@noy-db/hub 0.6.0-pre.22 → 0.6.0-pre.24

package/dist/{chunk-OIW75CLW.js → chunk-WN377AAV.js}

@@ -3,22 +3,22 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-FFSQFH6D.js";
+} from "./chunk-DNKVKO7K.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-JPVJTTHU.js";
+} from "./chunk-AKPIBKHK.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-47F6AI2K.js";
+} from "./chunk-GU5XWSH4.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-DIVPOJPV.js";
+} from "./chunk-43FOH2OK.js";
 import {
   buildSealedRecordEnvelope
-} from "./chunk-PENPHA45.js";
+} from "./chunk-FX3UIDCS.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -86,4 +86,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-OIW75CLW.js.map
+//# sourceMappingURL=chunk-WN377AAV.js.map

package/dist/{chunk-ESXVNASI.js → chunk-XCNYOVFV.js}

@@ -5,7 +5,7 @@ import {
   buildStringFieldEntries,
   extractSnippet,
   searchScan
-} from "./chunk-QK2QAMF7.js";
+} from "./chunk-ACIEKVFR.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
@@ -13,14 +13,14 @@ import {
   getAtPath,
   isStaticDictDescriptor,
   stripI18nFilled
-} from "./chunk-CW3VJARJ.js";
+} from "./chunk-IYXP6OR5.js";
 import {
   liveRecordIsElevated
-} from "./chunk-WUNRUSBJ.js";
+} from "./chunk-NSZGZYZL.js";
 import {
   EmbeddingDimMismatchError,
   EmbeddingModelMismatchError
-} from "./chunk-PKUJ3JLQ.js";
+} from "./chunk-5OFC3QYL.js";
 
 // src/with-lookup/embeddings/cosine.ts
 function cosine(a, b) {
@@ -394,4 +394,4 @@ export {
   rebuildEmbeddings,
   syncTierSearch
 };
-//# sourceMappingURL=chunk-ESXVNASI.js.map
+//# sourceMappingURL=chunk-XCNYOVFV.js.map

package/dist/{chunk-FFESJQ5A.js → chunk-YEEV4ZXL.js}

@@ -5,14 +5,18 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-KMGAFLCK.js";
+} from "./chunk-SQWXF2HP.js";
 import {
+  parseDekKey
+} from "./chunk-NSZGZYZL.js";
+import {
+  envelopeOpensUnderAny,
   rekeyBlobSet,
   rekeyEnvelopeIfNeeded
-} from "./chunk-DIVPOJPV.js";
+} from "./chunk-43FOH2OK.js";
 import {
   buildRecordEnvelope
-} from "./chunk-PENPHA45.js";
+} from "./chunk-FX3UIDCS.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -27,11 +31,12 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-O5QXH7U7.js";
+} from "./chunk-D7STIWJO.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-IGNJOJEP.js";
+} from "./chunk-UJ4Z67UQ.js";
 import {
+  BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
   InvalidKeyError,
@@ -46,7 +51,7 @@ import {
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-PKUJ3JLQ.js";
+} from "./chunk-5OFC3QYL.js";
 
 // src/with-party/team/roster-tag.ts
 function stable(value) {
@@ -63,6 +68,25 @@ function rosterCanonical(file) {
     role: file.role,
     permissions: file.permissions,
     granted_by: file.granted_by,
+    // #1115 — WHICH collections this keyring holds a key for, authenticated.
+    //
+    // `revoke` derives its rotation scope from `Object.keys(target.deks)`, so
+    // while this set was unauthenticated a store could strip entries from the
+    // target's file and have those collections silently skipped by the
+    // rotation — leaving a revoked member, colluding with that store, holding
+    // live DEKs for exactly the collections it removed. That directly
+    // contradicts `SECURITY.md`'s "the rotation cannot be skipped".
+    //
+    // NAMES ONLY, deliberately. The wrapped values are AES-KW, which is
+    // self-authenticating: a tampered wrap fails to unwrap. What was
+    // unprotected is the SHAPE of the map, not its contents.
+    //
+    // `pending_deks` is bound for the same reason one field over: stripping it
+    // makes an interrupted rotation mint a fresh DEK instead of resuming,
+    // permanently orphaning every record already rewritten under the pending
+    // key (#1074). Leaving it out would recreate the identical hole.
+    dek_slots: Object.keys(file.deks ?? {}).sort(),
+    pending_dek_slots: Object.keys(file.pending_deks ?? {}).sort(),
     expires_at: file.expires_at ?? null,
     export_capability: file.export_capability ?? null,
     import_capability: file.import_capability ?? null
@@ -88,12 +112,14 @@ async function assertRosterAuthenticated(file, deks, userId) {
 }
 async function assertRosterTagValid(file, rosterKey, userId) {
   if (!await verifyRosterTag(file, file.roster_tag, rosterKey)) {
-    throw new KeyringTamperedError({
-      userId,
-      reason: file.roster_tag == null ? "roster-tag-missing" : "roster-tag-mismatch"
-    });
+    throw new KeyringTamperedError({ userId, reason: mismatchReason(file) });
   }
 }
+function mismatchReason(file) {
+  if (file.roster_tag == null) return "roster-tag-missing";
+  if (file._noydb_keyring !== NOYDB_KEYRING_VERSION) return "format-superseded";
+  return "roster-tag-mismatch";
+}
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -478,6 +504,8 @@ async function createOwnerKeyring(store, vault, opts) {
   const wrappedUserEnvelopeDek = await wrapKey(userEnvelopeDek, kek);
   const rosterKey = await generateDEK();
   const wrappedRosterKey = await wrapKey(rosterKey, kek);
+  const blobAddressKey = await generateDEK();
+  const wrappedBlobAddressKey = await wrapKey(blobAddressKey, kek);
   const canary = await mintKeyringCanary(kek);
   const authority = {
     user_id: userId,
@@ -486,17 +514,21 @@ async function createOwnerKeyring(store, vault, opts) {
     permissions: {},
     granted_by: userId
   };
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authorityWithDeks = {
     ...authority,
     deks: {
       [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek,
-      [ROSTER_KEY_ID]: wrappedRosterKey
-    },
+      [ROSTER_KEY_ID]: wrappedRosterKey,
+      [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey
+    }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authority, rosterKey),
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
     // The presence of this block is what makes the keyring an echo keyring —
     // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
     ...typeof secret !== "string" ? {
@@ -557,6 +589,8 @@ async function grant(store, vault, callerKeyring, options) {
     mintedForGrant = true;
   }
   if (mintedForGrant) await persistKeyring(store, vault, callerKeyring);
+  const previousGrantFound = await readKeyringFile(store, vault, options.userId);
+  const previousDekNames = previousGrantFound ? new Set(Object.keys(previousGrantFound.file.deks)) : null;
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
     if (collName === PERMISSION_WILDCARD) continue;
@@ -593,18 +627,26 @@ async function grant(store, vault, callerKeyring, options) {
     ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authority,
-    deks: wrappedDeks,
+    ...authorityWithDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
     // The grantee's own copy of the roster key rode in via the `_`-prefix
     // propagation loop above, so they can verify this tag on first unlock.
-    roster_tag: await mintRosterTag(authority, callerRosterKey)
+    roster_tag: await mintRosterTag(authorityWithDeks, callerRosterKey)
   };
   await writeKeyringFile(store, vault, options.userId, keyringFile);
+  if (previousDekNames !== null && options.userId !== callerKeyring.userId) {
+    const dropped = [...previousDekNames].filter(
+      (name) => !name.startsWith("_") && !(name in wrappedDeks)
+    );
+    if (dropped.length > 0) {
+      await rotateKeys(store, vault, callerKeyring, { collections: dropped });
+    }
+  }
   const userEnvelopeDek = callerKeyring.deks.get(USER_ENVELOPE_COLLECTION);
   if (userEnvelopeDek) {
     const initialPayload = options.initialProfile ?? {};
@@ -690,6 +732,7 @@ async function revoke(store, vault, callerKeyring, options) {
     await deleteUserVisibility(store, vault, userId);
   }
   affectedCollections.delete(ROSTER_KEY_ID);
+  affectedCollections.delete(BLOB_ADDRESS_KEY_ID);
   if (affectedCollections.size > 0) {
     const { unverified } = await rotateKeys(store, vault, callerKeyring, {
       collections: [...affectedCollections]
@@ -865,6 +908,11 @@ async function derivedRefsFor(store, vault, rotated) {
 }
 async function rotateKeys(store, vault, callerKeyring, opts) {
   const { collections } = opts;
+  if (collections.includes(BLOB_ADDRESS_KEY_ID)) {
+    throw new ValidationError(
+      `rotateKeys: "${BLOB_ADDRESS_KEY_ID}" is the vault's blob content-addressing root, not a collection, and cannot be rotated \u2014 every blob eTag is derived from it, so rotating it would invalidate every stored address at once. Remove it from \`collections\`.`
+    );
+  }
   if (collections.includes(ROSTER_KEY_ID)) {
     throw new ValidationError(
       `rotateKeys: "${ROSTER_KEY_ID}" is the vault roster key, not a collection, and cannot be rotated \u2014 doing so would strip it from every other member and leave the vault unopenable. Remove it from \`collections\`.`
@@ -896,15 +944,27 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       for (const [name, dek] of newDeks) if (name !== collName) others.push(dek);
       await rekeyBlobSet(store, vault, oldDek, newDek, others);
     }
+    const { collection: baseColl } = parseDekKey(collName);
+    const siblingSlotDeks = [];
+    for (const [name, dek] of callerKeyring.deks) if (name !== collName) siblingSlotDeks.push(dek);
+    for (const [name, dek] of newDeks) if (name !== collName) siblingSlotDeks.push(dek);
     const refs = [
-      ...(await store.list(vault, collName)).map((id) => ({ collection: collName, id })),
-      ...await derivedRefsFor(store, vault, collName)
+      ...(await store.list(vault, baseColl)).map((id) => ({ collection: baseColl, id })),
+      ...await derivedRefsFor(store, vault, baseColl)
     ];
     for (const ref of refs) {
       const { collection: refColl, id } = ref;
       const envelope = await store.get(vault, refColl, id);
       if (!envelope || !envelope._iv) continue;
-      const newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
+      let newEnvelope;
+      try {
+        newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
+      } catch (err) {
+        if (await envelopeOpensUnderAny({ collection: refColl, id }, envelope, siblingSlotDeks)) {
+          continue;
+        }
+        throw err;
+      }
       if (newEnvelope !== null) await store.put(vault, refColl, id, newEnvelope);
     }
   }
@@ -980,14 +1040,14 @@ async function changeSecret(store, vault, keyring, opts) {
     ...existingAuthority?.export_capability !== void 0 && { export_capability: existingAuthority.export_capability },
     ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
   };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks };
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authority,
-    deks: wrappedDeks,
+    ...authorityWithDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authority, rosterKey)
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey)
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
@@ -1054,16 +1114,16 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
     ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
   };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks };
   return {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
-    ...authority,
-    deks: wrappedDeks,
+    ...authorityWithDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     canary,
     // The recipient's copy of the roster key rode in via the `_`-prefix
     // propagation loop above, so the slot verifies on first unlock.
-    roster_tag: await mintRosterTag(authority, rosterKey),
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
     // The presence of this block is what makes the recipient's slot an
     // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
     // ceremony (prompt → echo → key) travels with the pod, not just a
@@ -1217,15 +1277,18 @@ async function persistKeyring(store, vault, keyring) {
     ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
     ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability }
   };
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authorityWithDeks = {
     ...authority,
     deks: wrappedDeks,
-    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {},
+    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {}
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
     salt: bufferToBase64(keyring.salt),
     created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    roster_tag: await mintRosterTag(authority, rosterKey),
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
@@ -1323,4 +1386,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-FFESJQ5A.js.map
+//# sourceMappingURL=chunk-YEEV4ZXL.js.map