@noy-db/hub 0.7.0 → 0.8.0-pre.0

package/dist/{chunk-WEQEYLCS.js → chunk-LGRLME4M.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-6GOE5PGN.js";
+} from "./chunk-T2LBQ5DV.js";
 import {
   deriveSchemaManifest
-} from "./chunk-VXGSWL6L.js";
+} from "./chunk-SYVZW77S.js";
 import {
   loadFence
-} from "./chunk-453F654R.js";
+} from "./chunk-L7DOS3TE.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-5WDXHNSW.js";
+} from "./chunk-HBPPGWUM.js";
 import {
   loadKeyring
-} from "./chunk-G56KBWFY.js";
+} from "./chunk-M7NI3IWE.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -26,7 +26,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-WEQEYLCS.js.map
+//# sourceMappingURL=chunk-LGRLME4M.js.map

package/dist/{chunk-RMF67KCG.js → chunk-LQ4ZHOKP.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-LP7BEXCT.js";
 import {
   bufferToBase64
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 
 // src/kernel/enclave/classify/bidx.ts
 var subtle = globalThis.crypto.subtle;
@@ -66,4 +66,4 @@ export {
   mintBidxTag,
   computeBidxTarget
 };
-//# sourceMappingURL=chunk-RMF67KCG.js.map
+//# sourceMappingURL=chunk-LQ4ZHOKP.js.map

package/dist/{chunk-ZVO4QVPD.js → chunk-M522UYZ2.js}

@@ -1,20 +1,20 @@
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 import {
   encrypt
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 import {
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
   ValidationError,
   isConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-commit/sequence/active.ts
 function withSequence() {
@@ -201,4 +201,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-ZVO4QVPD.js.map
+//# sourceMappingURL=chunk-M522UYZ2.js.map

package/dist/{chunk-G56KBWFY.js → chunk-M7NI3IWE.js}

@@ -5,18 +5,19 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-KG7TZKZG.js";
+} from "./chunk-7VCXZDA4.js";
 import {
   parseDekKey
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-JCN44NCY.js";
 import {
   envelopeOpensUnderAny,
+  hasSealedBody,
   rekeyBlobSet,
   rekeyEnvelopeIfNeeded
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -31,10 +32,10 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-7MG7SJT7.js";
+} from "./chunk-ODVPTDPK.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
@@ -48,10 +49,11 @@ import {
   PermissionDeniedError,
   PrivilegeEscalationError,
   ROSTER_KEY_ID,
+  TamperedError,
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-party/team/roster-epoch.ts
 function assertRosterEpochCurrent(found, expected, userId) {
@@ -164,12 +166,20 @@ function mismatchReason(file) {
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
   reason;
+  /**
+   * Remediation copy. Empty string when no truthful advice was
+   * available — a `customValidator` rejected the phrase and supplied
+   * none, so the hub has no rules to describe (#1430). Never populated
+   * with the built-in copy in that case: wrong advice is worse than
+   * none, especially for a vault whose own credentials violate it.
+   */
   suggestion;
   constructor(reason, suggestion) {
-    super("WEAK_SECRET", `Weak secret (${reason}). ${suggestion}`);
+    const advice = suggestion ?? "";
+    super("WEAK_SECRET", advice ? `Weak secret (${reason}). ${advice}` : `Weak secret (${reason}).`);
     this.name = "WeakSecretError";
     this.reason = reason;
-    this.suggestion = suggestion;
+    this.suggestion = advice;
   }
 };
 var DEFAULT_MIN_WORDS = 6;
@@ -221,11 +231,19 @@ function validateSecret(s, opts) {
   }
   return { ok: true, words: words.length };
 }
+function resolveSuggestion(result, customValidatorInUse) {
+  if (result.suggestion !== void 0) return result.suggestion;
+  if (customValidatorInUse) return void 0;
+  return SUGGESTIONS[result.reason];
+}
 function assertStrongSecret(s, opts) {
   if (opts?.allowWeakSecret) return;
   const result = validateSecret(s, opts);
   if (result.ok) return;
-  throw new WeakSecretError(result.reason, SUGGESTIONS[result.reason]);
+  throw new WeakSecretError(
+    result.reason,
+    resolveSuggestion(result, opts?.customValidator !== void 0)
+  );
 }
 function estimateEntropy(secret) {
   const result = validateSecret(secret);
@@ -271,7 +289,8 @@ function assertStrongEchoSecret(parts, opts) {
   const { result, failedCheck } = validateEchoSecretDetailed(parts, opts);
   if (result.ok) return;
   const promptMinWords = opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS;
-  const suggestion = failedCheck === "prompt" ? promptSuggestion(result.reason, promptMinWords) : SUGGESTIONS[result.reason];
+  const customInUse = failedCheck === "prompt" ? opts?.prompt?.customValidator !== void 0 : opts?.combined?.customValidator !== void 0;
+  const suggestion = result.suggestion !== void 0 ? result.suggestion : failedCheck === "prompt" && !customInUse ? promptSuggestion(result.reason, promptMinWords) : resolveSuggestion(result, customInUse);
   throw new WeakSecretError(result.reason, suggestion);
 }
 
@@ -1227,6 +1246,13 @@ async function collectionHasRecords(store, vault, collectionName) {
   const ids = await store.list(vault, collectionName);
   return ids.length > 0;
 }
+async function reservedCollectionHasSealedRecords(store, vault, collectionName) {
+  for (const id of await store.list(vault, collectionName)) {
+    const env = await store.get(vault, collectionName, id);
+    if (env && hasSealedBody(env)) return true;
+  }
+  return false;
+}
 async function reloadPersistedDEK(store, vault, keyring, collectionName) {
   if (!keyring.kek) return null;
   const found = await readKeyringFile(store, vault, keyring.userId);
@@ -1261,6 +1287,13 @@ async function ensureCollectionDEK(store, vault, keyring) {
             `No access \u2014 user "${keyring.userId}" is entitled to collection "${collectionName}" but holds no key for it, because the collection was created AFTER their grant. A collection DEK can only be wrapped at grant time (wrapping needs the grantee's secret, which the vault never stores), so this cannot be back-filled \u2014 re-grant the user to give them the key.`
           );
         }
+      } else if (await reservedCollectionHasSealedRecords(store, vault, collectionName)) {
+        const refreshed = await reloadPersistedDEK(store, vault, keyring, collectionName);
+        if (refreshed) return refreshed;
+        throw new TamperedError(
+          `User "${keyring.userId}" holds no key for reserved collection "${collectionName}", which already holds sealed records \u2014 the collection was created AFTER their grant and a DEK cannot be back-filled (wrapping needs the grantee's secret, which the vault never stores). Re-grant the user to give them the key. Not a tamper: no decrypt was attempted.`,
+          "key-absent"
+        );
       }
       const dek = await generateDEK();
       keyring.deks.set(collectionName, dek);
@@ -1440,4 +1473,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-G56KBWFY.js.map
+//# sourceMappingURL=chunk-M7NI3IWE.js.map