@noy-db/hub 0.1.0-pre.8 → 0.1.0-pre.9

package/dist/i18n/index.d.cts

@@ -1,5 +1,5 @@
-import { I as I18nStrategy } from '../types-arFMsCtn.cjs';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-arFMsCtn.cjs';
+import { I as I18nStrategy } from '../types-Bnb82f5R.cjs';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-Bnb82f5R.cjs';
 import '../lazy-builder-CZVLKh0Z.cjs';
 import '../predicate-SBHmi6D0.cjs';
 import '../strategy-D-SrOLCl.cjs';

package/dist/i18n/index.d.ts

@@ -1,5 +1,5 @@
-import { I as I18nStrategy } from '../types-DD9eKKNc.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-DD9eKKNc.js';
+import { I as I18nStrategy } from '../types-Bo7NSXJr.js';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-Bo7NSXJr.js';
 import '../lazy-builder-BwEoBQZ9.js';
 import '../predicate-SBHmi6D0.js';
 import '../strategy-D-SrOLCl.js';

package/dist/i18n/index.js

@@ -10,10 +10,10 @@ import {
   isI18nTextDescriptor,
   resolveI18nText,
   validateI18nTextValue
-} from "../chunk-2WGMYBYS.js";
-import "../chunk-YVFTBQHL.js";
+} from "../chunk-MDDTIZUO.js";
+import "../chunk-WDM5XGGS.js";
 import "../chunk-CIMZBAZB.js";
-import "../chunk-PJK6IOBC.js";
+import "../chunk-RKJ6OL7K.js";
 import "../chunk-MR4424N3.js";
 import "../chunk-ACLDOTNQ.js";
 

package/dist/{index-Dp4tKCjX.d.ts → index-8QDuznDr.d.ts}

@@ -1,4 +1,4 @@
-import { aS as PublicEnvelope, b0 as BundleRecipient, aY as Vault } from './types-DD9eKKNc.js';
+import { aS as PublicEnvelope, b0 as BundleRecipient, aY as Vault } from './types-Bo7NSXJr.js';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.

package/dist/{index-DsVbTDZI.d.cts → index-CywCC1qZ.d.cts}

@@ -1,4 +1,4 @@
-import { aS as PublicEnvelope, b0 as BundleRecipient, aY as Vault } from './types-arFMsCtn.cjs';
+import { aS as PublicEnvelope, b0 as BundleRecipient, aY as Vault } from './types-Bnb82f5R.cjs';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.

package/dist/index.cjs

@@ -5012,6 +5012,11 @@ function canRevoke(callerRole, targetRole) {
   if (callerRole === "admin") return ADMIN_GRANTABLE_TARGETS.includes(targetRole);
   return false;
 }
+function canUpdateRole(callerRole, targetRole) {
+  if (callerRole === "owner") return true;
+  if (callerRole === "admin") return ADMIN_GRANTABLE_TARGETS.includes(targetRole);
+  return false;
+}
 async function loadKeyring(adapter, vault, userId, passphrase) {
   const envelope = await adapter.get(vault, "_keyring", userId);
   if (!envelope) {
@@ -5205,6 +5210,37 @@ async function revoke(adapter, vault, callerKeyring, options) {
     await rotateKeys(adapter, vault, callerKeyring, [...affectedCollections]);
   }
 }
+async function updateKeyringIdentity(adapter, vault, callerKeyring, options) {
+  if (options.role === void 0 && options.displayName === void 0 && options.permissions === void 0) {
+    throw new ValidationError(
+      `updateUser: at least one of role / displayName / permissions must be provided (userId: "${options.userId}").`
+    );
+  }
+  const env = await adapter.get(vault, "_keyring", options.userId);
+  if (!env) {
+    throw new NoAccessError(
+      `updateUser: user "${options.userId}" has no keyring in vault "${vault}".`
+    );
+  }
+  const target = JSON.parse(env._data);
+  if (!canUpdateRole(callerKeyring.role, target.role)) {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot update a keyring with role "${target.role}"`
+    );
+  }
+  if (options.role !== void 0 && options.role !== target.role && !canUpdateRole(callerKeyring.role, options.role)) {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot promote target to role "${options.role}"`
+    );
+  }
+  const next = {
+    ...target,
+    ...options.role !== void 0 && { role: options.role },
+    ...options.displayName !== void 0 && { display_name: options.displayName },
+    ...options.permissions !== void 0 && { permissions: options.permissions }
+  };
+  await writeKeyringFile(adapter, vault, options.userId, next);
+}
 async function rotateKeys(adapter, vault, callerKeyring, collections) {
   const newDeks = /* @__PURE__ */ new Map();
   for (const collName of collections) {
@@ -5505,6 +5541,38 @@ async function enrollAuthenticator(store, vault, keyring, options) {
   await persistKeyring(store, vault, next);
   return next;
 }
+async function updateAuthenticator(store, vault, keyring, slotId, options) {
+  if (options.meta === void 0) {
+    throw new ValidationError(
+      `updateAuthenticator: at least one of meta must be provided (slotId: "${slotId}").`
+    );
+  }
+  const idx = keyring.authenticators.findIndex((a) => a.id === slotId);
+  if (idx === -1) {
+    throw new NoAccessError(
+      `updateAuthenticator: slot "${slotId}" not found in vault "${vault}".`
+    );
+  }
+  const existing = keyring.authenticators[idx];
+  const mergedMeta = { ...existing.meta };
+  for (const [k, v] of Object.entries(options.meta)) {
+    if (v === void 0) continue;
+    if (v === null) {
+      delete mergedMeta[k];
+      continue;
+    }
+    mergedMeta[k] = v;
+  }
+  const next = { ...existing, meta: mergedMeta };
+  const nextSlots = [...keyring.authenticators];
+  nextSlots[idx] = next;
+  const nextKeyring = {
+    ...keyring,
+    authenticators: nextSlots
+  };
+  await persistKeyring(store, vault, nextKeyring);
+  return nextKeyring;
+}
 async function removeAuthenticator(store, vault, keyring, slotId) {
   const filtered = keyring.authenticators.filter((a) => a.id !== slotId);
   if (filtered.length === keyring.authenticators.length) {
@@ -5959,6 +6027,17 @@ var UserApi = class {
    * the envelope on first call. Optimistic-concurrency safe — a stale
    * `_v` (parallel writer on another device) throws `ConflictError`.
    *
+   * Patch semantics (#57):
+   *   - `undefined` (or omitted key) — skip; existing value preserved
+   *   - `null` — delete the field from the merged result
+   *   - any other value — overwrite (deep-merge for plain objects,
+   *     replace for primitives / arrays)
+   *
+   * To clear a field, pass `null` rather than `undefined`. Callers
+   * with shape `T = string | null` where `null` is a meaningful value
+   * should use `setMe` for that specific field instead — `null` here
+   * always means delete.
+   *
    * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
    * Pass `presented` to satisfy tightened policies that require a
    * factor proof (e.g. STRICT_POLICY's TOTP requirement).
@@ -6130,9 +6209,17 @@ function deepMerge(source, patch) {
   }
   const out = { ...source };
   for (const [key, patchVal] of Object.entries(patch)) {
+    if (patchVal === void 0) {
+      continue;
+    }
+    if (patchVal === null) {
+      delete out[key];
+      continue;
+    }
     const sourceVal = source[key];
-    if (isPlainObject(sourceVal) && isPlainObject(patchVal)) {
-      out[key] = deepMerge(sourceVal, patchVal);
+    if (isPlainObject(patchVal)) {
+      const recurseSource = isPlainObject(sourceVal) ? sourceVal : {};
+      out[key] = deepMerge(recurseSource, patchVal);
     } else {
       out[key] = patchVal;
     }
@@ -13656,6 +13743,12 @@ var PERSONAL_POLICY = Object.freeze({
     },
     "enroll-authenticator": { minTier: 1 },
     "remove-authenticator": { minTier: 1 },
+    // update-authenticator: meta-only mutation (slot rename, label
+    // changes). Symmetric with enroll/remove under PERSONAL — tier-1
+    // unlock alone. The structural anti-slot-swap guard inside the
+    // implementation enforces wrap-material/id/method immutability
+    // regardless of this gate's settings.
+    "update-authenticator": { minTier: 1 },
     "rotate-unlock": { minTier: 2 },
     "enroll-user": { minTier: 1 },
     "revoke-user": { minTier: 1 },
@@ -13665,6 +13758,12 @@ var PERSONAL_POLICY = Object.freeze({
     // virtue of being a co-owner). Tier-1 unlock is the floor; the
     // STRICT preset adds a recovery/email-OTP requirement.
     "peer-recover-user": { minTier: 1 },
+    // update-user: post-grant identity mutation (role/displayName/
+    // permissions). PERSONAL_POLICY treats this on par with enroll-user
+    // / revoke-user — tier-1 unlock alone. The role-elevation guard
+    // inside the implementation is the structural backstop that this
+    // gate's settings cannot weaken.
+    "update-user": { minTier: 1 },
     "export-bundle": { minTier: 1 },
     "export-plaintext": {
       minTier: 1,
@@ -13709,6 +13808,15 @@ var STRICT_POLICY = Object.freeze({
       minTier: 1,
       factors: [{ anyOf: ["totp", "email-otp"] }]
     },
+    // STRICT update-authenticator: same factor floor as enroll/remove.
+    // Even though meta changes don't touch wrap material, a malicious
+    // rename could mislead the user about which device a slot
+    // corresponds to ("MacBook Touch ID" → "iPhone Touch ID" on a
+    // shared workstation). STRICT requires a fresh factor proof.
+    "update-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
     "rotate-unlock": { minTier: 1 },
     "enroll-user": {
       minTier: 1,
@@ -13731,6 +13839,18 @@ var STRICT_POLICY = Object.freeze({
       minTier: 1,
       factors: [{ anyOf: ["recovery", "totp", "email-otp", "webauthn-roaming"] }]
     },
+    // STRICT update-user: matches the enroll-user / revoke-user shape
+    // (off-device factor required). Update-user is admin-shaped — it
+    // mutates someone else's role/permissions; STRICT requires a fresh
+    // off-device factor proof so the operator affirmatively re-asserts
+    // identity at the moment of mutation. Platform-bound factors
+    // (Touch ID / password / PIN) intentionally excluded: same logic as
+    // peer-recover-user — the off-device requirement is the whole
+    // point under STRICT.
+    "update-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
     "export-bundle": {
       minTier: 1,
       factors: [{ anyOf: ["totp", "email-otp"] }],
@@ -14125,6 +14245,56 @@ var Noydb = class {
     const keyring = await this.getKeyring(vault);
     await revoke(this.options.store, vault, keyring, options);
   }
+  /**
+   * Mutate post-grant identity fields on an existing keyring — `role`,
+   * `displayName`, and/or `permissions`. Pure plaintext-header rewrite:
+   * no DEK rewrap, no KEK required, no authenticator slots touched.
+   * Tier-2 enrollments and recovery codes survive.
+   *
+   * Different from `db.revoke + db.grant`:
+   *
+   *   - Same `userId`, same DEK wrappings, same `granted_by`, same
+   *     `_users/<keyringId>` envelope. Only the specified header
+   *     fields move. Last-write-wins via the standard keyring put.
+   *   - No cascade on role demotion (admins demoted to operator keep
+   *     the keyrings they previously granted; the cascade rules are
+   *     a `db.revoke` concern, not `db.updateUser`).
+   *   - Tier-2 slots NOT dropped — the wrapping is unaffected.
+   *
+   * Role-elevation guard: BOTH the old and new role must satisfy
+   * `db.grant`'s hierarchy. Owner can do anything; admin manages
+   * admin/operator/viewer/client laterally; admin cannot promote to
+   * owner OR demote from owner. The guard runs regardless of the
+   * `update-user` policy gate's settings — gates can only be more
+   * permissive than the structural floor, never less.
+   *
+   * Gated by `update-user`. `STRICT_POLICY` requires a TOTP/email-OTP
+   * factor proof so the operator affirmatively re-asserts identity at
+   * the moment of mutation; `PERSONAL_POLICY` accepts a tier-1 unlock
+   * alone.
+   *
+   * ```ts
+   * await db.updateUser('acme', {
+   *   userId: 'bob',
+   *   role: 'operator',                 // promote
+   *   permissions: { invoices: 'rw' },
+   * }, { factors: [{ kind: 'totp' }] })
+   * ```
+   *
+   * @throws `NoAccessError` when no keyring exists for the target.
+   * @throws `PermissionDeniedError` when the role hierarchy rejects.
+   * @throws `ValidationError` when no field is provided.
+   *
+   * @see #54
+   */
+  async updateUser(vault, options, factors) {
+    await this.checkGate(vault, "update-user", factors);
+    const keyring = await this.getKeyring(vault);
+    await updateKeyringIdentity(this.options.store, vault, keyring, options);
+    if (options.userId === this.options.user) {
+      this.keyringCache.delete(vault);
+    }
+  }
   /**
    * Rotate the DEKs for the given collections in a vault.
    *
@@ -14668,6 +14838,40 @@ var Noydb = class {
     const keyring = await this.getKeyring(vault);
     return keyring.authenticators;
   }
+  /**
+   * Mutate the `meta` blob on an existing authenticator slot — slot
+   * rename, label change, attachment of UI hints. The slot's `id`,
+   * `method`, and wrap material (`wrapped_kek` / `wrapped_deks` + `iv`)
+   * are immutable through this method. Anti-slot-swap is structural,
+   * not gate-driven.
+   *
+   * `meta` patch semantics (#57-aligned):
+   *   - Top-level merge — absent keys preserved
+   *   - `null` value — delete that meta key
+   *   - Other values — replace verbatim
+   *
+   * Use case: per-slot nickname for "iPhone Touch ID" vs "MacBook
+   * Touch ID" disambiguation in admin UIs. The slot id (auto-derived
+   * from credentialId prefix) is not human-friendly; `meta.nickname`
+   * is.
+   *
+   * Gated by `update-authenticator`. PERSONAL_POLICY: tier-1 unlock
+   * alone (matches enroll/remove). STRICT_POLICY: tier-1 +
+   * TOTP/email-OTP factor proof — a malicious rename on a shared
+   * workstation could mislead the user about which device a slot
+   * corresponds to, so STRICT requires fresh factor binding.
+   *
+   * @throws `NoAccessError` when no slot with the given id exists.
+   * @throws `ValidationError` when no patch field is provided.
+   *
+   * @see #55
+   */
+  async updateAuthenticator(vault, slotId, options, presented) {
+    await this.checkGate(vault, "update-authenticator", presented);
+    const keyring = await this.getKeyring(vault);
+    const next = await updateAuthenticator(this.options.store, vault, keyring, slotId, options);
+    this.keyringCache.set(vault, next);
+  }
   /**
    * Native WebAuthn enrollment using the **real** internal keyring (#16).
    *