@noy-db/on-password 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/index.d.ts

@@ -11,13 +11,13 @@ import { NoydbStore, UnlockedKeyring, EnrollAuthenticatorOptions, SlotRewrapCere
  * - **Different lifecycles** — the phrase rotates yearly; the password
  *   rotates per the developer's policy.
  * - **Different strength rules** — the phrase is validated against the
- *   phrase format (issue #7); the password is validated against a
+ *   phrase format; the password is validated against a
  *   length / regex rule the developer chooses.
  * - **Different storage** — the phrase derives the KEK; the password
  *   derives a wrapping key that wraps the SAME DEK SET in its own
  *   keyring slot (LUKS-like multi-slot, wrap-DEKs variant).
  *
- * ## Wrap-DEKs format (#26 Path C)
+ * ## Wrap-DEKs format (Path C)
  *
  * Slots produced by this package use the wrap-DEKs variant of
  * `KeyringAuthenticator` — they encrypt the serialized DEK set under
@@ -40,7 +40,7 @@ import { NoydbStore, UnlockedKeyring, EnrollAuthenticatorOptions, SlotRewrapCere
 /**
  * PBKDF2 iteration count — matches the tier-1 phrase derivation.
  * Exported as a documented invariant; the actual derivation lives
- * in hub's canonical wrap-DEKs primitive (#44).
+ * in hub's canonical wrap-DEKs primitive.
  */
 declare const PASSWORD_PBKDF2_ITERATIONS = 600000;
 /** Default minimum password length. Override per-app via `enrollPasswordAuthenticator`. */
@@ -102,7 +102,7 @@ declare function enrollPasswordAuthenticator(keyring: UnlockedKeyring, options:
  *
  * @throws {@link PasswordInvalidError} when the password is wrong or
  *   the slot is not a wrap-DEKs slot (e.g. a legacy wrap-KEK password
- *   slot from before pre.8 — those need re-enrollment).
+ *   legacy wrap-KEK slots — those need re-enrollment).
  */
 declare function unwrapDeksWithPassword(slot: KeyringAuthenticator, password: string): Promise<Map<string, CryptoKey>>;
 /**
@@ -151,10 +151,10 @@ interface VerifyPasswordSlotOptions {
 }
 /**
  * `SlotRewrapCeremony` factory for password slots — the password parallel
- * to `webAuthnSlotRewrapCeremony` (#56). Used by hub's
+ * to `webAuthnSlotRewrapCeremony`. Used by hub's
  * `rotatePassphrase({ slotCeremonies: { [slotId]: passwordSlotRewrapCeremony(pwd) } })`
  * to preserve a tier-2 password enrollment across a tier-1 phrase
- * rotation without forcing the user to re-enroll the password (#96).
+ * rotation without forcing the user to re-enroll the password.
  *
  * Returns a closure capturing the password so the result matches
  * hub's `SlotRewrapCeremony` signature `(ctx) => Promise<EnrollAuthenticatorOptions>`
@@ -189,7 +189,7 @@ interface VerifyPasswordSlotOptions {
  *      `id` + `method` + `wrapKind` to prevent slot-type swap mid-
  *      rotation.
  *
- * Pre-pre.8 wrap-KEK password slots (legacy) cannot be rewrapped via
+ * Legacy wrap-KEK password slots cannot be rewrapped via
  * this ceremony — they must be re-enrolled fresh via
  * {@link enrollPasswordAuthenticator}. The validation throws
  * {@link ValidationError} for those.
@@ -199,8 +199,7 @@ interface VerifyPasswordSlotOptions {
  * @throws {PasswordTooWeakError} when the supplied password fails the
  *         strength rules carried in `oldSlot.meta` (minLength, pattern).
  *
- * @see #56 webAuthnSlotRewrapCeremony — the WebAuthn parallel.
- * @see #29 — the slotCeremonies plumbing this fills in.
+ * @see webAuthnSlotRewrapCeremony — the WebAuthn parallel.
  */
 declare function passwordSlotRewrapCeremony(password: string): SlotRewrapCeremony;
 

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/on-password** — tier-2 password authenticator slot.\n *\n * The user's tier-1 *phrase* is the rarely-typed master that derives\n * the KEK. This package adds a SEPARATE secret — a password the user\n * types at each unlock — as a tier-2 slot in the multi-slot keyring.\n * The two credentials have:\n *\n * - **Different lifecycles** — the phrase rotates yearly; the password\n *   rotates per the developer's policy.\n * - **Different strength rules** — the phrase is validated against the\n *   phrase format (issue #7); the password is validated against a\n *   length / regex rule the developer chooses.\n * - **Different storage** — the phrase derives the KEK; the password\n *   derives a wrapping key that wraps the SAME DEK SET in its own\n *   keyring slot (LUKS-like multi-slot, wrap-DEKs variant).\n *\n * ## Wrap-DEKs format (#26 Path C)\n *\n * Slots produced by this package use the wrap-DEKs variant of\n * `KeyringAuthenticator` — they encrypt the serialized DEK set under\n * a password-derived AES-GCM key, NOT the KEK. This unifies tier-2\n * password slots with the tier-0 (paper recovery, `mintPaperRecoveryEntry`)\n * and tier-3 (`@noy-db/on-pin`'s `wrappedKeyring`) primitives — all\n * three sidestep the non-extractable-KEK constraint by wrapping the\n * DEK set rather than the KEK itself.\n *\n * Trade-off: an `UnlockedKeyring` produced via password-slot unlock\n * has `kek: null`. Sensitive operations (`enrollAuthenticator`,\n * `rotatePassphrase`) require a tier-1 unlock anyway — re-enter the\n * master phrase.\n *\n * @see docs/subsystems/session-tiers.md → Tier 2 — `on-password`\n *\n * @packageDocumentation\n */\nimport {\n  base64ToBuffer,\n  mintWrappedDeksBlob,\n  unwrapDeksFromBlob,\n  ValidationError,\n  type EnrollAuthenticatorOptions,\n  type KeyringAuthenticator,\n  type KeyringFile,\n  type NoydbStore,\n  type SlotRewrapCeremony,\n  type SlotRewrapContext,\n  type UnlockedKeyring,\n} from '@noy-db/hub'\n\n/**\n * PBKDF2 iteration count — matches the tier-1 phrase derivation.\n * Exported as a documented invariant; the actual derivation lives\n * in hub's canonical wrap-DEKs primitive (#44).\n */\nexport const PASSWORD_PBKDF2_ITERATIONS = 600_000\n\n/** Default minimum password length. Override per-app via `enrollPasswordAuthenticator`. */\nexport const PASSWORD_DEFAULT_MIN_LENGTH = 12\n\n// ─── Errors ────────────────────────────────────────────────────────────\n\nexport class PasswordTooWeakError extends Error {\n  readonly code = 'PASSWORD_TOO_WEAK' as const\n  readonly minLength: number\n  constructor(minLength: number, message?: string) {\n    super(\n      message ??\n        `Password must be at least ${String(minLength)} characters. ` +\n          'For accounts with a separate tier-1 phrase, prefer a longer password ' +\n          'or pair with TOTP/email-OTP via @noy-db/on-totp or @noy-db/on-email-otp.',\n    )\n    this.name = 'PasswordTooWeakError'\n    this.minLength = minLength\n  }\n}\n\nexport class PasswordInvalidError extends Error {\n  readonly code = 'PASSWORD_INVALID' as const\n  constructor(message = 'Password does not unlock this slot.') {\n    super(message)\n    this.name = 'PasswordInvalidError'\n  }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/** Options for {@link enrollPasswordAuthenticator}. */\nexport interface EnrollPasswordOptions {\n  /** Slot id. Default: `'password'`. */\n  readonly id?: string\n  /** Password the user will type at unlock. Distinct from the tier-1 phrase. */\n  readonly password: string\n  /** Minimum length. Default 12. */\n  readonly minLength?: number\n  /** Optional regex the password must satisfy in addition to length. */\n  readonly pattern?: RegExp\n  /** Tier the active session held when enrolling. Default 1. */\n  readonly enrolledViaTier?: 1 | 2\n}\n\n/**\n * Build the keyring slot for a tier-2 password authenticator. Returns\n * an `EnrollAuthenticatorOptions` value the caller hands to\n * `db.enrollAuthenticator(vault, slot)` — separating the cryptographic\n * step (this function) from the persistence step (the hub) keeps the\n * package small and lets the hub's policy gate run between the two.\n *\n * The slot uses the **wrap-DEKs** variant of `KeyringAuthenticator`:\n * the DEK set is serialized to JSON and encrypted with AES-GCM under\n * a PBKDF2-derived key. No requirement on `keyring.kek` — works with\n * tier-1 unlocked keyrings; throws if `keyring.deks` is empty.\n *\n * Usage:\n *\n * ```ts\n * import { enrollPasswordAuthenticator } from '@noy-db/on-password'\n *\n * const keyring = await db.getKeyring('acme')\n * const slot = await enrollPasswordAuthenticator(keyring, {\n *   password: 'strong-password-2026',\n *   minLength: 14,\n * })\n * await db.enrollAuthenticator('acme', slot, {\n *   factors: [{ kind: 'totp' }],\n * })\n * ```\n */\nexport async function enrollPasswordAuthenticator(\n  keyring: UnlockedKeyring,\n  options: EnrollPasswordOptions,\n): Promise<EnrollAuthenticatorOptions> {\n  const minLength = options.minLength ?? PASSWORD_DEFAULT_MIN_LENGTH\n  if (options.password.length < minLength) {\n    throw new PasswordTooWeakError(minLength)\n  }\n  if (options.pattern && !options.pattern.test(options.password)) {\n    throw new PasswordTooWeakError(\n      minLength,\n      `Password does not match the configured pattern: ${options.pattern.toString()}.`,\n    )\n  }\n\n  if (keyring.deks.size === 0) {\n    throw new Error(\n      'enrollPasswordAuthenticator: the supplied keyring has no DEKs in memory. ' +\n        'Re-authenticate at tier 1 first.',\n    )\n  }\n\n  // Delegate the wrap-DEKs crypto to the canonical hub primitive (#44).\n  // The slot envelope still stores `salt` inside `meta` for backward\n  // compatibility with the pre-#44 slot format; the issue defers\n  // moving it to top-level for parity with PaperRecoveryEntry.\n  const blob = await mintWrappedDeksBlob(keyring.deks, options.password)\n\n  return {\n    id: options.id ?? 'password',\n    method: 'password',\n    wrapKind: 'deks',\n    wrapped_deks: blob.wrappedDeks,\n    iv: blob.iv,\n    meta: {\n      salt: blob.salt,\n      minLength,\n      ...(options.pattern !== undefined ? { pattern: options.pattern.source } : {}),\n    },\n    enrolled_via_tier: options.enrolledViaTier ?? 1,\n  }\n}\n\n/**\n * Recover the DEK set from a wrap-DEKs password slot. Returns the raw\n * DEK map; the hub-friendly verifier {@link verifyPasswordSlot} wraps\n * this and produces a full `UnlockedKeyring`.\n *\n * @throws {@link PasswordInvalidError} when the password is wrong or\n *   the slot is not a wrap-DEKs slot (e.g. a legacy wrap-KEK password\n *   slot from before pre.8 — those need re-enrollment).\n */\nexport async function unwrapDeksWithPassword(\n  slot: KeyringAuthenticator,\n  password: string,\n): Promise<Map<string, CryptoKey>> {\n  if (slot.wrapKind !== 'deks') {\n    throw new PasswordInvalidError(\n      'Password slot is not a wrap-DEKs slot. Pre-pre.8 wrap-KEK password ' +\n        'slots are no longer supported — re-enrol via enrollPasswordAuthenticator.',\n    )\n  }\n\n  const meta = slot.meta as { salt?: unknown }\n  if (typeof meta.salt !== 'string') {\n    throw new PasswordInvalidError(\n      'Password slot is missing the per-slot salt — keyring may be corrupted.',\n    )\n  }\n\n  // Delegate to the canonical wrap-DEKs primitive (#44). The blob's\n  // three fields (salt / iv / wrappedDeks) are reconstructed from\n  // the slot's split layout: salt lives in meta, iv + wrappedDeks\n  // at top level. Pre-#44, this code re-implemented the same crypto\n  // inline.\n  try {\n    return await unwrapDeksFromBlob(\n      { salt: meta.salt, iv: slot.iv, wrappedDeks: slot.wrapped_deks },\n      password,\n    )\n  } catch {\n    throw new PasswordInvalidError()\n  }\n}\n\n/**\n * Hub-friendly verify callback. Pass to `db.unlockViaAuthenticator`:\n *\n * ```ts\n * import { verifyPasswordSlot } from '@noy-db/on-password'\n *\n * const unlocked = await db.unlockViaAuthenticator('acme', 'password',\n *   (slot) => verifyPasswordSlot(slot, 'strong-password-2026',\n *     { store, vault: 'acme', userId: 'alice' }),\n * )\n * ```\n *\n * Unwraps the DEK set with the supplied password and returns an\n * `UnlockedKeyring` the hub installs in its keyring cache. The\n * returned keyring has `kek: null` — sensitive operations (enrol new\n * slot, rotate phrase) require a tier-1 unlock from the master phrase.\n *\n * The `{ store, vault, userId }` shape works in both contexts:\n *   - **Warm re-unlock** — db is alive; consumer already has identity\n *     in memory but pays one cheap `_keyring/<userId>` read.\n *   - **Cold-start** (`createNoydb({ getKeyring: ... })`) — consumer\n *     does NOT have a keyring yet; the verifier loads identity from\n *     disk before returning the unlocked keyring. This is the\n *     primary cold-start tier-2 path (Niwat tier-2b uses this).\n *\n * Identity fields (userId, displayName, role, permissions,\n * authenticators, salt, capability bits, per-keyring policy) are read\n * directly from the `_keyring/<userId>` envelope's plaintext header —\n * those fields are not encrypted because the sync engine + grant flow\n * need them without a key.\n *\n * @throws {@link PasswordInvalidError} when the password is wrong or\n *   the keyring file is missing.\n */\nexport async function verifyPasswordSlot(\n  slot: KeyringAuthenticator,\n  password: string,\n  options: VerifyPasswordSlotOptions,\n): Promise<UnlockedKeyring> {\n  const deks = await unwrapDeksWithPassword(slot, password)\n\n  const env = await options.store.get(options.vault, '_keyring', options.userId)\n  if (!env) {\n    throw new PasswordInvalidError(\n      `verifyPasswordSlot: no keyring found at \"${options.vault}/_keyring/${options.userId}\". ` +\n        'Verify the vault and userId are correct.',\n    )\n  }\n  const file = JSON.parse(env._data) as KeyringFile\n  const salt = new Uint8Array(base64ToBuffer(file.salt))\n\n  return {\n    userId: file.user_id,\n    displayName: file.display_name,\n    role: file.role,\n    permissions: file.permissions,\n    authenticators: file.authenticators ?? [],\n    salt,\n    ...(file.export_capability !== undefined && { exportCapability: file.export_capability }),\n    ...(file.import_capability !== undefined && { importCapability: file.import_capability }),\n    ...(file.policy !== undefined && { policy: file.policy }),\n    deks,\n    // Wrap-DEKs unlock cannot recover the KEK. Sensitive ops route\n    // through tier-1 via re-entry of the master phrase. Matches the\n    // existing tier-3 (`@noy-db/on-pin`) pattern.\n    kek: null,\n  }\n}\n\n/** Adapter shape required by {@link verifyPasswordSlot}. */\nexport interface VerifyPasswordSlotOptions {\n  /** The vault's NoydbStore — used to load `_keyring/<userId>`. */\n  readonly store: NoydbStore\n  /** Vault name — same value passed to `db.openVault(name)`. */\n  readonly vault: string\n  /** User id — same value passed to `createNoydb({ user })`. */\n  readonly userId: string\n}\n\n/**\n * `SlotRewrapCeremony` factory for password slots — the password parallel\n * to `webAuthnSlotRewrapCeremony` (#56). Used by hub's\n * `rotatePassphrase({ slotCeremonies: { [slotId]: passwordSlotRewrapCeremony(pwd) } })`\n * to preserve a tier-2 password enrollment across a tier-1 phrase\n * rotation without forcing the user to re-enroll the password (#96).\n *\n * Returns a closure capturing the password so the result matches\n * hub's `SlotRewrapCeremony` signature `(ctx) => Promise<EnrollAuthenticatorOptions>`\n * directly. Pass into `slotCeremonies` keyed by the existing slot id:\n *\n * ```ts\n * import { passwordSlotRewrapCeremony } from '@noy-db/on-password'\n *\n * await db.rotatePassphrase('acme', {\n *   oldPassphrase: oldPhrase,\n *   newPassphrase: newPhrase,\n *   slotCeremonies: {\n *     'password': passwordSlotRewrapCeremony('strong-password-2026'),\n *   },\n * })\n * ```\n *\n * The password itself is unaffected by phrase rotation — what needs to\n * change is the **wrapped DEK set**: the encrypted blob the slot's\n * `wrapped_deks` field holds. After rotation, the old blob still has\n * the old DEKs (now stale because rotatePassphrase rewrapped them\n * under a fresh KEK); the new blob must hold the freshly rewrapped\n * `ctx.newDeks`.\n *\n * Single ceremony, one operation:\n *   1. Validate `oldSlot.method === 'password'` and `oldSlot.wrapKind === 'deks'`.\n *   2. Re-mint the wrap-DEKs blob via {@link enrollPasswordAuthenticator}\n *      using the supplied password against `ctx.newDeks`.\n *   3. Return `EnrollAuthenticatorOptions` preserving `oldSlot.id`,\n *      `method: 'password'`, and the strength config (`minLength`,\n *      `pattern`) carried in the old slot's `meta`. Hub validates\n *      `id` + `method` + `wrapKind` to prevent slot-type swap mid-\n *      rotation.\n *\n * Pre-pre.8 wrap-KEK password slots (legacy) cannot be rewrapped via\n * this ceremony — they must be re-enrolled fresh via\n * {@link enrollPasswordAuthenticator}. The validation throws\n * {@link ValidationError} for those.\n *\n * @throws {ValidationError} when `oldSlot.method !== 'password'` or\n *         `oldSlot.wrapKind !== 'deks'`.\n * @throws {PasswordTooWeakError} when the supplied password fails the\n *         strength rules carried in `oldSlot.meta` (minLength, pattern).\n *\n * @see #56 webAuthnSlotRewrapCeremony — the WebAuthn parallel.\n * @see #29 — the slotCeremonies plumbing this fills in.\n */\nexport function passwordSlotRewrapCeremony(password: string): SlotRewrapCeremony {\n  return async (ctx: SlotRewrapContext): Promise<EnrollAuthenticatorOptions> => {\n    if (ctx.oldSlot.method !== 'password') {\n      throw new ValidationError(\n        `passwordSlotRewrapCeremony: oldSlot.method is \"${ctx.oldSlot.method}\"; expected \"password\". ` +\n          'This ceremony only handles password slots — pair other methods with their own helpers.',\n      )\n    }\n    if (ctx.oldSlot.wrapKind !== 'deks') {\n      throw new ValidationError(\n        'passwordSlotRewrapCeremony: oldSlot is a wrap-KEK slot; expected wrap-DEKs. ' +\n          'Password slots use the wrap-DEKs variant since #26 Path C; legacy wrap-KEK ' +\n          'password slots are not supported here — re-enrol via enrollPasswordAuthenticator.',\n      )\n    }\n\n    // Preserve the strength config the slot was originally enrolled with —\n    // a rotation should not silently downgrade minLength or drop a pattern.\n    const oldMeta = ctx.oldSlot.meta as { minLength?: unknown; pattern?: unknown }\n    const minLength = typeof oldMeta.minLength === 'number' ? oldMeta.minLength : undefined\n    const pattern = typeof oldMeta.pattern === 'string' ? new RegExp(oldMeta.pattern) : undefined\n\n    return enrollPasswordAuthenticator(\n      // enrollPasswordAuthenticator only reads `keyring.deks`, so a\n      // synthetic minimal keyring is enough. The freshly-rewrapped DEKs\n      // come from hub via `ctx.newDeks`.\n      { deks: ctx.newDeks } as UnlockedKeyring,\n      {\n        id: ctx.oldSlot.id,\n        password,\n        ...(minLength !== undefined && { minLength }),\n        ...(pattern !== undefined && { pattern }),\n        // Carry the original tier so hub's anti-slot-swap guard plus\n        // the rotate-recover preservation rule keep the slot's\n        // provenance honest.\n        enrolledViaTier: ctx.oldSlot.enrolled_via_tier,\n      },\n    )\n  }\n}\n\n// All wrap-DEKs crypto helpers (PBKDF2 derivation, base64\n// codecs) moved to hub's `team/wrapped-deks.ts` in #44 — both this\n// package and `mintPaperRecoveryEntry` now share one implementation.\n"],"mappings":";AAoCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AAOA,IAAM,6BAA6B;AAGnC,IAAM,8BAA8B;AAIpC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EACP;AAAA,EACT,YAAY,WAAmB,SAAkB;AAC/C;AAAA,MACE,WACE,6BAA6B,OAAO,SAAS,CAAC;AAAA,IAGlD;AACA,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB,YAAY,UAAU,uCAAuC;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA6CA,eAAsB,4BACpB,SACA,SACqC;AACrC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,QAAQ,SAAS,SAAS,WAAW;AACvC,UAAM,IAAI,qBAAqB,SAAS;AAAA,EAC1C;AACA,MAAI,QAAQ,WAAW,CAAC,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,MACA,mDAAmD,QAAQ,QAAQ,SAAS,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,MAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAMA,QAAM,OAAO,MAAM,oBAAoB,QAAQ,MAAM,QAAQ,QAAQ;AAErE,SAAO;AAAA,IACL,IAAI,QAAQ,MAAM;AAAA,IAClB,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,cAAc,KAAK;AAAA,IACnB,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,MACJ,MAAM,KAAK;AAAA,MACX;AAAA,MACA,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IAC7E;AAAA,IACA,mBAAmB,QAAQ,mBAAmB;AAAA,EAChD;AACF;AAWA,eAAsB,uBACpB,MACA,UACiC;AACjC,MAAI,KAAK,aAAa,QAAQ;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,KAAK,SAAS,UAAU;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AACF,WAAO,MAAM;AAAA,MACX,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI,aAAa,KAAK,aAAa;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,qBAAqB;AAAA,EACjC;AACF;AAoCA,eAAsB,mBACpB,MACA,UACA,SAC0B;AAC1B,QAAM,OAAO,MAAM,uBAAuB,MAAM,QAAQ;AAExD,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,QAAQ,OAAO,YAAY,QAAQ,MAAM;AAC7E,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR,4CAA4C,QAAQ,KAAK,aAAa,QAAQ,MAAM;AAAA,IAEtF;AAAA,EACF;AACA,QAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAM,OAAO,IAAI,WAAW,eAAe,KAAK,IAAI,CAAC;AAErD,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,IACxC;AAAA,IACA,GAAI,KAAK,sBAAsB,UAAa,EAAE,kBAAkB,KAAK,kBAAkB;AAAA,IACvF,GAAI,KAAK,sBAAsB,UAAa,EAAE,kBAAkB,KAAK,kBAAkB;AAAA,IACvF,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,IACvD;AAAA;AAAA;AAAA;AAAA,IAIA,KAAK;AAAA,EACP;AACF;AAiEO,SAAS,2BAA2B,UAAsC;AAC/E,SAAO,OAAO,QAAgE;AAC5E,QAAI,IAAI,QAAQ,WAAW,YAAY;AACrC,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,QAAQ,MAAM;AAAA,MAEtE;AAAA,IACF;AACA,QAAI,IAAI,QAAQ,aAAa,QAAQ;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAIA,UAAM,UAAU,IAAI,QAAQ;AAC5B,UAAM,YAAY,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC9E,UAAM,UAAU,OAAO,QAAQ,YAAY,WAAW,IAAI,OAAO,QAAQ,OAAO,IAAI;AAEpF,WAAO;AAAA;AAAA;AAAA;AAAA,MAIL,EAAE,MAAM,IAAI,QAAQ;AAAA,MACpB;AAAA,QACE,IAAI,IAAI,QAAQ;AAAA,QAChB;AAAA,QACA,GAAI,cAAc,UAAa,EAAE,UAAU;AAAA,QAC3C,GAAI,YAAY,UAAa,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIvC,iBAAiB,IAAI,QAAQ;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/on-password** — tier-2 password authenticator slot.\n *\n * The user's tier-1 *phrase* is the rarely-typed master that derives\n * the KEK. This package adds a SEPARATE secret — a password the user\n * types at each unlock — as a tier-2 slot in the multi-slot keyring.\n * The two credentials have:\n *\n * - **Different lifecycles** — the phrase rotates yearly; the password\n *   rotates per the developer's policy.\n * - **Different strength rules** — the phrase is validated against the\n *   phrase format; the password is validated against a\n *   length / regex rule the developer chooses.\n * - **Different storage** — the phrase derives the KEK; the password\n *   derives a wrapping key that wraps the SAME DEK SET in its own\n *   keyring slot (LUKS-like multi-slot, wrap-DEKs variant).\n *\n * ## Wrap-DEKs format (Path C)\n *\n * Slots produced by this package use the wrap-DEKs variant of\n * `KeyringAuthenticator` — they encrypt the serialized DEK set under\n * a password-derived AES-GCM key, NOT the KEK. This unifies tier-2\n * password slots with the tier-0 (paper recovery, `mintPaperRecoveryEntry`)\n * and tier-3 (`@noy-db/on-pin`'s `wrappedKeyring`) primitives — all\n * three sidestep the non-extractable-KEK constraint by wrapping the\n * DEK set rather than the KEK itself.\n *\n * Trade-off: an `UnlockedKeyring` produced via password-slot unlock\n * has `kek: null`. Sensitive operations (`enrollAuthenticator`,\n * `rotatePassphrase`) require a tier-1 unlock anyway — re-enter the\n * master phrase.\n *\n * @see docs/subsystems/session-tiers.md → Tier 2 — `on-password`\n *\n * @packageDocumentation\n */\nimport {\n  base64ToBuffer,\n  mintWrappedDeksBlob,\n  unwrapDeksFromBlob,\n  ValidationError,\n  type EnrollAuthenticatorOptions,\n  type KeyringAuthenticator,\n  type KeyringFile,\n  type NoydbStore,\n  type SlotRewrapCeremony,\n  type SlotRewrapContext,\n  type UnlockedKeyring,\n} from '@noy-db/hub'\n\n/**\n * PBKDF2 iteration count — matches the tier-1 phrase derivation.\n * Exported as a documented invariant; the actual derivation lives\n * in hub's canonical wrap-DEKs primitive.\n */\nexport const PASSWORD_PBKDF2_ITERATIONS = 600_000\n\n/** Default minimum password length. Override per-app via `enrollPasswordAuthenticator`. */\nexport const PASSWORD_DEFAULT_MIN_LENGTH = 12\n\n// ─── Errors ────────────────────────────────────────────────────────────\n\nexport class PasswordTooWeakError extends Error {\n  readonly code = 'PASSWORD_TOO_WEAK' as const\n  readonly minLength: number\n  constructor(minLength: number, message?: string) {\n    super(\n      message ??\n        `Password must be at least ${String(minLength)} characters. ` +\n          'For accounts with a separate tier-1 phrase, prefer a longer password ' +\n          'or pair with TOTP/email-OTP via @noy-db/on-totp or @noy-db/on-email-otp.',\n    )\n    this.name = 'PasswordTooWeakError'\n    this.minLength = minLength\n  }\n}\n\nexport class PasswordInvalidError extends Error {\n  readonly code = 'PASSWORD_INVALID' as const\n  constructor(message = 'Password does not unlock this slot.') {\n    super(message)\n    this.name = 'PasswordInvalidError'\n  }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/** Options for {@link enrollPasswordAuthenticator}. */\nexport interface EnrollPasswordOptions {\n  /** Slot id. Default: `'password'`. */\n  readonly id?: string\n  /** Password the user will type at unlock. Distinct from the tier-1 phrase. */\n  readonly password: string\n  /** Minimum length. Default 12. */\n  readonly minLength?: number\n  /** Optional regex the password must satisfy in addition to length. */\n  readonly pattern?: RegExp\n  /** Tier the active session held when enrolling. Default 1. */\n  readonly enrolledViaTier?: 1 | 2\n}\n\n/**\n * Build the keyring slot for a tier-2 password authenticator. Returns\n * an `EnrollAuthenticatorOptions` value the caller hands to\n * `db.enrollAuthenticator(vault, slot)` — separating the cryptographic\n * step (this function) from the persistence step (the hub) keeps the\n * package small and lets the hub's policy gate run between the two.\n *\n * The slot uses the **wrap-DEKs** variant of `KeyringAuthenticator`:\n * the DEK set is serialized to JSON and encrypted with AES-GCM under\n * a PBKDF2-derived key. No requirement on `keyring.kek` — works with\n * tier-1 unlocked keyrings; throws if `keyring.deks` is empty.\n *\n * Usage:\n *\n * ```ts\n * import { enrollPasswordAuthenticator } from '@noy-db/on-password'\n *\n * const keyring = await db.getKeyring('acme')\n * const slot = await enrollPasswordAuthenticator(keyring, {\n *   password: 'strong-password-2026',\n *   minLength: 14,\n * })\n * await db.enrollAuthenticator('acme', slot, {\n *   factors: [{ kind: 'totp' }],\n * })\n * ```\n */\nexport async function enrollPasswordAuthenticator(\n  keyring: UnlockedKeyring,\n  options: EnrollPasswordOptions,\n): Promise<EnrollAuthenticatorOptions> {\n  const minLength = options.minLength ?? PASSWORD_DEFAULT_MIN_LENGTH\n  if (options.password.length < minLength) {\n    throw new PasswordTooWeakError(minLength)\n  }\n  if (options.pattern && !options.pattern.test(options.password)) {\n    throw new PasswordTooWeakError(\n      minLength,\n      `Password does not match the configured pattern: ${options.pattern.toString()}.`,\n    )\n  }\n\n  if (keyring.deks.size === 0) {\n    throw new Error(\n      'enrollPasswordAuthenticator: the supplied keyring has no DEKs in memory. ' +\n        'Re-authenticate at tier 1 first.',\n    )\n  }\n\n  // Delegate the wrap-DEKs crypto to the canonical hub primitive.\n  // The slot envelope still stores `salt` inside `meta` for backward\n  // compatibility with the legacy slot format; moving it to top-level\n  // for parity with PaperRecoveryEntry is deferred.\n  const blob = await mintWrappedDeksBlob(keyring.deks, options.password)\n\n  return {\n    id: options.id ?? 'password',\n    method: 'password',\n    wrapKind: 'deks',\n    wrapped_deks: blob.wrappedDeks,\n    iv: blob.iv,\n    meta: {\n      salt: blob.salt,\n      minLength,\n      ...(options.pattern !== undefined ? { pattern: options.pattern.source } : {}),\n    },\n    enrolled_via_tier: options.enrolledViaTier ?? 1,\n  }\n}\n\n/**\n * Recover the DEK set from a wrap-DEKs password slot. Returns the raw\n * DEK map; the hub-friendly verifier {@link verifyPasswordSlot} wraps\n * this and produces a full `UnlockedKeyring`.\n *\n * @throws {@link PasswordInvalidError} when the password is wrong or\n *   the slot is not a wrap-DEKs slot (e.g. a legacy wrap-KEK password\n *   legacy wrap-KEK slots — those need re-enrollment).\n */\nexport async function unwrapDeksWithPassword(\n  slot: KeyringAuthenticator,\n  password: string,\n): Promise<Map<string, CryptoKey>> {\n  if (slot.wrapKind !== 'deks') {\n    throw new PasswordInvalidError(\n      'Password slot is not a wrap-DEKs slot. Pre-pre.8 wrap-KEK password ' +\n        'slots are no longer supported — re-enrol via enrollPasswordAuthenticator.',\n    )\n  }\n\n  const meta = slot.meta as { salt?: unknown }\n  if (typeof meta.salt !== 'string') {\n    throw new PasswordInvalidError(\n      'Password slot is missing the per-slot salt — keyring may be corrupted.',\n    )\n  }\n\n  // Delegate to the canonical wrap-DEKs primitive. The blob's\n  // three fields (salt / iv / wrappedDeks) are reconstructed from\n  // the slot's split layout: salt lives in meta, iv + wrappedDeks\n  // at top level. Previously, this code re-implemented the same crypto\n  // inline.\n  try {\n    return await unwrapDeksFromBlob(\n      { salt: meta.salt, iv: slot.iv, wrappedDeks: slot.wrapped_deks },\n      password,\n    )\n  } catch {\n    throw new PasswordInvalidError()\n  }\n}\n\n/**\n * Hub-friendly verify callback. Pass to `db.unlockViaAuthenticator`:\n *\n * ```ts\n * import { verifyPasswordSlot } from '@noy-db/on-password'\n *\n * const unlocked = await db.unlockViaAuthenticator('acme', 'password',\n *   (slot) => verifyPasswordSlot(slot, 'strong-password-2026',\n *     { store, vault: 'acme', userId: 'alice' }),\n * )\n * ```\n *\n * Unwraps the DEK set with the supplied password and returns an\n * `UnlockedKeyring` the hub installs in its keyring cache. The\n * returned keyring has `kek: null` — sensitive operations (enrol new\n * slot, rotate phrase) require a tier-1 unlock from the master phrase.\n *\n * The `{ store, vault, userId }` shape works in both contexts:\n *   - **Warm re-unlock** — db is alive; consumer already has identity\n *     in memory but pays one cheap `_keyring/<userId>` read.\n *   - **Cold-start** (`createNoydb({ getKeyring: ... })`) — consumer\n *     does NOT have a keyring yet; the verifier loads identity from\n *     disk before returning the unlocked keyring. This is the\n *     primary cold-start tier-2 path (Niwat tier-2b uses this).\n *\n * Identity fields (userId, displayName, role, permissions,\n * authenticators, salt, capability bits, per-keyring policy) are read\n * directly from the `_keyring/<userId>` envelope's plaintext header —\n * those fields are not encrypted because the sync engine + grant flow\n * need them without a key.\n *\n * @throws {@link PasswordInvalidError} when the password is wrong or\n *   the keyring file is missing.\n */\nexport async function verifyPasswordSlot(\n  slot: KeyringAuthenticator,\n  password: string,\n  options: VerifyPasswordSlotOptions,\n): Promise<UnlockedKeyring> {\n  const deks = await unwrapDeksWithPassword(slot, password)\n\n  const env = await options.store.get(options.vault, '_keyring', options.userId)\n  if (!env) {\n    throw new PasswordInvalidError(\n      `verifyPasswordSlot: no keyring found at \"${options.vault}/_keyring/${options.userId}\". ` +\n        'Verify the vault and userId are correct.',\n    )\n  }\n  const file = JSON.parse(env._data) as KeyringFile\n  const salt = new Uint8Array(base64ToBuffer(file.salt))\n\n  return {\n    userId: file.user_id,\n    displayName: file.display_name,\n    role: file.role,\n    permissions: file.permissions,\n    authenticators: file.authenticators ?? [],\n    salt,\n    ...(file.export_capability !== undefined && { exportCapability: file.export_capability }),\n    ...(file.import_capability !== undefined && { importCapability: file.import_capability }),\n    ...(file.policy !== undefined && { policy: file.policy }),\n    deks,\n    // Wrap-DEKs unlock cannot recover the KEK. Sensitive ops route\n    // through tier-1 via re-entry of the master phrase. Matches the\n    // existing tier-3 (`@noy-db/on-pin`) pattern.\n    kek: null,\n  }\n}\n\n/** Adapter shape required by {@link verifyPasswordSlot}. */\nexport interface VerifyPasswordSlotOptions {\n  /** The vault's NoydbStore — used to load `_keyring/<userId>`. */\n  readonly store: NoydbStore\n  /** Vault name — same value passed to `db.openVault(name)`. */\n  readonly vault: string\n  /** User id — same value passed to `createNoydb({ user })`. */\n  readonly userId: string\n}\n\n/**\n * `SlotRewrapCeremony` factory for password slots — the password parallel\n * to `webAuthnSlotRewrapCeremony`. Used by hub's\n * `rotatePassphrase({ slotCeremonies: { [slotId]: passwordSlotRewrapCeremony(pwd) } })`\n * to preserve a tier-2 password enrollment across a tier-1 phrase\n * rotation without forcing the user to re-enroll the password.\n *\n * Returns a closure capturing the password so the result matches\n * hub's `SlotRewrapCeremony` signature `(ctx) => Promise<EnrollAuthenticatorOptions>`\n * directly. Pass into `slotCeremonies` keyed by the existing slot id:\n *\n * ```ts\n * import { passwordSlotRewrapCeremony } from '@noy-db/on-password'\n *\n * await db.rotatePassphrase('acme', {\n *   oldPassphrase: oldPhrase,\n *   newPassphrase: newPhrase,\n *   slotCeremonies: {\n *     'password': passwordSlotRewrapCeremony('strong-password-2026'),\n *   },\n * })\n * ```\n *\n * The password itself is unaffected by phrase rotation — what needs to\n * change is the **wrapped DEK set**: the encrypted blob the slot's\n * `wrapped_deks` field holds. After rotation, the old blob still has\n * the old DEKs (now stale because rotatePassphrase rewrapped them\n * under a fresh KEK); the new blob must hold the freshly rewrapped\n * `ctx.newDeks`.\n *\n * Single ceremony, one operation:\n *   1. Validate `oldSlot.method === 'password'` and `oldSlot.wrapKind === 'deks'`.\n *   2. Re-mint the wrap-DEKs blob via {@link enrollPasswordAuthenticator}\n *      using the supplied password against `ctx.newDeks`.\n *   3. Return `EnrollAuthenticatorOptions` preserving `oldSlot.id`,\n *      `method: 'password'`, and the strength config (`minLength`,\n *      `pattern`) carried in the old slot's `meta`. Hub validates\n *      `id` + `method` + `wrapKind` to prevent slot-type swap mid-\n *      rotation.\n *\n * Legacy wrap-KEK password slots cannot be rewrapped via\n * this ceremony — they must be re-enrolled fresh via\n * {@link enrollPasswordAuthenticator}. The validation throws\n * {@link ValidationError} for those.\n *\n * @throws {ValidationError} when `oldSlot.method !== 'password'` or\n *         `oldSlot.wrapKind !== 'deks'`.\n * @throws {PasswordTooWeakError} when the supplied password fails the\n *         strength rules carried in `oldSlot.meta` (minLength, pattern).\n *\n * @see webAuthnSlotRewrapCeremony — the WebAuthn parallel.\n */\nexport function passwordSlotRewrapCeremony(password: string): SlotRewrapCeremony {\n  return async (ctx: SlotRewrapContext): Promise<EnrollAuthenticatorOptions> => {\n    if (ctx.oldSlot.method !== 'password') {\n      throw new ValidationError(\n        `passwordSlotRewrapCeremony: oldSlot.method is \"${ctx.oldSlot.method}\"; expected \"password\". ` +\n          'This ceremony only handles password slots — pair other methods with their own helpers.',\n      )\n    }\n    if (ctx.oldSlot.wrapKind !== 'deks') {\n      throw new ValidationError(\n        'passwordSlotRewrapCeremony: oldSlot is a wrap-KEK slot; expected wrap-DEKs. ' +\n          'Password slots use the wrap-DEKs variant since #26 Path C; legacy wrap-KEK ' +\n          'password slots are not supported here — re-enrol via enrollPasswordAuthenticator.',\n      )\n    }\n\n    // Preserve the strength config the slot was originally enrolled with —\n    // a rotation should not silently downgrade minLength or drop a pattern.\n    const oldMeta = ctx.oldSlot.meta as { minLength?: unknown; pattern?: unknown }\n    const minLength = typeof oldMeta.minLength === 'number' ? oldMeta.minLength : undefined\n    const pattern = typeof oldMeta.pattern === 'string' ? new RegExp(oldMeta.pattern) : undefined\n\n    return enrollPasswordAuthenticator(\n      // enrollPasswordAuthenticator only reads `keyring.deks`, so a\n      // synthetic minimal keyring is enough. The freshly-rewrapped DEKs\n      // come from hub via `ctx.newDeks`.\n      { deks: ctx.newDeks } as UnlockedKeyring,\n      {\n        id: ctx.oldSlot.id,\n        password,\n        ...(minLength !== undefined && { minLength }),\n        ...(pattern !== undefined && { pattern }),\n        // Carry the original tier so hub's anti-slot-swap guard plus\n        // the rotate-recover preservation rule keep the slot's\n        // provenance honest.\n        enrolledViaTier: ctx.oldSlot.enrolled_via_tier,\n      },\n    )\n  }\n}\n\n// All wrap-DEKs crypto helpers (PBKDF2 derivation, base64\n// codecs) live in hub's `team/wrapped-deks.ts` — both this\n// package and `mintPaperRecoveryEntry` share one implementation.\n"],"mappings":";AAoCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AAOA,IAAM,6BAA6B;AAGnC,IAAM,8BAA8B;AAIpC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EACP;AAAA,EACT,YAAY,WAAmB,SAAkB;AAC/C;AAAA,MACE,WACE,6BAA6B,OAAO,SAAS,CAAC;AAAA,IAGlD;AACA,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB,YAAY,UAAU,uCAAuC;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA6CA,eAAsB,4BACpB,SACA,SACqC;AACrC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,QAAQ,SAAS,SAAS,WAAW;AACvC,UAAM,IAAI,qBAAqB,SAAS;AAAA,EAC1C;AACA,MAAI,QAAQ,WAAW,CAAC,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,MACA,mDAAmD,QAAQ,QAAQ,SAAS,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,MAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAMA,QAAM,OAAO,MAAM,oBAAoB,QAAQ,MAAM,QAAQ,QAAQ;AAErE,SAAO;AAAA,IACL,IAAI,QAAQ,MAAM;AAAA,IAClB,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,cAAc,KAAK;AAAA,IACnB,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,MACJ,MAAM,KAAK;AAAA,MACX;AAAA,MACA,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IAC7E;AAAA,IACA,mBAAmB,QAAQ,mBAAmB;AAAA,EAChD;AACF;AAWA,eAAsB,uBACpB,MACA,UACiC;AACjC,MAAI,KAAK,aAAa,QAAQ;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,KAAK,SAAS,UAAU;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AACF,WAAO,MAAM;AAAA,MACX,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI,aAAa,KAAK,aAAa;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,qBAAqB;AAAA,EACjC;AACF;AAoCA,eAAsB,mBACpB,MACA,UACA,SAC0B;AAC1B,QAAM,OAAO,MAAM,uBAAuB,MAAM,QAAQ;AAExD,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,QAAQ,OAAO,YAAY,QAAQ,MAAM;AAC7E,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR,4CAA4C,QAAQ,KAAK,aAAa,QAAQ,MAAM;AAAA,IAEtF;AAAA,EACF;AACA,QAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAM,OAAO,IAAI,WAAW,eAAe,KAAK,IAAI,CAAC;AAErD,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,IACxC;AAAA,IACA,GAAI,KAAK,sBAAsB,UAAa,EAAE,kBAAkB,KAAK,kBAAkB;AAAA,IACvF,GAAI,KAAK,sBAAsB,UAAa,EAAE,kBAAkB,KAAK,kBAAkB;AAAA,IACvF,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,IACvD;AAAA;AAAA;AAAA;AAAA,IAIA,KAAK;AAAA,EACP;AACF;AAgEO,SAAS,2BAA2B,UAAsC;AAC/E,SAAO,OAAO,QAAgE;AAC5E,QAAI,IAAI,QAAQ,WAAW,YAAY;AACrC,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,QAAQ,MAAM;AAAA,MAEtE;AAAA,IACF;AACA,QAAI,IAAI,QAAQ,aAAa,QAAQ;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAIA,UAAM,UAAU,IAAI,QAAQ;AAC5B,UAAM,YAAY,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC9E,UAAM,UAAU,OAAO,QAAQ,YAAY,WAAW,IAAI,OAAO,QAAQ,OAAO,IAAI;AAEpF,WAAO;AAAA;AAAA;AAAA;AAAA,MAIL,EAAE,MAAM,IAAI,QAAQ;AAAA,MACpB;AAAA,QACE,IAAI,IAAI,QAAQ;AAAA,QAChB;AAAA,QACA,GAAI,cAAc,UAAa,EAAE,UAAU;AAAA,QAC3C,GAAI,YAAY,UAAa,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIvC,iBAAiB,IAAI,QAAQ;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/on-password",
-  "version": "0.2.0-pre.3",
+  "version": "0.2.0-pre.31",
   "description": "Tier-2 password authenticator slot for noy-db. PBKDF2-SHA256 600K wraps the DEK set in its own keyring slot, distinct from the rarely-typed tier-1 phrase. Pair with @noy-db/on-email-otp or @noy-db/on-totp for the SaaS UX.",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -17,17 +17,10 @@
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "require": {
-        "types": "./dist/index.d.cts",
-        "default": "./dist/index.cjs"
-      }
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
-  "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -36,13 +29,13 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "peerDependencies": {
-    "@noy-db/hub": "0.2.0-pre.3"
+    "@noy-db/hub": "0.2.0-pre.31"
   },
   "devDependencies": {
-    "@noy-db/hub": "0.2.0-pre.3"
+    "@noy-db/hub": "0.2.0-pre.31"
   },
   "keywords": [
     "noy-db",

package/dist/index.cjs

@@ -1,177 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  PASSWORD_DEFAULT_MIN_LENGTH: () => PASSWORD_DEFAULT_MIN_LENGTH,
-  PASSWORD_PBKDF2_ITERATIONS: () => PASSWORD_PBKDF2_ITERATIONS,
-  PasswordInvalidError: () => PasswordInvalidError,
-  PasswordTooWeakError: () => PasswordTooWeakError,
-  enrollPasswordAuthenticator: () => enrollPasswordAuthenticator,
-  passwordSlotRewrapCeremony: () => passwordSlotRewrapCeremony,
-  unwrapDeksWithPassword: () => unwrapDeksWithPassword,
-  verifyPasswordSlot: () => verifyPasswordSlot
-});
-module.exports = __toCommonJS(index_exports);
-var import_hub = require("@noy-db/hub");
-var PASSWORD_PBKDF2_ITERATIONS = 6e5;
-var PASSWORD_DEFAULT_MIN_LENGTH = 12;
-var PasswordTooWeakError = class extends Error {
-  code = "PASSWORD_TOO_WEAK";
-  minLength;
-  constructor(minLength, message) {
-    super(
-      message ?? `Password must be at least ${String(minLength)} characters. For accounts with a separate tier-1 phrase, prefer a longer password or pair with TOTP/email-OTP via @noy-db/on-totp or @noy-db/on-email-otp.`
-    );
-    this.name = "PasswordTooWeakError";
-    this.minLength = minLength;
-  }
-};
-var PasswordInvalidError = class extends Error {
-  code = "PASSWORD_INVALID";
-  constructor(message = "Password does not unlock this slot.") {
-    super(message);
-    this.name = "PasswordInvalidError";
-  }
-};
-async function enrollPasswordAuthenticator(keyring, options) {
-  const minLength = options.minLength ?? PASSWORD_DEFAULT_MIN_LENGTH;
-  if (options.password.length < minLength) {
-    throw new PasswordTooWeakError(minLength);
-  }
-  if (options.pattern && !options.pattern.test(options.password)) {
-    throw new PasswordTooWeakError(
-      minLength,
-      `Password does not match the configured pattern: ${options.pattern.toString()}.`
-    );
-  }
-  if (keyring.deks.size === 0) {
-    throw new Error(
-      "enrollPasswordAuthenticator: the supplied keyring has no DEKs in memory. Re-authenticate at tier 1 first."
-    );
-  }
-  const blob = await (0, import_hub.mintWrappedDeksBlob)(keyring.deks, options.password);
-  return {
-    id: options.id ?? "password",
-    method: "password",
-    wrapKind: "deks",
-    wrapped_deks: blob.wrappedDeks,
-    iv: blob.iv,
-    meta: {
-      salt: blob.salt,
-      minLength,
-      ...options.pattern !== void 0 ? { pattern: options.pattern.source } : {}
-    },
-    enrolled_via_tier: options.enrolledViaTier ?? 1
-  };
-}
-async function unwrapDeksWithPassword(slot, password) {
-  if (slot.wrapKind !== "deks") {
-    throw new PasswordInvalidError(
-      "Password slot is not a wrap-DEKs slot. Pre-pre.8 wrap-KEK password slots are no longer supported \u2014 re-enrol via enrollPasswordAuthenticator."
-    );
-  }
-  const meta = slot.meta;
-  if (typeof meta.salt !== "string") {
-    throw new PasswordInvalidError(
-      "Password slot is missing the per-slot salt \u2014 keyring may be corrupted."
-    );
-  }
-  try {
-    return await (0, import_hub.unwrapDeksFromBlob)(
-      { salt: meta.salt, iv: slot.iv, wrappedDeks: slot.wrapped_deks },
-      password
-    );
-  } catch {
-    throw new PasswordInvalidError();
-  }
-}
-async function verifyPasswordSlot(slot, password, options) {
-  const deks = await unwrapDeksWithPassword(slot, password);
-  const env = await options.store.get(options.vault, "_keyring", options.userId);
-  if (!env) {
-    throw new PasswordInvalidError(
-      `verifyPasswordSlot: no keyring found at "${options.vault}/_keyring/${options.userId}". Verify the vault and userId are correct.`
-    );
-  }
-  const file = JSON.parse(env._data);
-  const salt = new Uint8Array((0, import_hub.base64ToBuffer)(file.salt));
-  return {
-    userId: file.user_id,
-    displayName: file.display_name,
-    role: file.role,
-    permissions: file.permissions,
-    authenticators: file.authenticators ?? [],
-    salt,
-    ...file.export_capability !== void 0 && { exportCapability: file.export_capability },
-    ...file.import_capability !== void 0 && { importCapability: file.import_capability },
-    ...file.policy !== void 0 && { policy: file.policy },
-    deks,
-    // Wrap-DEKs unlock cannot recover the KEK. Sensitive ops route
-    // through tier-1 via re-entry of the master phrase. Matches the
-    // existing tier-3 (`@noy-db/on-pin`) pattern.
-    kek: null
-  };
-}
-function passwordSlotRewrapCeremony(password) {
-  return async (ctx) => {
-    if (ctx.oldSlot.method !== "password") {
-      throw new import_hub.ValidationError(
-        `passwordSlotRewrapCeremony: oldSlot.method is "${ctx.oldSlot.method}"; expected "password". This ceremony only handles password slots \u2014 pair other methods with their own helpers.`
-      );
-    }
-    if (ctx.oldSlot.wrapKind !== "deks") {
-      throw new import_hub.ValidationError(
-        "passwordSlotRewrapCeremony: oldSlot is a wrap-KEK slot; expected wrap-DEKs. Password slots use the wrap-DEKs variant since #26 Path C; legacy wrap-KEK password slots are not supported here \u2014 re-enrol via enrollPasswordAuthenticator."
-      );
-    }
-    const oldMeta = ctx.oldSlot.meta;
-    const minLength = typeof oldMeta.minLength === "number" ? oldMeta.minLength : void 0;
-    const pattern = typeof oldMeta.pattern === "string" ? new RegExp(oldMeta.pattern) : void 0;
-    return enrollPasswordAuthenticator(
-      // enrollPasswordAuthenticator only reads `keyring.deks`, so a
-      // synthetic minimal keyring is enough. The freshly-rewrapped DEKs
-      // come from hub via `ctx.newDeks`.
-      { deks: ctx.newDeks },
-      {
-        id: ctx.oldSlot.id,
-        password,
-        ...minLength !== void 0 && { minLength },
-        ...pattern !== void 0 && { pattern },
-        // Carry the original tier so hub's anti-slot-swap guard plus
-        // the rotate-recover preservation rule keep the slot's
-        // provenance honest.
-        enrolledViaTier: ctx.oldSlot.enrolled_via_tier
-      }
-    );
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  PASSWORD_DEFAULT_MIN_LENGTH,
-  PASSWORD_PBKDF2_ITERATIONS,
-  PasswordInvalidError,
-  PasswordTooWeakError,
-  enrollPasswordAuthenticator,
-  passwordSlotRewrapCeremony,
-  unwrapDeksWithPassword,
-  verifyPasswordSlot
-});
-//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/on-password** — tier-2 password authenticator slot.\n *\n * The user's tier-1 *phrase* is the rarely-typed master that derives\n * the KEK. This package adds a SEPARATE secret — a password the user\n * types at each unlock — as a tier-2 slot in the multi-slot keyring.\n * The two credentials have:\n *\n * - **Different lifecycles** — the phrase rotates yearly; the password\n *   rotates per the developer's policy.\n * - **Different strength rules** — the phrase is validated against the\n *   phrase format (issue #7); the password is validated against a\n *   length / regex rule the developer chooses.\n * - **Different storage** — the phrase derives the KEK; the password\n *   derives a wrapping key that wraps the SAME DEK SET in its own\n *   keyring slot (LUKS-like multi-slot, wrap-DEKs variant).\n *\n * ## Wrap-DEKs format (#26 Path C)\n *\n * Slots produced by this package use the wrap-DEKs variant of\n * `KeyringAuthenticator` — they encrypt the serialized DEK set under\n * a password-derived AES-GCM key, NOT the KEK. This unifies tier-2\n * password slots with the tier-0 (paper recovery, `mintPaperRecoveryEntry`)\n * and tier-3 (`@noy-db/on-pin`'s `wrappedKeyring`) primitives — all\n * three sidestep the non-extractable-KEK constraint by wrapping the\n * DEK set rather than the KEK itself.\n *\n * Trade-off: an `UnlockedKeyring` produced via password-slot unlock\n * has `kek: null`. Sensitive operations (`enrollAuthenticator`,\n * `rotatePassphrase`) require a tier-1 unlock anyway — re-enter the\n * master phrase.\n *\n * @see docs/subsystems/session-tiers.md → Tier 2 — `on-password`\n *\n * @packageDocumentation\n */\nimport {\n  base64ToBuffer,\n  mintWrappedDeksBlob,\n  unwrapDeksFromBlob,\n  ValidationError,\n  type EnrollAuthenticatorOptions,\n  type KeyringAuthenticator,\n  type KeyringFile,\n  type NoydbStore,\n  type SlotRewrapCeremony,\n  type SlotRewrapContext,\n  type UnlockedKeyring,\n} from '@noy-db/hub'\n\n/**\n * PBKDF2 iteration count — matches the tier-1 phrase derivation.\n * Exported as a documented invariant; the actual derivation lives\n * in hub's canonical wrap-DEKs primitive (#44).\n */\nexport const PASSWORD_PBKDF2_ITERATIONS = 600_000\n\n/** Default minimum password length. Override per-app via `enrollPasswordAuthenticator`. */\nexport const PASSWORD_DEFAULT_MIN_LENGTH = 12\n\n// ─── Errors ────────────────────────────────────────────────────────────\n\nexport class PasswordTooWeakError extends Error {\n  readonly code = 'PASSWORD_TOO_WEAK' as const\n  readonly minLength: number\n  constructor(minLength: number, message?: string) {\n    super(\n      message ??\n        `Password must be at least ${String(minLength)} characters. ` +\n          'For accounts with a separate tier-1 phrase, prefer a longer password ' +\n          'or pair with TOTP/email-OTP via @noy-db/on-totp or @noy-db/on-email-otp.',\n    )\n    this.name = 'PasswordTooWeakError'\n    this.minLength = minLength\n  }\n}\n\nexport class PasswordInvalidError extends Error {\n  readonly code = 'PASSWORD_INVALID' as const\n  constructor(message = 'Password does not unlock this slot.') {\n    super(message)\n    this.name = 'PasswordInvalidError'\n  }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/** Options for {@link enrollPasswordAuthenticator}. */\nexport interface EnrollPasswordOptions {\n  /** Slot id. Default: `'password'`. */\n  readonly id?: string\n  /** Password the user will type at unlock. Distinct from the tier-1 phrase. */\n  readonly password: string\n  /** Minimum length. Default 12. */\n  readonly minLength?: number\n  /** Optional regex the password must satisfy in addition to length. */\n  readonly pattern?: RegExp\n  /** Tier the active session held when enrolling. Default 1. */\n  readonly enrolledViaTier?: 1 | 2\n}\n\n/**\n * Build the keyring slot for a tier-2 password authenticator. Returns\n * an `EnrollAuthenticatorOptions` value the caller hands to\n * `db.enrollAuthenticator(vault, slot)` — separating the cryptographic\n * step (this function) from the persistence step (the hub) keeps the\n * package small and lets the hub's policy gate run between the two.\n *\n * The slot uses the **wrap-DEKs** variant of `KeyringAuthenticator`:\n * the DEK set is serialized to JSON and encrypted with AES-GCM under\n * a PBKDF2-derived key. No requirement on `keyring.kek` — works with\n * tier-1 unlocked keyrings; throws if `keyring.deks` is empty.\n *\n * Usage:\n *\n * ```ts\n * import { enrollPasswordAuthenticator } from '@noy-db/on-password'\n *\n * const keyring = await db.getKeyring('acme')\n * const slot = await enrollPasswordAuthenticator(keyring, {\n *   password: 'strong-password-2026',\n *   minLength: 14,\n * })\n * await db.enrollAuthenticator('acme', slot, {\n *   factors: [{ kind: 'totp' }],\n * })\n * ```\n */\nexport async function enrollPasswordAuthenticator(\n  keyring: UnlockedKeyring,\n  options: EnrollPasswordOptions,\n): Promise<EnrollAuthenticatorOptions> {\n  const minLength = options.minLength ?? PASSWORD_DEFAULT_MIN_LENGTH\n  if (options.password.length < minLength) {\n    throw new PasswordTooWeakError(minLength)\n  }\n  if (options.pattern && !options.pattern.test(options.password)) {\n    throw new PasswordTooWeakError(\n      minLength,\n      `Password does not match the configured pattern: ${options.pattern.toString()}.`,\n    )\n  }\n\n  if (keyring.deks.size === 0) {\n    throw new Error(\n      'enrollPasswordAuthenticator: the supplied keyring has no DEKs in memory. ' +\n        'Re-authenticate at tier 1 first.',\n    )\n  }\n\n  // Delegate the wrap-DEKs crypto to the canonical hub primitive (#44).\n  // The slot envelope still stores `salt` inside `meta` for backward\n  // compatibility with the pre-#44 slot format; the issue defers\n  // moving it to top-level for parity with PaperRecoveryEntry.\n  const blob = await mintWrappedDeksBlob(keyring.deks, options.password)\n\n  return {\n    id: options.id ?? 'password',\n    method: 'password',\n    wrapKind: 'deks',\n    wrapped_deks: blob.wrappedDeks,\n    iv: blob.iv,\n    meta: {\n      salt: blob.salt,\n      minLength,\n      ...(options.pattern !== undefined ? { pattern: options.pattern.source } : {}),\n    },\n    enrolled_via_tier: options.enrolledViaTier ?? 1,\n  }\n}\n\n/**\n * Recover the DEK set from a wrap-DEKs password slot. Returns the raw\n * DEK map; the hub-friendly verifier {@link verifyPasswordSlot} wraps\n * this and produces a full `UnlockedKeyring`.\n *\n * @throws {@link PasswordInvalidError} when the password is wrong or\n *   the slot is not a wrap-DEKs slot (e.g. a legacy wrap-KEK password\n *   slot from before pre.8 — those need re-enrollment).\n */\nexport async function unwrapDeksWithPassword(\n  slot: KeyringAuthenticator,\n  password: string,\n): Promise<Map<string, CryptoKey>> {\n  if (slot.wrapKind !== 'deks') {\n    throw new PasswordInvalidError(\n      'Password slot is not a wrap-DEKs slot. Pre-pre.8 wrap-KEK password ' +\n        'slots are no longer supported — re-enrol via enrollPasswordAuthenticator.',\n    )\n  }\n\n  const meta = slot.meta as { salt?: unknown }\n  if (typeof meta.salt !== 'string') {\n    throw new PasswordInvalidError(\n      'Password slot is missing the per-slot salt — keyring may be corrupted.',\n    )\n  }\n\n  // Delegate to the canonical wrap-DEKs primitive (#44). The blob's\n  // three fields (salt / iv / wrappedDeks) are reconstructed from\n  // the slot's split layout: salt lives in meta, iv + wrappedDeks\n  // at top level. Pre-#44, this code re-implemented the same crypto\n  // inline.\n  try {\n    return await unwrapDeksFromBlob(\n      { salt: meta.salt, iv: slot.iv, wrappedDeks: slot.wrapped_deks },\n      password,\n    )\n  } catch {\n    throw new PasswordInvalidError()\n  }\n}\n\n/**\n * Hub-friendly verify callback. Pass to `db.unlockViaAuthenticator`:\n *\n * ```ts\n * import { verifyPasswordSlot } from '@noy-db/on-password'\n *\n * const unlocked = await db.unlockViaAuthenticator('acme', 'password',\n *   (slot) => verifyPasswordSlot(slot, 'strong-password-2026',\n *     { store, vault: 'acme', userId: 'alice' }),\n * )\n * ```\n *\n * Unwraps the DEK set with the supplied password and returns an\n * `UnlockedKeyring` the hub installs in its keyring cache. The\n * returned keyring has `kek: null` — sensitive operations (enrol new\n * slot, rotate phrase) require a tier-1 unlock from the master phrase.\n *\n * The `{ store, vault, userId }` shape works in both contexts:\n *   - **Warm re-unlock** — db is alive; consumer already has identity\n *     in memory but pays one cheap `_keyring/<userId>` read.\n *   - **Cold-start** (`createNoydb({ getKeyring: ... })`) — consumer\n *     does NOT have a keyring yet; the verifier loads identity from\n *     disk before returning the unlocked keyring. This is the\n *     primary cold-start tier-2 path (Niwat tier-2b uses this).\n *\n * Identity fields (userId, displayName, role, permissions,\n * authenticators, salt, capability bits, per-keyring policy) are read\n * directly from the `_keyring/<userId>` envelope's plaintext header —\n * those fields are not encrypted because the sync engine + grant flow\n * need them without a key.\n *\n * @throws {@link PasswordInvalidError} when the password is wrong or\n *   the keyring file is missing.\n */\nexport async function verifyPasswordSlot(\n  slot: KeyringAuthenticator,\n  password: string,\n  options: VerifyPasswordSlotOptions,\n): Promise<UnlockedKeyring> {\n  const deks = await unwrapDeksWithPassword(slot, password)\n\n  const env = await options.store.get(options.vault, '_keyring', options.userId)\n  if (!env) {\n    throw new PasswordInvalidError(\n      `verifyPasswordSlot: no keyring found at \"${options.vault}/_keyring/${options.userId}\". ` +\n        'Verify the vault and userId are correct.',\n    )\n  }\n  const file = JSON.parse(env._data) as KeyringFile\n  const salt = new Uint8Array(base64ToBuffer(file.salt))\n\n  return {\n    userId: file.user_id,\n    displayName: file.display_name,\n    role: file.role,\n    permissions: file.permissions,\n    authenticators: file.authenticators ?? [],\n    salt,\n    ...(file.export_capability !== undefined && { exportCapability: file.export_capability }),\n    ...(file.import_capability !== undefined && { importCapability: file.import_capability }),\n    ...(file.policy !== undefined && { policy: file.policy }),\n    deks,\n    // Wrap-DEKs unlock cannot recover the KEK. Sensitive ops route\n    // through tier-1 via re-entry of the master phrase. Matches the\n    // existing tier-3 (`@noy-db/on-pin`) pattern.\n    kek: null,\n  }\n}\n\n/** Adapter shape required by {@link verifyPasswordSlot}. */\nexport interface VerifyPasswordSlotOptions {\n  /** The vault's NoydbStore — used to load `_keyring/<userId>`. */\n  readonly store: NoydbStore\n  /** Vault name — same value passed to `db.openVault(name)`. */\n  readonly vault: string\n  /** User id — same value passed to `createNoydb({ user })`. */\n  readonly userId: string\n}\n\n/**\n * `SlotRewrapCeremony` factory for password slots — the password parallel\n * to `webAuthnSlotRewrapCeremony` (#56). Used by hub's\n * `rotatePassphrase({ slotCeremonies: { [slotId]: passwordSlotRewrapCeremony(pwd) } })`\n * to preserve a tier-2 password enrollment across a tier-1 phrase\n * rotation without forcing the user to re-enroll the password (#96).\n *\n * Returns a closure capturing the password so the result matches\n * hub's `SlotRewrapCeremony` signature `(ctx) => Promise<EnrollAuthenticatorOptions>`\n * directly. Pass into `slotCeremonies` keyed by the existing slot id:\n *\n * ```ts\n * import { passwordSlotRewrapCeremony } from '@noy-db/on-password'\n *\n * await db.rotatePassphrase('acme', {\n *   oldPassphrase: oldPhrase,\n *   newPassphrase: newPhrase,\n *   slotCeremonies: {\n *     'password': passwordSlotRewrapCeremony('strong-password-2026'),\n *   },\n * })\n * ```\n *\n * The password itself is unaffected by phrase rotation — what needs to\n * change is the **wrapped DEK set**: the encrypted blob the slot's\n * `wrapped_deks` field holds. After rotation, the old blob still has\n * the old DEKs (now stale because rotatePassphrase rewrapped them\n * under a fresh KEK); the new blob must hold the freshly rewrapped\n * `ctx.newDeks`.\n *\n * Single ceremony, one operation:\n *   1. Validate `oldSlot.method === 'password'` and `oldSlot.wrapKind === 'deks'`.\n *   2. Re-mint the wrap-DEKs blob via {@link enrollPasswordAuthenticator}\n *      using the supplied password against `ctx.newDeks`.\n *   3. Return `EnrollAuthenticatorOptions` preserving `oldSlot.id`,\n *      `method: 'password'`, and the strength config (`minLength`,\n *      `pattern`) carried in the old slot's `meta`. Hub validates\n *      `id` + `method` + `wrapKind` to prevent slot-type swap mid-\n *      rotation.\n *\n * Pre-pre.8 wrap-KEK password slots (legacy) cannot be rewrapped via\n * this ceremony — they must be re-enrolled fresh via\n * {@link enrollPasswordAuthenticator}. The validation throws\n * {@link ValidationError} for those.\n *\n * @throws {ValidationError} when `oldSlot.method !== 'password'` or\n *         `oldSlot.wrapKind !== 'deks'`.\n * @throws {PasswordTooWeakError} when the supplied password fails the\n *         strength rules carried in `oldSlot.meta` (minLength, pattern).\n *\n * @see #56 webAuthnSlotRewrapCeremony — the WebAuthn parallel.\n * @see #29 — the slotCeremonies plumbing this fills in.\n */\nexport function passwordSlotRewrapCeremony(password: string): SlotRewrapCeremony {\n  return async (ctx: SlotRewrapContext): Promise<EnrollAuthenticatorOptions> => {\n    if (ctx.oldSlot.method !== 'password') {\n      throw new ValidationError(\n        `passwordSlotRewrapCeremony: oldSlot.method is \"${ctx.oldSlot.method}\"; expected \"password\". ` +\n          'This ceremony only handles password slots — pair other methods with their own helpers.',\n      )\n    }\n    if (ctx.oldSlot.wrapKind !== 'deks') {\n      throw new ValidationError(\n        'passwordSlotRewrapCeremony: oldSlot is a wrap-KEK slot; expected wrap-DEKs. ' +\n          'Password slots use the wrap-DEKs variant since #26 Path C; legacy wrap-KEK ' +\n          'password slots are not supported here — re-enrol via enrollPasswordAuthenticator.',\n      )\n    }\n\n    // Preserve the strength config the slot was originally enrolled with —\n    // a rotation should not silently downgrade minLength or drop a pattern.\n    const oldMeta = ctx.oldSlot.meta as { minLength?: unknown; pattern?: unknown }\n    const minLength = typeof oldMeta.minLength === 'number' ? oldMeta.minLength : undefined\n    const pattern = typeof oldMeta.pattern === 'string' ? new RegExp(oldMeta.pattern) : undefined\n\n    return enrollPasswordAuthenticator(\n      // enrollPasswordAuthenticator only reads `keyring.deks`, so a\n      // synthetic minimal keyring is enough. The freshly-rewrapped DEKs\n      // come from hub via `ctx.newDeks`.\n      { deks: ctx.newDeks } as UnlockedKeyring,\n      {\n        id: ctx.oldSlot.id,\n        password,\n        ...(minLength !== undefined && { minLength }),\n        ...(pattern !== undefined && { pattern }),\n        // Carry the original tier so hub's anti-slot-swap guard plus\n        // the rotate-recover preservation rule keep the slot's\n        // provenance honest.\n        enrolledViaTier: ctx.oldSlot.enrolled_via_tier,\n      },\n    )\n  }\n}\n\n// All wrap-DEKs crypto helpers (PBKDF2 derivation, base64\n// codecs) moved to hub's `team/wrapped-deks.ts` in #44 — both this\n// package and `mintPaperRecoveryEntry` now share one implementation.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoCA,iBAYO;AAOA,IAAM,6BAA6B;AAGnC,IAAM,8BAA8B;AAIpC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EACP;AAAA,EACT,YAAY,WAAmB,SAAkB;AAC/C;AAAA,MACE,WACE,6BAA6B,OAAO,SAAS,CAAC;AAAA,IAGlD;AACA,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB,YAAY,UAAU,uCAAuC;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA6CA,eAAsB,4BACpB,SACA,SACqC;AACrC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,QAAQ,SAAS,SAAS,WAAW;AACvC,UAAM,IAAI,qBAAqB,SAAS;AAAA,EAC1C;AACA,MAAI,QAAQ,WAAW,CAAC,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,MACA,mDAAmD,QAAQ,QAAQ,SAAS,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,MAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAMA,QAAM,OAAO,UAAM,gCAAoB,QAAQ,MAAM,QAAQ,QAAQ;AAErE,SAAO;AAAA,IACL,IAAI,QAAQ,MAAM;AAAA,IAClB,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,cAAc,KAAK;AAAA,IACnB,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,MACJ,MAAM,KAAK;AAAA,MACX;AAAA,MACA,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IAC7E;AAAA,IACA,mBAAmB,QAAQ,mBAAmB;AAAA,EAChD;AACF;AAWA,eAAsB,uBACpB,MACA,UACiC;AACjC,MAAI,KAAK,aAAa,QAAQ;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,KAAK,SAAS,UAAU;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAOA,MAAI;AACF,WAAO,UAAM;AAAA,MACX,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI,aAAa,KAAK,aAAa;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,qBAAqB;AAAA,EACjC;AACF;AAoCA,eAAsB,mBACpB,MACA,UACA,SAC0B;AAC1B,QAAM,OAAO,MAAM,uBAAuB,MAAM,QAAQ;AAExD,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,QAAQ,OAAO,YAAY,QAAQ,MAAM;AAC7E,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR,4CAA4C,QAAQ,KAAK,aAAa,QAAQ,MAAM;AAAA,IAEtF;AAAA,EACF;AACA,QAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAM,OAAO,IAAI,eAAW,2BAAe,KAAK,IAAI,CAAC;AAErD,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,IACxC;AAAA,IACA,GAAI,KAAK,sBAAsB,UAAa,EAAE,kBAAkB,KAAK,kBAAkB;AAAA,IACvF,GAAI,KAAK,sBAAsB,UAAa,EAAE,kBAAkB,KAAK,kBAAkB;AAAA,IACvF,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;AAAA,IACvD;AAAA;AAAA;AAAA;AAAA,IAIA,KAAK;AAAA,EACP;AACF;AAiEO,SAAS,2BAA2B,UAAsC;AAC/E,SAAO,OAAO,QAAgE;AAC5E,QAAI,IAAI,QAAQ,WAAW,YAAY;AACrC,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,QAAQ,MAAM;AAAA,MAEtE;AAAA,IACF;AACA,QAAI,IAAI,QAAQ,aAAa,QAAQ;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAIA,UAAM,UAAU,IAAI,QAAQ;AAC5B,UAAM,YAAY,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC9E,UAAM,UAAU,OAAO,QAAQ,YAAY,WAAW,IAAI,OAAO,QAAQ,OAAO,IAAI;AAEpF,WAAO;AAAA;AAAA;AAAA;AAAA,MAIL,EAAE,MAAM,IAAI,QAAQ;AAAA,MACpB;AAAA,QACE,IAAI,IAAI,QAAQ;AAAA,QAChB;AAAA,QACA,GAAI,cAAc,UAAa,EAAE,UAAU;AAAA,QAC3C,GAAI,YAAY,UAAa,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIvC,iBAAiB,IAAI,QAAQ;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,207 +0,0 @@
-import { NoydbStore, UnlockedKeyring, EnrollAuthenticatorOptions, SlotRewrapCeremony, KeyringAuthenticator } from '@noy-db/hub';
-
-/**
- * **@noy-db/on-password** — tier-2 password authenticator slot.
- *
- * The user's tier-1 *phrase* is the rarely-typed master that derives
- * the KEK. This package adds a SEPARATE secret — a password the user
- * types at each unlock — as a tier-2 slot in the multi-slot keyring.
- * The two credentials have:
- *
- * - **Different lifecycles** — the phrase rotates yearly; the password
- *   rotates per the developer's policy.
- * - **Different strength rules** — the phrase is validated against the
- *   phrase format (issue #7); the password is validated against a
- *   length / regex rule the developer chooses.
- * - **Different storage** — the phrase derives the KEK; the password
- *   derives a wrapping key that wraps the SAME DEK SET in its own
- *   keyring slot (LUKS-like multi-slot, wrap-DEKs variant).
- *
- * ## Wrap-DEKs format (#26 Path C)
- *
- * Slots produced by this package use the wrap-DEKs variant of
- * `KeyringAuthenticator` — they encrypt the serialized DEK set under
- * a password-derived AES-GCM key, NOT the KEK. This unifies tier-2
- * password slots with the tier-0 (paper recovery, `mintPaperRecoveryEntry`)
- * and tier-3 (`@noy-db/on-pin`'s `wrappedKeyring`) primitives — all
- * three sidestep the non-extractable-KEK constraint by wrapping the
- * DEK set rather than the KEK itself.
- *
- * Trade-off: an `UnlockedKeyring` produced via password-slot unlock
- * has `kek: null`. Sensitive operations (`enrollAuthenticator`,
- * `rotatePassphrase`) require a tier-1 unlock anyway — re-enter the
- * master phrase.
- *
- * @see docs/subsystems/session-tiers.md → Tier 2 — `on-password`
- *
- * @packageDocumentation
- */
-
-/**
- * PBKDF2 iteration count — matches the tier-1 phrase derivation.
- * Exported as a documented invariant; the actual derivation lives
- * in hub's canonical wrap-DEKs primitive (#44).
- */
-declare const PASSWORD_PBKDF2_ITERATIONS = 600000;
-/** Default minimum password length. Override per-app via `enrollPasswordAuthenticator`. */
-declare const PASSWORD_DEFAULT_MIN_LENGTH = 12;
-declare class PasswordTooWeakError extends Error {
-    readonly code: "PASSWORD_TOO_WEAK";
-    readonly minLength: number;
-    constructor(minLength: number, message?: string);
-}
-declare class PasswordInvalidError extends Error {
-    readonly code: "PASSWORD_INVALID";
-    constructor(message?: string);
-}
-/** Options for {@link enrollPasswordAuthenticator}. */
-interface EnrollPasswordOptions {
-    /** Slot id. Default: `'password'`. */
-    readonly id?: string;
-    /** Password the user will type at unlock. Distinct from the tier-1 phrase. */
-    readonly password: string;
-    /** Minimum length. Default 12. */
-    readonly minLength?: number;
-    /** Optional regex the password must satisfy in addition to length. */
-    readonly pattern?: RegExp;
-    /** Tier the active session held when enrolling. Default 1. */
-    readonly enrolledViaTier?: 1 | 2;
-}
-/**
- * Build the keyring slot for a tier-2 password authenticator. Returns
- * an `EnrollAuthenticatorOptions` value the caller hands to
- * `db.enrollAuthenticator(vault, slot)` — separating the cryptographic
- * step (this function) from the persistence step (the hub) keeps the
- * package small and lets the hub's policy gate run between the two.
- *
- * The slot uses the **wrap-DEKs** variant of `KeyringAuthenticator`:
- * the DEK set is serialized to JSON and encrypted with AES-GCM under
- * a PBKDF2-derived key. No requirement on `keyring.kek` — works with
- * tier-1 unlocked keyrings; throws if `keyring.deks` is empty.
- *
- * Usage:
- *
- * ```ts
- * import { enrollPasswordAuthenticator } from '@noy-db/on-password'
- *
- * const keyring = await db.getKeyring('acme')
- * const slot = await enrollPasswordAuthenticator(keyring, {
- *   password: 'strong-password-2026',
- *   minLength: 14,
- * })
- * await db.enrollAuthenticator('acme', slot, {
- *   factors: [{ kind: 'totp' }],
- * })
- * ```
- */
-declare function enrollPasswordAuthenticator(keyring: UnlockedKeyring, options: EnrollPasswordOptions): Promise<EnrollAuthenticatorOptions>;
-/**
- * Recover the DEK set from a wrap-DEKs password slot. Returns the raw
- * DEK map; the hub-friendly verifier {@link verifyPasswordSlot} wraps
- * this and produces a full `UnlockedKeyring`.
- *
- * @throws {@link PasswordInvalidError} when the password is wrong or
- *   the slot is not a wrap-DEKs slot (e.g. a legacy wrap-KEK password
- *   slot from before pre.8 — those need re-enrollment).
- */
-declare function unwrapDeksWithPassword(slot: KeyringAuthenticator, password: string): Promise<Map<string, CryptoKey>>;
-/**
- * Hub-friendly verify callback. Pass to `db.unlockViaAuthenticator`:
- *
- * ```ts
- * import { verifyPasswordSlot } from '@noy-db/on-password'
- *
- * const unlocked = await db.unlockViaAuthenticator('acme', 'password',
- *   (slot) => verifyPasswordSlot(slot, 'strong-password-2026',
- *     { store, vault: 'acme', userId: 'alice' }),
- * )
- * ```
- *
- * Unwraps the DEK set with the supplied password and returns an
- * `UnlockedKeyring` the hub installs in its keyring cache. The
- * returned keyring has `kek: null` — sensitive operations (enrol new
- * slot, rotate phrase) require a tier-1 unlock from the master phrase.
- *
- * The `{ store, vault, userId }` shape works in both contexts:
- *   - **Warm re-unlock** — db is alive; consumer already has identity
- *     in memory but pays one cheap `_keyring/<userId>` read.
- *   - **Cold-start** (`createNoydb({ getKeyring: ... })`) — consumer
- *     does NOT have a keyring yet; the verifier loads identity from
- *     disk before returning the unlocked keyring. This is the
- *     primary cold-start tier-2 path (Niwat tier-2b uses this).
- *
- * Identity fields (userId, displayName, role, permissions,
- * authenticators, salt, capability bits, per-keyring policy) are read
- * directly from the `_keyring/<userId>` envelope's plaintext header —
- * those fields are not encrypted because the sync engine + grant flow
- * need them without a key.
- *
- * @throws {@link PasswordInvalidError} when the password is wrong or
- *   the keyring file is missing.
- */
-declare function verifyPasswordSlot(slot: KeyringAuthenticator, password: string, options: VerifyPasswordSlotOptions): Promise<UnlockedKeyring>;
-/** Adapter shape required by {@link verifyPasswordSlot}. */
-interface VerifyPasswordSlotOptions {
-    /** The vault's NoydbStore — used to load `_keyring/<userId>`. */
-    readonly store: NoydbStore;
-    /** Vault name — same value passed to `db.openVault(name)`. */
-    readonly vault: string;
-    /** User id — same value passed to `createNoydb({ user })`. */
-    readonly userId: string;
-}
-/**
- * `SlotRewrapCeremony` factory for password slots — the password parallel
- * to `webAuthnSlotRewrapCeremony` (#56). Used by hub's
- * `rotatePassphrase({ slotCeremonies: { [slotId]: passwordSlotRewrapCeremony(pwd) } })`
- * to preserve a tier-2 password enrollment across a tier-1 phrase
- * rotation without forcing the user to re-enroll the password (#96).
- *
- * Returns a closure capturing the password so the result matches
- * hub's `SlotRewrapCeremony` signature `(ctx) => Promise<EnrollAuthenticatorOptions>`
- * directly. Pass into `slotCeremonies` keyed by the existing slot id:
- *
- * ```ts
- * import { passwordSlotRewrapCeremony } from '@noy-db/on-password'
- *
- * await db.rotatePassphrase('acme', {
- *   oldPassphrase: oldPhrase,
- *   newPassphrase: newPhrase,
- *   slotCeremonies: {
- *     'password': passwordSlotRewrapCeremony('strong-password-2026'),
- *   },
- * })
- * ```
- *
- * The password itself is unaffected by phrase rotation — what needs to
- * change is the **wrapped DEK set**: the encrypted blob the slot's
- * `wrapped_deks` field holds. After rotation, the old blob still has
- * the old DEKs (now stale because rotatePassphrase rewrapped them
- * under a fresh KEK); the new blob must hold the freshly rewrapped
- * `ctx.newDeks`.
- *
- * Single ceremony, one operation:
- *   1. Validate `oldSlot.method === 'password'` and `oldSlot.wrapKind === 'deks'`.
- *   2. Re-mint the wrap-DEKs blob via {@link enrollPasswordAuthenticator}
- *      using the supplied password against `ctx.newDeks`.
- *   3. Return `EnrollAuthenticatorOptions` preserving `oldSlot.id`,
- *      `method: 'password'`, and the strength config (`minLength`,
- *      `pattern`) carried in the old slot's `meta`. Hub validates
- *      `id` + `method` + `wrapKind` to prevent slot-type swap mid-
- *      rotation.
- *
- * Pre-pre.8 wrap-KEK password slots (legacy) cannot be rewrapped via
- * this ceremony — they must be re-enrolled fresh via
- * {@link enrollPasswordAuthenticator}. The validation throws
- * {@link ValidationError} for those.
- *
- * @throws {ValidationError} when `oldSlot.method !== 'password'` or
- *         `oldSlot.wrapKind !== 'deks'`.
- * @throws {PasswordTooWeakError} when the supplied password fails the
- *         strength rules carried in `oldSlot.meta` (minLength, pattern).
- *
- * @see #56 webAuthnSlotRewrapCeremony — the WebAuthn parallel.
- * @see #29 — the slotCeremonies plumbing this fills in.
- */
-declare function passwordSlotRewrapCeremony(password: string): SlotRewrapCeremony;
-
-export { type EnrollPasswordOptions, PASSWORD_DEFAULT_MIN_LENGTH, PASSWORD_PBKDF2_ITERATIONS, PasswordInvalidError, PasswordTooWeakError, type VerifyPasswordSlotOptions, enrollPasswordAuthenticator, passwordSlotRewrapCeremony, unwrapDeksWithPassword, verifyPasswordSlot };