mindoodb 0.0.23 → 0.0.32

package/dist/core/accesscontrol/DirectoryTimeTravelIndex.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DirectoryTimeTravelIndex = exports.DIR_TT_CACHE_VERSION = exports.DIR_TT_CACHE_TYPE = void 0;
+const DirectoryStateNode_1 = require("./DirectoryStateNode");
+/** LocalCacheStore `type` namespace for the persisted time-travel chain. */
+exports.DIR_TT_CACHE_TYPE = "dir-tt";
+/** Bump when {@link PersistedTimeTravelState} layout changes (forces rebuild). */
+exports.DIR_TT_CACHE_VERSION = 2;
+/**
+ * Owns the access-control time-travel directory-state chain (docs/accesscontrol.md
+ * §8): the {@link DirectoryStateChainBuilder}, its resume cursor in the
+ * revision-grain changefeed, and the bookkeeping needed to keep it current and
+ * persist it.
+ *
+ * Revisions are accumulated keyed by store entry id ({@link upsertRevision}) and
+ * the chain is (re)built by replaying them through the projection in
+ * `(trustedTime, entryId)` order ({@link rebuild}). Keying by entry id makes
+ * out-of-order arrivals and witness re-stamps correct without any special-casing
+ * in the chain builder: a later, earlier-trusted-time revision (or a re-stamped
+ * one) just replaces the prior record and the chain is replayed in sorted order,
+ * so every node — head and intermediate — reflects the correct trusted-time
+ * frontier. Replaying is pure in-memory (no decryption / Automerge), so it is
+ * cheap relative to the (incremental) feed that produces the revisions.
+ */
+class DirectoryTimeTravelIndex {
+    constructor(cachePrefix) {
+        this.cachePrefix = cachePrefix;
+        /** The copy-on-write chain. Rebuilt from {@link revisions} via the projection. */
+        this.builder = new DirectoryStateNode_1.DirectoryStateChainBuilder();
+        /** Revisions the chain is built from, keyed by store entry id. */
+        this.revisions = new Map();
+        /** Resume position in the revision feed; `null` means "scan from genesis". */
+        this.cursor = null;
+        /**
+         * The directory DB's latest `changeSeq` observed at the last build. Persisted
+         * and restored so the directory's fast-path gate (see
+         * `BaseMindooTenantDirectory.ensureTimeTravelCurrent`) can short-circuit on a
+         * cold start when nothing has changed since the chain was flushed.
+         */
+        this.lastChangeSeq = null;
+        /**
+         * Entry ids of folded revisions that are still un-witnessed (their trusted
+         * time is the provisional `now`). Exposed via {@link hasUnwitnessed} so the
+         * directory knows the head overlay may still move when the entries are
+         * witnessed.
+         */
+        this.unwitnessedIds = new Set();
+        this.dirty = false;
+    }
+    /** The head node ("now"). */
+    getHead() {
+        return this.builder.getHead();
+    }
+    /** The node covering trusted time `T`. */
+    getStateAt(T) {
+        return this.builder.getStateAt(T);
+    }
+    /** Reset to an empty chain (full rebuild from genesis). */
+    reset() {
+        this.builder.reset();
+        this.revisions.clear();
+        this.cursor = null;
+        this.lastChangeSeq = null;
+        this.unwitnessedIds.clear();
+        this.dirty = true;
+    }
+    /**
+     * Record the directory DB's latest `changeSeq` as of this build so it can be
+     * persisted alongside the chain and consulted by the cold-start gate.
+     */
+    recordChangeSeq(changeSeq) {
+        if (this.lastChangeSeq !== changeSeq) {
+            this.lastChangeSeq = changeSeq;
+            this.dirty = true;
+        }
+    }
+    /**
+     * True while any folded revision is still un-witnessed: its provisional
+     * trusted time (`now`) may move when the entry is later witnessed, so consumers
+     * should not treat the head as final for those entries.
+     */
+    hasUnwitnessed() {
+        return this.unwitnessedIds.size > 0;
+    }
+    /**
+     * Insert or replace a revision (keyed by entry id) and advance the resume
+     * cursor. Replacing an existing entry id is how out-of-order arrivals and
+     * witness re-stamps are absorbed; the chain is rebuilt separately via
+     * {@link rebuild}. Returns true if the stored set changed.
+     */
+    upsertRevision(revision, cursor) {
+        this.cursor = cursor;
+        if (revision.witnessed) {
+            this.unwitnessedIds.delete(revision.entryId);
+        }
+        else {
+            this.unwitnessedIds.add(revision.entryId);
+        }
+        const prev = this.revisions.get(revision.entryId);
+        const changed = !prev ||
+            prev.trustedTime !== revision.trustedTime ||
+            prev.deleted !== revision.deleted ||
+            prev.witnessed !== revision.witnessed ||
+            prev.docId !== revision.docId ||
+            JSON.stringify(prev.data) !== JSON.stringify(revision.data);
+        this.revisions.set(revision.entryId, revision);
+        this.dirty = true;
+        return changed;
+    }
+    /**
+     * Rebuild the chain by replaying every stored revision through `project` in
+     * `(trustedTime, entryId)` order. Pure in-memory: no decryption, no Automerge.
+     */
+    rebuild(project) {
+        const sorted = [...this.revisions.values()].sort((a, b) => a.trustedTime !== b.trustedTime
+            ? a.trustedTime - b.trustedTime
+            : a.entryId.localeCompare(b.entryId));
+        this.builder.reset();
+        for (const revision of sorted) {
+            project(this.builder, revision);
+        }
+        this.dirty = true;
+    }
+    // ---- ICacheable -------------------------------------------------------
+    getCachePrefix() {
+        return this.cachePrefix;
+    }
+    hasDirtyState() {
+        return this.dirty;
+    }
+    clearDirty() {
+        this.dirty = false;
+    }
+    async flushToCache(store) {
+        const state = {
+            version: exports.DIR_TT_CACHE_VERSION,
+            cursor: this.cursor,
+            unwitnessedIds: [...this.unwitnessedIds],
+            revisions: [...this.revisions.values()],
+            lastChangeSeq: this.lastChangeSeq,
+        };
+        await store.put(exports.DIR_TT_CACHE_TYPE, this.cachePrefix, new TextEncoder().encode(JSON.stringify(state)));
+        return 1;
+    }
+    /**
+     * Restore the persisted revisions and cursor. Returns false (leaving the index
+     * empty) on a cache miss or version mismatch, so the caller does a full
+     * rebuild. The caller must invoke {@link rebuild} afterwards to materialize the
+     * chain (this index does not own the projection).
+     */
+    async restoreFromCache(store) {
+        const bytes = await store.get(exports.DIR_TT_CACHE_TYPE, this.cachePrefix);
+        if (!bytes)
+            return false;
+        let state;
+        try {
+            state = JSON.parse(new TextDecoder().decode(bytes));
+        }
+        catch {
+            return false;
+        }
+        if (state.version !== exports.DIR_TT_CACHE_VERSION)
+            return false;
+        this.revisions = new Map((state.revisions ?? []).map((r) => [r.entryId, r]));
+        this.cursor = state.cursor ?? null;
+        this.lastChangeSeq = state.lastChangeSeq ?? null;
+        this.unwitnessedIds = new Set(state.unwitnessedIds ?? []);
+        this.dirty = false;
+        return true;
+    }
+}
+exports.DirectoryTimeTravelIndex = DirectoryTimeTravelIndex;
+//# sourceMappingURL=DirectoryTimeTravelIndex.js.map

package/dist/core/accesscontrol/DirectoryTimeTravelIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectoryTimeTravelIndex.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryTimeTravelIndex.ts"],"names":[],"mappings":";;;AAGA,6DAAsF;AAEtF,4EAA4E;AAC/D,QAAA,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,kFAAkF;AACrE,QAAA,oBAAoB,GAAG,CAAC,CAAC;AAqDtC;;;;;;;;;;;;;;;GAeG;AACH,MAAa,wBAAwB;IA4BnC,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;QA3BhD,kFAAkF;QACzE,YAAO,GAAG,IAAI,+CAA0B,EAAE,CAAC;QAEpD,kEAAkE;QAC1D,cAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;QAE/D,8EAA8E;QAC9E,WAAM,GAA0B,IAAI,CAAC;QAErC;;;;;WAKG;QACH,kBAAa,GAAkB,IAAI,CAAC;QAEpC;;;;;WAKG;QACK,mBAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEnC,UAAK,GAAG,KAAK,CAAC;IAE6B,CAAC;IAEpD,6BAA6B;IAC7B,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,CAAS;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,2DAA2D;IAC3D,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,SAAwB;QACtC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAiC,EAAE,MAA6B;QAC7E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GACX,CAAC,IAAI;YACL,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACzC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;YACjC,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;YACrC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,OAA0B;QAChC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxD,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;YAC7B,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW;YAC/B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,0EAA0E;IAE1E,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAsB;QACvC,MAAM,KAAK,GAA6B;YACtC,OAAO,EAAE,4BAAoB;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;YACxC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAsB;QAC3C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAA6B,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,4BAAoB;YAAE,OAAO,KAAK,CAAC;QAEzD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAnKD,4DAmKC"}

package/dist/core/accesscontrol/directoryProjection.d.ts

@@ -0,0 +1,26 @@
+import { AclRuleDoc, DefaultAccessPolicyDoc, RuleType } from "./types";
+import { DirectoryStateChainBuilder } from "./DirectoryStateNode";
+/** Parse a policy document's fields into a {@link DefaultAccessPolicyDoc}. */
+export declare function parsePolicyDoc(data: Record<string, unknown>): DefaultAccessPolicyDoc;
+/** Parse a rule document's fields into an {@link AclRuleDoc}. */
+export declare function parseRuleDoc(data: Record<string, unknown>, ruleType: RuleType): AclRuleDoc;
+/** A single directory document revision to project onto the time-travel chain. */
+export interface DirectoryRevisionInput {
+    docId: string;
+    data: Record<string, unknown>;
+    deleted: boolean;
+    trustedTime: number;
+    /** Normalizes a raw group name (e.g. lowercase) for keying group snapshots. */
+    normalizeGroupName: (name: string) => string;
+}
+/**
+ * Classify a single directory document revision and feed it into the
+ * time-travel {@link DirectoryStateChainBuilder} at the revision's trusted time
+ * (docs/accesscontrol.md §6, §8).
+ *
+ * This is the revision-grain projection: it is called once per persisted change
+ * (not once per merged document), so every intermediate policy/grant/group
+ * state becomes its own chain node.
+ */
+export declare function projectDirectoryRevision(builder: DirectoryStateChainBuilder, input: DirectoryRevisionInput): void;
+//# sourceMappingURL=directoryProjection.d.ts.map

package/dist/core/accesscontrol/directoryProjection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directoryProjection.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,UAAU,EACV,sBAAsB,EAEtB,QAAQ,EAIT,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,0BAA0B,EAE3B,MAAM,sBAAsB,CAAC;AAI9B,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,CA+BpF;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAmB1F;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,GAC5B,IAAI,CAyCN"}

package/dist/core/accesscontrol/directoryProjection.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePolicyDoc = parsePolicyDoc;
+exports.parseRuleDoc = parseRuleDoc;
+exports.projectDirectoryRevision = projectDirectoryRevision;
+const grantKeys_1 = require("./grantKeys");
+const types_1 = require("./types");
+const ACL_DB_POLICY_PREFIX = "acl_dbpolicy_";
+/** Parse a policy document's fields into a {@link DefaultAccessPolicyDoc}. */
+function parsePolicyDoc(data) {
+    const bool = (v) => (typeof v === "boolean" ? v : undefined);
+    // An array of strings, or undefined when absent/malformed (treated as
+    // unconstrained). Non-string members are dropped defensively.
+    const stringArray = (v) => Array.isArray(v) ? v.filter((s) => typeof s === "string") : undefined;
+    return {
+        form: types_1.ACCESS_CONTROL_FORM,
+        type: "defaultpolicy",
+        disableAllAccessChecksAndPolicies: bool(data.disableAllAccessChecksAndPolicies),
+        denyDocCreate: bool(data.denyDocCreate),
+        denyDocChange: bool(data.denyDocChange),
+        denyDocDelete: bool(data.denyDocDelete),
+        denyDocUndelete: bool(data.denyDocUndelete),
+        denyDocSnapshot: bool(data.denyDocSnapshot),
+        denyDocRead: bool(data.denyDocRead),
+        defaultCreateKeyId: typeof data.defaultCreateKeyId === "string" ? data.defaultCreateKeyId : undefined,
+        databaseCreationPolicy: data.databaseCreationPolicy === "directory-restricted"
+            ? "directory-restricted"
+            : data.databaseCreationPolicy === "open"
+                ? "open"
+                : undefined,
+        allowedDbIds: stringArray(data.allowedDbIds),
+        requireMetadataSignatureSince: typeof data.requireMetadataSignatureSince === "number" &&
+            Number.isFinite(data.requireMetadataSignatureSince)
+            ? data.requireMetadataSignatureSince
+            : undefined,
+    };
+}
+/** Parse a rule document's fields into an {@link AclRuleDoc}. */
+function parseRuleDoc(data, ruleType) {
+    const usersHashes = Array.isArray(data.users_hashes)
+        ? data.users_hashes.filter((h) => typeof h === "string")
+        : [];
+    const withfields = Array.isArray(data.withfields)
+        ? data.withfields.filter((c) => !!c && typeof c === "object" && typeof c.key === "string")
+        : undefined;
+    return {
+        form: types_1.ACCESS_CONTROL_FORM,
+        type: ruleType,
+        ruleId: data.ruleId,
+        description: typeof data.description === "string" ? data.description : undefined,
+        dbid: typeof data.dbid === "string" ? data.dbid : "*",
+        withfields,
+        users_hashes: usersHashes,
+        users_encrypted: typeof data.users_encrypted === "string" ? data.users_encrypted : "",
+        action: data.action === "deny" ? "deny" : "allow",
+    };
+}
+/**
+ * Classify a single directory document revision and feed it into the
+ * time-travel {@link DirectoryStateChainBuilder} at the revision's trusted time
+ * (docs/accesscontrol.md §6, §8).
+ *
+ * This is the revision-grain projection: it is called once per persisted change
+ * (not once per merged document), so every intermediate policy/grant/group
+ * state becomes its own chain node.
+ */
+function projectDirectoryRevision(builder, input) {
+    const { docId, data, deleted, trustedTime } = input;
+    // Grant documents (`useroperation`/`grantaccess`). Revocation is expressed by
+    // removing keys from the grant in place (§6.5), so applyGrant with an empty
+    // key array deactivates the user.
+    if (data.form === "useroperation" && data.type === "grantaccess") {
+        if (typeof data.username_hash === "string") {
+            const signingKeys = (0, grantKeys_1.extractSigningPublicKeys)(data);
+            const grant = {
+                usernameHash: data.username_hash,
+                signingKeys,
+                encryptionKeys: (0, grantKeys_1.extractEncryptionPublicKeys)(data),
+                wipeRequestedSigningKeys: (0, grantKeys_1.extractWipeRequestedSigningKeys)(data),
+                active: signingKeys.length > 0,
+            };
+            builder.applyGrant(grant, trustedTime);
+        }
+        return;
+    }
+    // Access-control documents (policies, rules, trusted witnesses), §6.
+    if (data.form === types_1.ACCESS_CONTROL_FORM) {
+        projectAccessControlDoc(builder, docId, data, deleted, trustedTime);
+        return;
+    }
+    // Group documents (§8.1): each document's members contribute to the
+    // union-by-name group snapshot, keyed by the document id so revisions and
+    // deletions are tracked per document.
+    if (data.form === "group" && data.type === "group" && typeof data.groupName === "string") {
+        const name = input.normalizeGroupName(data.groupName);
+        if (deleted) {
+            builder.removeGroupDoc(docId, trustedTime);
+        }
+        else {
+            const memberHashes = Array.isArray(data.members_hashes)
+                ? data.members_hashes.filter((h) => typeof h === "string")
+                : [];
+            builder.applyGroupDoc(docId, name, memberHashes, trustedTime);
+        }
+    }
+}
+/** Project an `accesscontrol` document onto the chain. Deletions remove. */
+function projectAccessControlDoc(builder, docId, data, deleted, trustedTime) {
+    // Default tenant policy / per-database policy share the same shape and are
+    // distinguished by their fixed document id (§6.1, §6.2).
+    if (data.type === "defaultpolicy") {
+        if (deleted)
+            return;
+        const policy = parsePolicyDoc(data);
+        if (docId === types_1.ACL_DEFAULT_POLICY_DOC_ID) {
+            builder.applyDefaultPolicy(policy, trustedTime);
+        }
+        else if (docId.startsWith(ACL_DB_POLICY_PREFIX)) {
+            const dbid = (0, types_1.decodeAclIdComponent)(docId.slice(ACL_DB_POLICY_PREFIX.length));
+            builder.applyDbPolicy(dbid, policy, trustedTime);
+        }
+        return;
+    }
+    // Key-distribution documents carry no directory-state projection (they are
+    // read directly by recipient clients during reconcile); skip them here.
+    if (data.type === "keydistribution") {
+        return;
+    }
+    // App-distribution documents likewise carry no directory-state projection
+    // (recipient Haven clients read them directly during the post-sync reconcile);
+    // skip them here.
+    if (data.type === "appdistribution") {
+        return;
+    }
+    // Sync-setup-policy documents likewise carry no directory-state projection
+    // (recipient Haven clients read them directly during the post-sync Sync-page
+    // reconcile); skip them here.
+    if (data.type === "syncsetuppolicy") {
+        return;
+    }
+    // Document-history purge requests carry no directory-state projection (clients
+    // and the sync server read them directly during the post-sync purge reconcile);
+    // skip them here.
+    if (data.type === "dochistorypurge") {
+        return;
+    }
+    // Trusted witness (§6.4).
+    if (data.type === "trustedwitness" && typeof data.witnessPublicKey === "string") {
+        if (deleted) {
+            builder.removeTrustedWitness(data.witnessPublicKey, trustedTime);
+        }
+        else {
+            const witness = {
+                form: types_1.ACCESS_CONTROL_FORM,
+                type: "trustedwitness",
+                witnessPublicKey: data.witnessPublicKey,
+                serverUrl: typeof data.serverUrl === "string" ? data.serverUrl : undefined,
+            };
+            builder.applyTrustedWitness(witness, trustedTime);
+        }
+        return;
+    }
+    // Access-control rule (§6.3).
+    if (types_1.RULE_TYPES.includes(data.type) && typeof data.ruleId === "string") {
+        const ruleType = data.type;
+        if (deleted) {
+            builder.removeRule(data.ruleId, ruleType, trustedTime);
+        }
+        else {
+            builder.applyRule(parseRuleDoc(data, ruleType), trustedTime);
+        }
+    }
+}
+//# sourceMappingURL=directoryProjection.js.map

package/dist/core/accesscontrol/directoryProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directoryProjection.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":";;AAwBA,wCA+BC;AAGD,oCAmBC;AAqBD,4DA4CC;AA9ID,2CAIqB;AACrB,mCAUiB;AAMjB,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,CAAC,CAAU,EAAwB,EAAE,CACvD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC;QAC/E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACnF,sBAAsB,EACpB,IAAI,CAAC,sBAAsB,KAAK,sBAAsB;YACpD,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,IAAI,CAAC,sBAAsB,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,6BAA6B,EAC3B,OAAO,IAAI,CAAC,6BAA6B,KAAK,QAAQ;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,6BAA6B;YACpC,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,YAAY,CAAC,IAA6B,EAAE,QAAkB;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,CAAC,CAAE,IAAI,CAAC,UAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAChE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,IAAI,CAAC,MAAgB;QAC7B,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChF,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACrD,UAAU;QACV,YAAY,EAAE,WAAW;QACzB,eAAe,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACrF,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;KAClD,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,OAAmC,EACnC,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpD,8EAA8E;IAC9E,4EAA4E;IAC5E,kCAAkC;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjE,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAA,oCAAwB,EAAC,IAAI,CAAC,CAAC;YACnD,MAAM,KAAK,GAAsB;gBAC/B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW;gBACX,cAAc,EAAE,IAAA,uCAA2B,EAAC,IAAI,CAAC;gBACjD,wBAAwB,EAAE,IAAA,2CAA+B,EAAC,IAAI,CAAC;gBAC/D,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;aAC/B,CAAC;YACF,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzC,CAAC;QACD,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,2BAAmB,EAAE,CAAC;QACtC,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAC9B,OAAmC,EACnC,KAAa,EACb,IAA6B,EAC7B,OAAgB,EAChB,WAAmB;IAEnB,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,iCAAyB,EAAE,CAAC;YACxC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,4BAAoB,EAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAsB;gBACjC,IAAI,EAAE,2BAAmB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;YACF,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,8BAA8B;IAC9B,IAAK,kBAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAgB,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/accesscontrol/evaluate.d.ts

@@ -0,0 +1,77 @@
+import { AccessDecision, PSEUDO_TOKEN_ADMIN, PSEUDO_TOKEN_AUTHOR, RuleType, WithFieldWhen } from "./types";
+import { DirectoryStateNode } from "./DirectoryStateNode";
+/**
+ * The pure access-control evaluation engine (docs/accesscontrol.md §7).
+ *
+ * `evaluateAccess` is a **pure, deterministic function** of its inputs: the
+ * operation, the acting user's identity set, the directory-state node covering
+ * the entry's trusted time, and the before/after document states. This purity
+ * is what makes "quarantine on receipt" compatible with eventual consistency —
+ * every honest replica that has synced to the same point computes the identical
+ * verdict (§10). There is deliberately no wall-clock input.
+ */
+/**
+ * The acting user's resolved identity, used for rule matching and placeholder
+ * resolution (§7 step 3). The caller (directory) resolves these from grants,
+ * groups, and the username-hash scheme; the engine only consumes them.
+ */
+export interface IdentitySet {
+    /** Canonical username, for `${user.username}`. */
+    username: string;
+    /** Canonical + wildcard variants + groups, for `${user.usernames}`. */
+    usernames: string[];
+    /** Group names the user belongs to (incl. nested), for `${user.groups}`. */
+    groups: string[];
+    /**
+     * All hashes/tokens the user's identity matches against `users_hashes`:
+     * the username hash (v1 + v2), every group hash (incl. nested), and the
+     * applicable pseudo-tokens — always `$everyone`; `$admin` if the user is the
+     * tenant admin; `$author` if the user authored the document being modified.
+     */
+    hashes: Set<string>;
+}
+/** Inputs to {@link evaluateAccess}. */
+export interface EvaluateAccessInput {
+    /** The operation being attempted. */
+    op: RuleType;
+    /** Target database id. */
+    dbid: string;
+    /** The acting user's identity set. */
+    identity: IdentitySet;
+    /** Directory-state node covering the entry's trusted time (§8). */
+    node: DirectoryStateNode;
+    /**
+     * The document as it currently exists, before the candidate change
+     * (the "before" state). Required to evaluate `when: "before"` clauses.
+     */
+    beforeDoc?: Record<string, unknown> | null;
+    /**
+     * The document with the candidate change applied (the "after" state).
+     * Required to evaluate `when: "after"` clauses, including all `doc_create`
+     * clauses. The caller computes this (e.g. via `Automerge.clone()` + apply).
+     */
+    afterDoc?: Record<string, unknown> | null;
+    /**
+     * When true, the evaluator runs in **server/Tier 1 mode**: it cannot read
+     * encrypted document content, so it ignores Tier 2 rules (those with
+     * `withfields`) for the purpose of *denying*, and treats an entry as
+     * Tier 1-allowed whenever the only thing that could deny/allow it is a Tier 2
+     * rule — leaving that check to clients (§7, §10).
+     */
+    isServer?: boolean;
+}
+/** The default `when` for a clause, given the operation (§6.3). */
+export declare function defaultWhenForOp(op: RuleType): WithFieldWhen;
+/**
+ * Evaluate access for an operation (§7). The result is fully determined by the
+ * inputs; see {@link EvaluateAccessInput}.
+ */
+export declare function evaluateAccess(input: EvaluateAccessInput): AccessDecision;
+/**
+ * Convenience: the set of reserved pseudo-tokens an identity always/optionally
+ * carries. `$everyone` is always present for registered users; `$admin` and
+ * `$author` are added by the caller when applicable.
+ */
+export declare const ALWAYS_PRESENT_PSEUDO_TOKENS: readonly string[];
+export { PSEUDO_TOKEN_ADMIN, PSEUDO_TOKEN_AUTHOR };
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/core/accesscontrol/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAGd,kBAAkB,EAClB,mBAAmB,EAGnB,QAAQ,EAER,aAAa,EAGd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,qCAAqC;IACrC,EAAE,EAAE,QAAQ,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,EAAE,WAAW,CAAC;IACtB,mEAAmE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,aAAa,CAE5D;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuFzE;AA8GD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAA4B,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC"}