@noy-db/hub 0.2.0-pre.23 → 0.2.0-pre.25

package/dist/sync/index.d.cts

@@ -1,11 +1,11 @@
-import { aS as SyncStrategy } from '../types-Bhs2i_Ll.cjs';
+import { aS as SyncStrategy } from '../types-BCYvhKzr.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
-import '../strategy-WtB-jXYv.cjs';
-import '../errors-Dkc_fi-S.cjs';
+import '../strategy-D1zjEV3n.cjs';
+import '../errors-Dwk2k1xY.cjs';
 import '../strategy-BSxFXGzb.cjs';
 import '../index-BMmajblo.cjs';
-import '../index-tZqVB9g5.cjs';
+import '../index-DoxKSsMj.cjs';
 import '@noy-db/attestation';
 
 /**

package/dist/sync/index.d.ts

@@ -1,11 +1,11 @@
-import { aS as SyncStrategy } from '../types-DONgts0n.js';
+import { aS as SyncStrategy } from '../types-CCq0WHh9.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
-import '../strategy-54eIwox5.js';
-import '../errors-Dkc_fi-S.js';
+import '../strategy-YQ1qJWyq.js';
+import '../errors-Dwk2k1xY.js';
 import '../strategy-BSxFXGzb.js';
 import '../index-BMmajblo.js';
-import '../index-Bm9hIY7t.js';
+import '../index-LaexBi3v.js';
 import '@noy-db/attestation';
 
 /**

package/dist/sync/index.js

@@ -2,11 +2,11 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-UU6M64HI.js";
+} from "../chunk-GPZHHTJU.js";
 import "../chunk-2QR2PQTT.js";
-import "../chunk-TA6HPKWQ.js";
-import "../chunk-37VGJM3T.js";
-import "../chunk-OTWT6BAJ.js";
+import "../chunk-LR7CODVN.js";
+import "../chunk-7JSP3E67.js";
+import "../chunk-DDOYOMAD.js";
 
 // src/team/sync-active.ts
 function withSync() {

package/dist/team/index.cjs

@@ -506,12 +506,14 @@ async function deleteUserEnvelope(store, vault, keyringId) {
 var ADMIN_GRANTABLE_TARGETS = ["operator", "viewer", "client", "admin"];
 function canGrant(callerRole, targetRole) {
   if (callerRole === "owner") return true;
+  if (callerRole === "custodian") return false;
   if (callerRole === "admin") return ADMIN_GRANTABLE_TARGETS.includes(targetRole);
   return false;
 }
 function canRevoke(callerRole, targetRole) {
   if (targetRole === "owner") return false;
   if (callerRole === "owner") return true;
+  if (callerRole === "custodian") return false;
   if (callerRole === "admin") return ADMIN_GRANTABLE_TARGETS.includes(targetRole);
   return false;
 }
@@ -665,7 +667,7 @@ async function grant(adapter, vault, callerKeyring, options) {
       wrappedDeks[collName] = await wrapKey(dek, newKek);
     }
   }
-  if (options.role === "owner" || options.role === "admin" || options.role === "viewer") {
+  if (options.role === "owner" || options.role === "admin" || options.role === "custodian" || options.role === "viewer") {
     for (const [collName, dek] of callerKeyring.deks) {
       if (!(collName in wrappedDeks)) {
         wrappedDeks[collName] = await wrapKey(dek, newKek);
@@ -813,6 +815,11 @@ async function updateKeyringIdentity(adapter, vault, callerKeyring, options) {
   await writeKeyringFile(adapter, vault, options.userId, next);
 }
 async function rotateKeys(adapter, vault, callerKeyring, collections) {
+  if (callerKeyring.role === "custodian") {
+    throw new PermissionDeniedError(
+      "custodian cannot rotate keys (FR-6: re-key is an owner-only meta-capability; use the Deed owner)"
+    );
+  }
   const newDeks = /* @__PURE__ */ new Map();
   for (const collName of collections) {
     newDeks.set(collName, await generateDEK());
@@ -922,7 +929,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
       wrappedDeks[collName] = await wrapKey(dek, newKek);
     }
   }
-  if (role === "owner" || role === "admin" || role === "viewer") {
+  if (role === "owner" || role === "admin" || role === "custodian" || role === "viewer") {
     for (const [collName, dek] of callerKeyring.deks) {
       if (!(collName in wrappedDeks)) {
         wrappedDeks[collName] = await wrapKey(dek, newKek);
@@ -1086,7 +1093,7 @@ function evaluateImportCapability(capability, _role, tier, format) {
   return capability?.bundle === true;
 }
 function resolvePermissions(role, explicit) {
-  if (role === "owner" || role === "admin" || role === "viewer") return {};
+  if (role === "owner" || role === "admin" || role === "custodian" || role === "viewer") return {};
   return explicit ?? {};
 }
 async function writeKeyringFile(adapter, vault, userId, keyringFile) {