@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/{chunk-554KLAAN.js → chunk-BLCWSJLN.js}

@@ -5,7 +5,7 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-NCCBLYEB.js";
+} from "./chunk-JJZGIE4U.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -16,11 +16,11 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-VCTXU4AT.js";
+} from "./chunk-QBAC3GXA.js";
 import {
   DirectoryDisabledError,
   InvalidKeyError,
@@ -32,15 +32,15 @@ import {
   PrivilegeEscalationError,
   USER_ENVELOPE_COLLECTION,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/kernel/validation.ts
-var WeakPassphraseError = class extends NoydbError {
+var WeakSecretError = class extends NoydbError {
   reason;
   suggestion;
   constructor(reason, suggestion) {
-    super("WEAK_PASSPHRASE", `Weak passphrase (${reason}). ${suggestion}`);
-    this.name = "WeakPassphraseError";
+    super("WEAK_SECRET", `Weak secret (${reason}). ${suggestion}`);
+    this.name = "WeakSecretError";
     this.reason = reason;
     this.suggestion = suggestion;
   }
@@ -56,7 +56,7 @@ var SUGGESTIONS = {
   "word-too-short": 'Each word must be at least 3 characters. Drop short fillers like "a", "is", "of".',
   "repeated-adjacent": "Avoid repeating the same word twice in a row."
 };
-function validatePassphrase(s, opts) {
+function validateSecret(s, opts) {
   if (opts?.customValidator) {
     return opts.customValidator(s);
   }
@@ -94,14 +94,14 @@ function validatePassphrase(s, opts) {
   }
   return { ok: true, words: words.length };
 }
-function assertStrongPassphrase(s, opts) {
-  if (opts?.allowWeakPassphrase) return;
-  const result = validatePassphrase(s, opts);
+function assertStrongSecret(s, opts) {
+  if (opts?.allowWeakSecret) return;
+  const result = validateSecret(s, opts);
   if (result.ok) return;
-  throw new WeakPassphraseError(result.reason, SUGGESTIONS[result.reason]);
+  throw new WeakSecretError(result.reason, SUGGESTIONS[result.reason]);
 }
-function estimateEntropy(passphrase) {
-  const result = validatePassphrase(passphrase);
+function estimateEntropy(secret) {
+  const result = validateSecret(secret);
   if (!result.ok) return 0;
   return Math.round(result.words * Math.log2(7776));
 }
@@ -164,8 +164,9 @@ async function verifyKeyringCanary(wrappedCanary, kek) {
     return false;
   }
 }
-async function loadKeyring(adapter, vault, userId, passphrase) {
-  const envelope = await adapter.get(vault, "_keyring", userId);
+async function loadKeyring(store, vault, opts) {
+  const { userId, secret } = opts;
+  const envelope = await store.get(vault, "_keyring", userId);
   if (!envelope) {
     throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
   }
@@ -177,7 +178,7 @@ async function loadKeyring(adapter, vault, userId, passphrase) {
     }
   }
   const salt = base64ToBuffer(keyringFile.salt);
-  const kek = await deriveKey(passphrase, salt);
+  const kek = await deriveKey(secret, salt);
   const canaryOk = keyringFile.canary !== void 0 ? await verifyKeyringCanary(keyringFile.canary, kek) : null;
   const deks = /* @__PURE__ */ new Map();
   const failedCollections = [];
@@ -237,12 +238,13 @@ async function assertKeyringOpenAllowed(store, vault, userId, create) {
     );
   }
 }
-async function createOwnerKeyring(adapter, vault, userId, passphrase, passphraseOpts) {
-  if (passphraseOpts?.validate && !passphraseOpts.allowWeakPassphrase) {
-    assertStrongPassphrase(passphrase, passphraseOpts);
+async function createOwnerKeyring(store, vault, opts) {
+  const { userId, secret } = opts;
+  if (opts.validate && !opts.allowWeakSecret) {
+    assertStrongSecret(secret, opts);
   }
   const salt = generateSalt();
-  const kek = await deriveKey(passphrase, salt);
+  const kek = await deriveKey(secret, salt);
   const userEnvelopeDek = await generateDEK();
   const wrappedUserEnvelopeDek = await wrapKey(userEnvelopeDek, kek);
   const canary = await mintKeyringCanary(kek);
@@ -258,7 +260,7 @@ async function createOwnerKeyring(adapter, vault, userId, passphrase, passphrase
     granted_by: userId,
     canary
   };
-  await writeKeyringFile(adapter, vault, userId, keyringFile);
+  await writeKeyringFile(store, vault, userId, keyringFile);
   return {
     userId,
     displayName: userId,
@@ -270,10 +272,10 @@ async function createOwnerKeyring(adapter, vault, userId, passphrase, passphrase
     authenticators: []
   };
 }
-async function grant(adapter, vault, callerKeyring, options) {
+async function grant(store, vault, callerKeyring, options) {
   if (!callerKeyring.kek) {
     throw new ValidationError(
-      "grant: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot grant access to other users. Re-authenticate at tier 1 (passphrase) before granting."
+      "grant: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot grant access to other users. Re-authenticate at tier 1 (secret) before granting."
     );
   }
   if (!canGrant(callerKeyring.role, options.role)) {
@@ -281,12 +283,12 @@ async function grant(adapter, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot grant role "${options.role}"`
     );
   }
-  if (options.validatePassphrase && !options.allowWeakPassphrase) {
-    assertStrongPassphrase(options.passphrase);
+  if (options.validateSecret && !options.allowWeakSecret) {
+    assertStrongSecret(options.secret);
   }
   const permissions = resolvePermissions(options.role, options.permissions);
   const newSalt = generateSalt();
-  const newKek = await deriveKey(options.passphrase, newSalt);
+  const newKek = await deriveKey(options.secret, newSalt);
   const granteeMayHoldSecrets = options.role === "owner" || options.role === "admin";
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
@@ -328,12 +330,12 @@ async function grant(adapter, vault, callerKeyring, options) {
     ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
-  await writeKeyringFile(adapter, vault, options.userId, keyringFile);
+  await writeKeyringFile(store, vault, options.userId, keyringFile);
   const userEnvelopeDek = callerKeyring.deks.get(USER_ENVELOPE_COLLECTION);
   if (userEnvelopeDek) {
     const initialPayload = options.initialProfile ?? {};
     await saveUserEnvelope(
-      adapter,
+      store,
       vault,
       options.userId,
       initialPayload,
@@ -341,11 +343,11 @@ async function grant(adapter, vault, callerKeyring, options) {
     );
   }
 }
-async function findAdminDescendants(adapter, vault, rootUserId) {
-  const allUserIds = await adapter.list(vault, "_keyring");
+async function findAdminDescendants(store, vault, rootUserId) {
+  const allUserIds = await store.list(vault, "_keyring");
   const childrenByParent = /* @__PURE__ */ new Map();
   for (const userId of allUserIds) {
-    const env = await adapter.get(vault, "_keyring", userId);
+    const env = await store.get(vault, "_keyring", userId);
     if (!env) continue;
     const kf = JSON.parse(env._data);
     if (kf.role !== "admin") continue;
@@ -368,8 +370,8 @@ async function findAdminDescendants(adapter, vault, rootUserId) {
   }
   return order;
 }
-async function revoke(adapter, vault, callerKeyring, options) {
-  const targetEnvelope = await adapter.get(vault, "_keyring", options.userId);
+async function revoke(store, vault, callerKeyring, options) {
+  const targetEnvelope = await store.get(vault, "_keyring", options.userId);
   if (!targetEnvelope) {
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
@@ -383,7 +385,7 @@ async function revoke(adapter, vault, callerKeyring, options) {
   const usersToRevoke = [options.userId];
   const affectedCollections = new Set(Object.keys(targetKeyring.deks));
   if (targetKeyring.role === "admin") {
-    const descendants = await findAdminDescendants(adapter, vault, options.userId);
+    const descendants = await findAdminDescendants(store, vault, options.userId);
     if (descendants.length > 0) {
       if (cascadeMode === "warn") {
         console.warn(
@@ -391,7 +393,7 @@ async function revoke(adapter, vault, callerKeyring, options) {
         );
       } else {
         for (const userId of descendants) {
-          const descEnv = await adapter.get(vault, "_keyring", userId);
+          const descEnv = await store.get(vault, "_keyring", userId);
           if (!descEnv) continue;
           const descKf = JSON.parse(descEnv._data);
           usersToRevoke.push(userId);
@@ -401,21 +403,21 @@ async function revoke(adapter, vault, callerKeyring, options) {
     }
   }
   for (const userId of usersToRevoke) {
-    await adapter.delete(vault, "_keyring", userId);
-    await deleteUserEnvelope(adapter, vault, userId);
-    await deleteUserVisibility(adapter, vault, userId);
+    await store.delete(vault, "_keyring", userId);
+    await deleteUserEnvelope(store, vault, userId);
+    await deleteUserVisibility(store, vault, userId);
   }
   if (options.rotateKeys !== false && affectedCollections.size > 0) {
-    await rotateKeys(adapter, vault, callerKeyring, [...affectedCollections]);
+    await rotateKeys(store, vault, callerKeyring, { collections: [...affectedCollections] });
   }
 }
-async function updateKeyringIdentity(adapter, vault, callerKeyring, options) {
+async function updateKeyringIdentity(store, vault, callerKeyring, options) {
   if (options.role === void 0 && options.displayName === void 0 && options.permissions === void 0) {
     throw new ValidationError(
       `updateUser: at least one of role / displayName / permissions must be provided (userId: "${options.userId}").`
     );
   }
-  const env = await adapter.get(vault, "_keyring", options.userId);
+  const env = await store.get(vault, "_keyring", options.userId);
   if (!env) {
     throw new NoAccessError(
       `updateUser: user "${options.userId}" has no keyring in vault "${vault}".`
@@ -441,9 +443,10 @@ async function updateKeyringIdentity(adapter, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
-  await writeKeyringFile(adapter, vault, options.userId, next);
+  await writeKeyringFile(store, vault, options.userId, next);
 }
-async function rotateKeys(adapter, vault, callerKeyring, collections) {
+async function rotateKeys(store, vault, callerKeyring, opts) {
+  const { collections } = opts;
   if (callerKeyring.role === "custodian") {
     throw new PermissionDeniedError(
       "custodian cannot rotate keys (FR-6: re-key is an owner-only meta-capability; use the Deed owner)"
@@ -457,9 +460,9 @@ async function rotateKeys(adapter, vault, callerKeyring, collections) {
     const oldDek = callerKeyring.deks.get(collName);
     const newDek = newDeks.get(collName);
     if (!oldDek) continue;
-    const ids = await adapter.list(vault, collName);
+    const ids = await store.list(vault, collName);
     for (const id of ids) {
-      const envelope = await adapter.get(vault, collName, id);
+      const envelope = await store.get(vault, collName, id);
       if (!envelope || !envelope._iv) continue;
       const plaintext = await decrypt(envelope._iv, envelope._data, oldDek);
       const { iv, data } = await encrypt(plaintext, newDek);
@@ -470,25 +473,27 @@ async function rotateKeys(adapter, vault, callerKeyring, collections) {
         _iv: iv,
         _data: data
       };
-      await adapter.put(vault, collName, id, newEnvelope);
+      await store.put(vault, collName, id, newEnvelope);
     }
   }
   for (const [collName, newDek] of newDeks) {
     callerKeyring.deks.set(collName, newDek);
   }
-  await persistKeyring(adapter, vault, callerKeyring);
-  const userIds = await adapter.list(vault, "_keyring");
+  await persistKeyring(store, vault, callerKeyring);
+  const needsRegrant = [];
+  const userIds = await store.list(vault, "_keyring");
   for (const userId of userIds) {
     if (userId === callerKeyring.userId) continue;
-    const userEnvelope = await adapter.get(vault, "_keyring", userId);
+    const userEnvelope = await store.get(vault, "_keyring", userId);
     if (!userEnvelope) continue;
     const userKeyringFile = JSON.parse(userEnvelope._data);
     const updatedDeks = { ...userKeyringFile.deks };
-    for (const collName of collections) {
-      delete updatedDeks[collName];
-    }
     const updatedPermissions = { ...userKeyringFile.permissions };
     for (const collName of collections) {
+      if (collName in updatedDeks || collName in updatedPermissions) {
+        needsRegrant.push({ userId, collection: collName });
+      }
+      delete updatedDeks[collName];
       delete updatedPermissions[collName];
     }
     const updatedKeyring = {
@@ -496,15 +501,17 @@ async function rotateKeys(adapter, vault, callerKeyring, collections) {
       deks: updatedDeks,
       permissions: updatedPermissions
     };
-    await writeKeyringFile(adapter, vault, userId, updatedKeyring);
+    await writeKeyringFile(store, vault, userId, updatedKeyring);
   }
+  return { needsRegrant };
 }
-async function changeSecret(adapter, vault, keyring, newPassphrase, passphraseOpts) {
-  if (!passphraseOpts?.allowWeakPassphrase) {
-    assertStrongPassphrase(newPassphrase, passphraseOpts);
+async function changeSecret(store, vault, keyring, opts) {
+  const { newSecret } = opts;
+  if (!opts.allowWeakSecret) {
+    assertStrongSecret(newSecret, opts);
   }
   const newSalt = generateSalt();
-  const newKek = await deriveKey(newPassphrase, newSalt);
+  const newKek = await deriveKey(newSecret, newSalt);
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, newKek);
@@ -522,7 +529,7 @@ async function changeSecret(adapter, vault, keyring, newPassphrase, passphraseOp
     granted_by: keyring.userId,
     canary
   };
-  await writeKeyringFile(adapter, vault, keyring.userId, keyringFile);
+  await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
     userId: keyring.userId,
     displayName: keyring.displayName,
@@ -535,7 +542,7 @@ async function changeSecret(adapter, vault, keyring, newPassphrase, passphraseOp
     // Tier-2 slots are NOT preserved through `changeSecret` —
     // each slot wraps the OLD KEK, so the new keyring has no
     // authenticator slots until the user re-enrolls. The higher-level
-    // `db.rotatePassphrase()` preserves slots by rewrapping the
+    // `db.team.rotateSecret()` preserves slots by rewrapping the
     // KEK reference, not the KEK itself.
     authenticators: [],
     ...keyring.policy !== void 0 && { policy: keyring.policy }
@@ -544,13 +551,13 @@ async function changeSecret(adapter, vault, keyring, newPassphrase, passphraseOp
 async function buildRecipientKeyringFile(callerKeyring, recipient) {
   if (!callerKeyring.kek) {
     throw new ValidationError(
-      "buildRecipientKeyringFile: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot create bundle recipients. Re-authenticate at tier 1 (passphrase) before building a bundle."
+      "buildRecipientKeyringFile: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot create bundle recipients. Re-authenticate at tier 1 (secret) before building a bundle."
     );
   }
   const role = recipient.role ?? "viewer";
   const permissions = resolvePermissions(role, recipient.permissions);
   const newSalt = generateSalt();
-  const newKek = await deriveKey(recipient.passphrase, newSalt);
+  const newKek = await deriveKey(recipient.secret, newSalt);
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
     const dek = callerKeyring.deks.get(collName);
@@ -592,11 +599,11 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
   };
 }
-async function listUsers(adapter, vault) {
-  const userIds = await adapter.list(vault, "_keyring");
+async function listUsers(store, vault) {
+  const userIds = await store.list(vault, "_keyring");
   const users = [];
   for (const userId of userIds) {
-    const envelope = await adapter.get(vault, "_keyring", userId);
+    const envelope = await store.get(vault, "_keyring", userId);
     if (!envelope) continue;
     const kf = JSON.parse(envelope._data);
     users.push({
@@ -610,9 +617,9 @@ async function listUsers(adapter, vault) {
   }
   return users;
 }
-async function listUsersWithEnvelopes(adapter, vault, userEnvelopeDek, callerRole, options = {}) {
+async function listUsersWithEnvelopes(store, vault, userEnvelopeDek, callerRole, options = {}) {
   const isPrivileged = callerRole === "owner" || callerRole === "admin";
-  const dirConfig = await readDirectoryConfig(adapter, vault);
+  const dirConfig = await readDirectoryConfig(store, vault);
   if (dirConfig?.enabled === false && !isPrivileged) {
     throw new DirectoryDisabledError(vault);
   }
@@ -621,15 +628,15 @@ async function listUsersWithEnvelopes(adapter, vault, userEnvelopeDek, callerRol
       "Permission denied \u2014 listUsersWithEnvelopes({ includeHidden: true }) requires owner or admin role"
     );
   }
-  const users = await listUsers(adapter, vault);
+  const users = await listUsers(store, vault);
   const out = [];
   for (const user of users) {
     if (!options.includeHidden) {
-      const visibility = await readUserVisibility(adapter, vault, user.userId);
+      const visibility = await readUserVisibility(store, vault, user.userId);
       if (visibility?.hidden) continue;
     }
     const envelope = await loadUserEnvelope(
-      adapter,
+      store,
       vault,
       user.userId,
       userEnvelopeDek
@@ -638,7 +645,7 @@ async function listUsersWithEnvelopes(adapter, vault, userEnvelopeDek, callerRol
   }
   return out;
 }
-async function ensureCollectionDEK(adapter, vault, keyring) {
+async function ensureCollectionDEK(store, vault, keyring) {
   const inFlight = /* @__PURE__ */ new Map();
   return async (collectionName) => {
     const existing = keyring.deks.get(collectionName);
@@ -648,7 +655,7 @@ async function ensureCollectionDEK(adapter, vault, keyring) {
     const promise = (async () => {
       const dek = await generateDEK();
       keyring.deks.set(collectionName, dek);
-      await persistKeyring(adapter, vault, keyring);
+      await persistKeyring(store, vault, keyring);
       return dek;
     })();
     inFlight.set(collectionName, promise);
@@ -669,10 +676,10 @@ function hasAccess(keyring, collectionName) {
     return true;
   return collectionName in keyring.permissions;
 }
-async function persistKeyring(adapter, vault, keyring) {
+async function persistKeyring(store, vault, keyring) {
   if (!keyring.kek) {
     throw new ValidationError(
-      "persistKeyring: keyring.kek is null \u2014 cannot wrap DEKs without the KEK. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (passphrase) before persisting."
+      "persistKeyring: keyring.kek is null \u2014 cannot wrap DEKs without the KEK. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before persisting."
     );
   }
   const wrappedDeks = {};
@@ -696,7 +703,7 @@ async function persistKeyring(adapter, vault, keyring) {
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy }
   };
-  await writeKeyringFile(adapter, vault, keyring.userId, keyringFile);
+  await writeKeyringFile(store, vault, keyring.userId, keyringFile);
 }
 function defaultBundleCapability(role) {
   return role === "owner" || role === "admin";
@@ -735,7 +742,7 @@ function resolvePermissions(role, explicit) {
   if (role === "owner" || role === "admin" || role === "custodian" || role === "viewer") return {};
   return explicit ?? {};
 }
-async function writeKeyringFile(adapter, vault, userId, keyringFile) {
+async function writeKeyringFile(store, vault, userId, keyringFile) {
   const envelope = {
     _noydb: 1,
     _v: 1,
@@ -743,13 +750,13 @@ async function writeKeyringFile(adapter, vault, userId, keyringFile) {
     _iv: "",
     _data: JSON.stringify(keyringFile)
   };
-  await adapter.put(vault, "_keyring", userId, envelope);
+  await store.put(vault, "_keyring", userId, envelope);
 }
 
 export {
-  WeakPassphraseError,
-  validatePassphrase,
-  assertStrongPassphrase,
+  WeakSecretError,
+  validateSecret,
+  assertStrongSecret,
   estimateEntropy,
   SYNC_CREDENTIALS_COLLECTION,
   BROKER_COLLECTION,
@@ -775,4 +782,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-554KLAAN.js.map
+//# sourceMappingURL=chunk-BLCWSJLN.js.map