@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/chunk-HKB4HZDU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["import { NoydbError } from '../../kernel/errors.js'\nimport {\n  generateEphemeralKey, encryptBytes, decryptBytes, bufferToBase64, base64ToBuffer, type EnclaveKey,\n} from '../../capsule/index.js'\nimport type { NoydbDeviceSeal } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `NoydbSealer` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link NoydbDeviceSeal} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { NoydbDeviceSeal }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSeal implements NoydbDeviceSeal {\n  readonly id: string\n  private readonly keyPromise: Promise<EnclaveKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = generateEphemeralKey()\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const { iv, data } = await encryptBytes(plain, await this.keyPromise)\n    const ivB = base64ToBuffer(iv)\n    const ct = base64ToBuffer(data)\n    const out = new Uint8Array(ivB.byteLength + ct.byteLength)\n    out.set(ivB, 0)\n    out.set(ct, ivB.byteLength)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await decryptBytes(\n        bufferToBase64(sealed.slice(0, 12)),\n        bufferToBase64(sealed.slice(12)),\n        await this.keyPromise,\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine, verifyRoster as verifyRosterEngine, quarantineKeyring as quarantineEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n    async verifyRoster(team, vault) {\n      return team.runVerifyRoster(verifyRosterEngine, vault)\n    },\n    async quarantineKeyring(team, vault, userId, factors) {\n      return team.runQuarantine(quarantineEngine, vault, userId, factors)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAsBO,IAAM,mBAAN,MAAkD;AAAA,EAC9C;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,qBAAqB;AAAA,EACzC;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,aAAa,OAAO,MAAM,KAAK,UAAU;AACpE,UAAM,MAAM,eAAe,EAAE;AAC7B,UAAM,KAAK,eAAe,IAAI;AAC9B,UAAM,MAAM,IAAI,WAAW,IAAI,aAAa,GAAG,UAAU;AACzD,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,IAAI,IAAI,UAAU;AAC1B,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,MAAM;AAAA,QACX,eAAe,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,QAClC,eAAe,OAAO,MAAM,EAAE,CAAC;AAAA,QAC/B,MAAM,KAAK;AAAA,MACb;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACnCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,IACA,MAAM,aAAa,MAAM,OAAO;AAC9B,aAAO,KAAK,gBAAgB,cAAoB,KAAK;AAAA,IACvD;AAAA,IACA,MAAM,kBAAkB,MAAM,OAAO,QAAQ,SAAS;AACpD,aAAO,KAAK,cAAc,mBAAkB,OAAO,QAAQ,OAAO;AAAA,IACpE;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-4V3Q35WG.js → chunk-ICF3TIGY.js}

@@ -1,10 +1,10 @@
 import {
   compareKeys,
   toSortKey
-} from "./chunk-LGNDFRYC.js";
+} from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-GIQJGXV7.js";
 
 // src/kernel/query/relate/join-on.ts
 var RANGE_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "between"]);
@@ -201,4 +201,4 @@ export {
   joinOnDispatch,
   matchDeclaredJoin
 };
-//# sourceMappingURL=chunk-4V3Q35WG.js.map
+//# sourceMappingURL=chunk-ICF3TIGY.js.map

package/dist/{chunk-3L2NBKDR.js → chunk-IF2M43G4.js}

@@ -3,7 +3,7 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -41,4 +41,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-3L2NBKDR.js.map
+//# sourceMappingURL=chunk-IF2M43G4.js.map

package/dist/{chunk-37EPTBBR.js → chunk-IKPQ2GGB.js}

@@ -4,6 +4,7 @@ var USER_ENVELOPE_MAX_BYTES = 64 * 1024;
 var USER_ENVELOPE_COLLECTION = "_users";
 var ROSTER_KEY_ID = "_roster";
 var BLOB_ADDRESS_KEY_ID = "_blob_addr";
+var INBOX_KEY_ID = "_inbox_key";
 
 // src/kernel/errors.ts
 var NoydbError = class extends Error {
@@ -279,6 +280,17 @@ var DuplicateStoreKindError = class extends NoydbError {
     this.kind = kind;
   }
 };
+var MemberInboxMissingError = class extends NoydbError {
+  userId;
+  constructor(userId, message) {
+    super(
+      "MEMBER_INBOX_MISSING",
+      message ?? `Member "${userId}" has no keyring inbox \u2014 the keyring predates core#96, so a DEK cannot be delivered without their secret. Re-grant the member with a fresh temporary secret (they rotate it on first open); the new keyring carries an inbox.`
+    );
+    this.name = "MemberInboxMissingError";
+    this.userId = userId;
+  }
+};
 var PrivilegeEscalationError = class extends NoydbError {
   offendingCollection;
   constructor(offendingCollection, message) {
@@ -516,10 +528,22 @@ var TierDemoteDeniedError = class extends NoydbError {
 };
 var DelegationTargetMissingError = class extends NoydbError {
   toUser;
-  constructor(toUser) {
+  /**
+   * ⚠️ `reason` exists because two call sites were passing a SENTENCE as
+   * `toUser` (core#56), rendering as:
+   *
+   *     Delegation target user "grantor cannot find tier 1 DEK for (any)"
+   *     has no keyring in this vault
+   *
+   * — which names a target user that is not a user, and states a cause that is
+   * not the cause. A grantor-side failure is not a missing target; the class is
+   * kept for both only because it is PUBLISHED and consumers catch it. Pass the
+   * real `toUser` and put the explanation in `reason`.
+   */
+  constructor(toUser, reason) {
     super(
       "DELEGATION_TARGET_MISSING",
-      `Delegation target user "${toUser}" has no keyring in this vault`
+      reason ?? `Delegation target user "${toUser}" has no keyring in this vault`
     );
     this.name = "DelegationTargetMissingError";
     this.toUser = toUser;
@@ -1679,7 +1703,23 @@ var RecoveryProfileNotImplementedError = class extends NoydbError {
   }
 };
 var EnclaveNotSupportedError = class extends NoydbError {
-  /** The optional group that is not supported by this enclave. */
+  /**
+   * The group that is not supported by this enclave.
+   *
+   * ⭐ WIDENED to the full {@link CapsuleGroup} 2026-09-16 (core#42). It used
+   * to be `'sealing' | 'deterministic' | 'per-record-keys'` — three of ten,
+   * and not a subset: it could not name `classify`, which `capsule/contract.ts`
+   * explicitly documents a capsule refusing, nor the six core groups.
+   *
+   * ⚠️ The narrowness was invisible because **hub never constructs this error**
+   * — it exists for a fork to throw (see the note above), so the union is a
+   * contract for THIRD-PARTY capsule authors, and hub's own test only ever
+   * built it with `'sealing'`. Found only when the conformance kit's tests
+   * were finally typechecked against hub's source.
+   *
+   * ⛔ This is a widened published READ: a consumer switching exhaustively on
+   * `err.group` gains cases. Release-noted by name for that reason.
+   */
   group;
   constructor(group, detail) {
     super(
@@ -1742,6 +1782,7 @@ export {
   USER_ENVELOPE_COLLECTION,
   ROSTER_KEY_ID,
   BLOB_ADDRESS_KEY_ID,
+  INBOX_KEY_ID,
   NoydbError,
   DebugPlaintextError,
   DebugReservedFieldError,
@@ -1765,6 +1806,7 @@ export {
   StoreCapabilityError,
   UnknownStoreKindError,
   DuplicateStoreKindError,
+  MemberInboxMissingError,
   PrivilegeEscalationError,
   ReservedVaultNameError,
   PeriodClosedError,
@@ -1898,4 +1940,4 @@ export {
   ClassifiedRotationError,
   SatelliteConfigError
 };
-//# sourceMappingURL=chunk-37EPTBBR.js.map
+//# sourceMappingURL=chunk-IKPQ2GGB.js.map