@noy-db/hub 0.10.0-pre.1 → 0.10.0-pre.2

package/dist/{chunk-WVML7HUZ.js → chunk-UXH4AKH3.js}

@@ -5,17 +5,22 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-PQGCWTTI.js";
+} from "./chunk-ZQQLOEWN.js";
+import {
+  assertStrongEchoSecret,
+  assertStrongSecret
+} from "./chunk-KHSBMLQE.js";
 import {
   keyringClearance
-} from "./chunk-OCSKQUNE.js";
+} from "./chunk-VKZ3TDET.js";
 import {
   parseDekKey
-} from "./chunk-KFYUQMF5.js";
+} from "./chunk-F2FD4LSB.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   buildRecordEnvelope,
+  capabilities,
   checkCanary,
   decrypt,
   decryptBytes,
@@ -44,10 +49,13 @@ import {
   rekeyEnvelopeIfNeeded,
   unwrapKey,
   wrapKey
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
+import {
+  assertCapsuleSupports
+} from "./chunk-I4S7IZSS.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-VUBRHJ4H.js";
+} from "./chunk-CR5UPYIJ.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
@@ -59,7 +67,6 @@ import {
   KeyringTamperedError,
   MemberInboxMissingError,
   NoAccessError,
-  NoydbError,
   PermissionDeniedError,
   PrivilegeEscalationError,
   ROSTER_KEY_ID,
@@ -68,7 +75,7 @@ import {
   ValidationError,
   WrongPromptError,
   isConflictError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-party/team/roster-epoch.ts
 function assertRosterEpochCurrent(found, expected, userId) {
@@ -214,135 +221,45 @@ function stampAuthority(authority, previousEpoch) {
   };
 }
 
-// src/kernel/validation.ts
-var WeakSecretError = class extends NoydbError {
-  reason;
-  /**
-   * Remediation copy. Empty string when no truthful advice was
-   * available — a `customValidator` rejected the phrase and supplied
-   * none, so the hub has no rules to describe (#1430). Never populated
-   * with the built-in copy in that case: wrong advice is worse than
-   * none, especially for a vault whose own credentials violate it.
-   */
-  suggestion;
-  constructor(reason, suggestion) {
-    const advice = suggestion ?? "";
-    super("WEAK_SECRET", advice ? `Weak secret (${reason}). ${advice}` : `Weak secret (${reason}).`);
-    this.name = "WeakSecretError";
-    this.reason = reason;
-    this.suggestion = advice;
-  }
-};
-var DEFAULT_MIN_WORDS = 6;
-var DEFAULT_MIN_WORD_LENGTH = 3;
-var SUGGESTIONS = {
-  empty: "Provide a phrase of at least 6 lowercase words separated by single spaces.",
-  "invalid-chars": "Use only lowercase letters [a-z] and single spaces. No punctuation, symbols, digits, or uppercase.",
-  "leading-or-trailing-space": "Trim leading and trailing spaces.",
-  "double-space": "Use exactly one space between words.",
-  "too-few-words": 'Use at least 6 words by default (8 under strict policy). Example: "correct horse battery staple printer toaster".',
-  "word-too-short": 'Each word must be at least 3 characters. Drop short fillers like "a", "is", "of".',
-  "repeated-adjacent": "Avoid repeating the same word twice in a row."
+// src/kernel/capsule-requirements.ts
+var SERVICE_GROUPS = [
+  ["blobsStrategy", "per-record-keys"],
+  ["cargoStrategy", "per-record-keys"],
+  ["tiersStrategy", "per-record-keys"],
+  ["classifiedStrategy", "classify"]
+];
+var some = (v) => {
+  if (v == null) return false;
+  return Array.isArray(v) ? v.length > 0 : v.size > 0;
 };
-function validateSecret(s, opts) {
-  if (opts?.customValidator) {
-    return opts.customValidator(s);
-  }
-  const minWords = opts?.minWords ?? DEFAULT_MIN_WORDS;
-  const minWordLength = opts?.minWordLength ?? DEFAULT_MIN_WORD_LENGTH;
-  const rejectRepeated = opts?.rejectRepeatedAdjacent ?? true;
-  if (s.length === 0) {
-    return { ok: false, reason: "empty" };
-  }
-  if (s !== s.trim()) {
-    return { ok: false, reason: "leading-or-trailing-space" };
-  }
-  if (s.includes("  ")) {
-    return { ok: false, reason: "double-space" };
-  }
-  const charPattern = opts?.pattern ?? /^[a-z]+( [a-z]+)*$/;
-  if (!charPattern.test(s)) {
-    return { ok: false, reason: "invalid-chars" };
-  }
-  const words = s.split(" ");
-  if (words.length < minWords) {
-    return { ok: false, reason: "too-few-words", minimum: minWords, got: words.length };
-  }
-  for (const w of words) {
-    if (w.length < minWordLength) {
-      return { ok: false, reason: "word-too-short", minimum: minWordLength, got: w.length };
-    }
-  }
-  if (rejectRepeated) {
-    for (let i = 1; i < words.length; i++) {
-      if (words[i] === words[i - 1]) {
-        return { ok: false, reason: "repeated-adjacent" };
-      }
-    }
+function fieldGroupRequirements(collection, decl) {
+  const out = [];
+  if (some(decl.sensitiveFields)) out.push(["sealing", `collection "${collection}" sensitiveFields`]);
+  if (some(decl.deterministicFields)) out.push(["deterministic", `collection "${collection}" deterministicFields`]);
+  if (decl.perRecordKeys === true) out.push(["per-record-keys", `collection "${collection}" perRecordKeys`]);
+  for (const [field, spec] of Object.entries(decl.classifiedByField ?? {})) {
+    if (spec.storage === "recoverable") out.push(["sealing", `collection "${collection}" field "${field}" (storage:'recoverable')`]);
+    if (spec.storage === "digest-only") out.push(["classify", `collection "${collection}" field "${field}" (storage:'digest-only')`]);
+    if (spec.equatable === true) out.push(["classify", `collection "${collection}" field "${field}" (equatable)`]);
   }
-  return { ok: true, words: words.length };
-}
-function resolveSuggestion(result, customValidatorInUse) {
-  if (result.suggestion !== void 0) return result.suggestion;
-  if (customValidatorInUse) return void 0;
-  return SUGGESTIONS[result.reason];
-}
-function assertStrongSecret(s, opts) {
-  if (opts?.allowWeakSecret) return;
-  const result = validateSecret(s, opts);
-  if (result.ok) return;
-  throw new WeakSecretError(
-    result.reason,
-    resolveSuggestion(result, opts?.customValidator !== void 0)
-  );
+  return out;
 }
-function estimateEntropy(secret) {
-  const result = validateSecret(secret);
-  if (!result.ok) return 0;
-  return Math.round(result.words * Math.log2(7776));
-}
-var DEFAULT_ECHO_PROMPT_MIN_WORDS = 3;
-var DEFAULT_ECHO_MIN_WORD_LENGTH = 1;
-function validateEchoSecretDetailed(parts, opts) {
-  for (const part of [parts.prompt, parts.echo, parts.key]) {
-    if (part.trim().length === 0) return { result: { ok: false, reason: "empty" }, failedCheck: "empty" };
-  }
-  const promptPolicy = {
-    minWords: opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS,
-    minWordLength: opts?.prompt?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,
-    ...opts?.prompt?.rejectRepeatedAdjacent !== void 0 && { rejectRepeatedAdjacent: opts.prompt.rejectRepeatedAdjacent },
-    ...opts?.prompt?.pattern !== void 0 && { pattern: opts.prompt.pattern },
-    ...opts?.prompt?.customValidator !== void 0 && { customValidator: opts.prompt.customValidator }
-  };
-  const promptResult = validateSecret(parts.prompt, promptPolicy);
-  if (!promptResult.ok) return { result: promptResult, failedCheck: "prompt" };
-  const combinedPolicy = {
-    ...opts?.combined?.minWords !== void 0 && { minWords: opts.combined.minWords },
-    minWordLength: opts?.combined?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,
-    ...opts?.combined?.rejectRepeatedAdjacent !== void 0 && { rejectRepeatedAdjacent: opts.combined.rejectRepeatedAdjacent },
-    ...opts?.combined?.pattern !== void 0 && { pattern: opts.combined.pattern },
-    ...opts?.combined?.customValidator !== void 0 && { customValidator: opts.combined.customValidator }
-  };
-  const combinedResult = validateSecret(`${parts.prompt} ${parts.echo} ${parts.key}`, combinedPolicy);
-  return { result: combinedResult, failedCheck: "combined" };
+function serviceGroupRequirements(options) {
+  return SERVICE_GROUPS.filter(([key]) => options[key] != null).map(([key, group]) => [group, `createNoydb({ ${key} })`]);
 }
-function validateEchoSecret(parts, opts) {
-  return validateEchoSecretDetailed(parts, opts).result;
+function assertVaultPostureSupported(caps, requirer) {
+  assertCapsuleSupports(caps, "authenticate", requirer);
+  assertCapsuleSupports(caps, "seal", requirer);
 }
-function promptSuggestion(reason, minWords) {
-  if (reason === "too-few-words") {
-    return `The prompt (the part you type first) must be at least ${minWords} words. Example: "sono chiamato vicio".`;
+function assertServicesSupported(options, caps) {
+  for (const [group, requirer] of serviceGroupRequirements(options)) {
+    assertCapsuleSupports(caps, group, requirer);
   }
-  return `The prompt (the part you type first) is the problem. ${SUGGESTIONS[reason]}`;
 }
-function assertStrongEchoSecret(parts, opts) {
-  if (opts?.allowWeakSecret) return;
-  const { result, failedCheck } = validateEchoSecretDetailed(parts, opts);
-  if (result.ok) return;
-  const promptMinWords = opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS;
-  const customInUse = failedCheck === "prompt" ? opts?.prompt?.customValidator !== void 0 : opts?.combined?.customValidator !== void 0;
-  const suggestion = result.suggestion !== void 0 ? result.suggestion : failedCheck === "prompt" && !customInUse ? promptSuggestion(result.reason, promptMinWords) : resolveSuggestion(result, customInUse);
-  throw new WeakSecretError(result.reason, suggestion);
+function assertFieldsSupported(collection, decl, caps) {
+  for (const [group, requirer] of fieldGroupRequirements(collection, decl)) {
+    assertCapsuleSupports(caps, group, requirer);
+  }
 }
 
 // src/with-party/team/echo-secret.ts
@@ -500,6 +417,7 @@ function assertKeyringNotExpired(file) {
 }
 async function loadKeyring(store, vault, opts) {
   const { userId, secret } = opts;
+  assertVaultPostureSupported(capabilities(), `loadKeyring("${vault}")`);
   const found = await readKeyringFile(store, vault, userId);
   if (!found) {
     throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
@@ -571,6 +489,20 @@ async function loadKeyring(store, vault, opts) {
   if (drained) await persistKeyring(store, vault, unlocked);
   return unlocked;
 }
+async function assertPeerKeyringMatches(local, peer, vault, userId) {
+  const [mine, theirs] = await Promise.all([
+    readKeyringFile(local, vault, userId),
+    readKeyringFile(peer, vault, userId)
+  ]);
+  if (!mine || !theirs) return;
+  if (mine.file.salt === theirs.file.salt) return;
+  const mineEpoch = mine.file.roster_epoch ?? 0;
+  const theirsEpoch = theirs.file.roster_epoch ?? 0;
+  if (mineEpoch !== theirsEpoch) return;
+  throw new NoAccessError(
+    `attachSyncTarget("${vault}"): this device holds a DIFFERENT keyring for "${userId}" than the peer does, so the two have diverged and neither can read the other's records. This happens when a device opens the vault before its peer is attached: the open finds no keyring and provisions a new one. Either pass the peer at construction \u2014 createNoydb({ sync: { store, role: 'sync-peer' } }) \u2014 so the keyring is adopted before the first open, or start this device from an empty local store. \u26D4 Refusing rather than adopting the peer's keyring: any record already written on this device is sealed under the keyring that would be discarded.`
+  );
+}
 async function assertKeyringOpenAllowed(store, vault, userId, create) {
   const keyringUsers = await store.list(vault, "_keyring");
   if (keyringUsers.includes(userId)) return;
@@ -583,8 +515,17 @@ async function assertKeyringOpenAllowed(store, vault, userId, create) {
     );
   }
 }
+async function createOwnerKeyringOrLoad(store, vault, options) {
+  try {
+    return await createOwnerKeyring(store, vault, options);
+  } catch (err) {
+    if (!isConflictError(err)) throw err;
+    return await loadKeyring(store, vault, { userId: options.userId, secret: options.secret });
+  }
+}
 async function createOwnerKeyring(store, vault, opts) {
   const { userId, secret } = opts;
+  assertVaultPostureSupported(capabilities(), `createOwnerKeyring("${vault}")`);
   if (opts.validate && !opts.allowWeakSecret) {
     if (typeof secret === "string") assertStrongSecret(secret, opts);
     else {
@@ -1132,20 +1073,27 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
     ];
     for (const ref of refs) {
       const { collection: refColl, id } = ref;
-      const envelope = await store.get(vault, refColl, id);
-      if (!envelope || !envelope._iv) continue;
-      let newEnvelope;
-      try {
-        newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
-      } catch (err) {
-        if (await envelopeOpensUnderAny({ collection: refColl, id }, envelope, siblingSlotDeks)) {
-          continue;
+      let attempt = 0;
+      for (; ; ) {
+        const envelope = await store.get(vault, refColl, id);
+        if (!envelope || !envelope._iv) break;
+        let newEnvelope;
+        try {
+          newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
+        } catch (err) {
+          if (await envelopeOpensUnderAny({ collection: refColl, id }, envelope, siblingSlotDeks)) {
+            break;
+          }
+          throw err;
+        }
+        if (newEnvelope === null) break;
+        try {
+          await store.put(vault, refColl, id, newEnvelope, envelope._v);
+          rewritten.push({ collection: refColl, id, version: newEnvelope._v });
+          break;
+        } catch (err) {
+          if (!isConflictError(err) || ++attempt >= 3) throw err;
         }
-        throw err;
-      }
-      if (newEnvelope !== null) {
-        await store.put(vault, refColl, id, newEnvelope);
-        rewritten.push({ collection: refColl, id, version: newEnvelope._v });
       }
     }
   }
@@ -1632,14 +1580,8 @@ export {
   assertRosterAuthenticated,
   assertRosterTagValid,
   stampAuthority,
-  WeakSecretError,
-  validateSecret,
-  assertStrongSecret,
-  estimateEntropy,
-  DEFAULT_ECHO_PROMPT_MIN_WORDS,
-  DEFAULT_ECHO_MIN_WORD_LENGTH,
-  validateEchoSecret,
-  assertStrongEchoSecret,
+  assertServicesSupported,
+  assertFieldsSupported,
   buildEchoBlock,
   verifyPrompt,
   resolveEchoReveal,
@@ -1655,7 +1597,9 @@ export {
   readKeyringFile,
   assertKeyringNotExpired,
   loadKeyring,
+  assertPeerKeyringMatches,
   assertKeyringOpenAllowed,
+  createOwnerKeyringOrLoad,
   createOwnerKeyring,
   grant,
   NON_ROTATABLE_SLOTS,
@@ -1682,4 +1626,4 @@ export {
   basisOf,
   writeKeyringFile
 };
-//# sourceMappingURL=chunk-WVML7HUZ.js.map
+//# sourceMappingURL=chunk-UXH4AKH3.js.map