@jini-ai/platform 0.5.1 → 0.5.3

package/dist/net/address.js

@@ -135,95 +135,8 @@ export function isPrivateAddress({ address: addr }) {
     }
     return true; // not a literal IP — caller must resolve before trusting it
 }
-function normalizeBracketedIpv6(hostname) {
-    const stripped = hostname.startsWith('[') && hostname.endsWith(']')
-        ? hostname.slice(1, -1)
-        : hostname;
-    // FQDN trailing-dot form (RFC 1034) resolves identically to the dotless
-    // form, so `localhost.` must normalize to `localhost` before the equality
-    // check below — and `0.0.0.0.`, `10.0.0.1.`, etc. must normalize before
-    // isBlockedIpv4 parses them. Strips one or more trailing dots.
-    return stripped.toLowerCase().replace(/\.+$/, '');
-}
-function parseIpv4(hostname) {
-    const parts = hostname.split('.');
-    if (parts.length !== 4)
-        return null;
-    const parsed = parts.map((part) => {
-        if (!/^\d{1,3}$/.test(part))
-            return null;
-        const value = Number(part);
-        return value >= 0 && value <= 255 ? value : null;
-    });
-    if (parsed.some((part) => part === null))
-        return null;
-    return [parsed[0], parsed[1], parsed[2], parsed[3]];
-}
-function isLoopbackIpv4(hostname) {
-    const parts = parseIpv4(hostname);
-    return Boolean(parts && parts[0] === 127);
-}
-function isBlockedIpv4(hostname) {
-    const parts = parseIpv4(hostname);
-    if (!parts)
-        return false;
-    const [a, b] = parts;
-    return (a === 0 ||
-        (a === 100 && b >= 64 && b <= 127) ||
-        (a === 169 && b === 254) ||
-        a === 10 ||
-        (a === 192 && b === 168) ||
-        (a === 172 && b >= 16 && b <= 31) ||
-        a >= 224);
-}
-function ipv4MappedToDotted(hostname) {
-    const host = normalizeBracketedIpv6(hostname);
-    const mapped = /^::ffff:(.+)$/i.exec(host)?.[1];
-    if (!mapped)
-        return null;
-    if (parseIpv4(mapped.toLowerCase()))
-        return mapped.toLowerCase();
-    const hexParts = mapped.split(':');
-    if (hexParts.length !== 2 ||
-        !hexParts.every((part) => /^[0-9a-f]{1,4}$/i.test(part))) {
-        return null;
-    }
-    // Non-null assertions, not a runtime guard: the length/regex checks above
-    // already guarantee exactly two non-empty hex segments here.
-    const hi = hexParts[0];
-    const lo = hexParts[1];
-    const value = (Number.parseInt(hi, 16) << 16) | Number.parseInt(lo, 16);
-    return [
-        (value >>> 24) & 255,
-        (value >>> 16) & 255,
-        (value >>> 8) & 255,
-        value & 255,
-    ].join('.');
-}
-/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
-export function isLoopbackApiHost({ hostname }) {
-    const host = normalizeBracketedIpv6(hostname);
-    if (host === 'localhost' || host === '::1')
-        return true;
-    if (isLoopbackIpv4(host))
-        return true;
-    const mapped = ipv4MappedToDotted(host);
-    return Boolean(mapped && isLoopbackIpv4(mapped));
-}
-/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
-export function isBlockedExternalApiHostname({ hostname }) {
-    const host = normalizeBracketedIpv6(hostname);
-    if (host === '::')
-        return true;
-    if (isBlockedIpv4(host))
-        return true;
-    if (/^f[cd][0-9a-f]{2}:/i.test(host))
-        return true;
-    if (/^fe[89ab][0-9a-f]:/i.test(host))
-        return true;
-    const mapped = ipv4MappedToDotted(host);
-    return Boolean(mapped && isBlockedIpv4(mapped));
-}
+// Preserve the Node entry's published names while sharing the literal-host owner with browser consumers.
+export { isLoopbackApiHost, isBlockedExternalApiHostname } from './endpoint-policy.js';
 /** True when `hostname` is `localhost`, an IPv6 loopback literal, or a `127.0.0.0/8` IPv4 literal. */
 export function isLoopbackHostname({ hostname }, _optional = {}) {
     const normalized = String(hostname || '')

package/dist/net/endpoint-policy.d.ts

@@ -0,0 +1,9 @@
+/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
+export declare function isLoopbackApiHost({ hostname }: {
+    hostname: string;
+}): boolean;
+/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
+export declare function isBlockedExternalApiHostname({ hostname }: {
+    hostname: string;
+}): boolean;
+//# sourceMappingURL=endpoint-policy.d.ts.map

package/dist/net/endpoint-policy.js

@@ -0,0 +1,98 @@
+/**
+ * Browser-safe literal endpoint hostname policy. No Node imports or DNS effects:
+ * operator-configured local model servers deliberately keep their loopback
+ * exception. Resolved-peer validation and strict IP parsing belong to the Node
+ * adapters, whose different trust boundaries must not be collapsed into this.
+ * SSRF peer classification is distinct from core's browser-development LAN origin allow-list.
+ */
+function normalizeBracketedIpv6(hostname) {
+    const stripped = hostname.startsWith('[') && hostname.endsWith(']')
+        ? hostname.slice(1, -1)
+        : hostname;
+    // FQDN trailing-dot form (RFC 1034) resolves identically to the dotless
+    // form, so `localhost.` must normalize to `localhost` before the equality
+    // check below — and `0.0.0.0.`, `10.0.0.1.`, etc. must normalize before
+    // isBlockedIpv4 parses them. Strips one or more trailing dots.
+    return stripped.toLowerCase().replace(/\.+$/, '');
+}
+function parseIpv4(hostname) {
+    const parts = hostname.split('.');
+    if (parts.length !== 4)
+        return null;
+    const parsed = parts.map((part) => {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const value = Number(part);
+        return value >= 0 && value <= 255 ? value : null;
+    });
+    if (parsed.some((part) => part === null))
+        return null;
+    return [parsed[0], parsed[1], parsed[2], parsed[3]];
+}
+function isLoopbackIpv4(hostname) {
+    const parts = parseIpv4(hostname);
+    return Boolean(parts && parts[0] === 127);
+}
+function isBlockedIpv4(hostname) {
+    const parts = parseIpv4(hostname);
+    if (!parts)
+        return false;
+    const [a, b] = parts;
+    return (a === 0 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        a === 10 ||
+        (a === 192 && b === 168) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        a >= 224);
+}
+/** `::ffff:10.0.0.1` and `::ffff:a00:1` denote the same address; return dotted form so the v4 rules apply. */
+function ipv4MappedToDotted(hostname) {
+    const host = normalizeBracketedIpv6(hostname);
+    const mapped = /^::ffff:(.+)$/i.exec(host)?.[1];
+    if (!mapped)
+        return null;
+    if (parseIpv4(mapped.toLowerCase()))
+        return mapped.toLowerCase();
+    const hexParts = mapped.split(':');
+    if (hexParts.length !== 2 ||
+        !hexParts.every((part) => /^[0-9a-f]{1,4}$/i.test(part))) {
+        return null;
+    }
+    // Non-null assertions, not a runtime guard: the length/regex checks above
+    // already guarantee exactly two non-empty hex segments here.
+    const hi = hexParts[0];
+    const lo = hexParts[1];
+    const value = (Number.parseInt(hi, 16) << 16) | Number.parseInt(lo, 16);
+    return [
+        (value >>> 24) & 255,
+        (value >>> 16) & 255,
+        (value >>> 8) & 255,
+        value & 255,
+    ].join('.');
+}
+/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
+export function isLoopbackApiHost({ hostname }) {
+    const host = normalizeBracketedIpv6(hostname);
+    if (host === 'localhost' || host === '::1')
+        return true;
+    if (isLoopbackIpv4(host))
+        return true;
+    const mapped = ipv4MappedToDotted(host);
+    return Boolean(mapped && isLoopbackIpv4(mapped));
+}
+/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
+export function isBlockedExternalApiHostname({ hostname }) {
+    const host = normalizeBracketedIpv6(hostname);
+    if (host === '::')
+        return true;
+    if (isBlockedIpv4(host))
+        return true;
+    if (/^f[cd][0-9a-f]{2}:/i.test(host))
+        return true;
+    if (/^fe[89ab][0-9a-f]:/i.test(host))
+        return true;
+    const mapped = ipv4MappedToDotted(host);
+    return Boolean(mapped && isBlockedIpv4(mapped));
+}
+//# sourceMappingURL=endpoint-policy.js.map

package/dist/secrets/credential-sets/index.d.ts

@@ -1,4 +1,9 @@
 export type { VendorCredentialSetRecord, VendorCredentialSetSummary, VendorCredentialSetRepoPort } from "./types.js";
 export { buildVendorCredentialAad } from "./aad.js";
 export { InMemoryVendorCredentialSetRepo } from "./repo.memory.js";
+export * from "./vault.types.js";
+export { buildVaultAad } from "./vault.aad.js";
+export { createVaultMetaParsers, isCopyableKind } from "./vault.meta.js";
+export { SecretsVaultService, type VaultServiceDeps, type VaultPutInput, type VaultCopyInput, type VaultCommitPreparedInput } from "./vault.service.js";
+export { InMemoryVaultRepo } from "./vault.repo.memory.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/secrets/credential-sets/index.js

@@ -1,3 +1,8 @@
 export { buildVendorCredentialAad } from "./aad.js";
 export { InMemoryVendorCredentialSetRepo } from "./repo.memory.js";
+export * from "./vault.types.js";
+export { buildVaultAad } from "./vault.aad.js";
+export { createVaultMetaParsers, isCopyableKind } from "./vault.meta.js";
+export { SecretsVaultService } from "./vault.service.js";
+export { InMemoryVaultRepo } from "./vault.repo.memory.js";
 //# sourceMappingURL=index.js.map

package/dist/secrets/credential-sets/repo.memory.d.ts

@@ -1,36 +1,44 @@
 import type { VendorCredentialSetRecord, VendorCredentialSetRepoPort } from "./types.js";
-/** In-memory repository preserving label uniqueness and group default promotion. */
+/**
+ * @file `VendorCredentialSetRepoPort`'s in-memory adapter — the ADR-006 rule-of-two test double,
+ * mirroring `../deployments/publish-credentials/repo.memory.ts`'s shape byte-for-byte with
+ * `providerId` swapped for `vendorId`. See that file's own header for the full reasoning (row
+ * keying, the enforced UNIQUE constraint matching better-sqlite3's own error wording, why no
+ * explicit lock is needed for the `isDefault` group invariant in a single-threaded JS process).
+ */
 export declare class InMemoryVendorCredentialSetRepo implements VendorCredentialSetRepoPort {
-    constructor(_required: Record<string, never>);
+    constructor(_required: Record<string, never>, _optional?: Record<string, never>);
     private readonly rows;
     private static rowKey;
     private assertLabelAvailable;
     private clearOtherDefaults;
-    insert(record: VendorCredentialSetRecord): Promise<void>;
-    update(record: VendorCredentialSetRecord): Promise<void>;
+    insert(record: VendorCredentialSetRecord, _optional?: Record<string, never>): Promise<void>;
+    update(record: VendorCredentialSetRecord, _optional?: Record<string, never>): Promise<void>;
     findById(input: {
         workspaceId: string;
         id: string;
-    }): Promise<VendorCredentialSetRecord | null>;
+    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord | null>;
     findDefaultByVendor(input: {
         workspaceId: string;
         vendorId: string;
-    }): Promise<VendorCredentialSetRecord | null>;
+    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord | null>;
     listByVendor(input: {
         workspaceId: string;
         vendorId: string;
-    }): Promise<VendorCredentialSetRecord[]>;
+    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord[]>;
     listByWorkspace(input: {
         workspaceId: string;
-    }): Promise<VendorCredentialSetRecord[]>;
+    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord[]>;
     delete(input: {
         workspaceId: string;
         id: string;
-    }): Promise<void>;
+    }, _optional?: Record<string, never>): Promise<void>;
+    /** Mirrors the SQLite adapter's targeted single-column write — see
+     *  `VendorCredentialSetRepoPort.updateAccountLabel`'s own doc. No-op if the row vanished. */
     updateAccountLabel(input: {
         workspaceId: string;
         id: string;
         accountLabel: string;
-    }): Promise<void>;
+    }, _optional?: Record<string, never>): Promise<void>;
 }
 //# sourceMappingURL=repo.memory.d.ts.map

package/dist/secrets/credential-sets/repo.memory.js

@@ -1,6 +1,12 @@
-/** In-memory repository preserving label uniqueness and group default promotion. */
+/**
+ * @file `VendorCredentialSetRepoPort`'s in-memory adapter — the ADR-006 rule-of-two test double,
+ * mirroring `../deployments/publish-credentials/repo.memory.ts`'s shape byte-for-byte with
+ * `providerId` swapped for `vendorId`. See that file's own header for the full reasoning (row
+ * keying, the enforced UNIQUE constraint matching better-sqlite3's own error wording, why no
+ * explicit lock is needed for the `isDefault` group invariant in a single-threaded JS process).
+ */
 export class InMemoryVendorCredentialSetRepo {
-    constructor(_required) { }
+    constructor(_required, _optional = {}) { }
     rows = new Map();
     static rowKey(workspaceId, id) {
         return `${workspaceId}::${id}`;
@@ -21,35 +27,35 @@ export class InMemoryVendorCredentialSetRepo {
             this.rows.set(key, { ...row, isDefault: false });
         }
     }
-    async insert(record) {
+    async insert(record, _optional = {}) {
         this.assertLabelAvailable(record.workspaceId, record.vendorId, record.label);
         this.rows.set(InMemoryVendorCredentialSetRepo.rowKey(record.workspaceId, record.id), { ...record });
         if (record.isDefault)
             this.clearOtherDefaults(record.workspaceId, record.vendorId, record.id);
     }
-    async update(record) {
+    async update(record, _optional = {}) {
         this.assertLabelAvailable(record.workspaceId, record.vendorId, record.label, record.id);
         this.rows.set(InMemoryVendorCredentialSetRepo.rowKey(record.workspaceId, record.id), { ...record });
         if (record.isDefault)
             this.clearOtherDefaults(record.workspaceId, record.vendorId, record.id);
     }
-    async findById(input) {
+    async findById(input, _optional = {}) {
         return this.rows.get(InMemoryVendorCredentialSetRepo.rowKey(input.workspaceId, input.id)) ?? null;
     }
-    async findDefaultByVendor(input) {
+    async findDefaultByVendor(input, _optional = {}) {
         for (const row of this.rows.values()) {
             if (row.workspaceId === input.workspaceId && row.vendorId === input.vendorId && row.isDefault)
                 return row;
         }
         return null;
     }
-    async listByVendor(input) {
+    async listByVendor(input, _optional = {}) {
         return [...this.rows.values()].filter((row) => row.workspaceId === input.workspaceId && row.vendorId === input.vendorId);
     }
-    async listByWorkspace(input) {
+    async listByWorkspace(input, _optional = {}) {
         return [...this.rows.values()].filter((row) => row.workspaceId === input.workspaceId);
     }
-    async delete(input) {
+    async delete(input, _optional = {}) {
         const key = InMemoryVendorCredentialSetRepo.rowKey(input.workspaceId, input.id);
         const removed = this.rows.get(key);
         this.rows.delete(key);
@@ -61,7 +67,9 @@ export class InMemoryVendorCredentialSetRepo {
         const promoted = remaining.reduce((latest, row) => (row.updatedAt > latest.updatedAt ? row : latest));
         this.rows.set(InMemoryVendorCredentialSetRepo.rowKey(promoted.workspaceId, promoted.id), { ...promoted, isDefault: true });
     }
-    async updateAccountLabel(input) {
+    /** Mirrors the SQLite adapter's targeted single-column write — see
+     *  `VendorCredentialSetRepoPort.updateAccountLabel`'s own doc. No-op if the row vanished. */
+    async updateAccountLabel(input, _optional = {}) {
         const key = InMemoryVendorCredentialSetRepo.rowKey(input.workspaceId, input.id);
         const existing = this.rows.get(key);
         if (!existing)

package/dist/secrets/credential-sets/vault.aad.d.ts

@@ -0,0 +1,4 @@
+import type { VaultIdentity, VaultOptions } from "./vault.types.js";
+/** JSON tuple encoding prevents colons or separators in host identifiers aliasing another row. */
+export declare function buildVaultAad(input: VaultIdentity, _options?: VaultOptions): string;
+//# sourceMappingURL=vault.aad.d.ts.map

package/dist/secrets/credential-sets/vault.aad.js

@@ -0,0 +1,8 @@
+import { formatAad } from "../aad.js";
+/** JSON tuple encoding prevents colons or separators in host identifiers aliasing another row. */
+export function buildVaultAad(input, _options = {}) {
+    return formatAad({ kind: "secrets-vault", version: "v1", parts: [JSON.stringify([
+                input.workspaceId, input.id, input.kind, input.ownerKey, input.principalId, input.binding,
+            ])] });
+}
+//# sourceMappingURL=vault.aad.js.map

package/dist/secrets/credential-sets/vault.meta.d.ts

@@ -0,0 +1,10 @@
+import { type VaultKind, type VaultMetaParsers, type VaultOptions } from "./vault.types.js";
+/** Copy eligibility lives with the kind contracts; MCP rows require their server configuration. */
+export declare const isCopyableKind: Readonly<Record<VaultKind, boolean>>;
+/** Minimal structural parsers. Hosts inject catalog, URL/origin and safe-metadata policy here;
+ * secrets stay in payload JSON. Overrides own the complete shape, including merged patches.
+ */
+export declare function createVaultMetaParsers(_required: VaultOptions, { parsers }?: {
+    parsers?: Partial<VaultMetaParsers>;
+}): VaultMetaParsers;
+//# sourceMappingURL=vault.meta.d.ts.map

package/dist/secrets/credential-sets/vault.meta.js

@@ -0,0 +1,52 @@
+import { VAULT_KINDS, VaultError } from "./vault.types.js";
+/** Copy eligibility lives with the kind contracts; MCP rows require their server configuration. */
+export const isCopyableKind = Object.freeze({
+    "site-assistant": true, "personal-execution": false, "media-provider": true, custom: true,
+    "publish-peer": true, "database-destination": true, vendor: true, "source-control": true,
+    "mcp-env": false, "mcp-auth": false,
+});
+const FIELDS = {
+    "site-assistant": { baseUrl: "string", model: "string" },
+    "personal-execution": { protocol: "string", baseUrl: "string", model: "string", maxTokens: "number" },
+    "media-provider": { baseUrl: "string", model: "string" },
+    custom: { category: "string", baseUrl: "string", additionalHosts: "strings", username: "string" },
+    "publish-peer": { baseUrl: "string", remoteWorkspaceId: "string" },
+    "database-destination": { description: "object", lastRun: "object" },
+    vendor: { accountLabel: "string" }, "source-control": { accountLabel: "string" },
+    "mcp-env": {}, "mcp-auth": {},
+};
+function isObject(value) {
+    return value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
+}
+function isJson(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every(isJson);
+    return isObject(value) && Object.keys(value).every(key => !["__proto__", "constructor", "prototype"].includes(key) && isJson(value[key]));
+}
+/** Minimal structural parsers. Hosts inject catalog, URL/origin and safe-metadata policy here;
+ * secrets stay in payload JSON. Overrides own the complete shape, including merged patches.
+ */
+export function createVaultMetaParsers(_required, { parsers = {} } = {}) {
+    return Object.fromEntries(VAULT_KINDS.map(kind => [kind, ({ meta }) => {
+            if (!isObject(meta) || !isJson(meta) || Object.keys(meta).some(key => !/^[A-Za-z0-9_]+$/.test(key)))
+                throw new VaultError({ code: "invalid-meta" });
+            if (parsers[kind]) {
+                const parsed = parsers[kind]({ meta: structuredClone(meta) });
+                if (!isObject(parsed) || !isJson(parsed) || Object.keys(parsed).some(key => !/^[A-Za-z0-9_]+$/.test(key)))
+                    throw new VaultError({ code: "invalid-meta" });
+                return structuredClone(parsed);
+            }
+            for (const [key, value] of Object.entries(meta)) {
+                const field = Object.hasOwn(FIELDS[kind], key) ? FIELDS[kind][key] : undefined;
+                if (!field || (value !== null && !(field === "strings" ? Array.isArray(value) && value.every(v => typeof v === "string") :
+                    field === "object" ? isObject(value) : typeof value === field)))
+                    throw new VaultError({ code: "invalid-meta" });
+            }
+            return structuredClone(meta);
+        }]));
+}
+//# sourceMappingURL=vault.meta.js.map

package/dist/secrets/credential-sets/vault.repo.memory.d.ts

@@ -0,0 +1,51 @@
+import { type VaultBatchOp, type VaultBatchResult, type VaultDefaultQuery, type VaultSingletonQuery, type VaultMeta, type VaultOptions, type VaultQuery, type VaultRecord, type VaultRepoPort } from "./vault.types.js";
+/** Single-turn mutations are atomic in JS; clones prevent callers bypassing CAS through aliases. */
+export declare class InMemoryVaultRepo implements VaultRepoPort {
+    private rows;
+    private singletons;
+    constructor(_required: VaultOptions, _options?: VaultOptions);
+    private key;
+    find(input: {
+        workspaceId: string;
+        id: string;
+    }, _options?: VaultOptions): Promise<VaultRecord | null>;
+    private singletonKey;
+    /** Index all four optional scope combinations; copy sets so batch staging never mutates live indexes. */
+    private indexSingleton;
+    /** Indexed singleton selection; clone only the selected row, ignoring provider/default. */
+    findOne(input: VaultSingletonQuery, _options?: VaultOptions): Promise<VaultRecord | null>;
+    /** Stage through the same mutation owner, then publish once. No await can expose partial rows
+     * or let a concurrent writer be lost between snapshot and swap. O(n + ops*n) fixture work.
+     */
+    applyBatch({ ops }: {
+        ops: readonly VaultBatchOp[];
+    }, _options?: VaultOptions): Promise<VaultBatchResult[]>;
+    /** O(n) memory scan, n stored rows; clones only the default, never its siblings. */
+    findDefault(input: VaultDefaultQuery, _options?: VaultOptions): Promise<VaultRecord | null>;
+    list(input: VaultQuery, _options?: VaultOptions): Promise<VaultRecord[]>;
+    put(input: {
+        record: VaultRecord;
+        expectedRevision: number | null;
+    }, _options?: VaultOptions): Promise<VaultRecord>;
+    /** Synchronous mutation owner shared with batch staging; default moves never re-seal. */
+    private putRecord;
+    patchMeta(input: {
+        workspaceId: string;
+        id: string;
+        expectedRevision: number;
+        patch: VaultMeta;
+        updatedAt: string;
+    }, _options?: VaultOptions): Promise<VaultRecord>;
+    /** Clone merged metadata before mutating the staged/live map so failures leave it intact. */
+    private patchRecord;
+    delete(input: {
+        workspaceId: string;
+        id: string;
+        expectedRevision: number;
+    }, _options?: VaultOptions): Promise<boolean>;
+    /** Synchronous CAS delete shares promotion with provider moves and batch staging. */
+    private deleteRecord;
+    /** O(n) winner scan; promotion changes only default/revision, matching SQL. */
+    private promote;
+}
+//# sourceMappingURL=vault.repo.memory.d.ts.map

package/dist/secrets/credential-sets/vault.repo.memory.js

@@ -0,0 +1,148 @@
+import { assertVaultReplacement, vaultGroupKey, VaultError } from "./vault.types.js";
+/** Single-turn mutations are atomic in JS; clones prevent callers bypassing CAS through aliases. */
+export class InMemoryVaultRepo {
+    rows = new Map();
+    singletons = new Map();
+    constructor(_required, _options = {}) { }
+    key(input) { return JSON.stringify([input.workspaceId, input.id]); }
+    async find(input, _options = {}) {
+        return structuredClone(this.rows.get(this.key(input)) ?? null);
+    }
+    singletonKey(input) {
+        return JSON.stringify([input.workspaceId, input.kind, input.ownerKey !== undefined, input.ownerKey ?? null,
+            input.principalId !== undefined, input.principalId ?? null]);
+    }
+    /** Index all four optional scope combinations; copy sets so batch staging never mutates live indexes. */
+    indexSingleton({ record, remove }, _options = {}) {
+        for (const ownerKey of [undefined, record.ownerKey])
+            for (const principalId of [undefined, record.principalId]) {
+                const scope = this.singletonKey({ workspaceId: record.workspaceId, kind: record.kind, ownerKey, principalId });
+                const ids = new Set(this.singletons.get(scope));
+                if (remove)
+                    ids.delete(this.key(record));
+                else
+                    ids.add(this.key(record));
+                if (ids.size)
+                    this.singletons.set(scope, ids);
+                else
+                    this.singletons.delete(scope);
+            }
+    }
+    /** Indexed singleton selection; clone only the selected row, ignoring provider/default. */
+    async findOne(input, _options = {}) {
+        const id = this.singletons.get(this.singletonKey(input))?.values().next().value;
+        return structuredClone(id === undefined ? null : this.rows.get(id));
+    }
+    /** Stage through the same mutation owner, then publish once. No await can expose partial rows
+     * or let a concurrent writer be lost between snapshot and swap. O(n + ops*n) fixture work.
+     */
+    async applyBatch({ ops }, _options = {}) {
+        const staged = new InMemoryVaultRepo({});
+        staged.rows = new Map(this.rows);
+        staged.singletons = new Map(this.singletons);
+        const results = ops.map(op => {
+            if ("put" in op)
+                return staged.putRecord(op.put);
+            if ("delete" in op)
+                return staged.deleteRecord(op.delete);
+            return staged.patchRecord(op.patchMeta);
+        });
+        this.rows = staged.rows;
+        this.singletons = staged.singletons;
+        return results;
+    }
+    /** O(n) memory scan, n stored rows; clones only the default, never its siblings. */
+    async findDefault(input, _options = {}) {
+        for (const row of this.rows.values()) {
+            if (row.isDefault && row.workspaceId === input.workspaceId && row.kind === input.kind && row.ownerKey === input.ownerKey &&
+                row.principalId === input.principalId && row.provider === input.provider)
+                return structuredClone(row);
+        }
+        return null;
+    }
+    async list(input, _options = {}) {
+        return structuredClone([...this.rows.values()].filter(row => row.workspaceId === input.workspaceId && row.kind === input.kind &&
+            row.ownerKey === input.ownerKey && row.principalId === input.principalId && (input.provider === undefined || row.provider === input.provider))
+            .sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    }
+    async put(input, _options = {}) {
+        return this.putRecord(input);
+    }
+    /** Synchronous mutation owner shared with batch staging; default moves never re-seal. */
+    putRecord(input, _options = {}) {
+        const { record } = input;
+        const key = this.key(record);
+        const existing = this.rows.get(key) ?? null;
+        assertVaultReplacement({ ...input, existing });
+        const groupKey = vaultGroupKey({ record });
+        let hasGroup = false;
+        for (const row of this.rows.values())
+            if (vaultGroupKey({ record: row }) === groupKey) {
+                hasGroup = true;
+                if (row.id !== record.id && row.label === record.label)
+                    throw new VaultError({ code: "conflict" });
+            }
+        const saved = structuredClone({ ...record, isDefault: record.isDefault || !hasGroup });
+        // Clear first, matching a SQL partial UNIQUE index; no transient duplicate default is required.
+        if (saved.isDefault)
+            for (const row of this.rows.values()) {
+                if (row.id !== saved.id && row.isDefault && vaultGroupKey({ record: row }) === groupKey) {
+                    this.rows.set(this.key(row), { ...row, isDefault: false, revision: row.revision + 1 });
+                }
+            }
+        this.rows.set(key, saved);
+        if (!existing)
+            this.indexSingleton({ record: saved, remove: false });
+        if (existing?.isDefault && vaultGroupKey({ record: existing }) !== groupKey)
+            this.promote({ record: existing });
+        return structuredClone(saved);
+    }
+    async patchMeta(input, _options = {}) {
+        return this.patchRecord(input);
+    }
+    /** Clone merged metadata before mutating the staged/live map so failures leave it intact. */
+    patchRecord(input, _options = {}) {
+        const key = this.key(input);
+        const existing = this.rows.get(key);
+        if (existing?.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        const saved = { ...existing, meta: structuredClone({ ...existing.meta, ...input.patch }), updatedAt: input.updatedAt, revision: existing.revision + 1 };
+        this.rows.set(key, saved);
+        return structuredClone(saved);
+    }
+    async delete(input, _options = {}) {
+        return this.deleteRecord(input);
+    }
+    /** Synchronous CAS delete shares promotion with provider moves and batch staging. */
+    deleteRecord(input, _options = {}) {
+        const key = this.key(input);
+        const existing = this.rows.get(key);
+        if (!existing)
+            return false;
+        if (existing.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        this.rows.delete(key);
+        this.indexSingleton({ record: existing, remove: true });
+        if (existing.isDefault)
+            this.promote({ record: existing });
+        return true;
+    }
+    /** O(n) winner scan; promotion changes only default/revision, matching SQL. */
+    promote({ record }, _options = {}) {
+        const groupKey = vaultGroupKey({ record });
+        let promoted;
+        // SQL BINARY/C compares UTF-8 bytes; JS's UTF-16 order differs for supplementary IDs.
+        for (const row of this.rows.values()) {
+            if (vaultGroupKey({ record: row }) === groupKey && (!promoted || row.updatedAt > promoted.updatedAt ||
+                (row.updatedAt === promoted.updatedAt && Buffer.compare(Buffer.from(row.id), Buffer.from(promoted.id)) > 0))) {
+                promoted = { id: row.id, updatedAt: row.updatedAt };
+            }
+        }
+        if (promoted) {
+            const promotedKey = this.key({ workspaceId: record.workspaceId, id: promoted.id });
+            const row = this.rows.get(promotedKey);
+            this.rows.set(promotedKey, { ...row, isDefault: true, revision: row.revision + 1 });
+        }
+    }
+}
+//# sourceMappingURL=vault.repo.memory.js.map