@noy-db/hub 0.1.0-pre.14 → 0.1.0-pre.16

package/dist/sync/index.d.cts

@@ -1,9 +1,10 @@
-import { aI as SyncStrategy } from '../types-2JGVRzO2.cjs';
+import { aK as SyncStrategy } from '../types-DDy02bWN.cjs';
 import '../lazy-builder-C-rPfWG0.cjs';
 import '../predicate-Dnu81tsS.cjs';
-import '../strategy-D-SrOLCl.cjs';
+import '../strategy-DSTrsZ8t.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-CFJKJXWa.cjs';
+import '../index-CmVgTkqk.cjs';
+import '@noy-db/on-shamir';
 
 /**
  * Active sync strategy — `withSync()` returns the real implementation

package/dist/sync/index.d.ts

@@ -1,9 +1,10 @@
-import { aI as SyncStrategy } from '../types-DIOLYPUq.js';
+import { aK as SyncStrategy } from '../types-DImsOlJe.js';
 import '../lazy-builder-Rpd-V3jP.js';
 import '../predicate-Dnu81tsS.js';
-import '../strategy-D-SrOLCl.js';
+import '../strategy-DSTrsZ8t.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-7nd15fgy.js';
+import '../index-CNwA-B6-.js';
+import '@noy-db/on-shamir';
 
 /**
  * Active sync strategy — `withSync()` returns the real implementation

package/dist/sync/index.js

@@ -2,11 +2,11 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-E4ZSYZSN.js";
+} from "../chunk-NVBUGT76.js";
 import "../chunk-2QR2PQTT.js";
-import "../chunk-PMMNH7VZ.js";
-import "../chunk-7AQKLLI5.js";
-import "../chunk-W7M3E5M5.js";
+import "../chunk-H7XROQJM.js";
+import "../chunk-WCA2NROQ.js";
+import "../chunk-ADQ5MQ54.js";
 
 // src/team/sync-active.ts
 function withSync() {

package/dist/team/index.cjs

@@ -1279,6 +1279,8 @@ function base64ToBytes(b64) {
 }
 
 // src/team/recovery.ts
+var import_on_shamir = require("@noy-db/on-shamir");
+var import_on_shamir2 = require("@noy-db/on-shamir");
 var PAPER_DOC_ID = "recovery-paper";
 async function loadPaperRecoveryEntries(store, vault) {
   const env = await store.get(vault, "_meta", PAPER_DOC_ID);
@@ -1311,6 +1313,37 @@ async function burnPaperRecoveryEntry(store, vault, codeId) {
   const remaining = entries.filter((e) => e.codeId !== codeId);
   await savePaperRecoveryEntries(store, vault, remaining);
 }
+var SHAMIR_DOC_ID = "recovery-shamir";
+async function loadShamirRecoveryEntries(store, vault) {
+  const env = await store.get(vault, "_meta", SHAMIR_DOC_ID);
+  if (!env) return [];
+  try {
+    const doc = JSON.parse(env._data);
+    if (doc.profile !== "shamir" || !Array.isArray(doc.entries)) return [];
+    return doc.entries;
+  } catch {
+    return [];
+  }
+}
+async function unwrapDeksFromShamirEntry(entry, shares) {
+  if (shares.length < entry.k) {
+    throw new Error(
+      `Insufficient shares: this Shamir entry needs ${entry.k} of ${entry.n}, but ${shares.length} were provided.`
+    );
+  }
+  const secret = (0, import_on_shamir.combineSecret)(shares);
+  try {
+    const credential = bytesToBase642(secret);
+    return await unwrapDeksFromBlob(entry, credential);
+  } finally {
+    secret.fill(0);
+  }
+}
+function bytesToBase642(b) {
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s);
+}
 async function mintPaperRecoveryEntry(deks, code, codeId) {
   const blob = await mintWrappedDeksBlob(deks, code);
   return {
@@ -1324,6 +1357,7 @@ async function unwrapDeksFromPaperEntry(entry, code) {
 }
 
 // src/team/rotate-recover.ts
+var import_on_shamir3 = require("@noy-db/on-shamir");
 async function rotatePassphrase(store, vault, userId, input) {
   if (!input.allowWeakPassphrase) {
     assertStrongPassphrase(input.newPassphrase, input.passphrasePolicy);
@@ -1421,13 +1455,16 @@ async function recoverPassphrase(store, vault, userId, input) {
     assertStrongPassphrase(input.newPassphrase, input.passphrasePolicy);
   }
   const profile = input.recoveryProof.profile;
-  if (profile !== "paper") {
-    throw new RecoveryProfileNotImplementedError(
-      profile,
-      "https://github.com/vLannaAi/noy-db/issues/10"
-    );
+  if (profile === "paper") {
+    return recoverViaPaperCode(store, vault, userId, input);
   }
-  return recoverViaPaperCode(store, vault, userId, input);
+  if (profile === "shamir") {
+    return recoverViaShamir(store, vault, userId, input);
+  }
+  throw new RecoveryProfileNotImplementedError(
+    profile,
+    "https://github.com/vLannaAi/noy-db/issues/196"
+  );
 }
 async function recoverViaPaperCode(store, vault, userId, input) {
   if (input.recoveryProof.profile !== "paper") throw new Error("unreachable");
@@ -1493,6 +1530,99 @@ async function recoverViaPaperCode(store, vault, userId, input) {
 function normalizePaperCode(input) {
   return input.toUpperCase().replace(/[\s\-_]/g, "");
 }
+async function recoverViaShamir(store, vault, userId, input) {
+  if (input.recoveryProof.profile !== "shamir") throw new Error("unreachable");
+  const { entryId: requestedEntryId, shares: shareStrings } = input.recoveryProof.payload;
+  if (shareStrings.length === 0) {
+    throw new ValidationError(
+      "Shamir recovery requires at least one share; received an empty array."
+    );
+  }
+  const env = await store.get(vault, "_keyring", userId);
+  if (!env) {
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}".`);
+  }
+  const file = JSON.parse(env._data);
+  let decodedShares;
+  try {
+    decodedShares = shareStrings.map((s) => (0, import_on_shamir3.decodeShareBase32)(s));
+  } catch (err) {
+    throw new ValidationError(
+      "One or more Shamir shares could not be decoded. They may be malformed, truncated, or from an incompatible version. Original error: " + (err instanceof Error ? err.message : String(err))
+    );
+  }
+  const allEntries = await loadShamirRecoveryEntries(store, vault);
+  if (allEntries.length === 0) {
+    throw new NoAccessError(
+      `No Shamir-recovery entries enrolled for vault "${vault}". Enroll via \`db.enrollRecovery({ profile: "shamir", k, n })\` before relying on recovery.`
+    );
+  }
+  let candidates;
+  if (requestedEntryId !== void 0) {
+    candidates = allEntries.filter((e) => e.entryId === requestedEntryId);
+    if (candidates.length === 0) {
+      throw new NoAccessError(
+        `No Shamir-recovery entry with entryId="${requestedEntryId}" found in vault "${vault}". Available entries: ` + allEntries.map((e) => `"${e.entryId}"`).join(", ")
+      );
+    }
+  } else {
+    candidates = allEntries;
+  }
+  let recoveredDeks;
+  for (const entry of candidates) {
+    const xCoordSet = new Set(entry.xCoords);
+    const matchingShares = decodedShares.filter((s) => xCoordSet.has(s.x));
+    if (matchingShares.length < entry.k) {
+      continue;
+    }
+    try {
+      const deks = await unwrapDeksFromShamirEntry(entry, matchingShares);
+      recoveredDeks = deks;
+      break;
+    } catch {
+    }
+  }
+  if (!recoveredDeks) {
+    const minK = Math.min(...candidates.map((e) => e.k));
+    if (decodedShares.length < minK) {
+      throw new InvalidKeyError(
+        `Insufficient Shamir shares to combine: the smallest enrolled threshold is ${minK}, but only ${decodedShares.length} share${decodedShares.length === 1 ? " was" : "s were"} provided.`
+      );
+    }
+    throw new InvalidKeyError(
+      "Shamir shares do not match any enrolled entry. Possible causes: shares were tampered with, came from a different enrollment, or the entry was rotated after these shares were distributed."
+    );
+  }
+  const newSalt = generateSalt();
+  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const wrappedDeks = {};
+  for (const [coll, dek] of recoveredDeks) {
+    wrappedDeks[coll] = await wrapKey(dek, newKek);
+  }
+  const canary = await mintKeyringCanary(newKek);
+  const next = {
+    ...file,
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    deks: wrappedDeks,
+    salt: bufferToBase64(newSalt),
+    authenticators: [],
+    // tier-2 slots wrap old KEK, drop them on recovery
+    canary
+  };
+  await writeKeyringFile2(store, vault, userId, next);
+  return {
+    userId: file.user_id,
+    displayName: file.display_name,
+    role: file.role,
+    permissions: file.permissions,
+    deks: recoveredDeks,
+    kek: newKek,
+    salt: newSalt,
+    authenticators: [],
+    ...file.export_capability !== void 0 && { exportCapability: file.export_capability },
+    ...file.import_capability !== void 0 && { importCapability: file.import_capability }
+  };
+}
 async function writeKeyringFile2(store, vault, userId, file) {
   const envelope = {
     _noydb: 1,