@noy-db/hub 0.6.0-pre.8 → 0.6.0

package/dist/{chunk-ADW22QSB.js → chunk-HWI7GHJZ.js}

@@ -1,10 +1,10 @@
 import {
   grant,
   revoke
-} from "./chunk-JRKZTEZZ.js";
+} from "./chunk-J6I5VR6P.js";
 import {
   CustodyNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-party/custody/active.ts
 function withCustody() {
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-GFN4C7RR.js");
+      const { liberateVault } = await import("./liberate-LW7OKVBH.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-ADW22QSB.js.map
+//# sourceMappingURL=chunk-HWI7GHJZ.js.map

package/dist/{chunk-GQ3BX5EA.js → chunk-I3ISCYT7.js}

@@ -1,6 +1,6 @@
 import {
   readPath
-} from "./chunk-IGJCYUT5.js";
+} from "./chunk-NSITFOCJ.js";
 
 // src/with-lookup/indexing/eager-indexes.ts
 function normalizeIndexDefs(defs) {
@@ -156,4 +156,4 @@ export {
   normalizeIndexDefs,
   CollectionIndexes
 };
-//# sourceMappingURL=chunk-GQ3BX5EA.js.map
+//# sourceMappingURL=chunk-I3ISCYT7.js.map

package/dist/{chunk-YJ6IONGA.js → chunk-IWKCJCLP.js}

@@ -2,20 +2,22 @@ import {
   assertKeyringNotExpired,
   grant,
   loadKeyring,
+  quarantineKeyring,
   readKeyringFile,
   resolveEchoReveal,
   revoke,
   rotateKeys,
   verifyPrompt,
+  verifyRoster,
   verifyTypedEcho
-} from "./chunk-JRKZTEZZ.js";
+} from "./chunk-J6I5VR6P.js";
 import {
   NoAccessError,
   NoydbError,
   ValidationError,
   WrongEchoError,
   WrongPromptError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-party/team/echo-ceremony.ts
 async function beginEchoUnlock(store, vault, opts) {
@@ -105,6 +107,12 @@ function withTeam() {
     },
     async rotate(team, vault, collections) {
       return team.runRotate(rotateKeys, vault, collections);
+    },
+    async verifyRoster(team, vault) {
+      return team.runVerifyRoster(verifyRoster, vault);
+    },
+    async quarantineKeyring(team, vault, userId, factors) {
+      return team.runQuarantine(quarantineKeyring, vault, userId, factors);
     }
   };
 }
@@ -114,4 +122,4 @@ export {
   MemoryDeviceSealProvider,
   withTeam
 };
-//# sourceMappingURL=chunk-YJ6IONGA.js.map
+//# sourceMappingURL=chunk-IWKCJCLP.js.map

package/dist/{chunk-YJ6IONGA.js.map → chunk-IWKCJCLP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * design-history/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { DeviceSealProvider } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: DeviceSealProvider\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * design-history/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * design-history/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { DeviceSealProvider }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSealProvider implements DeviceSealProvider {\n  readonly id: string\n  private readonly keyPromise: Promise<CryptoKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n      'encrypt',\n      'decrypt',\n    ])\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12))\n    const ct = new Uint8Array(\n      await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await this.keyPromise, plain as BufferSource),\n    )\n    const out = new Uint8Array(12 + ct.length)\n    out.set(iv, 0)\n    out.set(ct, 12)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: sealed.slice(0, 12) },\n          await this.keyPromise,\n          sealed.slice(12) as BufferSource,\n        ),\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;ACjHO,IAAM,2BAAN,MAA6D;AAAA,EACzD;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,MAC9F;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,WAAW,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,YAAY,KAAqB;AAAA,IAC9G;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,GAAG,MAAM;AACzC,QAAI,IAAI,IAAI,CAAC;AACb,QAAI,IAAI,IAAI,EAAE;AACd,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO;AAAA,UAC7B,EAAE,MAAM,WAAW,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,UAC3C,MAAM,KAAK;AAAA,UACX,OAAO,MAAM,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACtCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * design-history/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { DeviceSealProvider } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: DeviceSealProvider\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * design-history/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * design-history/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { DeviceSealProvider }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSealProvider implements DeviceSealProvider {\n  readonly id: string\n  private readonly keyPromise: Promise<CryptoKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n      'encrypt',\n      'decrypt',\n    ])\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12))\n    const ct = new Uint8Array(\n      await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await this.keyPromise, plain as BufferSource),\n    )\n    const out = new Uint8Array(12 + ct.length)\n    out.set(iv, 0)\n    out.set(ct, 12)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: sealed.slice(0, 12) },\n          await this.keyPromise,\n          sealed.slice(12) as BufferSource,\n        ),\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine, verifyRoster as verifyRosterEngine, quarantineKeyring as quarantineEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n    async verifyRoster(team, vault) {\n      return team.runVerifyRoster(verifyRosterEngine, vault)\n    },\n    async quarantineKeyring(team, vault, userId, factors) {\n      return team.runQuarantine(quarantineEngine, vault, userId, factors)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;ACjHO,IAAM,2BAAN,MAA6D;AAAA,EACzD;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,MAC9F;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,WAAW,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,YAAY,KAAqB;AAAA,IAC9G;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,GAAG,MAAM;AACzC,QAAI,IAAI,IAAI,CAAC;AACb,QAAI,IAAI,IAAI,EAAE;AACd,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO;AAAA,UAC7B,EAAE,MAAM,WAAW,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,UAC3C,MAAM,KAAK;AAAA,UACX,OAAO,MAAM,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACtCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,IACA,MAAM,aAAa,MAAM,OAAO;AAC9B,aAAO,KAAK,gBAAgB,cAAoB,KAAK;AAAA,IACvD;AAAA,IACA,MAAM,kBAAkB,MAAM,OAAO,QAAQ,SAAS;AACpD,aAAO,KAAK,cAAc,mBAAkB,OAAO,QAAQ,OAAO;AAAA,IACpE;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-NJDQ4YSV.js → chunk-IWQPYT6S.js}

@@ -1,13 +1,13 @@
 import {
   ViaGraph
-} from "./chunk-7TSYBD3E.js";
+} from "./chunk-65JXA63J.js";
 import {
   sha256Hex
-} from "./chunk-VCETL77O.js";
+} from "./chunk-ONPVHX2Y.js";
 import {
   DerivationCycleError,
   DuplicateBehaviorNameError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-formula/derivations/strategy-hash.ts
 async function computeStrategyHash(source, outputKeys, derive, sources) {
@@ -172,4 +172,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-NJDQ4YSV.js.map
+//# sourceMappingURL=chunk-IWQPYT6S.js.map