@noy-db/hub 0.1.0-pre.5 → 0.1.0-pre.7

package/dist/index.js

@@ -31,7 +31,7 @@ import {
   readNoydbBundlePublicEnvelope,
   resetBrotliSupportCache,
   writeNoydbBundle
-} from "./chunk-LRN3PNI6.js";
+} from "./chunk-FAAWLVTF.js";
 import {
   PUBLIC_ENVELOPE_RECORD_ID,
   isPublicEnvelope,
@@ -39,13 +39,13 @@ import {
   readPublicEnvelope,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-UQQ2XFXI.js";
+} from "./chunk-GILMPJXB.js";
 import {
   CONSENT_AUDIT_COLLECTION
 } from "./chunk-M62XNWRA.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-QUDXYI4W.js";
+} from "./chunk-3WCRU7TI.js";
 import "./chunk-UF3BUNQZ.js";
 import {
   CollectionFrame,
@@ -69,7 +69,7 @@ import {
   isI18nTextDescriptor,
   resolveI18nText,
   validateI18nTextValue
-} from "./chunk-QV4WLLKB.js";
+} from "./chunk-NZ4XCIKS.js";
 import {
   createBundleStore,
   routeStore,
@@ -89,18 +89,22 @@ import {
   getCredential,
   listCredentials,
   putCredential
-} from "./chunk-MIRZMUSQ.js";
+} from "./chunk-INSJBB5W.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "./chunk-H3DV46AQ.js";
+} from "./chunk-CL37QSND.js";
 import {
+  USER_ENVELOPE_COLLECTION,
+  USER_ENVELOPE_MAX_BYTES,
+  UserEnvelopeOversizedError,
   WeakPassphraseError,
   assertStrongPassphrase,
   buildRecipientKeyringFile,
   changeSecret,
   createOwnerKeyring,
+  deleteUserEnvelope,
   ensureCollectionDEK,
   estimateEntropy,
   evaluateExportCapability,
@@ -110,13 +114,17 @@ import {
   hasExportCapability,
   hasImportCapability,
   hasWritePermission,
+  listUserEnvelopeIds,
   listUsers,
+  listUsersWithEnvelopes,
   loadKeyring,
+  loadUserEnvelope,
   persistKeyring,
   revoke,
   rotateKeys,
+  saveUserEnvelope,
   validatePassphrase
-} from "./chunk-6NPQTBZN.js";
+} from "./chunk-6IJQ27XN.js";
 import {
   BUNDLE_STORE_POLICY,
   INDEXED_STORE_POLICY,
@@ -153,7 +161,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-LMKOSLJY.js";
+} from "./chunk-N2LMZKLR.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -208,14 +216,14 @@ import {
   detectMimeType,
   isPreCompressed,
   runCompaction
-} from "./chunk-E4OOAPBZ.js";
+} from "./chunk-KPF2HHPI.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION,
   NOYDB_SYNC_VERSION,
   createStore
-} from "./chunk-NXUVITPB.js";
+} from "./chunk-B6HF6NTZ.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -772,6 +780,220 @@ async function writeKeyringFile(store, vault, userId, file) {
   await store.put(vault, "_keyring", userId, envelope);
 }
 
+// src/meta/user-envelope/api.ts
+var UserApi = class {
+  constructor(adapter, vaultName, writerKeyringId, getDek, checkGate2) {
+    this.adapter = adapter;
+    this.vaultName = vaultName;
+    this.writerKeyringId = writerKeyringId;
+    this.getDek = getDek;
+    this.checkGate = checkGate2;
+  }
+  adapter;
+  vaultName;
+  writerKeyringId;
+  getDek;
+  checkGate;
+  /** keyringId → set of listeners. Wildcard '*' fires on every change. */
+  listeners = /* @__PURE__ */ new Map();
+  // ─── Write-self ──────────────────────────────────────────────────────
+  /** Read the writer's own envelope. Returns null if never written. */
+  async me() {
+    const dek = await this.getDek();
+    return loadUserEnvelope(this.adapter, this.vaultName, this.writerKeyringId, dek);
+  }
+  /**
+   * Deep-merge a partial patch into the writer's own envelope. Creates
+   * the envelope on first call. Optimistic-concurrency safe — a stale
+   * `_v` (parallel writer on another device) throws `ConflictError`.
+   *
+   * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
+   * Pass `presented` to satisfy tightened policies that require a
+   * factor proof (e.g. STRICT_POLICY's TOTP requirement).
+   */
+  async updateMe(patch, presented) {
+    if (this.checkGate) await this.checkGate("edit-own-profile", presented);
+    const dek = await this.getDek();
+    const current = await loadUserEnvelope(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      dek
+    );
+    const merged = current ? deepMerge(current.data, patch) : patch;
+    const written = await saveUserEnvelope(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      merged,
+      dek,
+      current?._v ?? 0
+    );
+    this.fireChange(this.writerKeyringId, written);
+    return written;
+  }
+  /**
+   * Replace the writer's own envelope with `payload`. Use sparingly —
+   * `updateMe` is the canonical mutation. No `expectedVersion` check;
+   * callers explicitly take last-write-wins semantics.
+   *
+   * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.
+   */
+  async setMe(payload, presented) {
+    if (this.checkGate) await this.checkGate("edit-own-profile", presented);
+    const dek = await this.getDek();
+    const written = await saveUserEnvelope(
+      this.adapter,
+      this.vaultName,
+      this.writerKeyringId,
+      payload,
+      dek
+    );
+    this.fireChange(this.writerKeyringId, written);
+    return written;
+  }
+  // ─── Read-anyone ─────────────────────────────────────────────────────
+  /**
+   * Read another principal's envelope by their keyringId. Returns null
+   * if the principal exists but has no envelope yet, or if the
+   * keyringId does not exist at all.
+   *
+   * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for
+   * cross-principal reads. Reading your own envelope (`keyringId ===
+   * self`) is never gated; that's just `me()` written long-form.
+   */
+  async get(keyringId, presented) {
+    if (this.checkGate && keyringId !== this.writerKeyringId) {
+      await this.checkGate("view-team-profiles", presented);
+    }
+    const dek = await this.getDek();
+    return loadUserEnvelope(this.adapter, this.vaultName, keyringId, dek);
+  }
+  /**
+   * Read every persisted envelope in the vault. Order is store-defined.
+   *
+   * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets
+   * any authenticated session read all envelopes. Two privacy-strict
+   * opt-outs:
+   *
+   *  - `view-team-profiles.enabled: false` → list() returns only the
+   *    caller's own envelope (silent self-fallback, no thrown error).
+   *  - `view-team-profiles.minTier: 1` + insufficient tier → throws
+   *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The
+   *    caller is expected to elevate, not silently degrade.
+   *
+   * The asymmetry is deliberate: `enabled: false` is a deliberate
+   * design choice ("nobody sees teammate profiles in this app");
+   * `insufficient-tier` is "you need to authenticate further". Different
+   * UX prompts for different intents.
+   */
+  async list(presented) {
+    if (this.checkGate) {
+      try {
+        await this.checkGate("view-team-profiles", presented);
+      } catch (err) {
+        if (err instanceof PolicyDeniedError && err.reason === "disabled") {
+          const me = await this.me();
+          return me ? [me] : [];
+        }
+        throw err;
+      }
+    }
+    const dek = await this.getDek();
+    const ids = await listUserEnvelopeIds(this.adapter, this.vaultName);
+    const envelopes = await Promise.all(
+      ids.map((id) => loadUserEnvelope(this.adapter, this.vaultName, id, dek))
+    );
+    return envelopes.filter((e) => e !== null);
+  }
+  // ─── Reactive ────────────────────────────────────────────────────────
+  /**
+   * Listen for changes to a specific keyringId's envelope. The callback
+   * fires synchronously after every successful local `updateMe` /
+   * `setMe` for that principal.
+   *
+   * Cross-instance changes (a teammate edits their profile on their
+   * device, the sync engine pulls the diff onto this device) will fire
+   * subscribers when the sync layer replays the write through this API.
+   * In v1, subscribers do NOT fire on raw store changes — wire your sync
+   * layer to call back through `vault.user.setMe` / `updateMe` if you
+   * need that.
+   *
+   * Pass keyringId `'*'` to fire on every change in the vault.
+   */
+  subscribe(keyringId, cb) {
+    let listeners = this.listeners.get(keyringId);
+    if (!listeners) {
+      listeners = /* @__PURE__ */ new Set();
+      this.listeners.set(keyringId, listeners);
+    }
+    const wrapped = cb;
+    listeners.add(wrapped);
+    return () => {
+      listeners?.delete(wrapped);
+      if (listeners && listeners.size === 0) {
+        this.listeners.delete(keyringId);
+      }
+    };
+  }
+  /**
+   * Reactive handle that caches the current value and re-reads on every
+   * change for the given keyringId. Convenient for framework bindings:
+   *
+   *   const live = vault.user.live<UserShape>(vault.userId)
+   *   live.subscribe(env => render(env?.data))
+   *
+   * Initial value is `null` until the first `current()` call materializes
+   * it via `vault.user.get()`. Call `stop()` when done to release the
+   * subscription.
+   */
+  live(keyringId) {
+    let value = null;
+    let primed = false;
+    const unsubscribe = this.subscribe(keyringId, (env) => {
+      value = env;
+    });
+    return {
+      current() {
+        if (!primed) {
+          primed = true;
+        }
+        return value;
+      },
+      subscribe: (cb) => this.subscribe(keyringId, cb),
+      stop: unsubscribe
+    };
+  }
+  // ─── Internal: change emission ───────────────────────────────────────
+  fireChange(keyringId, env) {
+    const targeted = this.listeners.get(keyringId);
+    if (targeted) for (const l of targeted) l(env);
+    const wildcard = this.listeners.get("*");
+    if (wildcard) for (const l of wildcard) l(env);
+  }
+};
+function deepMerge(source, patch) {
+  if (!isPlainObject(source) || !isPlainObject(patch)) {
+    return patch;
+  }
+  const out = { ...source };
+  for (const [key, patchVal] of Object.entries(patch)) {
+    const sourceVal = source[key];
+    if (isPlainObject(sourceVal) && isPlainObject(patchVal)) {
+      out[key] = deepMerge(sourceVal, patchVal);
+    } else {
+      out[key] = patchVal;
+    }
+  }
+  return out;
+}
+function isPlainObject(x) {
+  if (x === null || typeof x !== "object") return false;
+  if (Array.isArray(x)) return false;
+  const proto = Object.getPrototypeOf(x);
+  return proto === Object.prototype || proto === null;
+}
+
 // src/policy/storage.ts
 var META_COLLECTION = "_meta";
 var POLICY_RECORD_ID = "policy";
@@ -3561,6 +3783,19 @@ var Vault = class {
   i18nStrategy;
   syncStrategy;
   getDEK;
+  /**
+   * Per-principal user envelope API.
+   *
+   * - Write-self: `me()`, `updateMe(patch)`, `setMe(payload)` — always
+   *   target this vault session's keyringId. There is no method to write
+   *   another principal's envelope (own-only write rule, structural).
+   * - Read-anyone: `get(keyringId)`, `list()` — read other principals'
+   *   envelopes, subject to the `view-team-profiles` policy gate (#22).
+   * - Reactive: `subscribe(id, cb)`, `live(id)` — fire on local writes.
+   *
+   * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+   */
+  user;
   /**
    * Optional callback that re-derives an UnlockedKeyring from the
    * adapter using the active user's passphrase. Called by `load()`
@@ -3693,6 +3928,13 @@ var Vault = class {
     this.locale = opts.locale;
     this.translateText = opts.plaintextTranslator;
     this.getDEK = this.makeGetDEK();
+    this.user = new UserApi(
+      this.adapter,
+      this.name,
+      this.keyring.userId,
+      () => this.getDEK(USER_ENVELOPE_COLLECTION),
+      (gate, presented) => this.noydb.checkGate(this.name, gate, presented)
+    );
   }
   /**
    * Construct (or reconstruct) the lazy DEK resolver. Captures the
@@ -4979,7 +5221,7 @@ var Vault = class {
    * @see docs/subsystems/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-R4EIEQE6.js");
+    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-DFJZHXVH.js");
     return readPublicEnvelope2(this.adapter, this.name, opts);
   }
   /**
@@ -5572,7 +5814,17 @@ var PERSONAL_POLICY = Object.freeze({
     "view-user-auth": {
       minTier: 1,
       enabled: false
-    }
+    },
+    // ─── User envelope gates (#22) ────────────────────────────────────
+    // edit-own-profile: tier 3 floor — any active session can edit their
+    //   own profile/preferences. Tightening to require a TOTP for
+    //   profile changes is a one-line override.
+    // view-team-profiles: tier 2 floor — an authenticated session can
+    //   read teammates' profiles (display names, avatars, locales).
+    //   Setting `enabled: false` makes vault.user.list() return only
+    //   self (privacy-strict opt-out).
+    "edit-own-profile": { minTier: 3 },
+    "view-team-profiles": { minTier: 2 }
   }
 });
 var STRICT_POLICY = Object.freeze({
@@ -5620,7 +5872,16 @@ var STRICT_POLICY = Object.freeze({
     "view-user-auth": {
       minTier: 1,
       enabled: false
-    }
+    },
+    // ─── User envelope gates (#22) ────────────────────────────────────
+    // STRICT: profile edits require a TOTP/email-OTP factor (typical
+    // shared-workstation hardening — your name/avatar shouldn't change
+    // without a fresh second-factor proof).
+    "edit-own-profile": {
+      minTier: 2,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "view-team-profiles": { minTier: 2 }
   }
 });
 function mergePolicy(base, override) {
@@ -6311,6 +6572,36 @@ var Noydb = class {
   off(event, handler) {
     this.emitter.off(event, handler);
   }
+  /**
+   * Soft-lock a single vault: clear its in-memory keyring, DEKs, vault
+   * instance, sync engine, policy enforcer, and active-tier entry —
+   * WITHOUT destroying the `Noydb` instance.
+   *
+   * Designed for "lock screen" UX: the user taps **Lock** and DEKs are
+   * scrubbed from memory immediately, but the same `Noydb` instance can
+   * be re-unlocked via {@link unlockViaAuthenticator} (tier 2) or
+   * {@link unlockViaPin} (tier 3) without re-running `createNoydb`.
+   *
+   * **QuickUnlock state is preserved.** That's the whole point — the
+   * user can still resume via PIN without a full credential re-prompt.
+   * The on-disk `_meta/policy` document is also kept in cache (it
+   * survives lock; nothing about it changes when DEKs are scrubbed).
+   *
+   * No-op when `vault` is not currently in cache (idempotent).
+   *
+   * Unblocks vLannaAi/niwat#33.
+   *
+   * @see #17
+   */
+  lockVault(vault) {
+    this.syncEngines.get(vault)?.stopAutoSync();
+    this.syncEngines.delete(vault);
+    this.policyEnforcers.get(vault)?.destroy();
+    this.policyEnforcers.delete(vault);
+    this.keyringCache.delete(vault);
+    this.vaultCache.delete(vault);
+    this.activeTier.delete(vault);
+  }
   close() {
     this.closed = true;
     if (this.sessionTimer) {
@@ -6505,6 +6796,92 @@ var Noydb = class {
     const keyring = await this.getKeyring(vault);
     return keyring.authenticators;
   }
+  /**
+   * Native WebAuthn enrollment using the **real** internal keyring (#16).
+   *
+   * Why this exists: when a consumer is using `createNoydb({ secret })`,
+   * they cannot reach the live `UnlockedKeyring` to feed it to
+   * `enrollWebAuthn(keyring, vault, opts)` from `@noy-db/on-webauthn`.
+   * Constructing a synthetic keyring (the previous workaround) produces
+   * a slot whose `wrapped_kek` references the synthetic payload, not
+   * the live session — so `unlockViaAuthenticator()` later replaces the
+   * live DEK map with stale wrapped DEKs and every decrypt fails.
+   *
+   * This method runs `ceremony` with the REAL keyring (still in
+   * `keyringCache`). The ceremony performs the WebAuthn enrollment and
+   * returns the slot options that hub then persists via the standard
+   * tier-2 enrollAuthenticator path.
+   *
+   * Layering note: hub does not import `@noy-db/on-webauthn` (that
+   * would invert the dep graph). The consumer wires it in:
+   *
+   * ```ts
+   * import { enrollWebAuthn } from '@noy-db/on-webauthn'
+   *
+   * await db.enrollWebAuthn('demo', async (keyring) => {
+   *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
+   *   return {
+   *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
+   *     method: 'webauthn',
+   *     wrapped_kek: e.wrappedPayload,
+   *     meta: {
+   *       credentialId: e.credentialId,
+   *       wrapIv: e.wrapIv,
+   *       prfUsed: e.prfUsed,
+   *       beFlag: e.beFlag,
+   *       requireSingleDevice: e.requireSingleDevice,
+   *     },
+   *   }
+   * })
+   * ```
+   *
+   * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
+   * for the caller's lookup index (a bootstrap vault, a PublicEnvelope,
+   * a server-side allowlist).
+   *
+   * Gated by `enroll-authenticator` like `enrollAuthenticator()` itself.
+   *
+   * @see #16
+   */
+  async enrollWebAuthn(vault, ceremony, presented) {
+    await this.checkGate(vault, "enroll-authenticator", presented);
+    const keyring = await this.getKeyring(vault);
+    const slotOptions = await ceremony(keyring);
+    if (slotOptions.method !== "webauthn") {
+      throw new ValidationError(
+        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.enrollAuthenticator() for non-webauthn methods.`
+      );
+    }
+    const credentialId = slotOptions.meta.credentialId;
+    if (typeof credentialId !== "string" || credentialId.length === 0) {
+      throw new ValidationError(
+        "enrollWebAuthn: ceremony result must include `meta.credentialId` (base64 string). See @noy-db/on-webauthn enrollWebAuthn() return shape."
+      );
+    }
+    const next = await enrollAuthenticator(this.options.store, vault, keyring, slotOptions);
+    this.keyringCache.set(vault, next);
+    return { credentialId };
+  }
+  /**
+   * Filter the slot list to webauthn-method slots only. Useful for
+   * "you have N WebAuthn credentials enrolled" UI surfaces and for
+   * deciding when a new device prompt should appear. Identity is
+   * `id` + `enrolled_at`; the `meta.credentialId` (base64) is used by
+   * `allowCredentials` at unlock time.
+   *
+   * @see #16
+   */
+  async listWebAuthnSlots(vault) {
+    const keyring = await this.getKeyring(vault);
+    return keyring.authenticators.filter((a) => a.method === "webauthn").map((a) => {
+      const credentialId = a.meta.credentialId;
+      return {
+        id: a.id,
+        enrolledAt: a.enrolled_at,
+        credentialId: typeof credentialId === "string" ? credentialId : ""
+      };
+    });
+  }
   /**
    * Resolve a slot by id, then hand the wrapped-KEK ciphertext + meta
    * to the caller-supplied verifier. The verifier is the
@@ -6724,6 +7101,15 @@ var Noydb = class {
           this.options.secret,
           { validate: this.options.validatePassphrase === true }
         );
+      } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
+        await this.options.store.delete(vault, "_keyring", this.options.user);
+        keyring = await createOwnerKeyring(
+          this.options.store,
+          vault,
+          this.options.user,
+          this.options.secret,
+          { validate: this.options.validatePassphrase === true }
+        );
       } else {
         throw err;
       }
@@ -7015,6 +7401,10 @@ export {
   TxCollection,
   TxContext,
   TxVault,
+  USER_ENVELOPE_COLLECTION,
+  USER_ENVELOPE_MAX_BYTES,
+  UserApi,
+  UserEnvelopeOversizedError,
   ValidationError,
   Vault,
   VaultFrame,
@@ -7047,6 +7437,7 @@ export {
   decryptDeterministic,
   dekKey,
   deleteCredential,
+  deleteUserEnvelope,
   deriveMagicLinkContentKey,
   derivePresenceKey,
   describeAllUsersAuth,
@@ -7098,10 +7489,14 @@ export {
   rotatePassphrase as keyringRotatePassphrase,
   listCredentials,
   listMagicLinkGrants,
+  listUserEnvelopeIds,
+  listUsers,
+  listUsersWithEnvelopes,
   loadActiveDelegations,
   loadDevUnlock,
   loadPaperRecoveryEntries,
   loadPublicEnvelope,
+  loadUserEnvelope,
   loadVaultPolicy,
   magicLinkGrantRecordId,
   max,
@@ -7135,6 +7530,7 @@ export {
   runTransaction,
   savePaperRecoveryEntries,
   savePublicEnvelope,
+  saveUserEnvelope,
   saveVaultPolicy,
   sha256Hex,
   sum,