@noy-db/at-macos-keychain 0.6.0-pre.0 → 0.6.0-pre.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -3
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -78,7 +78,10 @@ The Keychain entry IS the security boundary. Strength is bounded by:
|
|
|
78
78
|
- A physically present attacker who knows the user's login password and can unlock the keychain.
|
|
79
79
|
- macOS itself being compromised below the Keychain Services layer.
|
|
80
80
|
|
|
81
|
-
|
|
81
|
+
Note the family-level property: `at-*` providers are the one **non-zero-knowledge**
|
|
82
|
+
part of noy-db. A host you control can decrypt the scoped slice it unseals. That
|
|
83
|
+
is the point of the family, and it is a real reduction in the guarantee the rest
|
|
84
|
+
of the project makes.
|
|
82
85
|
|
|
83
86
|
## API
|
|
84
87
|
|
|
@@ -94,7 +97,7 @@ Returns a [`SealingKeyProvider`](../hub/src/team/managed-secret.ts) — the cont
|
|
|
94
97
|
|
|
95
98
|
Throws at construction when `service` or `account` is empty, or when running on a non-darwin platform without a test stub.
|
|
96
99
|
|
|
97
|
-
The provider exposes only `SealingKeyProvider` — not `RecipientSealer`.
|
|
100
|
+
The provider exposes only `SealingKeyProvider` — not `RecipientSealer`. It is **self-targeted only**: it can seal and unseal locally, but cannot seal for an arbitrary recipient (no public-half to publish). Bundle-handover delivery to arbitrary recipients requires a handover-capable cloud-KMS provider.
|
|
98
101
|
|
|
99
102
|
## Key lifecycle
|
|
100
103
|
|
|
@@ -136,7 +139,6 @@ For real-Keychain integration tests on darwin CI runners, leave `entry` undefine
|
|
|
136
139
|
|
|
137
140
|
- [`@noy-db/at-env`](../at-env) — env-var sealing for server / container deployments.
|
|
138
141
|
- [`@noy-db/hub`](../hub) — the database core that consumes `SealingKeyProvider`.
|
|
139
|
-
- [Foundation doc — at-* sealing dimension](../../docs/superpowers/specs/2026-05-23-sealing-at-dimension-foundation.md)
|
|
140
142
|
- [Sealing pid stability rule](https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/sealing-pid-stability.md)
|
|
141
143
|
|
|
142
144
|
## License
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@noy-db/at-macos-keychain",
|
|
3
|
-
"version": "0.6.0-pre.
|
|
3
|
+
"version": "0.6.0-pre.2",
|
|
4
4
|
"description": "macOS Keychain sealing key provider for noy-db managed-secret mode — AES-256-GCM under a 32-byte key stored in the user's login Keychain. Desktop-app provider in the at-* family; pairs with Touch ID via Keychain Access UI.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "vLannaAi <vicio@lanna.ai>",
|
|
@@ -36,7 +36,7 @@
|
|
|
36
36
|
},
|
|
37
37
|
"peerDependencies": {
|
|
38
38
|
"@napi-rs/keyring": "^1.1.0",
|
|
39
|
-
"@noy-db/hub": "0.6.0-pre.
|
|
39
|
+
"@noy-db/hub": "0.6.0-pre.2"
|
|
40
40
|
},
|
|
41
41
|
"peerDependenciesMeta": {
|
|
42
42
|
"@napi-rs/keyring": {
|
|
@@ -46,9 +46,9 @@
|
|
|
46
46
|
"devDependencies": {
|
|
47
47
|
"@napi-rs/keyring": "^1.1.0",
|
|
48
48
|
"@types/node": "^22.0.0",
|
|
49
|
-
"@noy-db/
|
|
50
|
-
"@noy-db/to-memory": "0.6.0-pre.
|
|
51
|
-
"@noy-db/
|
|
49
|
+
"@noy-db/on-shamir": "0.6.0-pre.2",
|
|
50
|
+
"@noy-db/to-memory": "0.6.0-pre.2",
|
|
51
|
+
"@noy-db/hub": "0.6.0-pre.2"
|
|
52
52
|
},
|
|
53
53
|
"keywords": [
|
|
54
54
|
"noy-db",
|