField = (key) => input.retainedCreationConfig !== void 0 && isDeepStrictEqual5(input.payload.agentConfig[key], input.retainedCreationConfig[key]);
   const actor = scheduledTaskInitiatorForGrant(input.grant).actor;
   const parent = actor && !existingChat ? await getSession8(input.db, input.workspaceId, actor.sessionId) : null;
   if (!existingChat && actor && (!parent || parent.accountId !== input.grant.accountId)) {
@@ -22871,7 +23990,7 @@ function validateIncidentTelemetryPreflightSelection(settings, agentConfig) {
     });
   }
   for (const required of preflight.requiredResources) {
-    if (!agentConfig.resources.some((selected) => isDeepStrictEqual4(selected, required))) {
+    if (!agentConfig.resources.some((selected) => isDeepStrictEqual5(selected, required))) {
       throw new HTTPException32(422, {
         message: "incidentTelemetryPreflight.requiredResources must be exact selected resources"
       });
@@ -22971,7 +24090,7 @@ import {
   ScheduledTaskHeadChangedError as ScheduledTaskHeadChangedError2
 } from "@opengeni/db";
 import { HTTPException as HTTPException33 } from "hono/http-exception";
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var ALWAYS_ATTACHED_CONNECTOR = "opengeni";
 var PRESERVED_ACCOUNT_SURFACES = /* @__PURE__ */ new Set([
   GOOGLE_DRIVE_PUBLICATION_SERVER_ID4,
@@ -22986,10 +24105,10 @@ function uniqueById(items) {
   return items.filter((item) => seen.has(item.id) ? false : (seen.add(item.id), true)).slice(0, SCHEDULED_TASK_ACCESS_CONNECTORS_MAX);
 }
 function planScheduledTaskConnectors(input) {
-  const unavailable = input.taskTools.filter(
+  const unavailable2 = input.taskTools.filter(
     (tool) => tool.id !== ALWAYS_ATTACHED_CONNECTOR && !input.availableServerIds.has(tool.id)
   );
-  const unavailableIds = new Set(unavailable.map((tool) => tool.id));
+  const unavailableIds = new Set(unavailable2.map((tool) => tool.id));
   const kept = input.taskTools.filter((tool) => !unavailableIds.has(tool.id));
   const keptIds = new Set(kept.map((tool) => tool.id));
   const missing = input.defaultTools.filter(
@@ -22998,7 +24117,7 @@ function planScheduledTaskConnectors(input) {
   return {
     tools: mergeToolRefs3([...kept], [...missing]),
     missing: uniqueById(missing.map((tool) => connector(tool.id, input.names))),
-    unavailable: uniqueById(unavailable.map((tool) => connector(tool.id, input.names)))
+    unavailable: uniqueById(unavailable2.map((tool) => connector(tool.id, input.names)))
   };
 }
 function planScheduledTaskPinnedAccounts(input) {
@@ -23009,7 +24128,7 @@ function planScheduledTaskPinnedAccounts(input) {
     )
   );
   const kept = [];
-  const unavailable = [];
+  const unavailable2 = [];
   const dropped = [];
   for (const pin of input.pins) {
     if (PRESERVED_ACCOUNT_SURFACES.has(pin.serverId)) {
@@ -23022,11 +24141,11 @@ function planScheduledTaskPinnedAccounts(input) {
     }
     kept.push(pin);
     if (!available.has(JSON.stringify([pin.serverId, pin.connectionId])))
-      unavailable.push(connector(pin.serverId, input.names));
+      unavailable2.push(connector(pin.serverId, input.names));
   }
   return {
     kept,
-    unavailable: uniqueById(unavailable),
+    unavailable: uniqueById(unavailable2),
     dropped: uniqueById(dropped)
   };
 }
@@ -23081,13 +24200,13 @@ function planScheduledTaskOpenGeniTools(input) {
     policy: unchanged ? null : { firstPartyMcpTools: tools, firstPartyMcpPermissions: permissions }
   };
 }
-var AuthNeededFact = z3.object({
-  serverId: z3.string().min(1),
-  canonicalServerId: z3.string().min(1).optional(),
-  providerDomain: z3.string().min(1),
+var AuthNeededFact = z4.object({
+  serverId: z4.string().min(1),
+  canonicalServerId: z4.string().min(1).optional(),
+  providerDomain: z4.string().min(1),
   reason: ToolAuthNeededReason,
-  capability: z3.unknown().optional(),
-  setupRequest: z3.unknown().optional()
+  capability: z4.unknown().optional(),
+  setupRequest: z4.unknown().optional()
 });
 function scheduledTaskRunAccessFailures(events, names) {
   const byKey = /* @__PURE__ */ new Map();
@@ -24323,7 +25442,14 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
 }
 
 // src/domain/insights-usage.ts
-import { readInsightsCalls, readInsightsUsage } from "@opengeni/db";
+import {
+  readInsightsCalls,
+  readInsightsUsage,
+  readInsightsSiteUsage
+} from "@opengeni/db";
+async function getInsightsSiteUsage(db, input) {
+  return readInsightsSiteUsage(db, { ...input, now: input.now ?? /* @__PURE__ */ new Date() });
+}
 async function getInsightsUsage(db, input) {
   return await readInsightsUsage(db, { ...input, now: input.now ?? /* @__PURE__ */ new Date() });
 }
@@ -27246,6 +28372,40 @@ async function controlHumanWorkspaceTimer(deps, context, input) {
   ]);
 }
 
+// src/application/site-session-cancellation.ts
+import { cancelSiteRuntimeConversation } from "@opengeni/db";
+import {
+  publishDurableSessionEvents as publishDurableSessionEvents4,
+  publishDurableWorkspaceControlEvent as publishDurableWorkspaceControlEvent3
+} from "@opengeni/events";
+async function cancelPublishedSiteSession(deps, input) {
+  const result = await cancelSiteRuntimeConversation(deps.db, input);
+  if (!result) return null;
+  const bySession = /* @__PURE__ */ new Map();
+  for (const event of result.events) {
+    const group = bySession.get(event.sessionId) ?? [];
+    group.push(event);
+    bySession.set(event.sessionId, group);
+  }
+  const effects = await Promise.allSettled([
+    ...[...bySession].map(
+      ([sessionId, events]) => publishDurableSessionEvents4(deps.bus, input.workspaceId, sessionId, events)
+    ),
+    ...result.workspaceEvent ? [publishDurableWorkspaceControlEvent3(deps.bus, input.workspaceId, result.workspaceEvent)] : [],
+    ...result.wakeCount > 0 ? [deps.workflowClient.requestSessionWorkflowWakeDispatch()] : []
+  ]);
+  if (effects.some((effect) => effect.status === "rejected"))
+    console.warn(
+      "[site-lifecycle] post-commit fanout failed; durable events and wake outbox retained"
+    );
+  return {
+    receiptId: result.receiptId,
+    replay: result.replay,
+    cancelledSessionCount: result.cancelledSessionCount,
+    cancelledTurnCount: result.cancelledTurnCount
+  };
+}
+
 // src/application/archived-session-imports.ts
 import {
   AppendArchivedSessionEventsRequest,
@@ -27260,7 +28420,7 @@ import {
   importArchivedSession,
   withSessionRlsActorContext as withSessionRlsActorContext7
 } from "@opengeni/db";
-import { publishDurableSessionEvents as publishDurableSessionEvents4 } from "@opengeni/events";
+import { publishDurableSessionEvents as publishDurableSessionEvents5 } from "@opengeni/events";
 import { HTTPException as HTTPException38 } from "hono/http-exception";
 import { ArchivedSessionImportError as ArchivedSessionImportError2 } from "@opengeni/db";
 function requireImportAuthorization(authorization, workspaceId, permission) {
@@ -27291,7 +28451,7 @@ function importerScope(authorization, workspaceId, permission, fileOwnerSubjectI
 async function publishImportedEvents(deps, workspaceId, sessionId, events) {
   if (!events.length) return;
   try {
-    await publishDurableSessionEvents4(deps.bus, workspaceId, sessionId, events);
+    await publishDurableSessionEvents5(deps.bus, workspaceId, sessionId, events);
   } catch {
     console.warn("[session-import] committed timeline fanout deferred to replay", { sessionId });
   }
@@ -27860,7 +29020,7 @@ import { createPinnedIntegrationTransport as createPinnedIntegrationTransport2 }
 import { mcpToolRecommendsApproval } from "@opengeni/contracts";
 import {
   buildConnectionTokenResolver,
-  getConnectionMetadata as getConnectionMetadata6,
+  getConnectionMetadata as getConnectionMetadata7,
   listEnabledMcpCapabilityServers as listEnabledMcpCapabilityServers3,
   listConnectorToolPermissionPolicies,
   listChangedConnectorToolPermissions,
@@ -27913,7 +29073,7 @@ async function resolveTarget2(input) {
     const server2 = settingsWithApiIntegrationServers({ ...input.settings, mcpServers: [] }, [
       integration
     ]).mcpServers[0];
-    const connection2 = integration.connectionRef?.connectionId ? await getConnectionMetadata6(
+    const connection2 = integration.connectionRef?.connectionId ? await getConnectionMetadata7(
       input.db,
       input.workspaceId,
       integration.connectionRef.connectionId,
@@ -28269,6 +29429,7 @@ export {
   EDITABLE_ARTIFACT_OPERATION_PROTOCOL_VERSION,
   EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,
   EXTERNAL_FIRST_USE_MEMBER_PERMISSIONS,
+  EXTERNAL_VAULT_CREDENTIAL_ROLE,
   EditableArtifactAgentApplication,
   EditableArtifactApplication,
   EditableArtifactCausalChainError,
@@ -28309,6 +29470,7 @@ export {
   KnowledgeVectorQueryRejectedError,
   LINKED_VAULT_MISS_MAX_AGE_MS,
   LINKED_VAULT_OPEN_WAIT_MS,
+  LINKED_VAULT_REFRESH_TIMEOUT_MS,
   LINKED_VAULT_REFRESH_WAIT_MS,
   LINKED_VAULT_SEARCH_MAX_AGE_MS,
   MAX_CHECKS_PER_RIG,
@@ -28378,6 +29540,7 @@ export {
   SessionTenancyManagedHumanRequiredError,
   SessionTenancyPersistenceOutcomeUnknownError,
   SessionUsageLimitHttpError,
+  StoredVaultProviderCredentials,
   SystemEditableArtifactClock,
   SystemEditableArtifactLiveClock,
   SystemEditableArtifactLiveScheduler,
@@ -28413,6 +29576,7 @@ export {
   agentAccessPermitsCrossTreeAccess,
   agentConfigParentFor,
   agentRunAdmissionDenial,
+  aggregateProviderFreshness,
   apiIntegrationsMatchingDelegations,
   appendArchivedSessionEventsForRequest,
   appendRigSetupCommand,
@@ -28455,12 +29619,14 @@ export {
   automationRequestDigest,
   availableMcpAccountBindings,
   availableToolRefs,
+  bindVaultProviderAuthority,
   buildApiIntegrationMcpServers,
   buildAutomationAcceptedExecution,
   buildCapabilityCatalog,
   buildFleetContextForSession,
   buildMissingSecretAskCard2 as buildMissingSecretAskCard,
   cancelExternalWorkspaceMemberGrantForRequest,
+  cancelPublishedSiteSession,
   canonicalConfiguredModel,
   canonicalConversationDeliveryCommandJson,
   canonicalConversationDeliveryOutcomeJson,
@@ -28499,8 +29665,10 @@ export {
   createCompanyProfileAgentAdminRouter,
   createCompanyProfileDurableLearningAdapter,
   createGitHubSkillSourceClient,
+  createPinnedRemoteVaultTransport,
   createPublicSkillSearchClient,
   createRealtimeVoiceBilling,
+  createRemoteExternalVaultFactories,
   createRigForApi,
   createRigVersionForApi,
   createRunOnSecretResolver,
@@ -28566,6 +29734,7 @@ export {
   editableArtifactTransactionId,
   effectiveFirstPartyMcpToolCeiling,
   effectiveOrganizationPrivacy,
+  effectiveProviderOperations,
   enableCapability,
   enabledCapabilityMcpToolRefs,
   encodeEditableArtifactBrokerHint,
@@ -28581,6 +29750,10 @@ export {
   externalActorContinuationForAuthorization,
   externalAttributionForAuthorization,
   externalContinuationCommitAuthorizer,
+  externalVaultConnectionDetails,
+  externalVaultConnectionMetadata,
+  externalVaultProviderDomain,
+  externalVaultProviderForConnection,
   fikenConnectionMetadata,
   fileOwnerContextForAccess,
   fileOwnerContextForAgent,
@@ -28596,6 +29769,7 @@ export {
   getAutomationAdapter,
   getConnectorToolPermissions,
   getHumanComposerDraft,
+  getInsightsSiteUsage,
   getInsightsUsage,
   getManagedAuthRequestActorAbortSignal,
   getManagedAuthRequestActorAdmissionStamp,
@@ -28637,6 +29811,7 @@ export {
   installSkill,
   integrationKeyForConnectProvider,
   integrationSourceForOrganizationPolicy,
+  intersectProviderOperations,
   isAcceptedMimeType,
   isAuthenticatedPersonAuthorization,
   isAuthoritativeGitHubRepositorySelectionError,
@@ -28644,6 +29819,7 @@ export {
   isDeveloperSetupAuthorization,
   isDeveloperSetupDelegatedPermissionAllowed,
   isDeveloperSetupGrant,
+  isExternalVaultConnection,
   isFikenConnection,
   isOnePasswordConnection,
   isOpenGeniSlackBotConnection,
@@ -28651,7 +29827,7 @@ export {
   isTerminalVideoGenerationState,
   isTrustedScheduledSlackBotSession,
   isUserMember,
-  isVaultError,
+  isVaultError3 as isVaultError,
   isVerifiedDelegatedHumanAuthorization,
   isVerifiedOrganizationServiceAuthorization,
   isWorkspaceCustomModelId,
@@ -28677,6 +29853,7 @@ export {
   listSkills,
   loadCoreRoutedClaudeCatalogReadiness,
   loadCoreRoutedXaiCatalogReadiness,
+  loadExternalVaultConnection,
   loadOnePasswordConnectionToken,
   loadWorkspaceClaudeSubscriptionReadiness,
   loadWorkspaceCodexCatalogReadiness,
@@ -28731,6 +29908,7 @@ export {
   parseSkillSource,
   pausePrivateScheduledTaskAsAdmin,
   pauseScheduledTaskAsAdmin,
+  pendingVaultCredentialBundle,
   personalAtlassianDelegationsFromVisibleConnections,
   personalConnectionDelegationForServer,
   personalConnectionDelegationSourceForGrant,
@@ -28771,10 +29949,12 @@ export {
   promoteSetupAppendChange,
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
+  providerOperationsForMode,
   providerPrimaryFieldId,
   providerSecretName,
   providerSettingsForSessionSandboxRuntime,
   providerSyncFailure,
+  providerVaultFreshness,
   provisionSandbox,
   publishGovernedLearningEventToSlack,
   readSessionAttachmentFiles,
@@ -28790,6 +29970,7 @@ export {
   recordUserMessageAccepted,
   recordWorkspaceUsage,
   refreshCoreCodexModelEntitlements,
+  refreshLinkedVaults,
   refreshScheduledTaskAccess,
   refreshStaleLinkedVaults,
   registerAutomationAdapter,
@@ -28969,9 +30150,11 @@ export {
   stableJson,
   stampDelegatedHumanAuthorization,
   stampPersonalApiKeyRequest,
+  stampSiteViewerSessionAuthorization,
   statusForVoiceInputError,
   steerAgentSession,
   steerHumanQueuePrompt,
+  storedProviderOperations,
   submitComposerDraftForRequest,
   suggestCapabilityCatalogItems,
   swapActiveSandbox,
@@ -29028,6 +30211,7 @@ export {
   vaultErrorCodeForProvider,
   vaultErrorFromDatabase,
   vaultItemReferences,
+  vaultRefreshScopeKey,
   verifiedDelegatedHumanAuthorizationForRequest,
   verifyDirectModelAccess,
   verifyPrReviewWebhook,