@jini-ai/platform 0.5.2 → 0.5.4

package/dist/secrets/credential-sets/vault.repo.memory.js

@@ -0,0 +1,148 @@
+import { assertVaultReplacement, vaultGroupKey, VaultError } from "./vault.types.js";
+/** Single-turn mutations are atomic in JS; clones prevent callers bypassing CAS through aliases. */
+export class InMemoryVaultRepo {
+    rows = new Map();
+    singletons = new Map();
+    constructor(_required, _options = {}) { }
+    key(input) { return JSON.stringify([input.workspaceId, input.id]); }
+    async find(input, _options = {}) {
+        return structuredClone(this.rows.get(this.key(input)) ?? null);
+    }
+    singletonKey(input) {
+        return JSON.stringify([input.workspaceId, input.kind, input.ownerKey !== undefined, input.ownerKey ?? null,
+            input.principalId !== undefined, input.principalId ?? null]);
+    }
+    /** Index all four optional scope combinations; copy sets so batch staging never mutates live indexes. */
+    indexSingleton({ record, remove }, _options = {}) {
+        for (const ownerKey of [undefined, record.ownerKey])
+            for (const principalId of [undefined, record.principalId]) {
+                const scope = this.singletonKey({ workspaceId: record.workspaceId, kind: record.kind, ownerKey, principalId });
+                const ids = new Set(this.singletons.get(scope));
+                if (remove)
+                    ids.delete(this.key(record));
+                else
+                    ids.add(this.key(record));
+                if (ids.size)
+                    this.singletons.set(scope, ids);
+                else
+                    this.singletons.delete(scope);
+            }
+    }
+    /** Indexed singleton selection; clone only the selected row, ignoring provider/default. */
+    async findOne(input, _options = {}) {
+        const id = this.singletons.get(this.singletonKey(input))?.values().next().value;
+        return structuredClone(id === undefined ? null : this.rows.get(id));
+    }
+    /** Stage through the same mutation owner, then publish once. No await can expose partial rows
+     * or let a concurrent writer be lost between snapshot and swap. O(n + ops*n) fixture work.
+     */
+    async applyBatch({ ops }, _options = {}) {
+        const staged = new InMemoryVaultRepo({});
+        staged.rows = new Map(this.rows);
+        staged.singletons = new Map(this.singletons);
+        const results = ops.map(op => {
+            if ("put" in op)
+                return staged.putRecord(op.put);
+            if ("delete" in op)
+                return staged.deleteRecord(op.delete);
+            return staged.patchRecord(op.patchMeta);
+        });
+        this.rows = staged.rows;
+        this.singletons = staged.singletons;
+        return results;
+    }
+    /** O(n) memory scan, n stored rows; clones only the default, never its siblings. */
+    async findDefault(input, _options = {}) {
+        for (const row of this.rows.values()) {
+            if (row.isDefault && row.workspaceId === input.workspaceId && row.kind === input.kind && row.ownerKey === input.ownerKey &&
+                row.principalId === input.principalId && row.provider === input.provider)
+                return structuredClone(row);
+        }
+        return null;
+    }
+    async list(input, _options = {}) {
+        return structuredClone([...this.rows.values()].filter(row => row.workspaceId === input.workspaceId && row.kind === input.kind &&
+            row.ownerKey === input.ownerKey && row.principalId === input.principalId && (input.provider === undefined || row.provider === input.provider))
+            .sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    }
+    async put(input, _options = {}) {
+        return this.putRecord(input);
+    }
+    /** Synchronous mutation owner shared with batch staging; default moves never re-seal. */
+    putRecord(input, _options = {}) {
+        const { record } = input;
+        const key = this.key(record);
+        const existing = this.rows.get(key) ?? null;
+        assertVaultReplacement({ ...input, existing });
+        const groupKey = vaultGroupKey({ record });
+        let hasGroup = false;
+        for (const row of this.rows.values())
+            if (vaultGroupKey({ record: row }) === groupKey) {
+                hasGroup = true;
+                if (row.id !== record.id && row.label === record.label)
+                    throw new VaultError({ code: "conflict" });
+            }
+        const saved = structuredClone({ ...record, isDefault: record.isDefault || !hasGroup });
+        // Clear first, matching a SQL partial UNIQUE index; no transient duplicate default is required.
+        if (saved.isDefault)
+            for (const row of this.rows.values()) {
+                if (row.id !== saved.id && row.isDefault && vaultGroupKey({ record: row }) === groupKey) {
+                    this.rows.set(this.key(row), { ...row, isDefault: false, revision: row.revision + 1 });
+                }
+            }
+        this.rows.set(key, saved);
+        if (!existing)
+            this.indexSingleton({ record: saved, remove: false });
+        if (existing?.isDefault && vaultGroupKey({ record: existing }) !== groupKey)
+            this.promote({ record: existing });
+        return structuredClone(saved);
+    }
+    async patchMeta(input, _options = {}) {
+        return this.patchRecord(input);
+    }
+    /** Clone merged metadata before mutating the staged/live map so failures leave it intact. */
+    patchRecord(input, _options = {}) {
+        const key = this.key(input);
+        const existing = this.rows.get(key);
+        if (existing?.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        const saved = { ...existing, meta: structuredClone({ ...existing.meta, ...input.patch }), updatedAt: input.updatedAt, revision: existing.revision + 1 };
+        this.rows.set(key, saved);
+        return structuredClone(saved);
+    }
+    async delete(input, _options = {}) {
+        return this.deleteRecord(input);
+    }
+    /** Synchronous CAS delete shares promotion with provider moves and batch staging. */
+    deleteRecord(input, _options = {}) {
+        const key = this.key(input);
+        const existing = this.rows.get(key);
+        if (!existing)
+            return false;
+        if (existing.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        this.rows.delete(key);
+        this.indexSingleton({ record: existing, remove: true });
+        if (existing.isDefault)
+            this.promote({ record: existing });
+        return true;
+    }
+    /** O(n) winner scan; promotion changes only default/revision, matching SQL. */
+    promote({ record }, _options = {}) {
+        const groupKey = vaultGroupKey({ record });
+        let promoted;
+        // SQL BINARY/C compares UTF-8 bytes; JS's UTF-16 order differs for supplementary IDs.
+        for (const row of this.rows.values()) {
+            if (vaultGroupKey({ record: row }) === groupKey && (!promoted || row.updatedAt > promoted.updatedAt ||
+                (row.updatedAt === promoted.updatedAt && Buffer.compare(Buffer.from(row.id), Buffer.from(promoted.id)) > 0))) {
+                promoted = { id: row.id, updatedAt: row.updatedAt };
+            }
+        }
+        if (promoted) {
+            const promotedKey = this.key({ workspaceId: record.workspaceId, id: promoted.id });
+            const row = this.rows.get(promotedKey);
+            this.rows.set(promotedKey, { ...row, isDefault: true, revision: row.revision + 1 });
+        }
+    }
+}
+//# sourceMappingURL=vault.repo.memory.js.map

package/dist/secrets/credential-sets/vault.service.d.ts

@@ -0,0 +1,115 @@
+import type { KeyringPort, SecretSealerPort } from "../ports.js";
+import { type VaultContext, type VaultIdentity, type VaultMeta, type VaultMetaParsers, type VaultCopyResult, type VaultDefaultQuery, type VaultOptions, type VaultQuery, type VaultRecord, type VaultRepoPort, type VaultSummary } from "./vault.types.js";
+export interface VaultServiceDeps {
+    repo: VaultRepoPort;
+    keyring: KeyringPort;
+    sealer: SecretSealerPort;
+    metaParsers: VaultMetaParsers;
+    /** Host policy must throw on denial. No permissive default is provided. */
+    authorize: (input: {
+        action: "put" | "get" | "list" | "rotate" | "delete";
+        context: VaultContext | VaultIdentity | VaultQuery;
+    }) => Promise<void>;
+    now: (input: VaultOptions) => string;
+    newId: (input: VaultOptions) => string;
+}
+export interface VaultPutInput extends VaultContext {
+    /** Omit for creation with an injected ID. Replacement requires id and expectedRevision. */
+    id?: string;
+    expectedRevision: number | null;
+    provider: string | null;
+    label: string;
+    meta: unknown;
+    /** null clears; omitted on replacement preserves the envelope/hint without opening or sealing.
+     * Creation requires a payload (which may be null). Payloads are always sealed JSON.
+     */
+    payload?: VaultMeta | null | undefined;
+    /** Omitted preserves same-group default status; a provider move starts with false and the
+     * repository applies its first-row rule. Explicit true selects the destination default.
+     */
+    isDefault?: boolean;
+    /** A host-selected token, never a URI or serialized connection object. */
+    hintToken?: string;
+}
+export interface VaultCopyInput {
+    /** This service owns the source repository, authorization and keyring-backed sealer. */
+    source: SecretsVaultService;
+    sourceContext: VaultContext;
+    targetContext: VaultContext;
+    ids: readonly string[];
+    overwrite: boolean;
+    /** Optional selection-time guard; otherwise the revisions read by this operation are used. */
+    sourceRevisions?: Readonly<Record<string, number>>;
+}
+/** Shared vault lifecycle. Policy/catalogs are injected; persistence and encryption are ports.
+ * Expected context is checked before opening. Normal reads have no legacy-AAD fallback.
+ * Metadata reads never need keys, and every merged patch is parsed before CAS persistence.
+ */
+export declare class SecretsVaultService {
+    private readonly deps;
+    constructor(deps: VaultServiceDeps, _options?: VaultOptions);
+    private authorize;
+    private parse;
+    private find;
+    private seal;
+    private open;
+    /** Create/replace configuration and a sealed JSON payload. Throws on policy, validation or CAS failure. */
+    put(input: VaultPutInput, _options?: VaultOptions): Promise<VaultSummary>;
+    /** Authorize, validate and seal before the host enters its transaction, without persisting.
+     * Replacements retain identity/createdAt; omitted payload preserves the existing envelope.
+     * Commit must CAS again because preparation does not reserve a revision or a default.
+     * Prepared records contain envelopes and stay private to the host, never a public read model.
+     * @example const record = await vault.prepare(input); await repo.put({ record, expectedRevision: input.expectedRevision }); // inside the host transaction
+     */
+    prepare(input: VaultPutInput, _options?: VaultOptions): Promise<VaultRecord>;
+    /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
+    get(input: VaultIdentity, _options?: VaultOptions): Promise<{
+        summary: VaultSummary;
+        payload: VaultMeta | null;
+    } | null>;
+    /** Singleton runtime read using one provider-independent lookup. Full expected ownership and
+     * binding are required before policy/decryption; repo callers may use a broader selection scope.
+     * @example await vault.findOne({ workspaceId, kind: "site-assistant", ownerKey: "assistant", principalId: null, binding: null });
+     */
+    findOne(input: VaultContext, _options?: VaultOptions): Promise<{
+        summary: VaultSummary;
+        payload: VaultMeta | null;
+    } | null>;
+    /** Authorized default read using one exact-group query; ownership is checked before opening.
+     * @throws On policy, context, metadata or authentication failure.
+     * @complexity One indexed row lookup, then O(payload size) decryption.
+     */
+    findDefault(input: VaultDefaultQuery & {
+        binding: string | null;
+    }, _options?: VaultOptions): Promise<{
+        summary: VaultSummary;
+        payload: VaultMeta | null;
+    } | null>;
+    /** Copy selected rows into this service without exposing plaintext or envelopes. Each ID is
+     * attempted once; failures are isolated and raw adapter/policy/crypto errors never escape.
+     * Source reads are plain SELECTs; this operation never upgrades or writes the source.
+     * @throws VaultError for invalid scopes. Per-row failures use fixed reason codes.
+     * @complexity O(n + payload bytes), n unique IDs; sequential bounded row reads and CAS writes.
+     */
+    copyToSite(input: VaultCopyInput, _options?: VaultOptions): Promise<VaultCopyResult[]>;
+    /** One transfer reuses both services' parsing/open/seal and the repository's default/CAS owner.
+     * @complexity Constant row queries plus O(payload size); no group read or source transaction.
+     */
+    private copyRow;
+    /** Human-managed scoped inventory. No envelope or plaintext is opened or returned. */
+    list(input: VaultQuery, _options?: VaultOptions): Promise<VaultSummary[]>;
+    /** Merge and validate complete metadata, then target only changed JSON keys with revision CAS. */
+    patchMeta(input: VaultIdentity & {
+        expectedRevision: number;
+        patch: VaultMeta;
+    }, _options?: VaultOptions): Promise<VaultSummary>;
+    /** Re-seal using the active key; concurrent replacement wins through CAS. Metadata-only rows persist. */
+    rotate(input: VaultIdentity & {
+        expectedRevision: number;
+    }, _options?: VaultOptions): Promise<VaultSummary>;
+    /** Idempotent for missing rows; existing rows require matching context and revision. */
+    delete(input: VaultIdentity & {
+        expectedRevision: number;
+    }, _options?: VaultOptions): Promise<boolean>;
+}
+//# sourceMappingURL=vault.service.d.ts.map

package/dist/secrets/credential-sets/vault.service.js

@@ -0,0 +1,273 @@
+import { credentialTokenHint } from "../credential-token.js";
+import { buildVaultAad } from "./vault.aad.js";
+import { isCopyableKind } from "./vault.meta.js";
+import { VAULT_KINDS, VaultError } from "./vault.types.js";
+function assertContext(context) {
+    if (typeof context.workspaceId !== "string" || !context.workspaceId || typeof context.ownerKey !== "string" || !context.ownerKey ||
+        !VAULT_KINDS.includes(context.kind) || (context.principalId !== null && typeof context.principalId !== "string") ||
+        ("binding" in context && context.binding !== null && typeof context.binding !== "string") ||
+        (context.kind === "personal-execution" && !context.principalId))
+        throw new VaultError({ code: "context" });
+}
+function summary(record) {
+    // Enumerate the read model: an adapter's extra runtime properties cannot become API fields.
+    return { workspaceId: record.workspaceId, id: record.id, kind: record.kind, ownerKey: record.ownerKey,
+        principalId: record.principalId, binding: record.binding, provider: record.provider, label: record.label,
+        isDefault: record.isDefault, revision: record.revision, tokenLength: record.tokenLength,
+        last4: record.tokenLength !== null && record.tokenLength >= 12 ? record.last4?.slice(-4) ?? null : null,
+        meta: record.meta, createdAt: record.createdAt, updatedAt: record.updatedAt, configured: record.sealed !== null };
+}
+/** Shared vault lifecycle. Policy/catalogs are injected; persistence and encryption are ports.
+ * Expected context is checked before opening. Normal reads have no legacy-AAD fallback.
+ * Metadata reads never need keys, and every merged patch is parsed before CAS persistence.
+ */
+export class SecretsVaultService {
+    deps;
+    constructor(deps, _options = {}) {
+        this.deps = deps;
+    }
+    authorize(input) {
+        const context = input.context;
+        // Policy adapters receive only scope, never a put payload or a metadata patch through an
+        // extra-property alias. This also keeps ordinary authorization diagnostics secret-free.
+        return this.deps.authorize({ action: input.action, context: { workspaceId: context.workspaceId,
+                kind: context.kind, ownerKey: context.ownerKey, principalId: context.principalId,
+                ...("binding" in context ? { binding: context.binding } : {}),
+                ...("id" in context ? { id: context.id } : {}),
+                ...("provider" in context && context.provider !== undefined ? { provider: context.provider } : {}) } });
+    }
+    parse(record) {
+        assertContext(record);
+        return { ...record, meta: this.deps.metaParsers[record.kind]({ meta: record.meta }) };
+    }
+    async find(input) {
+        const record = await this.deps.repo.find({ workspaceId: input.workspaceId, id: input.id });
+        if (!record)
+            return null;
+        if (buildVaultAad(input) !== buildVaultAad(record))
+            throw new VaultError({ code: "context" });
+        return this.parse(record);
+    }
+    async seal(input) {
+        if (input.payload === null)
+            return null;
+        // JSON round-trip makes the payload contract explicit; encryption never receives an object
+        // coerced to '[object Object]' or a connection URI masquerading as an entire payload.
+        if (typeof input.payload !== "object" || Array.isArray(input.payload))
+            throw new VaultError({ code: "invalid-record" });
+        const plaintext = JSON.stringify(input.payload);
+        return this.deps.sealer.seal({ plaintext, key: await this.deps.keyring.activeKey({}), aad: buildVaultAad(input.context) });
+    }
+    async open(record) {
+        if (!record.sealed)
+            return null;
+        const plaintext = await this.deps.sealer.open({ sealed: record.sealed }, { aad: buildVaultAad(record) });
+        let payload;
+        try {
+            payload = JSON.parse(plaintext);
+        }
+        catch {
+            throw new VaultError({ code: "invalid-record" });
+        }
+        if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+            throw new VaultError({ code: "invalid-record" });
+        return payload;
+    }
+    /** Create/replace configuration and a sealed JSON payload. Throws on policy, validation or CAS failure. */
+    async put(input, _options = {}) {
+        const record = await this.prepare(input);
+        return summary(this.parse(await this.deps.repo.put({ record, expectedRevision: input.expectedRevision })));
+    }
+    /** Authorize, validate and seal before the host enters its transaction, without persisting.
+     * Replacements retain identity/createdAt; omitted payload preserves the existing envelope.
+     * Commit must CAS again because preparation does not reserve a revision or a default.
+     * Prepared records contain envelopes and stay private to the host, never a public read model.
+     * @example const record = await vault.prepare(input); await repo.put({ record, expectedRevision: input.expectedRevision }); // inside the host transaction
+     */
+    async prepare(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "put", context: input });
+        if (input.expectedRevision !== null && !input.id)
+            throw new VaultError({ code: "conflict" });
+        const identity = { workspaceId: input.workspaceId, kind: input.kind, ownerKey: input.ownerKey,
+            principalId: input.principalId, binding: input.binding, id: input.id ?? this.deps.newId({}) };
+        const existing = await this.find(identity);
+        if (input.expectedRevision === null ? existing !== null : existing?.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        const meta = this.deps.metaParsers[input.kind]({ meta: input.meta });
+        if (input.payload === undefined && !existing)
+            throw new VaultError({ code: "invalid-record" });
+        const sealed = input.payload === undefined ? existing.sealed : await this.seal({ context: identity, payload: input.payload });
+        // Never expose any suffix of a database address, environment map or OAuth session.
+        const hint = sealed && input.hintToken !== undefined && !["database-destination", "mcp-env", "mcp-auth"].includes(input.kind)
+            ? credentialTokenHint({ token: input.hintToken }) : null;
+        const now = this.deps.now({});
+        const record = { ...identity, provider: input.provider, label: input.label, meta, sealed,
+            isDefault: input.isDefault ?? (existing !== null && existing.provider === input.provider && existing.isDefault),
+            revision: (input.expectedRevision ?? 0) + 1,
+            last4: input.payload === undefined ? existing.last4 : hint?.last4 ?? null,
+            tokenLength: input.payload === undefined ? existing.tokenLength : hint?.length ?? null,
+            createdAt: existing?.createdAt ?? now, updatedAt: now };
+        return record;
+    }
+    /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
+    async get(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "get", context: input });
+        const record = await this.find(input);
+        return record ? { summary: summary(record), payload: await this.open(record) } : null;
+    }
+    /** Singleton runtime read using one provider-independent lookup. Full expected ownership and
+     * binding are required before policy/decryption; repo callers may use a broader selection scope.
+     * @example await vault.findOne({ workspaceId, kind: "site-assistant", ownerKey: "assistant", principalId: null, binding: null });
+     */
+    async findOne(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "get", context: input });
+        if (!this.deps.repo.findOne)
+            throw new VaultError({ code: "invalid-record" });
+        const record = await this.deps.repo.findOne(input);
+        if (!record)
+            return null;
+        if (buildVaultAad({ ...input, id: record.id }) !== buildVaultAad(record))
+            throw new VaultError({ code: "context" });
+        const parsed = this.parse(record);
+        return { summary: summary(parsed), payload: await this.open(parsed) };
+    }
+    /** Authorized default read using one exact-group query; ownership is checked before opening.
+     * @throws On policy, context, metadata or authentication failure.
+     * @complexity One indexed row lookup, then O(payload size) decryption.
+     */
+    async findDefault(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "get", context: input });
+        // Old injected ports retain their existing operations; default reads require this capability.
+        if (!this.deps.repo.findDefault)
+            throw new VaultError({ code: "invalid-record" });
+        const record = await this.deps.repo.findDefault(input);
+        if (!record)
+            return null;
+        if (!record.isDefault || record.provider !== input.provider || buildVaultAad({ ...input, id: record.id }) !== buildVaultAad(record)) {
+            throw new VaultError({ code: "context" });
+        }
+        const parsed = this.parse(record);
+        return { summary: summary(parsed), payload: await this.open(parsed) };
+    }
+    /** Copy selected rows into this service without exposing plaintext or envelopes. Each ID is
+     * attempted once; failures are isolated and raw adapter/policy/crypto errors never escape.
+     * Source reads are plain SELECTs; this operation never upgrades or writes the source.
+     * @throws VaultError for invalid scopes. Per-row failures use fixed reason codes.
+     * @complexity O(n + payload bytes), n unique IDs; sequential bounded row reads and CAS writes.
+     */
+    async copyToSite(input, _options = {}) {
+        assertContext(input.sourceContext);
+        assertContext(input.targetContext);
+        const results = [];
+        for (const id of new Set(input.ids))
+            results.push(await this.copyRow({ ...input, id }));
+        return results;
+    }
+    /** One transfer reuses both services' parsing/open/seal and the repository's default/CAS owner.
+     * @complexity Constant row queries plus O(payload size); no group read or source transaction.
+     */
+    async copyRow(input, _options = {}) {
+        const { source, sourceContext, targetContext, id } = input;
+        const result = { kind: sourceContext.kind, id };
+        if (!isCopyableKind[sourceContext.kind])
+            return { ...result, status: "skipped",
+                reasonCode: sourceContext.kind === "mcp-env" ? "requires-mcp-configuration" : "kind-not-copyable" };
+        try {
+            // Copy changes the site/key, never the credential's owning feature or endpoint. Principal
+            // identities are local to each installation and cannot be carried to the target.
+            if (sourceContext.kind !== targetContext.kind || sourceContext.ownerKey !== targetContext.ownerKey ||
+                sourceContext.binding !== targetContext.binding || sourceContext.principalId !== null || targetContext.principalId !== null ||
+                (source.deps.repo === this.deps.repo && sourceContext.workspaceId === targetContext.workspaceId)) {
+                throw new VaultError({ code: "context" });
+            }
+            const sourceIdentity = { ...sourceContext, id };
+            const targetIdentity = { ...targetContext, id };
+            await source.authorize({ action: "get", context: sourceIdentity });
+            await this.authorize({ action: "put", context: targetIdentity });
+            const raw = await source.deps.repo.find(sourceIdentity);
+            if (!raw)
+                return { ...result, status: "failed", reasonCode: "source-missing" };
+            if (buildVaultAad(sourceIdentity) !== buildVaultAad(raw))
+                throw new VaultError({ code: "context" });
+            // Check before parsing: normal parsers deliberately reject legacy-AAD metadata.
+            if (Object.hasOwn(raw.meta, "legacyAad"))
+                return { ...result, status: "failed", reasonCode: "source-needs-upgrade" };
+            if (input.sourceRevisions && Object.hasOwn(input.sourceRevisions, id) && input.sourceRevisions[id] !== raw.revision)
+                throw new VaultError({ code: "conflict" });
+            const record = source.parse(raw);
+            const existing = await this.find(targetIdentity);
+            if (existing && !input.overwrite)
+                return { ...result, status: "skipped", reasonCode: "target-exists" };
+            if (existing && existing.provider !== record.provider)
+                throw new VaultError({ code: "context" });
+            const expectedRevision = existing?.revision ?? null;
+            const now = this.deps.now({});
+            const candidate = this.parse({ ...record, ...targetIdentity, isDefault: existing?.isDefault ?? false,
+                revision: (expectedRevision ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now });
+            candidate.sealed = await this.seal({ context: targetIdentity, payload: await source.open(record) });
+            // Reuse the source's hint policy without guessing a token field from a structured payload.
+            candidate.last4 = record.kind === "database-destination" ? null : summary(record).last4;
+            candidate.tokenLength = record.kind === "database-destination" ? null : record.tokenLength;
+            const saved = await this.deps.repo.put({ record: candidate, expectedRevision });
+            const last4 = summary(saved).last4;
+            return { ...result, status: "copied", ...(last4 ? { last4 } : {}) };
+        }
+        catch (error) {
+            return { ...result, status: "failed", reasonCode: error instanceof VaultError ? error.code : "copy-failed" };
+        }
+    }
+    /** Human-managed scoped inventory. No envelope or plaintext is opened or returned. */
+    async list(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "list", context: input });
+        return (await this.deps.repo.list(input)).map(record => {
+            if (record.workspaceId !== input.workspaceId || record.kind !== input.kind || record.ownerKey !== input.ownerKey ||
+                record.principalId !== input.principalId || (input.provider !== undefined && record.provider !== input.provider))
+                throw new VaultError({ code: "context" });
+            return summary(this.parse(record));
+        });
+    }
+    /** Merge and validate complete metadata, then target only changed JSON keys with revision CAS. */
+    async patchMeta(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "put", context: input });
+        const existing = await this.find(input);
+        if (existing?.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        const meta = this.deps.metaParsers[existing.kind]({ meta: { ...existing.meta, ...input.patch } });
+        // jsonSet can add/replace a key but cannot remove one. Reject parser omissions instead of
+        // silently persisting an unvalidated old field. Normalized values and defaults can be patched.
+        if (Object.keys({ ...existing.meta, ...input.patch }).some(key => !Object.hasOwn(meta, key)))
+            throw new VaultError({ code: "invalid-meta" });
+        const patch = Object.fromEntries(Object.entries(meta).filter(([key, value]) => JSON.stringify(value) !== JSON.stringify(existing.meta[key])));
+        return summary(this.parse(await this.deps.repo.patchMeta({ workspaceId: input.workspaceId, id: input.id,
+            expectedRevision: input.expectedRevision, patch, updatedAt: this.deps.now({}) })));
+    }
+    /** Re-seal using the active key; concurrent replacement wins through CAS. Metadata-only rows persist. */
+    async rotate(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "rotate", context: input });
+        const existing = await this.find(input);
+        if (existing?.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        const sealed = await this.seal({ context: input, payload: await this.open(existing) });
+        return summary(this.parse(await this.deps.repo.put({ expectedRevision: input.expectedRevision,
+            record: { ...existing, sealed, revision: existing.revision + 1, updatedAt: this.deps.now({}) } })));
+    }
+    /** Idempotent for missing rows; existing rows require matching context and revision. */
+    async delete(input, _options = {}) {
+        assertContext(input);
+        await this.authorize({ action: "delete", context: input });
+        const existing = await this.find(input);
+        if (!existing)
+            return false;
+        if (existing.revision !== input.expectedRevision)
+            throw new VaultError({ code: "conflict" });
+        return this.deps.repo.delete({ workspaceId: input.workspaceId, id: input.id, expectedRevision: input.expectedRevision });
+    }
+}
+//# sourceMappingURL=vault.service.js.map