@noy-db/hub 0.5.0 → 0.6.0-pre.0

package/dist/{chunk-FZAP4JNC.js → chunk-RLWY6Z44.js}

@@ -5,24 +5,29 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-6PFST3FC.js";
+} from "./chunk-27TCYH6G.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   decrypt,
+  deriveEchoKey,
   deriveKey,
+  deriveSecretKey,
+  encodeEchoParts,
   encrypt,
   generateDEK,
+  generateIV,
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-RPWMDIGK.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   DirectoryDisabledError,
+  EchoCeremonyRequiredError,
   InvalidKeyError,
   KeyringCorruptError,
   KeyringExpiredError,
@@ -31,8 +36,9 @@ import {
   PermissionDeniedError,
   PrivilegeEscalationError,
   USER_ENVELOPE_COLLECTION,
-  ValidationError
-} from "./chunk-AR5D76T2.js";
+  ValidationError,
+  WrongPromptError
+} from "./chunk-HNGSV2YC.js";
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -105,6 +111,130 @@ function estimateEntropy(secret) {
   if (!result.ok) return 0;
   return Math.round(result.words * Math.log2(7776));
 }
+var DEFAULT_ECHO_PROMPT_MIN_WORDS = 3;
+var DEFAULT_ECHO_MIN_WORD_LENGTH = 1;
+function validateEchoSecretDetailed(parts, opts) {
+  for (const part of [parts.prompt, parts.echo, parts.key]) {
+    if (part.trim().length === 0) return { result: { ok: false, reason: "empty" }, failedCheck: "empty" };
+  }
+  const promptPolicy = {
+    minWords: opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS,
+    minWordLength: opts?.prompt?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,
+    ...opts?.prompt?.rejectRepeatedAdjacent !== void 0 && { rejectRepeatedAdjacent: opts.prompt.rejectRepeatedAdjacent },
+    ...opts?.prompt?.pattern !== void 0 && { pattern: opts.prompt.pattern },
+    ...opts?.prompt?.customValidator !== void 0 && { customValidator: opts.prompt.customValidator }
+  };
+  const promptResult = validateSecret(parts.prompt, promptPolicy);
+  if (!promptResult.ok) return { result: promptResult, failedCheck: "prompt" };
+  const combinedPolicy = {
+    ...opts?.combined?.minWords !== void 0 && { minWords: opts.combined.minWords },
+    minWordLength: opts?.combined?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,
+    ...opts?.combined?.rejectRepeatedAdjacent !== void 0 && { rejectRepeatedAdjacent: opts.combined.rejectRepeatedAdjacent },
+    ...opts?.combined?.pattern !== void 0 && { pattern: opts.combined.pattern },
+    ...opts?.combined?.customValidator !== void 0 && { customValidator: opts.combined.customValidator }
+  };
+  const combinedResult = validateSecret(`${parts.prompt} ${parts.echo} ${parts.key}`, combinedPolicy);
+  return { result: combinedResult, failedCheck: "combined" };
+}
+function validateEchoSecret(parts, opts) {
+  return validateEchoSecretDetailed(parts, opts).result;
+}
+function promptSuggestion(reason, minWords) {
+  if (reason === "too-few-words") {
+    return `The prompt (the part you type first) must be at least ${minWords} words. Example: "sono chiamato vicio".`;
+  }
+  return `The prompt (the part you type first) is the problem. ${SUGGESTIONS[reason]}`;
+}
+function assertStrongEchoSecret(parts, opts) {
+  if (opts?.allowWeakSecret) return;
+  const { result, failedCheck } = validateEchoSecretDetailed(parts, opts);
+  if (result.ok) return;
+  const promptMinWords = opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS;
+  const suggestion = failedCheck === "prompt" ? promptSuggestion(result.reason, promptMinWords) : SUGGESTIONS[result.reason];
+  throw new WeakSecretError(result.reason, suggestion);
+}
+
+// src/with-party/team/echo-secret.ts
+var ECHO_KDF_ITERATIONS = 6e5;
+var VERIFIER_PLAINTEXT = new Uint8Array(32).fill(90);
+var subtle = globalThis.crypto.subtle;
+async function getVerifierKey() {
+  return subtle.importKey("raw", VERIFIER_PLAINTEXT, { name: "AES-GCM" }, true, ["encrypt"]);
+}
+async function mintVerifier(part, salt) {
+  const kek = await deriveSecretKey(part, salt, { iterations: ECHO_KDF_ITERATIONS, keyUsage: "aes-kw" });
+  return wrapKey(await getVerifierKey(), kek);
+}
+async function checkVerifier(verifier, part, saltB64) {
+  try {
+    const kek = await deriveSecretKey(part, base64ToBuffer(saltB64), { iterations: ECHO_KDF_ITERATIONS, keyUsage: "aes-kw" });
+    await subtle.unwrapKey("raw", base64ToBuffer(verifier), kek, "AES-KW", { name: "AES-GCM" }, false, ["encrypt"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function buildEchoBlock(parts, reveal, maskHint) {
+  encodeEchoParts(parts);
+  const promptSalt = generateSalt();
+  const echoSalt = generateSalt();
+  let revealField;
+  if (reveal.kind === "portable") {
+    const blobSalt = generateSalt();
+    const iv = generateIV();
+    const gcmKey = await deriveSecretKey(parts.prompt, blobSalt, { iterations: ECHO_KDF_ITERATIONS, keyUsage: "aes-gcm" });
+    const ct = new Uint8Array(
+      await subtle.encrypt({ name: "AES-GCM", iv }, gcmKey, new TextEncoder().encode(parts.echo))
+    );
+    revealField = { kind: "portable", blob: bufferToBase64(ct), iv: bufferToBase64(iv), salt: bufferToBase64(blobSalt) };
+  } else if (reveal.kind === "sealed") {
+    const sealed = await reveal.deviceSeal.seal(new TextEncoder().encode(parts.echo));
+    revealField = { kind: "sealed", blob: bufferToBase64(sealed), provider_hint: reveal.deviceSeal.id };
+  } else {
+    revealField = { kind: "none" };
+  }
+  return {
+    v: 1,
+    prompt_salt: bufferToBase64(promptSalt),
+    prompt_verifier: await mintVerifier(parts.prompt, promptSalt),
+    echo_salt: bufferToBase64(echoSalt),
+    echo_verifier: await mintVerifier(parts.echo, echoSalt),
+    reveal: revealField,
+    ...maskHint !== void 0 ? { mask_hint: maskHint } : {}
+  };
+}
+async function verifyPrompt(block, prompt) {
+  return checkVerifier(block.prompt_verifier, prompt, block.prompt_salt);
+}
+async function resolveEchoReveal(block, prompt, deviceSeal) {
+  if (block.reveal.kind === "portable") {
+    try {
+      const gcmKey = await deriveSecretKey(prompt, base64ToBuffer(block.reveal.salt), {
+        iterations: ECHO_KDF_ITERATIONS,
+        keyUsage: "aes-gcm"
+      });
+      const plain = await subtle.decrypt(
+        { name: "AES-GCM", iv: base64ToBuffer(block.reveal.iv) },
+        gcmKey,
+        base64ToBuffer(block.reveal.blob)
+      );
+      return new TextDecoder().decode(plain);
+    } catch {
+      throw new WrongPromptError();
+    }
+  }
+  if (block.reveal.kind === "sealed" && deviceSeal !== void 0) {
+    if (deviceSeal.id !== block.reveal.provider_hint) {
+      return null;
+    }
+    const plain = await deviceSeal.unseal(base64ToBuffer(block.reveal.blob));
+    return new TextDecoder().decode(plain);
+  }
+  return null;
+}
+async function verifyTypedEcho(block, echo) {
+  return checkVerifier(block.echo_verifier, echo, block.echo_salt);
+}
 
 // src/with-party/team/reserved-secret-collections.ts
 var SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
@@ -164,21 +294,42 @@ async function verifyKeyringCanary(wrappedCanary, kek) {
     return false;
   }
 }
-async function loadKeyring(store, vault, opts) {
-  const { userId, secret } = opts;
-  const envelope = await store.get(vault, "_keyring", userId);
-  if (!envelope) {
-    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
+async function deriveKekForKeyring(file, secret, salt) {
+  if (file.echo !== void 0) {
+    if (typeof secret === "string") throw new EchoCeremonyRequiredError();
+    return deriveEchoKey(secret, salt);
   }
-  const keyringFile = JSON.parse(envelope._data);
-  if (keyringFile.expires_at !== void 0) {
-    const cutoff = Date.parse(keyringFile.expires_at);
+  if (typeof secret !== "string") {
+    throw new ValidationError("This keyring uses a standard secret \u2014 pass a string, not echo parts.");
+  }
+  return deriveKey(secret, salt);
+}
+function parseKeyringEnvelope(envelope) {
+  return JSON.parse(envelope._data);
+}
+async function readKeyringFile(store, vault, userId) {
+  const envelope = await store.get(vault, "_keyring", userId);
+  if (!envelope) return void 0;
+  return { envelope, file: parseKeyringEnvelope(envelope) };
+}
+function assertKeyringNotExpired(file) {
+  if (file.expires_at !== void 0) {
+    const cutoff = Date.parse(file.expires_at);
     if (Number.isFinite(cutoff) && Date.now() >= cutoff) {
-      throw new KeyringExpiredError({ userId: keyringFile.user_id, expiresAt: keyringFile.expires_at });
+      throw new KeyringExpiredError({ userId: file.user_id, expiresAt: file.expires_at });
     }
   }
+}
+async function loadKeyring(store, vault, opts) {
+  const { userId, secret } = opts;
+  const found = await readKeyringFile(store, vault, userId);
+  if (!found) {
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
+  }
+  const { file: keyringFile } = found;
+  assertKeyringNotExpired(keyringFile);
   const salt = base64ToBuffer(keyringFile.salt);
-  const kek = await deriveKey(secret, salt);
+  const kek = await deriveKekForKeyring(keyringFile, secret, salt);
   const canaryOk = keyringFile.canary !== void 0 ? await verifyKeyringCanary(keyringFile.canary, kek) : null;
   const deks = /* @__PURE__ */ new Map();
   const failedCollections = [];
@@ -241,10 +392,16 @@ async function assertKeyringOpenAllowed(store, vault, userId, create) {
 async function createOwnerKeyring(store, vault, opts) {
   const { userId, secret } = opts;
   if (opts.validate && !opts.allowWeakSecret) {
-    assertStrongSecret(secret, opts);
+    if (typeof secret === "string") assertStrongSecret(secret, opts);
+    else {
+      assertStrongEchoSecret(secret, {
+        ...opts.echoSecretPolicy,
+        ...opts.allowWeakSecret !== void 0 && { allowWeakSecret: opts.allowWeakSecret }
+      });
+    }
   }
   const salt = generateSalt();
-  const kek = await deriveKey(secret, salt);
+  const kek = typeof secret === "string" ? await deriveKey(secret, salt) : await deriveEchoKey(secret, salt);
   const userEnvelopeDek = await generateDEK();
   const wrappedUserEnvelopeDek = await wrapKey(userEnvelopeDek, kek);
   const canary = await mintKeyringCanary(kek);
@@ -258,7 +415,16 @@ async function createOwnerKeyring(store, vault, opts) {
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     granted_by: userId,
-    canary
+    canary,
+    // The presence of this block is what makes the keyring an echo keyring —
+    // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
+    ...typeof secret !== "string" ? {
+      echo: await buildEchoBlock(
+        secret,
+        opts.deviceSeal ? { kind: "sealed", deviceSeal: opts.deviceSeal } : { kind: "portable" },
+        opts.echoMaskHint
+      )
+    } : {}
   };
   await writeKeyringFile(store, vault, userId, keyringFile);
   return {
@@ -347,9 +513,9 @@ async function findAdminDescendants(store, vault, rootUserId) {
   const allUserIds = await store.list(vault, "_keyring");
   const childrenByParent = /* @__PURE__ */ new Map();
   for (const userId of allUserIds) {
-    const env = await store.get(vault, "_keyring", userId);
-    if (!env) continue;
-    const kf = JSON.parse(env._data);
+    const found = await readKeyringFile(store, vault, userId);
+    if (!found) continue;
+    const kf = found.file;
     if (kf.role !== "admin") continue;
     if (kf.user_id === rootUserId) continue;
     const list = childrenByParent.get(kf.granted_by) ?? [];
@@ -371,11 +537,11 @@ async function findAdminDescendants(store, vault, rootUserId) {
   return order;
 }
 async function revoke(store, vault, callerKeyring, options) {
-  const targetEnvelope = await store.get(vault, "_keyring", options.userId);
-  if (!targetEnvelope) {
+  const targetFound = await readKeyringFile(store, vault, options.userId);
+  if (!targetFound) {
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
-  const targetKeyring = JSON.parse(targetEnvelope._data);
+  const targetKeyring = targetFound.file;
   if (!canRevoke(callerKeyring.role, targetKeyring.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot revoke role "${targetKeyring.role}"`
@@ -393,11 +559,10 @@ async function revoke(store, vault, callerKeyring, options) {
         );
       } else {
         for (const userId of descendants) {
-          const descEnv = await store.get(vault, "_keyring", userId);
-          if (!descEnv) continue;
-          const descKf = JSON.parse(descEnv._data);
+          const descFound = await readKeyringFile(store, vault, userId);
+          if (!descFound) continue;
           usersToRevoke.push(userId);
-          for (const c of Object.keys(descKf.deks)) affectedCollections.add(c);
+          for (const c of Object.keys(descFound.file.deks)) affectedCollections.add(c);
         }
       }
     }
@@ -417,13 +582,13 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
       `updateUser: at least one of role / displayName / permissions must be provided (userId: "${options.userId}").`
     );
   }
-  const env = await store.get(vault, "_keyring", options.userId);
-  if (!env) {
+  const found = await readKeyringFile(store, vault, options.userId);
+  if (!found) {
     throw new NoAccessError(
       `updateUser: user "${options.userId}" has no keyring in vault "${vault}".`
     );
   }
-  const target = JSON.parse(env._data);
+  const target = found.file;
   if (!canUpdateRole(callerKeyring.role, target.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot update a keyring with role "${target.role}"`
@@ -484,9 +649,9 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
   const userIds = await store.list(vault, "_keyring");
   for (const userId of userIds) {
     if (userId === callerKeyring.userId) continue;
-    const userEnvelope = await store.get(vault, "_keyring", userId);
-    if (!userEnvelope) continue;
-    const userKeyringFile = JSON.parse(userEnvelope._data);
+    const userFound = await readKeyringFile(store, vault, userId);
+    if (!userFound) continue;
+    const userKeyringFile = userFound.file;
     const updatedDeks = { ...userKeyringFile.deks };
     const updatedPermissions = { ...userKeyringFile.permissions };
     for (const collName of collections) {
@@ -506,6 +671,8 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
   return { needsRegrant };
 }
 async function changeSecret(store, vault, keyring, opts) {
+  const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound && existingFound.file.echo !== void 0) throw new EchoCeremonyRequiredError();
   const { newSecret } = opts;
   if (!opts.allowWeakSecret) {
     assertStrongSecret(newSecret, opts);
@@ -557,7 +724,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
   const role = recipient.role ?? "viewer";
   const permissions = resolvePermissions(role, recipient.permissions);
   const newSalt = generateSalt();
-  const newKek = await deriveKey(recipient.secret, newSalt);
+  const newKek = typeof recipient.secret === "string" ? await deriveKey(recipient.secret, newSalt) : await deriveEchoKey(recipient.secret, newSalt);
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
     const dek = callerKeyring.deks.get(collName);
@@ -596,16 +763,21 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     canary,
     ...recipient.exportCapability !== void 0 ? { export_capability: recipient.exportCapability } : {},
     ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
-    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
+    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {},
+    // The presence of this block is what makes the recipient's slot an
+    // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
+    // ceremony (prompt → echo → key) travels with the pod, not just a
+    // live owner keyring.
+    ...typeof recipient.secret !== "string" ? { echo: await buildEchoBlock(recipient.secret, { kind: recipient.secret.reveal ?? "portable" }) } : {}
   };
 }
 async function listUsers(store, vault) {
   const userIds = await store.list(vault, "_keyring");
   const users = [];
   for (const userId of userIds) {
-    const envelope = await store.get(vault, "_keyring", userId);
-    if (!envelope) continue;
-    const kf = JSON.parse(envelope._data);
+    const found = await readKeyringFile(store, vault, userId);
+    if (!found) continue;
+    const kf = found.file;
     users.push({
       userId: kf.user_id,
       displayName: kf.display_name,
@@ -682,6 +854,8 @@ async function persistKeyring(store, vault, keyring) {
       "persistKeyring: keyring.kek is null \u2014 cannot wrap DEKs without the KEK. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before persisting."
     );
   }
+  const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  const existingEcho = existingFound?.file.echo;
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
@@ -701,7 +875,8 @@ async function persistKeyring(store, vault, keyring) {
     ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
     ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability },
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
-    ...keyring.policy !== void 0 && { policy: keyring.policy }
+    ...keyring.policy !== void 0 && { policy: keyring.policy },
+    ...existingEcho !== void 0 && { echo: existingEcho }
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
 }
@@ -758,10 +933,21 @@ export {
   validateSecret,
   assertStrongSecret,
   estimateEntropy,
+  DEFAULT_ECHO_PROMPT_MIN_WORDS,
+  DEFAULT_ECHO_MIN_WORD_LENGTH,
+  validateEchoSecret,
+  assertStrongEchoSecret,
+  buildEchoBlock,
+  verifyPrompt,
+  resolveEchoReveal,
+  verifyTypedEcho,
   SYNC_CREDENTIALS_COLLECTION,
   BROKER_COLLECTION,
   isSecretBearingReservedCollection,
   mintKeyringCanary,
+  deriveKekForKeyring,
+  readKeyringFile,
+  assertKeyringNotExpired,
   loadKeyring,
   assertKeyringOpenAllowed,
   createOwnerKeyring,
@@ -782,4 +968,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-FZAP4JNC.js.map
+//# sourceMappingURL=chunk-RLWY6Z44.js.map