@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.1

package/dist/{chunk-6QLCS7ET.js → chunk-FMINS2B6.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-6QLCS7ET.js.map
+//# sourceMappingURL=chunk-FMINS2B6.js.map

package/dist/{chunk-6WS35E6X.js → chunk-FPF5HRBE.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -23,4 +23,4 @@ export {
   PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-6WS35E6X.js.map
+//# sourceMappingURL=chunk-FPF5HRBE.js.map

package/dist/{chunk-7CT6SX4M.js → chunk-FZVCZEVI.js}

@@ -6,7 +6,7 @@ import {
   ConflictError,
   InvariantError,
   ValidationError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-commit/tx/atomic-eligibility.ts
 function canCommitAtomically(db, ctx) {
@@ -322,7 +322,7 @@ async function runTransaction(db, fn, options, txInvariants) {
     db._clearActiveTxContext(ctx);
   }
   if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-WWM3DD4P.js");
+    const { GuardExecutor } = await import("./executor-OXRA64TY.js");
     try {
       for (const [vaultName, v] of ctx._amendmentVaults) {
         const registry = v._getGuardRegistry();
@@ -500,4 +500,4 @@ export {
   TxCollection,
   runTransaction
 };
-//# sourceMappingURL=chunk-7CT6SX4M.js.map
+//# sourceMappingURL=chunk-FZVCZEVI.js.map

package/dist/{chunk-BUE7R3B5.js → chunk-GIQJGXV7.js}

@@ -1,6 +1,6 @@
 import {
   UnsafePatternError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/query/predicate.ts
 function readPath(record, path) {
@@ -272,4 +272,4 @@ export {
   evaluateClause,
   hasFnClause
 };
-//# sourceMappingURL=chunk-BUE7R3B5.js.map
+//# sourceMappingURL=chunk-GIQJGXV7.js.map

package/dist/{chunk-GOJQ5DZA.js → chunk-GYZICGRU.js}

@@ -1,10 +1,10 @@
 import {
   grant,
   revoke
-} from "./chunk-45VHWE4C.js";
+} from "./chunk-V7AKGAXY.js";
 import {
   CustodyNotEnabledError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-party/custody/active.ts
 function withCustody() {
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-LEKDYKTC.js");
+      const { liberateVault } = await import("./liberate-OJIP2ZFX.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-GOJQ5DZA.js.map
+//# sourceMappingURL=chunk-GYZICGRU.js.map

package/dist/chunk-GYZICGRU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/custody/active.ts","../src/with-party/custody/strategy.ts","../src/with-party/custody/index.ts"],"sourcesContent":["/**\n * Enable the sovereign-custody (FR-6) capability.\n * Pass to `createNoydb({ custodyStrategy: withCustody() })` to make\n * `db.grantCustodian` / `db.revokeCustodian` (and the `vault.custody.*` facade\n * that delegates to them) plus `vault.custody.liberate()` live. The heavy\n * `liberateVault` ceremony is dynamically imported here, so it is reached only\n * via opt-in; grant/revoke run the host's own gate + keyring engine.\n */\nimport type { CustodyStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine } from '../team/keyring.js'\n\nexport function withCustody(): CustodyStrategy {\n  return {\n    async grantCustodian(host, vault, options, factors) {\n      return host._grantCustodianImpl(grantEngine, vault, options, factors)\n    },\n    async revokeCustodian(host, vault, options, factors) {\n      return host._revokeCustodianImpl(revokeEngine, vault, options, factors)\n    },\n    async liberate(vault, opts) {\n      const { liberateVault } = await import('./liberate.js')\n      return liberateVault(vault, opts)\n    },\n  }\n}\n","/**\n * Sovereign-custody (FR-6) capability strategy — the three on-demand\n * operations the custody surface routes through: minting a custodian\n * (`grantCustodian`), removing one (`revokeCustodian`), and the audited\n * ownership-claim ceremony (`liberate`). The active engine ({@link withCustody})\n * runs the grant/revoke impls the host exposes and dynamically imports the\n * heavy `liberateVault` ceremony (keeping it out of the floor bundle);\n * {@link NO_CUSTODY} throws.\n *\n * `Noydb.grantCustodian` / `Noydb.revokeCustodian` delegate here (passing\n * themselves as the {@link CustodyHost}), and `vault.custody.liberate` delegates\n * here with its {@link Vault}. An un-opted-in caller hits `NO_CUSTODY`'s throw.\n *\n * Note: the lower-level `liberateVault` FREE FUNCTION (exported from\n * `custody/liberate.ts`) stays ungated — it has no `createNoydb` instance to\n * gate against (the same carve-out as the `openSealedRecord` host opener). Only\n * the instance surfaces (`db.grantCustodian` / `db.revokeCustodian` /\n * `vault.custody.*`) are the capability.\n * @internal\n */\nimport type { GrantOptions, RevokeOptions, FactorProofBundle, NoydbStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { UnlockedKeyring, RevokeResult } from '../team/keyring.js'\nimport type { GrantCustodianOptions } from './index.js'\nimport type { LiberateOptions, LiberateResult } from './liberate.js'\nimport { CustodyNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * The grant/revoke engine the strategy runs when opted in — implemented by\n * `Noydb` (`_grantCustodianImpl` / `_revokeCustodianImpl` hold the gate +\n * keyring logic; the public `grantCustodian` / `revokeCustodian` route through\n * the strategy). Since the #267 team split the keyring grant/revoke engines\n * are passed IN by `withCustody()` (statically linked there, not in the\n * kernel) so the single-user floor never carries them.\n */\nexport interface CustodyHost {\n  _grantCustodianImpl(\n    engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>,\n    vault: string,\n    options: GrantCustodianOptions,\n    factors?: FactorProofBundle,\n  ): Promise<void>\n  _revokeCustodianImpl(\n    engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<RevokeResult>,\n    vault: string,\n    options: RevokeOptions,\n    factors?: FactorProofBundle,\n  ): Promise<void>\n}\n\nexport interface CustodyStrategy {\n  grantCustodian(host: CustodyHost, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>\n  revokeCustodian(host: CustodyHost, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>\n  liberate(vault: Vault, opts: LiberateOptions): Promise<LiberateResult>\n}\n\n/**\n * No-op stub — the floor default. Every custody operation throws\n * {@link CustodyNotEnabledError}; opt in with `custodyStrategy: withCustody()`\n * in createNoydb. @internal\n */\nexport const NO_CUSTODY: CustodyStrategy = {\n  async grantCustodian() { throw new CustodyNotEnabledError() },\n  async revokeCustodian() { throw new CustodyNotEnabledError() },\n  async liberate() { throw new CustodyNotEnabledError() },\n}\n","/**\n * Public `vault.custody.*` API surface (FR-6).\n *\n * The custody namespace is the vault-instance face of the FR-6 sovereign-custody\n * model — it mirrors `vault.user.*` exactly: a thin delegation shell with NO\n * business logic. The Vault constructs one `CustodyApi` per session, injecting\n * closures that bind the vault name / keyring into the genuinely-core\n * implementations (`Noydb.grantCustodian` / `Noydb.revokeCustodian` and the\n * `liberateVault` ceremony). Each method just forwards to its injected callback.\n *\n * Three operations:\n *  - `grantCustodian(opts)` — owner-only: mint a `custodian` who operates the\n *    vault fully but can never grant / rotate / sever / extract.\n *  - `revokeCustodian(opts)` — owner-only: remove a custodian.\n *  - `liberate(opts)` — custodian-only: audited claim of ownership over a\n *    sealed-owner (Deed) vault (mints a DISTINCT new owner; ledger-audited).\n *\n * Provisioning a Deed (`createDeedOwner`) is deliberately NOT on this class: it\n * is a store-level operation that mints the vault's first owner, so there is no\n * vault instance (and thus no custody namespace) yet — it stays the exported\n * `team/deed.ts` function.\n *\n * @see design-history/2026-06-17-fr6-deed-custodian-liberate-design.md\n * @module\n */\nimport type { GrantOptions, RevokeOptions, FactorProofBundle } from '../../kernel/types.js'\nimport type { LiberateOptions, LiberateResult } from './liberate.js'\n\n/** Options for `vault.custody.grantCustodian` — a grant with the role fixed to `custodian`. */\nexport type GrantCustodianOptions = Omit<GrantOptions, 'role'>\n\n// Capability opt-in seam (S4): grant/revoke custodian + liberate throw\n// CustodyNotEnabledError unless `custodyStrategy: withCustody()` is opted in.\nexport { withCustody } from './active.js'\nexport { NO_CUSTODY, type CustodyStrategy, type CustodyHost } from './strategy.js'\nexport { CustodyNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Implementation behind `vault.custody`. Constructed once per Vault. Holds the\n * injected, vault-bound implementations in closure; every method delegates with\n * no added logic (the owner-only / custodian-only / gate checks all live in the\n * injected implementations — `Noydb.grantCustodian` etc. and `liberateVault`).\n */\nexport class CustodyApi {\n  constructor(\n    /** Bound `Noydb.grantCustodian(this.name, ...)` — owner-only, gated. */\n    private readonly _grantCustodian: (options: GrantCustodianOptions, factors?: FactorProofBundle) => Promise<void>,\n    /** Bound `Noydb.revokeCustodian(this.name, ...)` — owner-only, gated. */\n    private readonly _revokeCustodian: (options: RevokeOptions, factors?: FactorProofBundle) => Promise<void>,\n    /** Bound `liberateVault(this, ...)` — custodian-only audited ownership claim. */\n    private readonly _liberate: (opts: LiberateOptions) => Promise<LiberateResult>,\n  ) {}\n\n  /**\n   * Owner-only: grant the FR-6 `custodian` role. The custodian operates every\n   * collection (rw + access) but is provably unable to grant / revoke / rotate /\n   * extract-and-sever. Defended in depth (gate + owner-only role check) inside\n   * the injected `Noydb.grantCustodian`.\n   */\n  async grantCustodian(options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void> {\n    return this._grantCustodian(options, factors)\n  }\n\n  /** Owner-only: revoke a custodian. */\n  async revokeCustodian(options: RevokeOptions, factors?: FactorProofBundle): Promise<void> {\n    return this._revokeCustodian(options, factors)\n  }\n\n  /**\n   * Custodian-only: the audited claim of ownership over a sealed-owner (Deed)\n   * vault. Mints a DISTINCT new owner re-wrapping the incumbent DEKs under a\n   * fresh KEK (the latent owner is never impersonated), ledger-audited. See\n   * {@link liberateVault}.\n   */\n  async liberate(opts: LiberateOptions): Promise<LiberateResult> {\n    return this._liberate(opts)\n  }\n}\n"],"mappings":";;;;;;;;;AAWO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,MAAM,eAAe,MAAM,OAAO,SAAS,SAAS;AAClD,aAAO,KAAK,oBAAoB,OAAa,OAAO,SAAS,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,gBAAgB,MAAM,OAAO,SAAS,SAAS;AACnD,aAAO,KAAK,qBAAqB,QAAc,OAAO,SAAS,OAAO;AAAA,IACxE;AAAA,IACA,MAAM,SAAS,OAAO,MAAM;AAC1B,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,wBAAe;AACtD,aAAO,cAAc,OAAO,IAAI;AAAA,IAClC;AAAA,EACF;AACF;;;ACqCO,IAAM,aAA8B;AAAA,EACzC,MAAM,iBAAiB;AAAE,UAAM,IAAI,uBAAuB;AAAA,EAAE;AAAA,EAC5D,MAAM,kBAAkB;AAAE,UAAM,IAAI,uBAAuB;AAAA,EAAE;AAAA,EAC7D,MAAM,WAAW;AAAE,UAAM,IAAI,uBAAuB;AAAA,EAAE;AACxD;;;ACtBO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAEmB,iBAEA,kBAEA,WACjB;AALiB;AAEA;AAEA;AAAA,EAChB;AAAA,EALgB;AAAA,EAEA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASnB,MAAM,eAAe,SAAgC,SAA4C;AAC/F,WAAO,KAAK,gBAAgB,SAAS,OAAO;AAAA,EAC9C;AAAA;AAAA,EAGA,MAAM,gBAAgB,SAAwB,SAA4C;AACxF,WAAO,KAAK,iBAAiB,SAAS,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,MAAgD;AAC7D,WAAO,KAAK,UAAU,IAAI;AAAA,EAC5B;AACF;","names":[]}

package/dist/{chunk-C53ER7AG.js → chunk-H334G6KU.js}

@@ -1,6 +1,6 @@
 import {
   LookupHandle
-} from "./chunk-NZULV7LK.js";
+} from "./chunk-KZA3DITX.js";
 
 // src/via/lookup/active.ts
 function withLookup() {
@@ -33,4 +33,4 @@ function withLookup() {
 export {
   withLookup
 };
-//# sourceMappingURL=chunk-C53ER7AG.js.map
+//# sourceMappingURL=chunk-H334G6KU.js.map

package/dist/{chunk-GCUMOKTN.js → chunk-HE7EAHGS.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-FZXRLNJO.js";
+} from "./chunk-QT5ITL25.js";
 import {
   PolicyDeniedError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-GCUMOKTN.js.map
+//# sourceMappingURL=chunk-HE7EAHGS.js.map

package/dist/{chunk-BU2ABHFW.js → chunk-HKB4HZDU.js}

@@ -4,17 +4,17 @@ import {
   revoke,
   rotateKeys,
   verifyRoster
-} from "./chunk-45VHWE4C.js";
+} from "./chunk-V7AKGAXY.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   decryptBytes,
   encryptBytes,
   generateEphemeralKey
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NoydbError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-party/team/device-seal.ts
 var MemoryDeviceSeal = class {
@@ -71,4 +71,4 @@ export {
   MemoryDeviceSeal,
   withTeam
 };
-//# sourceMappingURL=chunk-BU2ABHFW.js.map
+//# sourceMappingURL=chunk-HKB4HZDU.js.map

package/dist/{chunk-5UUJE4FP.js → chunk-ICF3TIGY.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-BUE7R3B5.js";
+} from "./chunk-GIQJGXV7.js";
 
 // src/kernel/query/relate/join-on.ts
 var RANGE_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "between"]);
@@ -201,4 +201,4 @@ export {
   joinOnDispatch,
   matchDeclaredJoin
 };
-//# sourceMappingURL=chunk-5UUJE4FP.js.map
+//# sourceMappingURL=chunk-ICF3TIGY.js.map

package/dist/{chunk-H3YM66EI.js → chunk-IF2M43G4.js}

@@ -3,7 +3,7 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -41,4 +41,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-H3YM66EI.js.map
+//# sourceMappingURL=chunk-IF2M43G4.js.map

package/dist/{chunk-VSUQI5Q6.js → chunk-IKPQ2GGB.js}

@@ -4,6 +4,7 @@ var USER_ENVELOPE_MAX_BYTES = 64 * 1024;
 var USER_ENVELOPE_COLLECTION = "_users";
 var ROSTER_KEY_ID = "_roster";
 var BLOB_ADDRESS_KEY_ID = "_blob_addr";
+var INBOX_KEY_ID = "_inbox_key";
 
 // src/kernel/errors.ts
 var NoydbError = class extends Error {
@@ -279,6 +280,17 @@ var DuplicateStoreKindError = class extends NoydbError {
     this.kind = kind;
   }
 };
+var MemberInboxMissingError = class extends NoydbError {
+  userId;
+  constructor(userId, message) {
+    super(
+      "MEMBER_INBOX_MISSING",
+      message ?? `Member "${userId}" has no keyring inbox \u2014 the keyring predates core#96, so a DEK cannot be delivered without their secret. Re-grant the member with a fresh temporary secret (they rotate it on first open); the new keyring carries an inbox.`
+    );
+    this.name = "MemberInboxMissingError";
+    this.userId = userId;
+  }
+};
 var PrivilegeEscalationError = class extends NoydbError {
   offendingCollection;
   constructor(offendingCollection, message) {
@@ -1770,6 +1782,7 @@ export {
   USER_ENVELOPE_COLLECTION,
   ROSTER_KEY_ID,
   BLOB_ADDRESS_KEY_ID,
+  INBOX_KEY_ID,
   NoydbError,
   DebugPlaintextError,
   DebugReservedFieldError,
@@ -1793,6 +1806,7 @@ export {
   StoreCapabilityError,
   UnknownStoreKindError,
   DuplicateStoreKindError,
+  MemberInboxMissingError,
   PrivilegeEscalationError,
   ReservedVaultNameError,
   PeriodClosedError,
@@ -1926,4 +1940,4 @@ export {
   ClassifiedRotationError,
   SatelliteConfigError
 };
-//# sourceMappingURL=chunk-VSUQI5Q6.js.map
+//# sourceMappingURL=chunk-IKPQ2GGB.js.map