@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-2OZXVKVP.js

@@ -1,367 +0,0 @@
-import {
-  loadVaultPolicy,
-  saveVaultPolicy
-} from "./chunk-G4JYND6L.js";
-import {
-  PolicyDeniedError,
-  ValidationError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-party/policy/presets.ts
-var PERSONAL_POLICY = Object.freeze({
-  passphrase: {
-    minWords: 6,
-    minWordLength: 3,
-    rejectRepeatedAdjacent: true
-  },
-  gates: {
-    "rotate-passphrase": {
-      minTier: 1,
-      // Any second factor satisfies the gate — off-device kinds (TOTP,
-      // email-OTP, paper recovery, roaming WebAuthn) are the strongest;
-      // platform-bound kinds (platform WebAuthn, password, PIN) are
-      // accepted because requiring "something off-device" is overkill
-      // for personal/SMB threat models. Consumers needing the off-device
-      // guarantee should use STRICT_POLICY or override this gate.
-      factors: [{
-        anyOf: [
-          "totp",
-          "email-otp",
-          "recovery",
-          "webauthn-roaming",
-          "webauthn-platform",
-          "password",
-          "pin"
-        ]
-      }]
-    },
-    "recover-passphrase": {
-      minTier: 1,
-      enabled: true
-    },
-    // rotate-recovery: deliberate paper-sheet regeneration
-    // when the user remembers their passphrase. PERSONAL allows tier-1 —
-    // knowing the passphrase is enough.
-    "rotate-recovery": { minTier: 1 },
-    "enroll-authenticator": { minTier: 1 },
-    "remove-authenticator": { minTier: 1 },
-    // update-authenticator: meta-only mutation (slot rename, label
-    // changes). Symmetric with enroll/remove under PERSONAL — tier-1
-    // unlock alone. The structural anti-slot-swap guard inside the
-    // implementation enforces wrap-material/id/method immutability
-    // regardless of this gate's settings.
-    "update-authenticator": { minTier: 1 },
-    "rotate-unlock": { minTier: 2 },
-    "enroll-user": { minTier: 1 },
-    "revoke-user": { minTier: 1 },
-    // Peer-recovery is a high-trust intentional op — co-owners
-    // recovering each other should not need an off-device factor in
-    // the personal/SMB threat model (the partner is already vetted by
-    // virtue of being a co-owner). Tier-1 unlock is the floor; the
-    // STRICT preset adds a recovery/email-OTP requirement.
-    "peer-recover-user": { minTier: 1 },
-    // update-user: post-grant identity mutation (role/displayName/
-    // permissions). PERSONAL_POLICY treats this on par with enroll-user
-    // / revoke-user — tier-1 unlock alone. The role-elevation guard
-    // inside the implementation is the structural backstop that this
-    // gate's settings cannot weaken.
-    "update-user": { minTier: 1 },
-    "export-bundle": { minTier: 1 },
-    "export-plaintext": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "view-user-auth": {
-      minTier: 1,
-      enabled: false
-    },
-    // ─── User envelope gates ──────────────────────────────────────────
-    // edit-own-profile: tier 3 floor — any active session can edit their
-    //   own profile/preferences. Tightening to require a TOTP for
-    //   profile changes is a one-line override.
-    // view-team-profiles: tier 2 floor — an authenticated session can
-    //   read teammates' profiles (display names, avatars, locales).
-    //   Setting `enabled: false` makes vault.user.list() return only
-    //   self (privacy-strict opt-out).
-    "edit-own-profile": { minTier: 3 },
-    "view-team-profiles": { minTier: 2 },
-    // client-unilateral-withdraw: a non-owner's self-service DESTRUCTIVE
-    // withdrawal (export-and-delete/freeze). Fail-closed by default —
-    // the firm opts in per jurisdiction/contract (e.g. GDPR Art. 17).
-    // Listed explicitly (not just relying on the built-in default) so it is
-    // discoverable in describeGate / policy dumps.
-    "client-unilateral-withdraw": { minTier: 1, enabled: false },
-    // Two-party withdrawal: filing a request is non-destructive
-    // (tier-1, enabled so a read-only client can ask); deciding it is the
-    // destructive step (tier-2 floor + owner/admin role, enforced in code).
-    "user-request-withdrawal": { minTier: 1 },
-    "approve-user-withdrawal": { minTier: 2 }
-  }
-});
-var STRICT_POLICY = Object.freeze({
-  passphrase: {
-    minWords: 8,
-    minWordLength: 3,
-    rejectRepeatedAdjacent: true
-  },
-  gates: {
-    "rotate-passphrase": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp", "recovery"], count: 2 }]
-    },
-    "recover-passphrase": {
-      minTier: 1,
-      enabled: true
-    },
-    // rotate-recovery: STRICT requires an off-device factor —
-    // rotating recovery is an off-site-trust event; a stolen unlocked
-    // laptop must not be able to silently mint a new sheet for the
-    // attacker. Matches the `peer-recover-user` STRICT default.
-    "rotate-recovery": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp", "webauthn-roaming"] }]
-    },
-    "enroll-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "remove-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    // STRICT update-authenticator: same factor floor as enroll/remove.
-    // Even though meta changes don't touch wrap material, a malicious
-    // rename could mislead the user about which device a slot
-    // corresponds to ("MacBook Touch ID" → "iPhone Touch ID" on a
-    // shared workstation). STRICT requires a fresh factor proof.
-    "update-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "rotate-unlock": { minTier: 1 },
-    "enroll-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "revoke-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    // STRICT peer-recovery: the issuer must present a recovery code
-    // OR a fresh off-device second factor at the moment of recovery.
-    // This binds the high-trust operation to a verifiable proof
-    // (recovery sheet photographed by an attacker won't suffice —
-    // they'd also need tier-1 unlock first; this gate is the freshness
-    // binding on top). Roaming WebAuthn (YubiKey-class hardware key)
-    // accepted; platform-bound kinds (Touch ID, password, PIN)
-    // intentionally excluded under STRICT because they don't survive
-    // device theft — the off-device requirement is the whole point.
-    "peer-recover-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["recovery", "totp", "email-otp", "webauthn-roaming"] }]
-    },
-    // STRICT update-user: matches the enroll-user / revoke-user shape
-    // (off-device factor required). Update-user is admin-shaped — it
-    // mutates someone else's role/permissions; STRICT requires a fresh
-    // off-device factor proof so the operator affirmatively re-asserts
-    // identity at the moment of mutation. Platform-bound factors
-    // (Touch ID / password / PIN) intentionally excluded: same logic as
-    // peer-recover-user — the off-device requirement is the whole
-    // point under STRICT.
-    "update-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "export-bundle": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }],
-      warn: { sharedDevice: "block" }
-    },
-    "export-plaintext": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
-      warn: { sharedDevice: "block" }
-    },
-    "view-user-auth": {
-      minTier: 1,
-      enabled: false
-    },
-    // ─── User envelope gates ──────────────────────────────────────────
-    // STRICT: profile edits require a TOTP/email-OTP factor (typical
-    // shared-workstation hardening — your name/avatar shouldn't change
-    // without a fresh second-factor proof).
-    "edit-own-profile": {
-      minTier: 2,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "view-team-profiles": { minTier: 2 },
-    // STRICT: still fail-closed, but if a regulated firm flips enabled:true
-    // they inherit a two-factor proof + shared-device block for the
-    // destructive withdrawal (mirrors export-plaintext's hardening).
-    "client-unilateral-withdraw": {
-      minTier: 1,
-      enabled: false,
-      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
-      warn: { sharedDevice: "block" }
-    },
-    // STRICT: filing stays tier-1; the destructive APPROVE demands an
-    // off-device factor + shared-device block (mirrors export-bundle).
-    "user-request-withdrawal": { minTier: 1 },
-    "approve-user-withdrawal": {
-      minTier: 2,
-      factors: [{ anyOf: ["totp", "email-otp"] }],
-      warn: { sharedDevice: "block" }
-    }
-  }
-});
-function mergePolicy(base, override) {
-  if (!override) return base;
-  const passphrase = override.passphrase ?? base.passphrase;
-  return {
-    ...passphrase !== void 0 ? { passphrase } : {},
-    gates: {
-      ...base.gates,
-      ...override.gates ?? {}
-    }
-  };
-}
-
-// src/with-party/policy/engine.ts
-var DEFAULT_FRESHNESS_MS = 5 * 60 * 1e3;
-async function checkGate(policy, gate, context) {
-  const configured = policy.gates[gate];
-  if (!configured) {
-    if (gate.startsWith("app:")) {
-      return;
-    }
-    throw deny(gate, "disabled", { minTier: 1, enabled: false });
-  }
-  if (configured.enabled === false) {
-    throw deny(gate, "disabled", configured);
-  }
-  if (context.activeTier > configured.minTier) {
-    throw deny(gate, "insufficient-tier", configured);
-  }
-  if (configured.factors && configured.factors.length > 0) {
-    const presented = context.factors ?? [];
-    const now = context.now ?? Date.now();
-    for (const requirement of configured.factors) {
-      const matches = countMatchingFactors(presented, requirement, now);
-      const need = requirement.count ?? 1;
-      if (matches.fresh < need) {
-        if (matches.totalKindMatches < need) {
-          throw deny(gate, "missing-factor", configured);
-        }
-        throw deny(gate, "stale-proof", configured);
-      }
-    }
-  }
-  if (configured.warn?.sharedDevice === "block" && context.sharedDevice === true) {
-    throw deny(gate, "shared-device-blocked", configured);
-  }
-}
-async function describeGate(policy, gate, context) {
-  try {
-    await checkGate(policy, gate, context);
-    return { ok: true };
-  } catch (err) {
-    if (err instanceof PolicyDeniedError) {
-      return { ok: false, reason: err.reason, required: err.required };
-    }
-    throw err;
-  }
-}
-function countMatchingFactors(presented, requirement, now) {
-  const freshnessMs = requirement.freshnessMs ?? DEFAULT_FRESHNESS_MS;
-  let totalKindMatches = 0;
-  let fresh = 0;
-  for (const proof of presented) {
-    if (!requirement.anyOf.includes(proof.kind)) continue;
-    totalKindMatches += 1;
-    const minted = proof.mintedAt ? Date.parse(proof.mintedAt) : now;
-    if (Number.isFinite(minted) && now - minted <= freshnessMs) {
-      fresh += 1;
-    }
-  }
-  return { totalKindMatches, fresh };
-}
-function deny(gate, reason, required) {
-  return new PolicyDeniedError(gate, reason, required);
-}
-
-// src/with-party/policy/noydb-facade.ts
-var NoydbPolicy = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  /**
-   * Touch the policy enforcer for a vault (records activity, resets
-   * idle timer). Also touches the legacy session timer. No-op if no enforcer.
-   */
-  touchPolicy(vault) {
-    this.deps.resetSessionTimer();
-    if (vault) {
-      this.deps.policyEnforcers.get(vault)?.touch();
-    }
-  }
-  /**
-   * Check that a policy-guarded operation is permitted.
-   * Throws `SessionPolicyError` if re-auth is required.
-   */
-  checkPolicyOperation(vault, op) {
-    this.deps.policyEnforcers.get(vault)?.checkOperation(op);
-  }
-  /**
-   * Read the active policy for a vault. Loads from `_meta/policy` on
-   * first call; subsequent calls hit the in-memory cache. Throws
-   * `ValidationError` if the vault has not been opened.
-   */
-  async getPolicy(vault) {
-    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
-    const cached = this.deps.policyCache.get(vault);
-    if (cached) return cached;
-    await this.bootstrapPolicy(vault);
-    return this.deps.policyCache.get(vault) ?? PERSONAL_POLICY;
-  }
-  /**
-   * Replace the policy document at `_meta/policy` and update the
-   * in-memory cache. Gated by the `enroll-user` policy (a policy
-   * change is fundamentally a privilege-management action).
-   */
-  async updatePolicy(vault, override) {
-    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
-    const current = await this.getPolicy(vault);
-    const merged = mergePolicy(current, override);
-    if (this.deps.encrypted) {
-      await saveVaultPolicy(this.deps.store, vault, merged);
-    }
-    this.deps.policyCache.set(vault, merged);
-    return merged;
-  }
-  /** Read or persist the vault policy at `_meta/policy` on first open. */
-  async bootstrapPolicy(vault, opts) {
-    const onDisk = await loadVaultPolicy(this.deps.store, vault);
-    if (onDisk) {
-      this.deps.policyCache.set(vault, onDisk);
-      await this.deps.assertRecoveryEnrolled(vault, onDisk, opts);
-      return;
-    }
-    const initial = this.deps.policyOption ? mergePolicy(PERSONAL_POLICY, this.deps.policyOption) : PERSONAL_POLICY;
-    await saveVaultPolicy(this.deps.store, vault, initial);
-    this.deps.policyCache.set(vault, initial);
-    await this.deps.assertRecoveryEnrolled(vault, initial, opts);
-  }
-};
-var createNoydbPolicy = (deps) => new NoydbPolicy(deps);
-
-export {
-  PERSONAL_POLICY,
-  STRICT_POLICY,
-  mergePolicy,
-  DEFAULT_FRESHNESS_MS,
-  checkGate,
-  describeGate,
-  createNoydbPolicy
-};
-//# sourceMappingURL=chunk-2OZXVKVP.js.map

package/dist/chunk-2REPHKET.js

@@ -1,54 +0,0 @@
-// src/with-formula/materialized-views/stale.ts
-var _staleByRegistry = /* @__PURE__ */ new WeakMap();
-function markMVStale(registry, mvName) {
-  let set = _staleByRegistry.get(registry);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    _staleByRegistry.set(registry, set);
-  }
-  set.add(mvName);
-}
-function isMVStale(registry, mvName) {
-  return _staleByRegistry.get(registry)?.has(mvName) ?? false;
-}
-async function resolveStaleMVOnRead(accessor, outputCollection, dispatchCtx) {
-  const registry = accessor.registry();
-  const pending = _staleByRegistry.get(registry);
-  if (!pending || pending.size === 0) return;
-  const candidates = [];
-  for (const mv of registry.all()) {
-    if (mv.outputCollection !== outputCollection) continue;
-    if (!pending.has(mv.spec.name)) continue;
-    candidates.push(mv.spec.name);
-  }
-  if (candidates.length === 0) return;
-  let executor = null;
-  for (const name of candidates) {
-    const reg = registry.byName(name);
-    if (!reg) {
-      pending.delete(name);
-      continue;
-    }
-    if (executor === null) {
-      ({ MaterializedViewExecutor: executor } = await import("./executor-KSHKRJXP.js"));
-    }
-    await executor.refresh(reg, {
-      getCollection: (n) => accessor.getCollection(n),
-      getActiveTxContext: () => accessor.getActiveTxContext(),
-      getQueryContext: () => accessor.getQueryContext(),
-      ...dispatchCtx !== void 0 ? { dispatchCtx } : {}
-    });
-    pending.delete(name);
-  }
-}
-function clearMVStale(registry, mvName) {
-  _staleByRegistry.get(registry)?.delete(mvName);
-}
-
-export {
-  markMVStale,
-  isMVStale,
-  resolveStaleMVOnRead,
-  clearMVStale
-};
-//# sourceMappingURL=chunk-2REPHKET.js.map