@opengeni/worker-bundle 3.1.2 → 3.2.2

package/dist/external-vault-providers.d.ts

@@ -0,0 +1,29 @@
+import type { Settings } from "@opengeni/config";
+import type { ExternalVaultProviderFactories } from "@opengeni/core";
+import { type PinnedFetchOptions } from "@opengeni/network";
+import type { KeeperRuntimeOptions } from "@opengeni/vaults-keeper";
+/** Test seams only; production passes nothing. */
+export type NativeExternalVaultOptions = {
+    keeper?: Pick<KeeperRuntimeOptions, "queryFunction" | "fetchFile" | "sdk">;
+    /** Applies when this call creates the pool for its CLI path. */
+    protonpass?: {
+        stateRoot?: string;
+        hostEnv?: Readonly<Record<string, string | undefined>>;
+    };
+};
+/**
+ * Native external vault adapters that run inside this server: Keeper Secrets
+ * Manager always, Proton Pass only when the operator installed `pass-cli`
+ * (`OPENGENI_PROTON_PASS_CLI_PATH`). Both packages load through `import()`
+ * on first use (packages/vaults-keeper/test/import-guard.test.ts). Keep this
+ * file identical to apps/api/src/integrations/external-vault-providers.ts.
+ */
+export declare function createNativeExternalVaultFactories(settings: Settings, options?: NativeExternalVaultOptions): ExternalVaultProviderFactories;
+/** Logs out every pooled Proton Pass CLI session and wipes its state (graceful shutdown). */
+export declare function closeNativeExternalVaultProviders(): Promise<void>;
+/**
+ * The fetch every Keeper request and file download uses: DNS-pinned and
+ * policy-checked (no private or special-use targets). The adapter adds
+ * HTTPS-only, no redirects, deadlines, size bounds and the caller's abort.
+ */
+export declare function nativeKeeperFetch(settings: Settings, pinned?: Pick<PinnedFetchOptions, "dnsLookup" | "fetchImpl" | "agentFactory">): (input: string | URL, init: RequestInit) => Promise<Response>;

package/dist/index.js

@@ -1,6 +1,9 @@
 import {
   createHostExportPump
 } from "./chunk-4ER3YXOT.js";
+import {
+  closeNativeExternalVaultProviders
+} from "./chunk-K225DMA7.js";
 import {
   CONTROL_WORKER_MAX_CACHED_WORKFLOWS,
   CONTROL_WORKER_MAX_CONCURRENT_ACTIVITIES,
@@ -794,7 +797,7 @@ async function internalMaintenanceCadences(input) {
     assertSandboxReaperActivityTimeout(settings);
     const periodMs = settings.sandboxLeaseReaperPeriodMs;
     const lifecycleQueue = sandboxLifecycleTaskQueue(taskQueue);
-    const sandbox = await import("./sandbox-lease-BJYU72N3.js");
+    const sandbox = await import("./sandbox-lease-F47EDHHY.js");
     if (jobs.has("sandbox-lease-reaper")) {
       const { SANDBOX_CHECKPOINT_GC_CLAIM_TTL_MS } = sandbox;
       cadences.push({
@@ -1434,7 +1437,7 @@ async function createDefaultWorkerActivities(role, dependencies = {}) {
   if (dependencies.objectStorage == null) {
     prepareObjectStorageProvider(dependencies.settings ?? getSettings());
   }
-  return role === "control" ? (await import("./activities-control-ROJJNNTJ.js")).createControlActivities(dependencies) : (await import("./activities-turn-4SWYWKI5.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-LC7WXEIX.js")).createControlActivities(dependencies) : (await import("./activities-turn-PEDPUZI4.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");
@@ -2128,7 +2131,12 @@ async function startWorker() {
       }
     });
   } finally {
-    await Promise.allSettled([bus?.close(), readinessDbClient.close(), dbClient.close()]);
+    await Promise.allSettled([
+      closeNativeExternalVaultProviders(),
+      bus?.close(),
+      readinessDbClient.close(),
+      dbClient.close()
+    ]);
     disposeUnhandledRejectionBoundary();
   }
 }