@jini-ai/platform 0.5.9 → 0.5.10

package/dist/secrets/credential-sets/types.d.ts

@@ -8,6 +8,10 @@ export interface VendorCredentialSetRecord {
     readonly id: string;
     /** Open string so plugin hosts can declare vendors beyond the built-in validators. */
     readonly vendorId: string;
+    /** Optional only for historical DTO producers; unified vault metadata requires this subtype. */
+    readonly credentialType?: "vendor";
+    /** Explicit compatibility IDs, independent of label; omitted by historical DTO producers. */
+    readonly worksFor?: readonly string[];
     readonly label: string;
     readonly sealed: SealedSecret;
     /** Last four secret characters for recognition, stored in clear; a suffix alone is not the token. */
@@ -22,6 +26,9 @@ export interface VendorCredentialSetRecord {
 export interface VendorCredentialSetSummary {
     readonly id: string;
     readonly vendorId: string;
+    /** Optional for compatibility with historical summaries. */
+    readonly credentialType?: "vendor";
+    readonly worksFor?: readonly string[];
     readonly label: string;
     readonly configured: true;
     readonly isDefault: boolean;

package/dist/secrets/credential-sets/vault.meta.js

@@ -1,19 +1,25 @@
 import { VAULT_KINDS, VaultError } from "./vault.types.js";
+import { normalizeCredentialWorksFor } from "./provider-matches.js";
 /** Copy eligibility lives with the kind contracts; MCP rows require their server configuration. */
 export const isCopyableKind = Object.freeze({
-    "site-assistant": true, "personal-execution": false, "media-provider": true, custom: true,
+    "site-assistant": true, "personal-execution": false, "media-provider": true, custom: false,
     "publish-peer": true, "database-destination": true, vendor: true, "source-control": true,
     "mcp-env": false, "mcp-auth": false,
+    // A plugin API connection's tokens and attempts are bound to one workspace's sign-in.
+    "api-connection": false,
 });
 const FIELDS = {
     "site-assistant": { baseUrl: "string", model: "string" },
     "personal-execution": { protocol: "string", baseUrl: "string", model: "string", maxTokens: "number" },
     "media-provider": { baseUrl: "string", model: "string" },
-    custom: { category: "string", baseUrl: "string", additionalHosts: "strings", username: "string" },
+    custom: { credentialType: "string", worksFor: "strings", category: "string", baseUrl: "string", additionalHosts: "strings", username: "string" },
     "publish-peer": { baseUrl: "string", remoteWorkspaceId: "string" },
     "database-destination": { description: "object", lastRun: "object" },
-    vendor: { accountLabel: "string" }, "source-control": { accountLabel: "string" },
+    vendor: { accountLabel: "string", credentialType: "string", worksFor: "strings", category: "string",
+        baseUrl: "string", additionalHosts: "strings", username: "string" }, "source-control": { accountLabel: "string" },
     "mcp-env": {}, "mcp-auth": {},
+    // Hosts register the owning feature's parser (e.g. parseOAuthTokenVaultMeta); no default fields.
+    "api-connection": {},
 };
 function isObject(value) {
     return value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
@@ -27,26 +33,58 @@ function isJson(value) {
         return value.every(isJson);
     return isObject(value) && Object.keys(value).every(key => !["__proto__", "constructor", "prototype"].includes(key) && isJson(value[key]));
 }
+/** Enforce common credential metadata before and after optional host policy parsing.
+ * Missing fields on pre-unification rows are read defaults, never a reason to rewrite/reseal.
+ * Explicit empty compatibility is preserved; labels never imply compatibility.
+ * @throws VaultError when a supplied subtype or compatibility list is invalid.
+ * @complexity O(worksFor characters); returns a fresh metadata object.
+ */
+function credentialMeta({ meta, kind, provider }) {
+    const credentialType = meta.credentialType === undefined ? kind : meta.credentialType;
+    if ((credentialType !== "vendor" && credentialType !== "custom") || (kind === "custom" && credentialType !== "custom"))
+        throw new VaultError({ code: "invalid-meta" });
+    const worksFor = meta.worksFor === undefined ? (credentialType === "vendor" && provider != null ? [provider] : []) : meta.worksFor;
+    return { ...meta, credentialType, worksFor: normalizeCredentialWorksFor({ value: worksFor }) };
+}
+/** Plain JSON object with identifier-only top-level keys; checked on input and on override output. */
+function requireMetaShape({ value }) {
+    if (!isObject(value) || !isJson(value) || Object.keys(value).some(key => !/^[A-Za-z0-9_]+$/.test(key)))
+        throw new VaultError({ code: "invalid-meta" });
+    return value;
+}
+/** vendor/custom rows carry the unified subtype + compatibility contract; other kinds pass through. */
+function canonicalMeta({ meta, kind, provider }) {
+    return kind === "vendor" || kind === "custom" ? credentialMeta({ meta, kind, provider }) : meta;
+}
+function matchesField({ field, value }) {
+    if (value === null)
+        return true;
+    if (field === "strings")
+        return Array.isArray(value) && value.every(v => typeof v === "string");
+    if (field === "object")
+        return isObject(value);
+    return typeof value === field;
+}
+function assertDeclaredFields({ meta, kind }) {
+    for (const [key, value] of Object.entries(meta)) {
+        const field = Object.hasOwn(FIELDS[kind], key) ? FIELDS[kind][key] : undefined;
+        if (!field || !matchesField({ field, value }))
+            throw new VaultError({ code: "invalid-meta" });
+    }
+}
+function parseKindMeta({ kind, override }, { meta, provider }) {
+    const canonical = canonicalMeta({ meta: requireMetaShape({ value: meta }), kind, provider });
+    if (override) {
+        const parsed = requireMetaShape({ value: override({ meta: structuredClone(canonical), provider }) });
+        return structuredClone(canonicalMeta({ meta: parsed, kind, provider }));
+    }
+    assertDeclaredFields({ meta: canonical, kind });
+    return structuredClone(canonical);
+}
 /** Minimal structural parsers. Hosts inject catalog, URL/origin and safe-metadata policy here;
  * secrets stay in payload JSON. Overrides own the complete shape, including merged patches.
  */
 export function createVaultMetaParsers(_required, { parsers = {} } = {}) {
-    return Object.fromEntries(VAULT_KINDS.map(kind => [kind, ({ meta }) => {
-            if (!isObject(meta) || !isJson(meta) || Object.keys(meta).some(key => !/^[A-Za-z0-9_]+$/.test(key)))
-                throw new VaultError({ code: "invalid-meta" });
-            if (parsers[kind]) {
-                const parsed = parsers[kind]({ meta: structuredClone(meta) });
-                if (!isObject(parsed) || !isJson(parsed) || Object.keys(parsed).some(key => !/^[A-Za-z0-9_]+$/.test(key)))
-                    throw new VaultError({ code: "invalid-meta" });
-                return structuredClone(parsed);
-            }
-            for (const [key, value] of Object.entries(meta)) {
-                const field = Object.hasOwn(FIELDS[kind], key) ? FIELDS[kind][key] : undefined;
-                if (!field || (value !== null && !(field === "strings" ? Array.isArray(value) && value.every(v => typeof v === "string") :
-                    field === "object" ? isObject(value) : typeof value === field)))
-                    throw new VaultError({ code: "invalid-meta" });
-            }
-            return structuredClone(meta);
-        }]));
+    return Object.fromEntries([...VAULT_KINDS, "custom"].map(kind => [kind, (input) => parseKindMeta({ kind, override: parsers[kind] }, input)]));
 }
 //# sourceMappingURL=vault.meta.js.map

package/dist/secrets/credential-sets/vault.repo.memory.d.ts

@@ -12,6 +12,7 @@ export declare class InMemoryVaultRepo implements VaultRepoPort {
     private singletonKey;
     /** Index all four optional scope combinations; copy sets so batch staging never mutates live indexes. */
     private indexSingleton;
+    private singletonScopes;
     /** Indexed singleton selection; clone only the selected row, ignoring provider/default. */
     findOne(input: VaultSingletonQuery, _options?: VaultOptions): Promise<VaultRecord | null>;
     /** Stage through the same mutation owner, then publish once. No await can expose partial rows
@@ -47,5 +48,11 @@ export declare class InMemoryVaultRepo implements VaultRepoPort {
     private deleteRecord;
     /** O(n) winner scan; promotion changes only default/revision, matching SQL. */
     private promote;
+    /** Every default change increments revision. A replaced row may be cleared here too: the caller
+     * writes its saved version over that entry immediately afterwards.
+     */
+    private clearDefaults;
+    /** O(n) scan of live rows sharing one default group. */
+    private groupRows;
 }
 //# sourceMappingURL=vault.repo.memory.d.ts.map

package/dist/secrets/credential-sets/vault.repo.memory.js

@@ -13,20 +13,22 @@ export class InMemoryVaultRepo {
             input.principalId !== undefined, input.principalId ?? null]);
     }
     /** Index all four optional scope combinations; copy sets so batch staging never mutates live indexes. */
-    indexSingleton({ record, remove }, _options = {}) {
-        for (const ownerKey of [undefined, record.ownerKey])
-            for (const principalId of [undefined, record.principalId]) {
-                const scope = this.singletonKey({ workspaceId: record.workspaceId, kind: record.kind, ownerKey, principalId });
-                const ids = new Set(this.singletons.get(scope));
-                if (remove)
-                    ids.delete(this.key(record));
-                else
-                    ids.add(this.key(record));
-                if (ids.size)
-                    this.singletons.set(scope, ids);
-                else
-                    this.singletons.delete(scope);
-            }
+    indexSingleton({ record, remove }) {
+        const rowKey = this.key(record);
+        for (const scope of this.singletonScopes({ record })) {
+            const ids = new Set(this.singletons.get(scope));
+            if (remove)
+                ids.delete(rowKey);
+            else
+                ids.add(rowKey);
+            if (ids.size)
+                this.singletons.set(scope, ids);
+            else
+                this.singletons.delete(scope);
+        }
+    }
+    singletonScopes({ record }) {
+        return [undefined, record.ownerKey].flatMap(ownerKey => [undefined, record.principalId].map(principalId => this.singletonKey({ workspaceId: record.workspaceId, kind: record.kind, ownerKey, principalId })));
     }
     /** Indexed singleton selection; clone only the selected row, ignoring provider/default. */
     async findOne(input, _options = {}) {
@@ -63,33 +65,26 @@ export class InMemoryVaultRepo {
     async list(input, _options = {}) {
         return structuredClone([...this.rows.values()].filter(row => row.workspaceId === input.workspaceId && row.kind === input.kind &&
             row.ownerKey === input.ownerKey && row.principalId === input.principalId && (input.provider === undefined || row.provider === input.provider))
-            .sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+            // Rows are keyed by (workspaceId, id), so one workspace never lists two equal IDs.
+            .sort((a, b) => a.id < b.id ? -1 : 1));
     }
     async put(input, _options = {}) {
         return this.putRecord(input);
     }
     /** Synchronous mutation owner shared with batch staging; default moves never re-seal. */
-    putRecord(input, _options = {}) {
+    putRecord(input) {
         const { record } = input;
         const key = this.key(record);
         const existing = this.rows.get(key) ?? null;
         assertVaultReplacement({ ...input, existing });
         const groupKey = vaultGroupKey({ record });
-        let hasGroup = false;
-        for (const row of this.rows.values())
-            if (vaultGroupKey({ record: row }) === groupKey) {
-                hasGroup = true;
-                if (row.id !== record.id && row.label === record.label)
-                    throw new VaultError({ code: "conflict" });
-            }
-        const saved = structuredClone({ ...record, isDefault: record.isDefault || !hasGroup });
+        const group = this.groupRows({ groupKey });
+        if (group.some(row => row.id !== record.id && row.label === record.label))
+            throw new VaultError({ code: "conflict" });
+        const saved = structuredClone({ ...record, isDefault: record.isDefault || group.length === 0 });
         // Clear first, matching a SQL partial UNIQUE index; no transient duplicate default is required.
         if (saved.isDefault)
-            for (const row of this.rows.values()) {
-                if (row.id !== saved.id && row.isDefault && vaultGroupKey({ record: row }) === groupKey) {
-                    this.rows.set(this.key(row), { ...row, isDefault: false, revision: row.revision + 1 });
-                }
-            }
+            this.clearDefaults({ group });
         this.rows.set(key, saved);
         if (!existing)
             this.indexSingleton({ record: saved, remove: false });
@@ -101,7 +96,7 @@ export class InMemoryVaultRepo {
         return this.patchRecord(input);
     }
     /** Clone merged metadata before mutating the staged/live map so failures leave it intact. */
-    patchRecord(input, _options = {}) {
+    patchRecord(input) {
         const key = this.key(input);
         const existing = this.rows.get(key);
         if (existing?.revision !== input.expectedRevision)
@@ -114,7 +109,7 @@ export class InMemoryVaultRepo {
         return this.deleteRecord(input);
     }
     /** Synchronous CAS delete shares promotion with provider moves and batch staging. */
-    deleteRecord(input, _options = {}) {
+    deleteRecord(input) {
         const key = this.key(input);
         const existing = this.rows.get(key);
         if (!existing)
@@ -128,13 +123,12 @@ export class InMemoryVaultRepo {
         return true;
     }
     /** O(n) winner scan; promotion changes only default/revision, matching SQL. */
-    promote({ record }, _options = {}) {
-        const groupKey = vaultGroupKey({ record });
+    promote({ record }) {
         let promoted;
         // SQL BINARY/C compares UTF-8 bytes; JS's UTF-16 order differs for supplementary IDs.
-        for (const row of this.rows.values()) {
-            if (vaultGroupKey({ record: row }) === groupKey && (!promoted || row.updatedAt > promoted.updatedAt ||
-                (row.updatedAt === promoted.updatedAt && Buffer.compare(Buffer.from(row.id), Buffer.from(promoted.id)) > 0))) {
+        for (const row of this.groupRows({ groupKey: vaultGroupKey({ record }) })) {
+            if (!promoted || row.updatedAt > promoted.updatedAt ||
+                (row.updatedAt === promoted.updatedAt && Buffer.compare(Buffer.from(row.id), Buffer.from(promoted.id)) > 0)) {
                 promoted = { id: row.id, updatedAt: row.updatedAt };
             }
         }
@@ -144,5 +138,18 @@ export class InMemoryVaultRepo {
             this.rows.set(promotedKey, { ...row, isDefault: true, revision: row.revision + 1 });
         }
     }
+    /** Every default change increments revision. A replaced row may be cleared here too: the caller
+     * writes its saved version over that entry immediately afterwards.
+     */
+    clearDefaults({ group }) {
+        for (const row of group) {
+            if (row.isDefault)
+                this.rows.set(this.key(row), { ...row, isDefault: false, revision: row.revision + 1 });
+        }
+    }
+    /** O(n) scan of live rows sharing one default group. */
+    groupRows({ groupKey }) {
+        return [...this.rows.values()].filter(row => vaultGroupKey({ record: row }) === groupKey);
+    }
 }
 //# sourceMappingURL=vault.repo.memory.js.map

package/dist/secrets/credential-sets/vault.service.d.ts

@@ -62,6 +62,11 @@ export declare class SecretsVaultService {
      * @example const record = await vault.prepare(input); await repo.put({ record, expectedRevision: input.expectedRevision }); // inside the host transaction
      */
     prepare(input: VaultPutInput, _options?: VaultOptions): Promise<VaultRecord>;
+    /** Resolve the target identity and apply the service-level CAS precheck. */
+    private findForPut;
+    private parsePutMeta;
+    /** Omitted payload keeps the existing envelope and hints without opening or sealing. */
+    private putEnvelope;
     /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
     get(input: VaultIdentity, _options?: VaultOptions): Promise<{
         summary: VaultSummary;
@@ -96,6 +101,10 @@ export declare class SecretsVaultService {
      * @complexity Constant row queries plus O(payload size); no group read or source transaction.
      */
     private copyRow;
+    /** Guarded read of the source row, then a CAS write of the resealed target row. */
+    private transferRow;
+    /** Overwrite keeps the target's default, revision chain and creation time. */
+    private writeCopy;
     /** Human-managed scoped inventory. No envelope or plaintext is opened or returned. */
     list(input: VaultQuery, _options?: VaultOptions): Promise<VaultSummary[]>;
     /** Merge and validate complete metadata, then target only changed JSON keys with revision CAS. */

package/dist/secrets/credential-sets/vault.service.js

@@ -2,13 +2,54 @@ import { credentialTokenHint } from "../credential-token.js";
 import { buildVaultAad } from "./vault.aad.js";
 import { isCopyableKind } from "./vault.meta.js";
 import { VAULT_KINDS, VaultError } from "./vault.types.js";
+/** Kinds whose payloads are addresses, environment maps or OAuth sessions, never single tokens. */
+const HINTLESS_KINDS = ["database-destination", "mcp-env", "mcp-auth"];
+function isNonEmptyString({ value }) {
+    return typeof value === "string" && value !== "";
+}
+function isNullableString({ value }) {
+    return value === null || typeof value === "string";
+}
+function hasValidOwnership({ context }) {
+    return isNonEmptyString({ value: context.workspaceId }) && isNonEmptyString({ value: context.ownerKey }) &&
+        isNullableString({ value: context.principalId }) && (!("binding" in context) || isNullableString({ value: context.binding }));
+}
+function hasValidKind({ context }) {
+    if (!VAULT_KINDS.some(kind => kind === context.kind) && context.kind !== "custom")
+        return false;
+    return context.kind !== "personal-execution" || Boolean(context.principalId);
+}
 function assertContext(context) {
-    if (typeof context.workspaceId !== "string" || !context.workspaceId || typeof context.ownerKey !== "string" || !context.ownerKey ||
-        !VAULT_KINDS.includes(context.kind) || (context.principalId !== null && typeof context.principalId !== "string") ||
-        ("binding" in context && context.binding !== null && typeof context.binding !== "string") ||
-        (context.kind === "personal-execution" && !context.principalId))
+    if (!hasValidOwnership({ context }) || !hasValidKind({ context }))
         throw new VaultError({ code: "context" });
 }
+/** Unified credential rows declare both subtype and compatibility; read defaults cover older rows. */
+function declaresCredential({ meta }) {
+    return meta !== null && typeof meta === "object" && Object.hasOwn(meta, "credentialType") && Object.hasOwn(meta, "worksFor");
+}
+function isInQueryScope({ record, query }) {
+    return record.workspaceId === query.workspaceId && record.kind === query.kind && record.ownerKey === query.ownerKey &&
+        record.principalId === query.principalId && (query.provider === undefined || record.provider === query.provider);
+}
+/** Copy changes the site/key, never the credential's owning feature or endpoint. Principal
+ * identities are local to each installation and cannot be carried to the target.
+ */
+function isCopyTarget({ sourceContext, targetContext, sameRepo }) {
+    return sourceContext.kind === targetContext.kind && sourceContext.ownerKey === targetContext.ownerKey &&
+        sourceContext.binding === targetContext.binding && sourceContext.principalId === null && targetContext.principalId === null &&
+        !(sameRepo && sourceContext.workspaceId === targetContext.workspaceId);
+}
+function sourceNeedsUpgrade({ raw }) {
+    return Object.hasOwn(raw.meta, "legacyAad") || (raw.kind === "vendor" && !declaresCredential({ meta: raw.meta }));
+}
+function isStaleSelection({ selected, id, revision }) {
+    if (!selected)
+        return false;
+    return Object.hasOwn(selected, id) && selected[id] !== revision;
+}
+function isCompatibleOverwrite({ existing, record }) {
+    return existing.provider === record.provider && (record.kind !== "vendor" || existing.meta.credentialType === record.meta.credentialType);
+}
 function summary(record) {
     // Enumerate the read model: an adapter's extra runtime properties cannot become API fields.
     return { workspaceId: record.workspaceId, id: record.id, kind: record.kind, ownerKey: record.ownerKey,
@@ -38,7 +79,7 @@ export class SecretsVaultService {
     }
     parse(record) {
         assertContext(record);
-        return { ...record, meta: this.deps.metaParsers[record.kind]({ meta: record.meta }) };
+        return { ...record, meta: this.deps.metaParsers[record.kind]({ meta: record.meta, provider: record.provider }) };
     }
     async find(input) {
         const record = await this.deps.repo.find({ workspaceId: input.workspaceId, id: input.id });
@@ -86,7 +127,22 @@ export class SecretsVaultService {
      */
     async prepare(input, _options = {}) {
         assertContext(input);
+        // Existing custom-kind identities keep their authenticated kind until a migration marks
+        // them for boot resealing. New credentials always use the unified vendor kind.
+        if (input.kind === "custom" && input.expectedRevision === null)
+            throw new VaultError({ code: "context" });
         await this.authorize({ action: "put", context: input });
+        const { identity, existing } = await this.findForPut({ input });
+        const meta = this.parsePutMeta({ input, existing });
+        const { sealed, last4, tokenLength } = await this.putEnvelope({ input, identity, existing });
+        const now = this.deps.now({});
+        return { ...identity, provider: input.provider, label: input.label, meta, sealed,
+            isDefault: input.isDefault ?? (existing !== null && existing.provider === input.provider && existing.isDefault),
+            revision: (input.expectedRevision ?? 0) + 1, last4, tokenLength,
+            createdAt: existing === null ? now : existing.createdAt, updatedAt: now };
+    }
+    /** Resolve the target identity and apply the service-level CAS precheck. */
+    async findForPut({ input }) {
         if (input.expectedRevision !== null && !input.id)
             throw new VaultError({ code: "conflict" });
         const identity = { workspaceId: input.workspaceId, kind: input.kind, ownerKey: input.ownerKey,
@@ -94,21 +150,29 @@ export class SecretsVaultService {
         const existing = await this.find(identity);
         if (input.expectedRevision === null ? existing !== null : existing?.revision !== input.expectedRevision)
             throw new VaultError({ code: "conflict" });
-        const meta = this.deps.metaParsers[input.kind]({ meta: input.meta });
-        if (input.payload === undefined && !existing)
-            throw new VaultError({ code: "invalid-record" });
-        const sealed = input.payload === undefined ? existing.sealed : await this.seal({ context: identity, payload: input.payload });
+        return { identity, existing };
+    }
+    parsePutMeta({ input, existing }) {
+        // Read defaults keep older sites usable; new records still declare their subtype/compatibility.
+        if (!existing && input.kind === "vendor" && !declaresCredential({ meta: input.meta }))
+            throw new VaultError({ code: "invalid-meta" });
+        const meta = this.deps.metaParsers[input.kind]({ meta: input.meta, provider: input.provider });
+        if (existing?.kind === "vendor" && existing.meta.credentialType !== meta.credentialType)
+            throw new VaultError({ code: "context" });
+        return meta;
+    }
+    /** Omitted payload keeps the existing envelope and hints without opening or sealing. */
+    async putEnvelope({ input, identity, existing }) {
+        if (input.payload === undefined) {
+            if (!existing)
+                throw new VaultError({ code: "invalid-record" });
+            return { sealed: existing.sealed, last4: existing.last4, tokenLength: existing.tokenLength };
+        }
+        const sealed = await this.seal({ context: identity, payload: input.payload });
         // Never expose any suffix of a database address, environment map or OAuth session.
-        const hint = sealed && input.hintToken !== undefined && !["database-destination", "mcp-env", "mcp-auth"].includes(input.kind)
+        const hint = sealed && input.hintToken !== undefined && !HINTLESS_KINDS.includes(input.kind)
             ? credentialTokenHint({ token: input.hintToken }) : null;
-        const now = this.deps.now({});
-        const record = { ...identity, provider: input.provider, label: input.label, meta, sealed,
-            isDefault: input.isDefault ?? (existing !== null && existing.provider === input.provider && existing.isDefault),
-            revision: (input.expectedRevision ?? 0) + 1,
-            last4: input.payload === undefined ? existing.last4 : hint?.last4 ?? null,
-            tokenLength: input.payload === undefined ? existing.tokenLength : hint?.length ?? null,
-            createdAt: existing?.createdAt ?? now, updatedAt: now };
-        return record;
+        return { sealed, last4: hint?.last4 ?? null, tokenLength: hint?.length ?? null };
     }
     /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
     async get(input, _options = {}) {
@@ -170,63 +234,67 @@ export class SecretsVaultService {
     /** One transfer reuses both services' parsing/open/seal and the repository's default/CAS owner.
      * @complexity Constant row queries plus O(payload size); no group read or source transaction.
      */
-    async copyRow(input, _options = {}) {
-        const { source, sourceContext, targetContext, id } = input;
+    async copyRow(input) {
+        const { sourceContext, id } = input;
         const result = { kind: sourceContext.kind, id };
         if (!isCopyableKind[sourceContext.kind])
             return { ...result, status: "skipped",
                 reasonCode: sourceContext.kind === "mcp-env" ? "requires-mcp-configuration" : "kind-not-copyable" };
         try {
-            // Copy changes the site/key, never the credential's owning feature or endpoint. Principal
-            // identities are local to each installation and cannot be carried to the target.
-            if (sourceContext.kind !== targetContext.kind || sourceContext.ownerKey !== targetContext.ownerKey ||
-                sourceContext.binding !== targetContext.binding || sourceContext.principalId !== null || targetContext.principalId !== null ||
-                (source.deps.repo === this.deps.repo && sourceContext.workspaceId === targetContext.workspaceId)) {
-                throw new VaultError({ code: "context" });
-            }
-            const sourceIdentity = { ...sourceContext, id };
-            const targetIdentity = { ...targetContext, id };
-            await source.authorize({ action: "get", context: sourceIdentity });
-            await this.authorize({ action: "put", context: targetIdentity });
-            const raw = await source.deps.repo.find(sourceIdentity);
-            if (!raw)
-                return { ...result, status: "failed", reasonCode: "source-missing" };
-            if (buildVaultAad(sourceIdentity) !== buildVaultAad(raw))
-                throw new VaultError({ code: "context" });
-            // Check before parsing: normal parsers deliberately reject legacy-AAD metadata.
-            if (Object.hasOwn(raw.meta, "legacyAad"))
-                return { ...result, status: "failed", reasonCode: "source-needs-upgrade" };
-            if (input.sourceRevisions && Object.hasOwn(input.sourceRevisions, id) && input.sourceRevisions[id] !== raw.revision)
-                throw new VaultError({ code: "conflict" });
-            const record = source.parse(raw);
-            const existing = await this.find(targetIdentity);
-            if (existing && !input.overwrite)
-                return { ...result, status: "skipped", reasonCode: "target-exists" };
-            if (existing && existing.provider !== record.provider)
-                throw new VaultError({ code: "context" });
-            const expectedRevision = existing?.revision ?? null;
-            const now = this.deps.now({});
-            const candidate = this.parse({ ...record, ...targetIdentity, isDefault: existing?.isDefault ?? false,
-                revision: (expectedRevision ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now });
-            candidate.sealed = await this.seal({ context: targetIdentity, payload: await source.open(record) });
-            // Reuse the source's hint policy without guessing a token field from a structured payload.
-            candidate.last4 = record.kind === "database-destination" ? null : summary(record).last4;
-            candidate.tokenLength = record.kind === "database-destination" ? null : record.tokenLength;
-            const saved = await this.deps.repo.put({ record: candidate, expectedRevision });
-            const last4 = summary(saved).last4;
-            return { ...result, status: "copied", ...(last4 ? { last4 } : {}) };
+            return { ...result, ...(await this.transferRow(input)) };
         }
         catch (error) {
             return { ...result, status: "failed", reasonCode: error instanceof VaultError ? error.code : "copy-failed" };
         }
     }
+    /** Guarded read of the source row, then a CAS write of the resealed target row. */
+    async transferRow(input) {
+        const { source, sourceContext, targetContext, id } = input;
+        if (!isCopyTarget({ sourceContext, targetContext, sameRepo: source.deps.repo === this.deps.repo }))
+            throw new VaultError({ code: "context" });
+        const sourceIdentity = { ...sourceContext, id };
+        const targetIdentity = { ...targetContext, id };
+        await source.authorize({ action: "get", context: sourceIdentity });
+        await this.authorize({ action: "put", context: targetIdentity });
+        const raw = await source.deps.repo.find(sourceIdentity);
+        if (!raw)
+            return { status: "failed", reasonCode: "source-missing" };
+        if (buildVaultAad(sourceIdentity) !== buildVaultAad(raw))
+            throw new VaultError({ code: "context" });
+        // Check before parsing: normal parsers deliberately reject legacy-AAD metadata.
+        if (sourceNeedsUpgrade({ raw }))
+            return { status: "failed", reasonCode: "source-needs-upgrade" };
+        if (isStaleSelection({ selected: input.sourceRevisions, id, revision: raw.revision }))
+            throw new VaultError({ code: "conflict" });
+        const record = source.parse(raw);
+        const existing = await this.find(targetIdentity);
+        if (existing && !input.overwrite)
+            return { status: "skipped", reasonCode: "target-exists" };
+        const last4 = summary(await this.writeCopy({ source, record, targetIdentity, existing })).last4;
+        return { status: "copied", ...(last4 ? { last4 } : {}) };
+    }
+    /** Overwrite keeps the target's default, revision chain and creation time. */
+    async writeCopy({ source, record, targetIdentity, existing }) {
+        if (existing && !isCompatibleOverwrite({ existing, record }))
+            throw new VaultError({ code: "context" });
+        const now = this.deps.now({});
+        const placement = existing
+            ? { isDefault: existing.isDefault, revision: existing.revision + 1, createdAt: existing.createdAt }
+            : { isDefault: false, revision: 1, createdAt: now };
+        const candidate = this.parse({ ...record, ...targetIdentity, ...placement, updatedAt: now });
+        candidate.sealed = await this.seal({ context: targetIdentity, payload: await source.open(record) });
+        // Reuse the source's hint policy without guessing a token field from a structured payload.
+        const hintless = record.kind === "database-destination";
+        candidate.last4 = hintless ? null : summary(record).last4;
+        candidate.tokenLength = hintless ? null : record.tokenLength;
+        return this.deps.repo.put({ record: candidate, expectedRevision: existing ? existing.revision : null });
+    }
     /** Human-managed scoped inventory. No envelope or plaintext is opened or returned. */
     async list(input, _options = {}) {
         assertContext(input);
         await this.authorize({ action: "list", context: input });
         return (await this.deps.repo.list(input)).map(record => {
-            if (record.workspaceId !== input.workspaceId || record.kind !== input.kind || record.ownerKey !== input.ownerKey ||
-                record.principalId !== input.principalId || (input.provider !== undefined && record.provider !== input.provider))
+            if (!isInQueryScope({ record, query: input }))
                 throw new VaultError({ code: "context" });
             return summary(this.parse(record));
         });
@@ -238,7 +306,9 @@ export class SecretsVaultService {
         const existing = await this.find(input);
         if (existing?.revision !== input.expectedRevision)
             throw new VaultError({ code: "conflict" });
-        const meta = this.deps.metaParsers[existing.kind]({ meta: { ...existing.meta, ...input.patch } });
+        const meta = this.deps.metaParsers[existing.kind]({ meta: { ...existing.meta, ...input.patch }, provider: existing.provider });
+        if (existing.kind === "vendor" && existing.meta.credentialType !== meta.credentialType)
+            throw new VaultError({ code: "context" });
         // jsonSet can add/replace a key but cannot remove one. Reject parser omissions instead of
         // silently persisting an unvalidated old field. Normalized values and defaults can be patched.
         if (Object.keys({ ...existing.meta, ...input.patch }).some(key => !Object.hasOwn(meta, key)))

package/dist/secrets/credential-sets/vault.types.d.ts

@@ -1,6 +1,13 @@
 import type { SealedSecret } from "../types.js";
-export declare const VAULT_KINDS: readonly ["site-assistant", "personal-execution", "media-provider", "custom", "publish-peer", "database-destination", "vendor", "source-control", "mcp-env", "mcp-auth"];
-export type VaultKind = typeof VAULT_KINDS[number];
+export declare const VAULT_KINDS: readonly ["site-assistant", "personal-execution", "media-provider", "publish-peer", "database-destination", "vendor", "source-control", "mcp-env", "mcp-auth", "api-connection"];
+/** `custom` remains readable/replaceable until each workspace activates its data migration. */
+export type VaultKind = typeof VAULT_KINDS[number] | "custom";
+export type CredentialType = "vendor" | "custom";
+/** Required metadata on every active vendor-kind credential. Subtype is immutable after create. */
+export type CredentialMeta = VaultMeta & {
+    credentialType: CredentialType;
+    worksFor: string[];
+};
 export type VaultJson = null | boolean | number | string | VaultJson[] | {
     [key: string]: VaultJson;
 };
@@ -40,7 +47,7 @@ export interface VaultQuery {
     kind: VaultKind;
     ownerKey: string;
     principalId: string | null;
-    provider?: string | null;
+    provider?: string | null | undefined;
 }
 /** A default belongs to one exact group; omitted provider never means all providers. */
 export interface VaultDefaultQuery extends VaultQuery {
@@ -86,6 +93,7 @@ export interface VaultCopyResult {
 }
 export type VaultMetaParser = (input: {
     meta: unknown;
+    provider?: string | null | undefined;
 }, options?: VaultOptions) => VaultMeta;
 export type VaultMetaParsers = Readonly<Record<VaultKind, VaultMetaParser>>;
 /** Safe error codes never contain submitted values or encrypted material. */

package/dist/secrets/credential-sets/vault.types.js

@@ -1,5 +1,5 @@
-export const VAULT_KINDS = ["site-assistant", "personal-execution", "media-provider", "custom", "publish-peer",
-    "database-destination", "vendor", "source-control", "mcp-env", "mcp-auth"];
+export const VAULT_KINDS = ["site-assistant", "personal-execution", "media-provider", "publish-peer",
+    "database-destination", "vendor", "source-control", "mcp-env", "mcp-auth", "api-connection"];
 /** Safe error codes never contain submitted values or encrypted material. */
 export class VaultError extends Error {
     code;
@@ -13,16 +13,30 @@ export class VaultError extends Error {
 export function vaultGroupKey({ record }, _options = {}) {
     return JSON.stringify([record.workspaceId, record.kind, record.ownerKey, record.principalId, record.provider]);
 }
-/** Adapters guard CAS and immutable identity even for callers below the service. */
-export function assertVaultReplacement({ record, existing, expectedRevision }, _options = {}) {
+/** Fields fixed at create and checked on every replacement. */
+// Provider groups defaults, but is not authenticated identity (see buildVaultAad).
+const IMMUTABLE_FIELDS = ["workspaceId", "kind", "ownerKey", "principalId", "id", "binding", "createdAt"];
+function assertRevision({ record, existing, expectedRevision }) {
     if (expectedRevision === null ? existing !== null : existing?.revision !== expectedRevision)
         throw new VaultError({ code: "conflict" });
     if (!Number.isSafeInteger(record.revision) || record.revision !== (expectedRevision ?? 0) + 1)
         throw new VaultError({ code: "invalid-record" });
-    // Provider groups defaults, but is not authenticated identity (see buildVaultAad).
-    if (existing && (record.workspaceId !== existing.workspaceId || record.kind !== existing.kind ||
-        record.ownerKey !== existing.ownerKey || record.principalId !== existing.principalId ||
-        record.id !== existing.id || record.binding !== existing.binding || record.createdAt !== existing.createdAt))
+}
+function assertSameIdentity({ record, existing }) {
+    if (IMMUTABLE_FIELDS.some(field => record[field] !== existing[field]))
         throw new VaultError({ code: "context" });
+    if (existing.kind === "vendor") {
+        // Missing subtype identifies a pre-unification vendor; an explicit null is not a default.
+        const previousType = existing.meta.credentialType === undefined ? "vendor" : existing.meta.credentialType;
+        const nextType = record.meta.credentialType === undefined ? "vendor" : record.meta.credentialType;
+        if (nextType !== previousType)
+            throw new VaultError({ code: "context" });
+    }
+}
+/** Adapters guard CAS and immutable identity even for callers below the service. */
+export function assertVaultReplacement({ record, existing, expectedRevision }, _options = {}) {
+    assertRevision({ record, existing, expectedRevision });
+    if (existing)
+        assertSameIdentity({ record, existing });
 }
 //# sourceMappingURL=vault.types.js.map