@jini-ai/platform 0.5.3 → 0.5.5

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @jini-ai/platform
 
+## 0.5.5 — 2026-10-13
+
+- New narrow subpaths for the existing OS helpers: `./command`, `./process`, `./toolchain`, `./proxy-env`, `./shell`, `./child-environment`. Importing one loads 1-2 modules instead of the root barrel's 181 (incl. undici). The root still exports everything; no signature change.
+
+## 0.5.4 — 2026-10-12
+
+- Removed unused exports: `SecretsVaultService.commitPrepared`, `VaultCommitPreparedInput`, `VaultCopyInput.targetRevisions`, the pre-vault `InMemoryVendorCredentialSetRepo` and `buildVendorCredentialAad`. No known consumer; prepared records are committed through the vault repository's `put`/`applyBatch`.
+
 ## 0.5.2
 
 ### Patch Changes

package/README.md

@@ -140,7 +140,7 @@ New factories/functions/methods accept a required object and, where needed, a se
 object. No-input operations take `{}`: `createNodeGuardedHttpPorts({})`,
 `createNodeGuardedReaderFilesystem({})`, `createNodeDurableJsonPorts({})`,
 `new FetchHttpTransportAdapter({})`, `new InMemoryTrashRepo({})`,
-`new InMemoryVendorCredentialSetRepo({})`, `keyring.activeKey({})`,
+`keyring.activeKey({})`,
 `mailer.capabilities({})`, `clock.nowMs({})`, `clock.nowIso({})`, `random.token({})`,
 and `file.read({})`. SMTP ports receive `sendMail({ mail })`; `NodemailerPort` exposes the
 vendor-shaped `NativeSmtpTransport` so the factory adapts the payload once. Policy errors use

package/dist/secrets/credential-sets/index.d.ts

@@ -1,9 +1,7 @@
 export type { VendorCredentialSetRecord, VendorCredentialSetSummary, VendorCredentialSetRepoPort } from "./types.js";
-export { buildVendorCredentialAad } from "./aad.js";
-export { InMemoryVendorCredentialSetRepo } from "./repo.memory.js";
 export * from "./vault.types.js";
 export { buildVaultAad } from "./vault.aad.js";
 export { createVaultMetaParsers, isCopyableKind } from "./vault.meta.js";
-export { SecretsVaultService, type VaultServiceDeps, type VaultPutInput, type VaultCopyInput, type VaultCommitPreparedInput } from "./vault.service.js";
+export { SecretsVaultService, type VaultServiceDeps, type VaultPutInput, type VaultCopyInput } from "./vault.service.js";
 export { InMemoryVaultRepo } from "./vault.repo.memory.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/secrets/credential-sets/index.js

@@ -1,5 +1,3 @@
-export { buildVendorCredentialAad } from "./aad.js";
-export { InMemoryVendorCredentialSetRepo } from "./repo.memory.js";
 export * from "./vault.types.js";
 export { buildVaultAad } from "./vault.aad.js";
 export { createVaultMetaParsers, isCopyableKind } from "./vault.meta.js";

package/dist/secrets/credential-sets/vault.service.d.ts

@@ -31,15 +31,6 @@ export interface VaultPutInput extends VaultContext {
     /** A host-selected token, never a URI or serialized connection object. */
     hintToken?: string;
 }
-/** Prepared records contain envelopes and stay private to the host, never a public read model.
- * Expected revisions are mandatory for every ID; null means create-only. Deletes carry full
- * expected ownership. Default side effects follow repository operation order (records, deletes).
- */
-export interface VaultCommitPreparedInput {
-    records: readonly VaultRecord[];
-    deletes: readonly VaultIdentity[];
-    expectedRevisions: Readonly<Record<string, number | null>>;
-}
 export interface VaultCopyInput {
     /** This service owns the source repository, authorization and keyring-backed sealer. */
     source: SecretsVaultService;
@@ -47,9 +38,8 @@ export interface VaultCopyInput {
     targetContext: VaultContext;
     ids: readonly string[];
     overwrite: boolean;
-    /** Optional selection-time guards; otherwise the revisions read by this operation are used. */
+    /** Optional selection-time guard; otherwise the revisions read by this operation are used. */
     sourceRevisions?: Readonly<Record<string, number>>;
-    targetRevisions?: Readonly<Record<string, number | null>>;
 }
 /** Shared vault lifecycle. Policy/catalogs are injected; persistence and encryption are ports.
  * Expected context is checked before opening. Normal reads have no legacy-AAD fallback.
@@ -68,15 +58,10 @@ export declare class SecretsVaultService {
     /** Authorize, validate and seal before the host enters its transaction, without persisting.
      * Replacements retain identity/createdAt; omitted payload preserves the existing envelope.
      * Commit must CAS again because preparation does not reserve a revision or a default.
-     * @example const record = await vault.prepare(input); // pass to commitPrepared inside the host transaction
+     * Prepared records contain envelopes and stay private to the host, never a public read model.
+     * @example const record = await vault.prepare(input); await repo.put({ record, expectedRevision: input.expectedRevision }); // inside the host transaction
      */
     prepare(input: VaultPutInput, _options?: VaultOptions): Promise<VaultRecord>;
-    /** Reauthorize prepared rows, validate ownership/metadata, then commit through the batch owner.
-     * No plaintext is opened or sealed. Missing capability/revisions and duplicate identities fail
-     * before writes; stale CAS or a later operation failure rolls back the whole repository batch.
-     * @example await vault.commitPrepared({ records: [record], deletes: [], expectedRevisions: { [record.id]: null } });
-     */
-    commitPrepared(input: VaultCommitPreparedInput, _options?: VaultOptions): Promise<VaultSummary[]>;
     /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
     get(input: VaultIdentity, _options?: VaultOptions): Promise<{
         summary: VaultSummary;

package/dist/secrets/credential-sets/vault.service.js

@@ -81,7 +81,8 @@ export class SecretsVaultService {
     /** Authorize, validate and seal before the host enters its transaction, without persisting.
      * Replacements retain identity/createdAt; omitted payload preserves the existing envelope.
      * Commit must CAS again because preparation does not reserve a revision or a default.
-     * @example const record = await vault.prepare(input); // pass to commitPrepared inside the host transaction
+     * Prepared records contain envelopes and stay private to the host, never a public read model.
+     * @example const record = await vault.prepare(input); await repo.put({ record, expectedRevision: input.expectedRevision }); // inside the host transaction
      */
     async prepare(input, _options = {}) {
         assertContext(input);
@@ -109,42 +110,6 @@ export class SecretsVaultService {
             createdAt: existing?.createdAt ?? now, updatedAt: now };
         return record;
     }
-    /** Reauthorize prepared rows, validate ownership/metadata, then commit through the batch owner.
-     * No plaintext is opened or sealed. Missing capability/revisions and duplicate identities fail
-     * before writes; stale CAS or a later operation failure rolls back the whole repository batch.
-     * @example await vault.commitPrepared({ records: [record], deletes: [], expectedRevisions: { [record.id]: null } });
-     */
-    async commitPrepared(input, _options = {}) {
-        if (!this.deps.repo.applyBatch)
-            throw new VaultError({ code: "invalid-record" });
-        const { records, deletes, expectedRevisions } = structuredClone(input);
-        const identities = new Set();
-        const ops = [];
-        const entries = [...records.map(record => ({ put: record })), ...deletes.map(record => ({ delete: record }))];
-        for (const entry of entries) {
-            const record = "put" in entry ? entry.put : entry.delete;
-            assertContext(record);
-            const key = JSON.stringify([record.workspaceId, record.id]);
-            if (identities.has(key) || !Object.hasOwn(expectedRevisions, record.id))
-                throw new VaultError({ code: "invalid-record" });
-            identities.add(key);
-            const expectedRevision = expectedRevisions[record.id];
-            const putting = "put" in entry;
-            await this.authorize({ action: putting ? "put" : "delete", context: record });
-            const existing = await this.find(record);
-            if (expectedRevision === null ? existing !== null : existing?.revision !== expectedRevision)
-                throw new VaultError({ code: "conflict" });
-            if ("put" in entry)
-                ops.push({ put: { record: this.parse(entry.put), expectedRevision } });
-            else {
-                if (expectedRevision === null)
-                    throw new VaultError({ code: "invalid-record" });
-                ops.push({ delete: { workspaceId: record.workspaceId, id: record.id, expectedRevision } });
-            }
-        }
-        const results = await this.deps.repo.applyBatch({ ops });
-        return results.filter((result) => typeof result !== "boolean").map(summary);
-    }
     /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
     async get(input, _options = {}) {
         assertContext(input);
@@ -240,8 +205,6 @@ export class SecretsVaultService {
             if (existing && existing.provider !== record.provider)
                 throw new VaultError({ code: "context" });
             const expectedRevision = existing?.revision ?? null;
-            if (input.targetRevisions && Object.hasOwn(input.targetRevisions, id) && input.targetRevisions[id] !== expectedRevision)
-                throw new VaultError({ code: "conflict" });
             const now = this.deps.now({});
             const candidate = this.parse({ ...record, ...targetIdentity, isDefault: existing?.isDefault ?? false,
                 revision: (expectedRevision ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now });

package/dist/secrets/credential-sets/vault.types.d.ts

@@ -111,7 +111,8 @@ export interface VaultRepoPort {
     findDefault?(input: VaultDefaultQuery, options?: VaultOptions): Promise<VaultRecord | null>;
     /** Optional additions keep older injected ports source-compatible; built-in adapters implement both. */
     findOne?(input: VaultSingletonQuery, options?: VaultOptions): Promise<VaultRecord | null>;
-    /** All operations commit together or throw with no published changes.
+    /** All operations commit together or throw with no published changes. Default side effects
+     * follow operation order; a delete carries full expected ownership.
      * SQL joins the host transaction: callers must propagate failures to roll that transaction back.
      * @example await repo.applyBatch!({ ops: [{ put: { record, expectedRevision: null } }] });
      */

package/dist/secrets/testing.d.ts

@@ -1,4 +1,3 @@
 export { InMemoryKeyring } from "./keyring.memory.js";
 export { FixedRootKeyKeyring } from "./keyring.env.js";
-export { InMemoryVendorCredentialSetRepo } from "./credential-sets/repo.memory.js";
 //# sourceMappingURL=testing.d.ts.map

package/dist/secrets/testing.js

@@ -1,4 +1,3 @@
 export { InMemoryKeyring } from "./keyring.memory.js";
 export { FixedRootKeyKeyring } from "./keyring.env.js";
-export { InMemoryVendorCredentialSetRepo } from "./credential-sets/repo.memory.js";
 //# sourceMappingURL=testing.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/platform",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Generic OS/platform primitives: process exec and lifecycle, filesystem containment, HTTP readiness polling, toolchain discovery, blob storage, AWS signing, and an SSRF-safe asset cache.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,7 +28,23 @@
       "./net/endpoint-policy": "universal",
       "./fs/file-lock": "node",
       "./secrets/credential-token": "universal",
-      "./web": "node"
+      "./web": "node",
+      "./command": "node",
+      "./process": "node",
+      "./toolchain": "node",
+      "./proxy-env": "node",
+      "./shell": "node",
+      "./child-environment": "node"
+    },
+    "isolation": {
+      "entries": {
+        "./command": "os",
+        "./process": "os",
+        "./toolchain": "os",
+        "./proxy-env": "os",
+        "./shell": "os",
+        "./child-environment": "os"
+      }
     }
   },
   "type": "module",
@@ -115,6 +131,36 @@
       "types": "./dist/web/index.d.ts",
       "import": "./dist/web/index.js",
       "default": "./dist/web/index.js"
+    },
+    "./command": {
+      "types": "./dist/command.d.ts",
+      "import": "./dist/command.js",
+      "default": "./dist/command.js"
+    },
+    "./process": {
+      "types": "./dist/process.d.ts",
+      "import": "./dist/process.js",
+      "default": "./dist/process.js"
+    },
+    "./toolchain": {
+      "types": "./dist/toolchain.d.ts",
+      "import": "./dist/toolchain.js",
+      "default": "./dist/toolchain.js"
+    },
+    "./proxy-env": {
+      "types": "./dist/proxy-env.d.ts",
+      "import": "./dist/proxy-env.js",
+      "default": "./dist/proxy-env.js"
+    },
+    "./shell": {
+      "types": "./dist/shell.d.ts",
+      "import": "./dist/shell.js",
+      "default": "./dist/shell.js"
+    },
+    "./child-environment": {
+      "types": "./dist/child-environment.d.ts",
+      "import": "./dist/child-environment.js",
+      "default": "./dist/child-environment.js"
     }
   },
   "files": [

package/dist/secrets/credential-sets/aad.d.ts

@@ -1,7 +0,0 @@
-/** Stable v1 AAD binding workspace, vendor, and credential identity. */
-export declare function buildVendorCredentialAad(input: {
-    workspaceId: string;
-    vendorId: string;
-    id: string;
-}): string;
-//# sourceMappingURL=aad.d.ts.map

package/dist/secrets/credential-sets/aad.js

@@ -1,7 +0,0 @@
-import { formatAad } from "../aad.js";
-const AAD_VERSION = "v1";
-/** Stable v1 AAD binding workspace, vendor, and credential identity. */
-export function buildVendorCredentialAad(input) {
-    return formatAad({ kind: "vendor-credential-set", version: AAD_VERSION, parts: [input.workspaceId, input.vendorId, input.id] });
-}
-//# sourceMappingURL=aad.js.map

package/dist/secrets/credential-sets/repo.memory.d.ts

@@ -1,44 +0,0 @@
-import type { VendorCredentialSetRecord, VendorCredentialSetRepoPort } from "./types.js";
-/**
- * @file `VendorCredentialSetRepoPort`'s in-memory adapter — the ADR-006 rule-of-two test double,
- * mirroring `../deployments/publish-credentials/repo.memory.ts`'s shape byte-for-byte with
- * `providerId` swapped for `vendorId`. See that file's own header for the full reasoning (row
- * keying, the enforced UNIQUE constraint matching better-sqlite3's own error wording, why no
- * explicit lock is needed for the `isDefault` group invariant in a single-threaded JS process).
- */
-export declare class InMemoryVendorCredentialSetRepo implements VendorCredentialSetRepoPort {
-    constructor(_required: Record<string, never>, _optional?: Record<string, never>);
-    private readonly rows;
-    private static rowKey;
-    private assertLabelAvailable;
-    private clearOtherDefaults;
-    insert(record: VendorCredentialSetRecord, _optional?: Record<string, never>): Promise<void>;
-    update(record: VendorCredentialSetRecord, _optional?: Record<string, never>): Promise<void>;
-    findById(input: {
-        workspaceId: string;
-        id: string;
-    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord | null>;
-    findDefaultByVendor(input: {
-        workspaceId: string;
-        vendorId: string;
-    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord | null>;
-    listByVendor(input: {
-        workspaceId: string;
-        vendorId: string;
-    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord[]>;
-    listByWorkspace(input: {
-        workspaceId: string;
-    }, _optional?: Record<string, never>): Promise<VendorCredentialSetRecord[]>;
-    delete(input: {
-        workspaceId: string;
-        id: string;
-    }, _optional?: Record<string, never>): Promise<void>;
-    /** Mirrors the SQLite adapter's targeted single-column write — see
-     *  `VendorCredentialSetRepoPort.updateAccountLabel`'s own doc. No-op if the row vanished. */
-    updateAccountLabel(input: {
-        workspaceId: string;
-        id: string;
-        accountLabel: string;
-    }, _optional?: Record<string, never>): Promise<void>;
-}
-//# sourceMappingURL=repo.memory.d.ts.map

package/dist/secrets/credential-sets/repo.memory.js

@@ -1,80 +0,0 @@
-/**
- * @file `VendorCredentialSetRepoPort`'s in-memory adapter — the ADR-006 rule-of-two test double,
- * mirroring `../deployments/publish-credentials/repo.memory.ts`'s shape byte-for-byte with
- * `providerId` swapped for `vendorId`. See that file's own header for the full reasoning (row
- * keying, the enforced UNIQUE constraint matching better-sqlite3's own error wording, why no
- * explicit lock is needed for the `isDefault` group invariant in a single-threaded JS process).
- */
-export class InMemoryVendorCredentialSetRepo {
-    constructor(_required, _optional = {}) { }
-    rows = new Map();
-    static rowKey(workspaceId, id) {
-        return `${workspaceId}::${id}`;
-    }
-    assertLabelAvailable(workspaceId, vendorId, label, excludingId) {
-        for (const row of this.rows.values()) {
-            if (row.workspaceId !== workspaceId || row.vendorId !== vendorId || row.label !== label)
-                continue;
-            if (excludingId !== undefined && row.id === excludingId)
-                continue;
-            throw new Error(`UNIQUE constraint failed: vendor_credential_sets.workspace_id, vendor_credential_sets.vendor_id, vendor_credential_sets.label`);
-        }
-    }
-    clearOtherDefaults(workspaceId, vendorId, keepId) {
-        for (const [key, row] of this.rows) {
-            if (row.workspaceId !== workspaceId || row.vendorId !== vendorId || row.id === keepId || !row.isDefault)
-                continue;
-            this.rows.set(key, { ...row, isDefault: false });
-        }
-    }
-    async insert(record, _optional = {}) {
-        this.assertLabelAvailable(record.workspaceId, record.vendorId, record.label);
-        this.rows.set(InMemoryVendorCredentialSetRepo.rowKey(record.workspaceId, record.id), { ...record });
-        if (record.isDefault)
-            this.clearOtherDefaults(record.workspaceId, record.vendorId, record.id);
-    }
-    async update(record, _optional = {}) {
-        this.assertLabelAvailable(record.workspaceId, record.vendorId, record.label, record.id);
-        this.rows.set(InMemoryVendorCredentialSetRepo.rowKey(record.workspaceId, record.id), { ...record });
-        if (record.isDefault)
-            this.clearOtherDefaults(record.workspaceId, record.vendorId, record.id);
-    }
-    async findById(input, _optional = {}) {
-        return this.rows.get(InMemoryVendorCredentialSetRepo.rowKey(input.workspaceId, input.id)) ?? null;
-    }
-    async findDefaultByVendor(input, _optional = {}) {
-        for (const row of this.rows.values()) {
-            if (row.workspaceId === input.workspaceId && row.vendorId === input.vendorId && row.isDefault)
-                return row;
-        }
-        return null;
-    }
-    async listByVendor(input, _optional = {}) {
-        return [...this.rows.values()].filter((row) => row.workspaceId === input.workspaceId && row.vendorId === input.vendorId);
-    }
-    async listByWorkspace(input, _optional = {}) {
-        return [...this.rows.values()].filter((row) => row.workspaceId === input.workspaceId);
-    }
-    async delete(input, _optional = {}) {
-        const key = InMemoryVendorCredentialSetRepo.rowKey(input.workspaceId, input.id);
-        const removed = this.rows.get(key);
-        this.rows.delete(key);
-        if (!removed?.isDefault)
-            return;
-        const remaining = [...this.rows.values()].filter((row) => row.workspaceId === removed.workspaceId && row.vendorId === removed.vendorId);
-        if (remaining.length === 0)
-            return;
-        const promoted = remaining.reduce((latest, row) => (row.updatedAt > latest.updatedAt ? row : latest));
-        this.rows.set(InMemoryVendorCredentialSetRepo.rowKey(promoted.workspaceId, promoted.id), { ...promoted, isDefault: true });
-    }
-    /** Mirrors the SQLite adapter's targeted single-column write — see
-     *  `VendorCredentialSetRepoPort.updateAccountLabel`'s own doc. No-op if the row vanished. */
-    async updateAccountLabel(input, _optional = {}) {
-        const key = InMemoryVendorCredentialSetRepo.rowKey(input.workspaceId, input.id);
-        const existing = this.rows.get(key);
-        if (!existing)
-            return;
-        this.rows.set(key, { ...existing, accountLabel: input.accountLabel });
-    }
-}
-//# sourceMappingURL=repo.memory.js.map