@jini-ai/platform 0.6.12 → 0.6.15-rc.1

package/dist/secrets/credential-sets/vault.service.js

@@ -81,13 +81,15 @@ export class SecretsVaultService {
         assertContext(record);
         return { ...record, meta: this.deps.metaParsers[record.kind]({ meta: record.meta, provider: record.provider }) };
     }
-    async find(input) {
+    /** Resolve a matching identity; deletion can retain legacy metadata without interpreting it. */
+    async find(input, { parseMeta = true } = {}) {
         const record = await this.deps.repo.find({ workspaceId: input.workspaceId, id: input.id });
         if (!record)
             return null;
         if (buildVaultAad(input) !== buildVaultAad(record))
             throw new VaultError({ code: "context" });
-        return this.parse(record);
+        assertContext(record);
+        return parseMeta ? this.parse(record) : record;
     }
     async seal(input) {
         if (input.payload === null)
@@ -137,7 +139,7 @@ export class SecretsVaultService {
         const { sealed, last4, tokenLength } = await this.putEnvelope({ input, identity, existing });
         const now = this.deps.now({});
         return { ...identity, provider: input.provider, label: input.label, meta, sealed,
-            isDefault: input.isDefault ?? (existing !== null && existing.provider === input.provider && existing.isDefault),
+            isDefault: input.isDefault ?? (existing !== null && existing.provider === input.provider ? existing.isDefault : undefined),
             revision: (input.expectedRevision ?? 0) + 1, last4, tokenLength,
             createdAt: existing === null ? now : existing.createdAt, updatedAt: now };
     }
@@ -174,11 +176,15 @@ export class SecretsVaultService {
             ? credentialTokenHint({ token: input.hintToken }) : null;
         return { sealed, last4: hint?.last4 ?? null, tokenLength: hint?.length ?? null };
     }
-    /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership. */
-    async get(input, _options = {}) {
+    /** Authorized runtime read; returns plaintext only to the caller that supplied exact ownership.
+     * `provider`, when given, must match the row's group before its envelope is opened (a stale
+     * selection never decrypts another group's secret). */
+    async get(input, { provider } = {}) {
         assertContext(input);
         await this.authorize({ action: "get", context: input });
         const record = await this.find(input);
+        if (record && provider !== undefined && record.provider !== provider)
+            throw new VaultError({ code: "context" });
         return record ? { summary: summary(record), payload: await this.open(record) } : null;
     }
     /** Singleton runtime read using one provider-independent lookup. Full expected ownership and
@@ -273,14 +279,15 @@ export class SecretsVaultService {
         const last4 = summary(await this.writeCopy({ source, record, targetIdentity, existing })).last4;
         return { status: "copied", ...(last4 ? { last4 } : {}) };
     }
-    /** Overwrite keeps the target's default, revision chain and creation time. */
+    /** Overwrite keeps the target's default, revision chain and creation time. A new copy leaves
+     * placement unspecified, so the repo's first-row rule applies (never the source's default flag). */
     async writeCopy({ source, record, targetIdentity, existing }) {
         if (existing && !isCompatibleOverwrite({ existing, record }))
             throw new VaultError({ code: "context" });
         const now = this.deps.now({});
         const placement = existing
             ? { isDefault: existing.isDefault, revision: existing.revision + 1, createdAt: existing.createdAt }
-            : { isDefault: false, revision: 1, createdAt: now };
+            : { isDefault: undefined, revision: 1, createdAt: now };
         const candidate = this.parse({ ...record, ...targetIdentity, ...placement, updatedAt: now });
         candidate.sealed = await this.seal({ context: targetIdentity, payload: await source.open(record) });
         // Reuse the source's hint policy without guessing a token field from a structured payload.
@@ -328,11 +335,13 @@ export class SecretsVaultService {
         return summary(this.parse(await this.deps.repo.put({ expectedRevision: input.expectedRevision,
             record: { ...existing, sealed, revision: existing.revision + 1, updatedAt: this.deps.now({}) } })));
     }
-    /** Idempotent for missing rows; existing rows require matching context and revision. */
+    /** Idempotent for missing rows; existing rows require matching context and revision.
+     * Deletion needs no metadata interpretation, so unupgraded legacy rows remain removable.
+     */
     async delete(input, _options = {}) {
         assertContext(input);
         await this.authorize({ action: "delete", context: input });
-        const existing = await this.find(input);
+        const existing = await this.find(input, { parseMeta: false });
         if (!existing)
             return false;
         if (existing.revision !== input.expectedRevision)

package/dist/secrets/credential-sets/vault.types.d.ts

@@ -42,6 +42,12 @@ export interface VaultRecord extends VaultIdentity {
 export type VaultSummary = Omit<VaultRecord, "sealed"> & {
     configured: boolean;
 };
+/** Unspecified placement lets the repo auto-default a group's first row; false opts out.
+ * Persisted records and read models always contain a concrete boolean.
+ */
+export type VaultPutRecord = Omit<VaultRecord, "isDefault"> & {
+    isDefault?: boolean | undefined;
+};
 export interface VaultQuery {
     workspaceId: string;
     kind: VaultKind;
@@ -65,7 +71,7 @@ export interface VaultSingletonQuery {
 /** Ordered CAS operations; default side effects affect later operations' revisions. */
 export type VaultBatchOp = {
     put: {
-        record: VaultRecord;
+        record: VaultPutRecord;
         expectedRevision: number | null;
     };
 } | {
@@ -129,7 +135,7 @@ export interface VaultRepoPort {
     }, options?: VaultOptions): Promise<VaultBatchResult[]>;
     list(input: VaultQuery, options?: VaultOptions): Promise<VaultRecord[]>;
     put(input: {
-        record: VaultRecord;
+        record: VaultPutRecord;
         expectedRevision: number | null;
     }, options?: VaultOptions): Promise<VaultRecord>;
     /** Service-validated patch: top-level keys are plain JSON-path identifiers. */
@@ -148,11 +154,11 @@ export interface VaultRepoPort {
 }
 /** Unambiguous scope encoding keeps adapter default/identity checks on the same contract. */
 export declare function vaultGroupKey({ record }: {
-    record: VaultRecord;
+    record: VaultDefaultQuery;
 }, _options?: VaultOptions): string;
 /** Adapters guard CAS and immutable identity even for callers below the service. */
 export declare function assertVaultReplacement({ record, existing, expectedRevision }: {
-    record: VaultRecord;
+    record: VaultPutRecord;
     existing: VaultRecord | null;
     expectedRevision: number | null;
 }, _options?: VaultOptions): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/platform",
-  "version": "0.6.12",
+  "version": "0.6.15-rc.1",
   "description": "Generic OS/platform primitives: process exec and lifecycle, filesystem containment, HTTP readiness polling, toolchain discovery, blob storage, AWS signing, and an SSRF-safe asset cache.",
   "license": "Apache-2.0",
   "repository": {
@@ -22,6 +22,7 @@
       "./secrets/testing": "node",
       "./http/guarded": "node",
       "./mail": "node",
+      "./mail/senders": "universal",
       "./mail/smtp": "node",
       "./fs/guarded-reader": "node",
       "./fs/durable-json": "node",
@@ -106,6 +107,11 @@
       "import": "./dist/mail/index.js",
       "default": "./dist/mail/index.js"
     },
+    "./mail/senders": {
+      "types": "./dist/mail/senders.d.ts",
+      "import": "./dist/mail/senders.js",
+      "default": "./dist/mail/senders.js"
+    },
     "./mail/smtp": {
       "types": "./dist/mail/smtp.d.ts",
       "import": "./dist/mail/smtp.js",
@@ -200,7 +206,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@jini-ai/core": "^0.6.12"
+    "@jini-ai/core": "^0.6.15-rc.1"
   },
   "publishConfig": {
     "access": "public",