@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/{chunk-VKCADNMR.js → chunk-NFNJLRY7.js}

@@ -1,33 +1,31 @@
 import {
-  burnPaperRecoveryEntry,
-  loadPaperRecoveryEntries,
-  loadShamirRecoveryEntries,
-  unwrapDeksFromPaperEntry,
-  unwrapDeksFromShamirEntry
-} from "./chunk-ANATMTOA.js";
+  loadVaultPolicy
+} from "./chunk-WLXMTYGO.js";
 import {
-  assertStrongPassphrase,
+  assertStrongSecret,
   mintKeyringCanary,
   persistKeyring
-} from "./chunk-554KLAAN.js";
+} from "./chunk-BLCWSJLN.js";
 import {
   dekKey
-} from "./chunk-UC2ETWF3.js";
+} from "./chunk-PTHKZWEH.js";
 import {
   openEnvelopeJson
-} from "./chunk-W4TCUGQR.js";
+} from "./chunk-G2JUIDFA.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   deriveKey,
+  deriveSecretKey,
   encrypt,
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-AKKRXT23.js";
 import {
+  NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-VCTXU4AT.js";
+} from "./chunk-QBAC3GXA.js";
 import {
   DelegationTargetMissingError,
   InvalidKeyError,
@@ -37,20 +35,214 @@ import {
   RecoveryProfileNotImplementedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
+
+// src/port/with/team-strategy.ts
+var NO_TEAM = {
+  async grant() {
+    throw new TeamNotEnabledError();
+  },
+  async revoke() {
+    throw new TeamNotEnabledError();
+  },
+  async rotate() {
+    throw new TeamNotEnabledError();
+  }
+};
+
+// src/with-party/team/wrapped-deks.ts
+var PBKDF2_ITERATIONS = 6e5;
+var SALT_BYTES = 32;
+var IV_BYTES = 12;
+var subtle = globalThis.crypto.subtle;
+async function mintWrappedDeksBlob(deks, credential) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const wrappingKey = await deriveWrappingKey(credential, salt);
+  const exported = {};
+  for (const [coll, dek] of deks) {
+    const raw = await subtle.exportKey("raw", dek);
+    exported[coll] = bytesToBase64(new Uint8Array(raw));
+  }
+  const plaintext = new TextEncoder().encode(JSON.stringify({ deks: exported }));
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    wrappingKey,
+    plaintext
+  );
+  return {
+    salt: bytesToBase64(salt),
+    iv: bytesToBase64(iv),
+    wrappedDeks: bytesToBase64(new Uint8Array(ciphertext))
+  };
+}
+async function unwrapDeksFromBlob(blob, credential) {
+  const wrappingKey = await deriveWrappingKey(credential, base64ToBytes(blob.salt));
+  const plaintext = await subtle.decrypt(
+    { name: "AES-GCM", iv: base64ToBytes(blob.iv) },
+    wrappingKey,
+    base64ToBytes(blob.wrappedDeks)
+  );
+  const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+  const deks = /* @__PURE__ */ new Map();
+  for (const [coll, b64] of Object.entries(parsed.deks)) {
+    const raw = base64ToBytes(b64);
+    const key = await subtle.importKey(
+      "raw",
+      raw,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    deks.set(coll, key);
+  }
+  return deks;
+}
+async function deriveWrappingKey(credential, salt) {
+  return deriveSecretKey(credential, salt, { iterations: PBKDF2_ITERATIONS, keyUsage: "aes-gcm" });
+}
+function bytesToBase64(b) {
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s);
+}
+function base64ToBytes(b64) {
+  const s = atob(b64);
+  const out = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+  return out;
+}
+
+// src/with-party/team/recovery.ts
+var PAPER_DOC_ID = "recovery-paper";
+async function loadPaperRecoveryEntries(store, vault) {
+  const env = await store.get(vault, "_meta", PAPER_DOC_ID);
+  if (!env) return [];
+  try {
+    const doc = JSON.parse(env._data);
+    if (doc.profile !== "paper" || !Array.isArray(doc.entries)) return [];
+    return doc.entries;
+  } catch {
+    return [];
+  }
+}
+async function savePaperRecoveryEntries(store, vault, entries) {
+  const doc = {
+    _noydb_recovery: 1,
+    profile: "paper",
+    entries
+  };
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(doc)
+  };
+  await store.put(vault, "_meta", PAPER_DOC_ID, envelope);
+}
+async function burnPaperRecoveryEntry(store, vault, codeId) {
+  const entries = await loadPaperRecoveryEntries(store, vault);
+  const remaining = entries.filter((e) => e.codeId !== codeId);
+  await savePaperRecoveryEntries(store, vault, remaining);
+}
+async function hasRecoveryEnrolled(store, vault) {
+  const paper = await loadPaperRecoveryEntries(store, vault);
+  if (paper.length > 0) return true;
+  const shamir = await loadShamirRecoveryEntries(store, vault);
+  return shamir.length > 0;
+}
+async function hasStrongRecoveryEnrolled(store, vault) {
+  const shamir = await loadShamirRecoveryEntries(store, vault);
+  return shamir.length > 0;
+}
+var SHAMIR_DOC_ID = "recovery-shamir";
+async function loadShamirRecoveryEntries(store, vault) {
+  const env = await store.get(vault, "_meta", SHAMIR_DOC_ID);
+  if (!env) return [];
+  try {
+    const doc = JSON.parse(env._data);
+    if (doc.profile !== "shamir" || !Array.isArray(doc.entries)) return [];
+    return doc.entries;
+  } catch {
+    return [];
+  }
+}
+async function saveShamirRecoveryEntries(store, vault, entries) {
+  const doc = {
+    _noydb_recovery: 1,
+    profile: "shamir",
+    entries
+  };
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(doc)
+  };
+  await store.put(vault, "_meta", SHAMIR_DOC_ID, envelope);
+}
+async function mintShamirRecoveryEntry(provider, deks, entryId, k, n, label) {
+  const recoverySecret = crypto.getRandomValues(new Uint8Array(32));
+  try {
+    const credential = bytesToBase642(recoverySecret);
+    const blob = await mintWrappedDeksBlob(deks, credential);
+    const shareStrings = provider.splitToShares(recoverySecret, k, n);
+    const entry = {
+      ...blob,
+      entryId,
+      k,
+      n,
+      enrolledAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...label !== void 0 && { label }
+    };
+    return { entry, shareStrings };
+  } finally {
+    recoverySecret.fill(0);
+  }
+}
+async function unwrapDeksFromShamirEntry(provider, entry, shareStrings) {
+  if (shareStrings.length < entry.k) {
+    throw new Error(
+      `Insufficient shares: this Shamir entry needs ${entry.k} of ${entry.n}, but ${shareStrings.length} were provided.`
+    );
+  }
+  const secret = provider.combineShares(shareStrings);
+  try {
+    return await unwrapDeksFromBlob(entry, bytesToBase642(secret));
+  } finally {
+    secret.fill(0);
+  }
+}
+function bytesToBase642(b) {
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s);
+}
+async function mintPaperRecoveryEntry(deks, code, codeId) {
+  const blob = await mintWrappedDeksBlob(deks, code);
+  return {
+    ...blob,
+    codeId,
+    enrolledAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function unwrapDeksFromPaperEntry(entry, code) {
+  return unwrapDeksFromBlob(entry, code);
+}
 
 // src/with-party/team/magic-link-grant.ts
 var MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 var MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
-var MAGIC_LINK_KEK_INFO_PREFIX = "noydb-magic-link-v1:";
 async function deriveMagicLinkContentKey(serverSecret, token, vault) {
-  const subtle = globalThis.crypto.subtle;
+  const subtle2 = globalThis.crypto.subtle;
   const ikmBytes = serverSecret instanceof Uint8Array ? serverSecret : new TextEncoder().encode(serverSecret);
   const tokenBytes = new TextEncoder().encode(token);
-  const saltBuffer = await subtle.digest("SHA-256", tokenBytes);
+  const saltBuffer = await subtle2.digest("SHA-256", tokenBytes);
   const info = new TextEncoder().encode(MAGIC_LINK_CONTENT_INFO_PREFIX + vault);
-  const ikm = await subtle.importKey("raw", ikmBytes, "HKDF", false, ["deriveKey"]);
-  return subtle.deriveKey(
+  const ikm = await subtle2.importKey("raw", ikmBytes, "HKDF", false, ["deriveKey"]);
+  return subtle2.deriveKey(
     { name: "HKDF", hash: "SHA-256", salt: saltBuffer, info },
     ikm,
     { name: "AES-GCM", length: 256 },
@@ -132,23 +324,10 @@ function isMagicLinkGrantExpired(payload, now = /* @__PURE__ */ new Date()) {
   return payload.until <= now.toISOString();
 }
 
-// src/port/with/team-strategy.ts
-var NO_TEAM = {
-  async grant() {
-    throw new TeamNotEnabledError();
-  },
-  async revoke() {
-    throw new TeamNotEnabledError();
-  },
-  async rotate() {
-    throw new TeamNotEnabledError();
-  }
-};
-
 // src/with-party/team/rotate-recover.ts
-async function rotatePassphrase(store, vault, userId, input) {
-  if (!input.allowWeakPassphrase) {
-    assertStrongPassphrase(input.newPassphrase, input.passphrasePolicy);
+async function rotateSecret(store, vault, userId, input) {
+  if (!input.allowWeakSecret) {
+    assertStrongSecret(input.newSecret, input.secretPolicy);
   }
   const env = await store.get(vault, "_keyring", userId);
   if (!env) {
@@ -156,13 +335,13 @@ async function rotatePassphrase(store, vault, userId, input) {
   }
   const file = JSON.parse(env._data);
   const oldSalt = base64ToBuffer(file.salt);
-  const oldKek = await deriveKey(input.oldPassphrase, oldSalt);
+  const oldKek = await deriveKey(input.oldSecret, oldSalt);
   const deks = /* @__PURE__ */ new Map();
   for (const [coll, wrapped] of Object.entries(file.deks)) {
     deks.set(coll, await unwrapKey(wrapped, oldKek));
   }
   const newSalt = generateSalt();
-  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const newKek = await deriveKey(input.newSecret, newSalt);
   const wrappedDeks = {};
   for (const [coll, dek] of deks) {
     wrappedDeks[coll] = await wrapKey(dek, newKek);
@@ -238,9 +417,9 @@ async function rotatePassphrase(store, vault, userId, input) {
     ...file.import_capability !== void 0 && { importCapability: file.import_capability }
   };
 }
-async function recoverPassphrase(provider, store, vault, userId, input) {
-  if (!input.allowWeakPassphrase) {
-    assertStrongPassphrase(input.newPassphrase, input.passphrasePolicy);
+async function recoverSecret(provider, store, vault, userId, input) {
+  if (!input.allowWeakSecret) {
+    assertStrongSecret(input.newSecret, input.secretPolicy);
   }
   const profile = input.recoveryProof.profile;
   if (profile === "paper") {
@@ -265,7 +444,7 @@ async function recoverViaPaperCode(store, vault, userId, input) {
   const entries = await loadPaperRecoveryEntries(store, vault);
   if (entries.length === 0) {
     throw new NoAccessError(
-      `No paper-recovery entries enrolled for vault "${vault}". Enroll via \`db.enrollRecovery({ profile: "paper", entries })\` before relying on recovery.`
+      `No paper-recovery entries enrolled for vault "${vault}". Enroll via \`db.team.enrollRecovery({ profile: "paper", entries })\` before relying on recovery.`
     );
   }
   const normalized = normalizePaperCode(code);
@@ -285,7 +464,7 @@ async function recoverViaPaperCode(store, vault, userId, input) {
   }
   const deks = recovered.deks;
   const newSalt = generateSalt();
-  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const newKek = await deriveKey(input.newSecret, newSalt);
   const wrappedDeks = {};
   for (const [coll, dek] of deks) {
     wrappedDeks[coll] = await wrapKey(dek, newKek);
@@ -334,7 +513,7 @@ async function recoverViaShamir(provider, store, vault, userId, input) {
   const allEntries = await loadShamirRecoveryEntries(store, vault);
   if (allEntries.length === 0) {
     throw new NoAccessError(
-      `No Shamir-recovery entries enrolled for vault "${vault}". Enroll via \`db.enrollRecovery({ profile: "shamir", k, n })\` before relying on recovery.`
+      `No Shamir-recovery entries enrolled for vault "${vault}". Enroll via \`db.team.enrollRecovery({ profile: "shamir", k, n })\` before relying on recovery.`
     );
   }
   if (!provider) {
@@ -377,7 +556,7 @@ async function recoverViaShamir(provider, store, vault, userId, input) {
     );
   }
   const newSalt = generateSalt();
-  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const newKek = await deriveKey(input.newSecret, newSalt);
   const wrappedDeks = {};
   for (const [coll, dek] of recoveredDeks) {
     wrappedDeks[coll] = await wrapKey(dek, newKek);
@@ -448,11 +627,11 @@ async function recoverUser(store, vault, callerKeyring, options) {
       throw new PrivilegeEscalationError(coll);
     }
   }
-  if (options.validatePassphrase && !options.allowWeakPassphrase) {
-    assertStrongPassphrase(options.passphrase, options.passphrasePolicy);
+  if (options.validateSecret && !options.allowWeakSecret) {
+    assertStrongSecret(options.secret, options.secretPolicy);
   }
   const newSalt = generateSalt();
-  const newKek = await deriveKey(options.passphrase, newSalt);
+  const newKek = await deriveKey(options.secret, newSalt);
   const wrappedDeks = {};
   for (const coll of Object.keys(target.deks)) {
     const callerDek = callerKeyring.deks.get(coll);
@@ -483,6 +662,129 @@ async function recoverUser(store, vault, callerKeyring, options) {
   await store.put(vault, "_keyring", options.userId, envelope);
 }
 
+// src/with-party/auth-introspection/index.ts
+async function describeAuthConfig(store, vault) {
+  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
+  const recoveryProfiles = await listRecoveryProfilesEnrolled(store, vault);
+  const lines = [];
+  lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
+  lines.push("");
+  lines.push("Tier 1 \u2014 Secret (master)");
+  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
+  lines.push("  Strength validator: enforced (override available for tests only)");
+  lines.push("");
+  lines.push("Tier 2 \u2014 Authenticate (routine login)");
+  lines.push("  Allowed methods: WebAuthn (passkey), OIDC, Password");
+  lines.push("  Slots per user: unlimited");
+  lines.push("");
+  lines.push("Tier 3 \u2014 Unlock (quick resume)");
+  lines.push("  Method: PIN (per-app configurable)");
+  lines.push("");
+  lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
+  lines.push("Managed-secret mode: off (post-1.0)");
+  lines.push("");
+  lines.push("Sensitive-action gates:");
+  for (const [gate, gp] of Object.entries(policy.gates)) {
+    lines.push(`  ${gate} \u2014 ${describeGatePolicy(gp)}`);
+  }
+  return lines.join("\n");
+}
+async function diagramAuthConfig(store, vault) {
+  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
+  const lines = [];
+  lines.push("flowchart TB");
+  lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
+  lines.push('  tier1["Tier 1<br/>Secret"]');
+  lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
+  lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
+  lines.push("  vault --> tier1");
+  lines.push("  tier1 --> tier2");
+  lines.push("  tier2 --> tier3");
+  for (const [gateName, gp] of Object.entries(policy.gates)) {
+    if (gp.enabled === false) continue;
+    const id = sanitizeId(gateName);
+    const label = `${gateName}<br/>tier \u2265 ${gp.minTier}`;
+    lines.push(`  ${id}["${escapeMermaid(label)}"]`);
+    const tierNode = gp.minTier === 1 ? "tier1" : gp.minTier === 2 ? "tier2" : "tier3";
+    lines.push(`  ${tierNode} --> ${id}`);
+  }
+  return lines.join("\n");
+}
+async function describeUserAuth(store, vault, userId) {
+  const env = await store.get(vault, "_keyring", userId);
+  if (!env) return "";
+  const file = JSON.parse(env._data);
+  const lines = [];
+  lines.push(
+    `User: ${file.user_id} (joined ${file.created_at.slice(0, 10)}, role: ${file.role})`
+  );
+  lines.push("");
+  lines.push("Tier 2 enrollments:");
+  if (!file.authenticators || file.authenticators.length === 0) {
+    lines.push("  (none enrolled)");
+  } else {
+    for (const slot of file.authenticators) {
+      lines.push(`  - ${describeSlot(slot)}`);
+    }
+  }
+  return lines.join("\n");
+}
+async function describeAllUsersAuth(store, vault) {
+  const ids = await store.list(vault, "_keyring");
+  const results = [];
+  for (const userId of ids) {
+    const description = await describeUserAuth(store, vault, userId);
+    if (description !== "") results.push({ userId, description });
+  }
+  return results;
+}
+var SLOT_FIELD_ALLOWLIST = [
+  "id",
+  "method",
+  "enrolled_at",
+  "enrolled_via_tier"
+];
+function describeSlot(slot) {
+  const sanitized = {};
+  for (const key of SLOT_FIELD_ALLOWLIST) {
+    if (key in slot) {
+      sanitized[key] = slot[key];
+    }
+  }
+  const date = (sanitized.enrolled_at ?? "").slice(0, 10);
+  return `${sanitized.method ?? "?"} (id=${sanitized.id ?? "?"}, enrolled ${date}, via tier ${sanitized.enrolled_via_tier ?? "?"})`;
+}
+function describeGatePolicy(gp) {
+  if (gp.enabled === false) return "disabled";
+  const parts = [];
+  parts.push(`tier ${gp.minTier}`);
+  if (gp.factors && gp.factors.length > 0) {
+    for (const f of gp.factors) {
+      parts.push(`+ ${f.count ?? 1}\xD7 ${f.anyOf.join("|")}`);
+    }
+  }
+  if (gp.warn?.sharedDevice === "block") parts.push("block-on-shared-device");
+  return parts.join(" ");
+}
+function defaultPolicySnapshot() {
+  return {
+    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
+    gates: {}
+  };
+}
+async function listRecoveryProfilesEnrolled(store, vault) {
+  const enrolled = [];
+  const paper = await loadPaperRecoveryEntries(store, vault);
+  if (paper.length > 0) enrolled.push(`paper (${paper.length} codes)`);
+  return enrolled;
+}
+function escapeMermaid(s) {
+  return s.replace(/"/g, '\\"').replace(/\n/g, " ");
+}
+function sanitizeId(s) {
+  return s.replace(/[^a-zA-Z0-9]/g, "_");
+}
+
 // src/with-party/team/authenticators.ts
 async function enrollAuthenticator(store, vault, keyring, options) {
   const existing = keyring.authenticators.find((a) => a.id === options.id);
@@ -566,9 +868,20 @@ function appendSlot(keyring, slot) {
 }
 
 export {
+  NO_TEAM,
+  mintWrappedDeksBlob,
+  unwrapDeksFromBlob,
+  loadPaperRecoveryEntries,
+  savePaperRecoveryEntries,
+  burnPaperRecoveryEntry,
+  hasRecoveryEnrolled,
+  hasStrongRecoveryEnrolled,
+  loadShamirRecoveryEntries,
+  saveShamirRecoveryEntries,
+  mintShamirRecoveryEntry,
+  mintPaperRecoveryEntry,
+  unwrapDeksFromPaperEntry,
   MAGIC_LINK_GRANTS_COLLECTION,
-  MAGIC_LINK_CONTENT_INFO_PREFIX,
-  MAGIC_LINK_KEK_INFO_PREFIX,
   deriveMagicLinkContentKey,
   writeMagicLinkGrant,
   readMagicLinkGrantRecord,
@@ -577,13 +890,16 @@ export {
   revokeMagicLinkGrant,
   magicLinkGrantRecordId,
   isMagicLinkGrantExpired,
-  NO_TEAM,
-  rotatePassphrase,
-  recoverPassphrase,
+  rotateSecret,
+  recoverSecret,
   recoverUser,
+  describeAuthConfig,
+  diagramAuthConfig,
+  describeUserAuth,
+  describeAllUsersAuth,
   enrollAuthenticator,
   updateAuthenticator,
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-VKCADNMR.js.map
+//# sourceMappingURL=chunk-NFNJLRY7.js.map