mindoodb 0.0.24 → 0.0.32

package/dist/core/accesscontrol/DirectoryStateNode.d.ts

@@ -0,0 +1,220 @@
+import { AclRuleDoc, DefaultAccessPolicyDoc, RuleType, TrustedWitnessDoc } from "./types";
+/**
+ * Time-travel directory state (docs/accesscontrol.md §8).
+ *
+ * We keep an in-memory, copy-on-write chain of directory snapshots keyed by the
+ * **trusted time** of directory changes, so we can answer "what was allowed at
+ * time `T`?" quickly — including while materializing a database from scratch.
+ *
+ * The chain is built incrementally from the directory's change iteration. Each
+ * applied directory document yields a NEW node that shares, by pointer, every
+ * map that did not change (so memory stays compact), and replaces only the map
+ * it touched. Reads at the head answer "now"; reads at an earlier node answer a
+ * historic question.
+ *
+ * Trusted time of an entry follows the version-aware rule (see
+ * `core/storeEntryTime.ts` `entryTrustedTime`): it is the entry's `receivedAt`
+ * when witnessed; for an un-witnessed entry it is the wall-clock `now` if the
+ * entry is versioned (written in the witness era — provisional, "waiting to be
+ * pushed") or its stable `createdAt` if it is legacy (pre-witness, already
+ * synced and never to be witnessed). This chain consumes the trusted time the
+ * changefeed already computed via that rule, so it needs no separate fallback.
+ */
+/** A user's grant as projected into a directory-state node (§6.5, §8). */
+export interface UserGrantSnapshot {
+    /** `username_hash` the grant is keyed by (the value written on the doc). */
+    usernameHash: string;
+    /** All currently-granted signing public keys (array or legacy scalar). */
+    signingKeys: string[];
+    /** All currently-granted encryption public keys. */
+    encryptionKeys: string[];
+    /** Signing keys whose device must wipe the local tenant (`wipeRequestedForSigningKeys`). */
+    wipeRequestedSigningKeys: string[];
+    /** Whether the grant is active (not revoked, has at least one signing key). */
+    active: boolean;
+}
+/** A group as projected into a node, mirroring the directory's offline merge (§8.1). */
+export interface GroupSnapshot {
+    /** Normalized (lowercase) group name. */
+    name: string;
+    /** Member hashes (union across same-named docs). */
+    memberHashes: string[];
+}
+/**
+ * A single immutable snapshot of directory state covering every directory entry
+ * whose trusted time is `<= trustedTimeUpperBound`. Unchanged collections are
+ * shared with {@link prev} by reference.
+ */
+export interface DirectoryStateNode {
+    /** Covers all directory entries whose trusted time ≤ this bound. */
+    trustedTimeUpperBound: number;
+    defaultPolicy: DefaultAccessPolicyDoc | null;
+    dbPolicies: Map<string, DefaultAccessPolicyDoc>;
+    rulesByType: Map<RuleType, AclRuleDoc[]>;
+    groupsByName: Map<string, GroupSnapshot>;
+    /** Keyed by `username_hash`. */
+    usersByHash: Map<string, UserGrantSnapshot>;
+    /** Reverse index: signing public key -> grant. */
+    bySigningKey: Map<string, UserGrantSnapshot>;
+    /** Trusted witness public keys -> witness doc. */
+    trustedWitnessKeys: Map<string, TrustedWitnessDoc>;
+    /** Previous node in the chain, or null for the genesis node. */
+    prev: DirectoryStateNode | null;
+}
+/** The empty genesis node: access control not yet configured. */
+export declare function createGenesisNode(): DirectoryStateNode;
+/**
+ * Walk a chain backwards to find the node that covers trusted time `T` — i.e.
+ * the most recent node whose `trustedTimeUpperBound <= T`. Returns the genesis
+ * node's predecessor semantics (an all-empty node) if `T` precedes everything.
+ */
+export declare function nodeCovering(head: DirectoryStateNode, T: number): DirectoryStateNode;
+/**
+ * A single recorded mutation of the {@link DirectoryStateChainBuilder}, in the
+ * trusted-time order it was applied. The ordered list of deltas is the compact,
+ * serialization-friendly representation of the whole chain: replaying it through
+ * the same `apply*` methods rebuilds an identical chain (including its
+ * copy-on-write structural sharing) without any decryption or Automerge replay.
+ *
+ * Payloads are plain JSON-serializable objects, so the log round-trips through
+ * `JSON.stringify`/`parse` (unlike the `Map`-based node fields themselves).
+ */
+export type DirectoryRevisionDelta = {
+    op: "defaultPolicy";
+    t: number;
+    policy: DefaultAccessPolicyDoc;
+} | {
+    op: "dbPolicy";
+    t: number;
+    dbid: string;
+    policy: DefaultAccessPolicyDoc;
+} | {
+    op: "rule";
+    t: number;
+    rule: AclRuleDoc;
+} | {
+    op: "removeRule";
+    t: number;
+    ruleId: string;
+    ruleType: RuleType;
+} | {
+    op: "trustedWitness";
+    t: number;
+    witness: TrustedWitnessDoc;
+} | {
+    op: "removeTrustedWitness";
+    t: number;
+    witnessPublicKey: string;
+} | {
+    op: "grant";
+    t: number;
+    grant: UserGrantSnapshot;
+} | {
+    op: "revokeBySigningKey";
+    t: number;
+    signingKey: string;
+} | {
+    op: "groupDoc";
+    t: number;
+    docId: string;
+    name: string;
+    memberHashes: string[];
+} | {
+    op: "removeGroupDoc";
+    t: number;
+    docId: string;
+} | {
+    op: "setGroups";
+    t: number;
+    groups: GroupSnapshot[];
+};
+/**
+ * Incrementally builds a {@link DirectoryStateNode} chain as directory
+ * documents are observed in trusted-time (iteration) order.
+ *
+ * The directory is responsible for decrypting documents and passing already
+ * structured inputs (e.g. decoded grant key arrays, merged group member
+ * hashes); this builder owns only the copy-on-write chain mechanics so it stays
+ * pure and unit-testable.
+ */
+export declare class DirectoryStateChainBuilder {
+    private head;
+    /**
+     * Ordered log of every mutation, used to serialize/rebuild the chain (see
+     * {@link exportDeltaLog} / {@link importDeltaLog}).
+     */
+    private deltaLog;
+    /**
+     * Per-group-document member contributions, keyed by group document id, used
+     * to recompute the union-by-name {@link GroupSnapshot} map incrementally as
+     * individual group documents are revised (§8.1). Not part of the chain nodes;
+     * rebuilt deterministically when {@link importDeltaLog} replays the log.
+     */
+    private groupContributions;
+    /** The current head node ("now"). */
+    getHead(): DirectoryStateNode;
+    /** The node covering trusted time `T`. */
+    getStateAt(T: number): DirectoryStateNode;
+    /** Reset to the empty genesis node (used on a full rebuild). */
+    reset(): void;
+    /**
+     * The ordered mutation log. This is the compact on-disk representation of the
+     * chain; persist it and rebuild later with {@link importDeltaLog}.
+     */
+    exportDeltaLog(): DirectoryRevisionDelta[];
+    /**
+     * Rebuild the chain by replaying a previously {@link exportDeltaLog}-ed log
+     * through the same `apply*` methods. Pure in-memory: no decryption, no
+     * Automerge — and it reconstructs the copy-on-write structural sharing.
+     */
+    importDeltaLog(deltas: DirectoryRevisionDelta[]): void;
+    /**
+     * Push a new node derived from the current head, replacing exactly one
+     * collection (`mutate` receives a working copy of the head to mutate in
+     * place) and sharing the rest by reference. `trustedTime` becomes the node's
+     * upper bound; it must be monotonically non-decreasing across calls.
+     */
+    private push;
+    /** Apply the tenant default policy document. */
+    applyDefaultPolicy(policy: DefaultAccessPolicyDoc, trustedTime: number): void;
+    /** Apply a per-database policy document. */
+    applyDbPolicy(dbid: string, policy: DefaultAccessPolicyDoc, trustedTime: number): void;
+    /** Apply an access-control rule document (replaces any rule with the same id). */
+    applyRule(rule: AclRuleDoc, trustedTime: number): void;
+    /** Remove a rule (e.g. its document was deleted). */
+    removeRule(ruleId: string, ruleType: RuleType, trustedTime: number): void;
+    /** Apply a trusted-witness document, keyed by its public key. */
+    applyTrustedWitness(witness: TrustedWitnessDoc, trustedTime: number): void;
+    /** Remove a trusted witness (rotation: drop the old doc). */
+    removeTrustedWitness(witnessPublicKey: string, trustedTime: number): void;
+    /** Apply (insert or replace) a user grant, keyed by `username_hash`. */
+    applyGrant(grant: UserGrantSnapshot, trustedTime: number): void;
+    /**
+     * Mark a grant revoked by signing key (legacy standalone `revokeaccess`
+     * compatibility, §8.1). If the key belongs to a known grant, the grant is
+     * deactivated.
+     */
+    revokeBySigningKey(signingKey: string, trustedTime: number): void;
+    /**
+     * Apply (insert or replace) a single group document's contribution, keyed by
+     * its document id, at trusted time `T`. Because several documents may share a
+     * group name (offline merge, §8.1), the resulting `groupsByName[name]` is the
+     * union of member hashes across every contributing document seen so far.
+     */
+    applyGroupDoc(docId: string, name: string, memberHashes: string[], trustedTime: number): void;
+    /** Drop a group document's contribution (e.g. it was deleted), at time `T`. */
+    removeGroupDoc(docId: string, trustedTime: number): void;
+    /**
+     * Recompute the union-by-name {@link GroupSnapshot} for `name` from the
+     * current per-document contributions and push a node at trusted time `T`.
+     * Removes the entry when no contributing document remains.
+     */
+    private recomputeGroup;
+    /**
+     * Replace the full set of groups (mirrors the directory's post-merge result).
+     * Retained for direct/unit use; the directory feed prefers the per-revision
+     * {@link applyGroupDoc} / {@link removeGroupDoc}.
+     */
+    setGroups(groups: Map<string, GroupSnapshot>, trustedTime: number): void;
+}
+//# sourceMappingURL=DirectoryStateNode.d.ts.map

package/dist/core/accesscontrol/DirectoryStateNode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectoryStateNode.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryStateNode.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oDAAoD;IACpD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,4FAA4F;IAC5F,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,+EAA+E;IAC/E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,qBAAqB,EAAE,MAAM,CAAC;IAE9B,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAChD,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACzC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACzC,gCAAgC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,kDAAkD;IAClD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C,kDAAkD;IAClD,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAEnD,gEAAgE;IAChE,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACjC;AAED,iEAAiE;AACjE,wBAAgB,iBAAiB,IAAI,kBAAkB,CAYtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAMpF;AAgBD;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,eAAe,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAC3E;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,YAAY,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,gBAAgB,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAC/D;IAAE,EAAE,EAAE,sBAAsB,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,oBAAoB,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,GAClF;IAAE,EAAE,EAAE,gBAAgB,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,WAAW,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC;AAE5D;;;;;;;;GAQG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,IAAI,CAA2C;IAEvD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAgC;IAEhD;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAA+D;IAEzF,qCAAqC;IACrC,OAAO,IAAI,kBAAkB;IAI7B,0CAA0C;IAC1C,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAIzC,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAMb;;;OAGG;IACH,cAAc,IAAI,sBAAsB,EAAE;IAI1C;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,sBAAsB,EAAE,GAAG,IAAI;IA4CtD;;;;;OAKG;IACH,OAAO,CAAC,IAAI;IAiBZ,gDAAgD;IAChD,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAO7E,4CAA4C;IAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAQtF,kFAAkF;IAClF,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAWtD,qDAAqD;IACrD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAYzE,iEAAiE;IACjE,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAQ1E,6DAA6D;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAQzE,wEAAwE;IACxE,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAS/D;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAYjE;;;;;OAKG;IACH,aAAa,CACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,EACtB,WAAW,EAAE,MAAM,GAClB,IAAI;IAMP,+EAA+E;IAC/E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAQxD;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAoBtB;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;CAUzE"}

package/dist/core/accesscontrol/DirectoryStateNode.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DirectoryStateChainBuilder = void 0;
+exports.createGenesisNode = createGenesisNode;
+exports.nodeCovering = nodeCovering;
+/** The empty genesis node: access control not yet configured. */
+function createGenesisNode() {
+    return {
+        trustedTimeUpperBound: Number.NEGATIVE_INFINITY,
+        defaultPolicy: null,
+        dbPolicies: new Map(),
+        rulesByType: new Map(),
+        groupsByName: new Map(),
+        usersByHash: new Map(),
+        bySigningKey: new Map(),
+        trustedWitnessKeys: new Map(),
+        prev: null,
+    };
+}
+/**
+ * Walk a chain backwards to find the node that covers trusted time `T` — i.e.
+ * the most recent node whose `trustedTimeUpperBound <= T`. Returns the genesis
+ * node's predecessor semantics (an all-empty node) if `T` precedes everything.
+ */
+function nodeCovering(head, T) {
+    let node = head;
+    while (node && node.trustedTimeUpperBound > T) {
+        node = node.prev;
+    }
+    return node ?? createGenesisNode();
+}
+/** Rebuild a reverse signing-key index from a `usersByHash` map. */
+function buildBySigningKey(usersByHash) {
+    const bySigningKey = new Map();
+    for (const grant of usersByHash.values()) {
+        if (!grant.active)
+            continue;
+        for (const key of grant.signingKeys) {
+            bySigningKey.set(key, grant);
+        }
+    }
+    return bySigningKey;
+}
+/**
+ * Incrementally builds a {@link DirectoryStateNode} chain as directory
+ * documents are observed in trusted-time (iteration) order.
+ *
+ * The directory is responsible for decrypting documents and passing already
+ * structured inputs (e.g. decoded grant key arrays, merged group member
+ * hashes); this builder owns only the copy-on-write chain mechanics so it stays
+ * pure and unit-testable.
+ */
+class DirectoryStateChainBuilder {
+    constructor() {
+        this.head = createGenesisNode();
+        /**
+         * Ordered log of every mutation, used to serialize/rebuild the chain (see
+         * {@link exportDeltaLog} / {@link importDeltaLog}).
+         */
+        this.deltaLog = [];
+        /**
+         * Per-group-document member contributions, keyed by group document id, used
+         * to recompute the union-by-name {@link GroupSnapshot} map incrementally as
+         * individual group documents are revised (§8.1). Not part of the chain nodes;
+         * rebuilt deterministically when {@link importDeltaLog} replays the log.
+         */
+        this.groupContributions = new Map();
+    }
+    /** The current head node ("now"). */
+    getHead() {
+        return this.head;
+    }
+    /** The node covering trusted time `T`. */
+    getStateAt(T) {
+        return nodeCovering(this.head, T);
+    }
+    /** Reset to the empty genesis node (used on a full rebuild). */
+    reset() {
+        this.head = createGenesisNode();
+        this.deltaLog = [];
+        this.groupContributions.clear();
+    }
+    /**
+     * The ordered mutation log. This is the compact on-disk representation of the
+     * chain; persist it and rebuild later with {@link importDeltaLog}.
+     */
+    exportDeltaLog() {
+        return this.deltaLog;
+    }
+    /**
+     * Rebuild the chain by replaying a previously {@link exportDeltaLog}-ed log
+     * through the same `apply*` methods. Pure in-memory: no decryption, no
+     * Automerge — and it reconstructs the copy-on-write structural sharing.
+     */
+    importDeltaLog(deltas) {
+        this.reset();
+        for (const d of deltas) {
+            switch (d.op) {
+                case "defaultPolicy":
+                    this.applyDefaultPolicy(d.policy, d.t);
+                    break;
+                case "dbPolicy":
+                    this.applyDbPolicy(d.dbid, d.policy, d.t);
+                    break;
+                case "rule":
+                    this.applyRule(d.rule, d.t);
+                    break;
+                case "removeRule":
+                    this.removeRule(d.ruleId, d.ruleType, d.t);
+                    break;
+                case "trustedWitness":
+                    this.applyTrustedWitness(d.witness, d.t);
+                    break;
+                case "removeTrustedWitness":
+                    this.removeTrustedWitness(d.witnessPublicKey, d.t);
+                    break;
+                case "grant":
+                    this.applyGrant(d.grant, d.t);
+                    break;
+                case "revokeBySigningKey":
+                    this.revokeBySigningKey(d.signingKey, d.t);
+                    break;
+                case "groupDoc":
+                    this.applyGroupDoc(d.docId, d.name, d.memberHashes, d.t);
+                    break;
+                case "removeGroupDoc":
+                    this.removeGroupDoc(d.docId, d.t);
+                    break;
+                case "setGroups":
+                    this.setGroups(new Map(d.groups.map((g) => [g.name, g])), d.t);
+                    break;
+            }
+        }
+    }
+    /**
+     * Push a new node derived from the current head, replacing exactly one
+     * collection (`mutate` receives a working copy of the head to mutate in
+     * place) and sharing the rest by reference. `trustedTime` becomes the node's
+     * upper bound; it must be monotonically non-decreasing across calls.
+     */
+    push(trustedTime, mutate) {
+        const bound = Math.max(trustedTime, this.head.trustedTimeUpperBound);
+        const next = {
+            trustedTimeUpperBound: bound,
+            defaultPolicy: this.head.defaultPolicy,
+            dbPolicies: this.head.dbPolicies,
+            rulesByType: this.head.rulesByType,
+            groupsByName: this.head.groupsByName,
+            usersByHash: this.head.usersByHash,
+            bySigningKey: this.head.bySigningKey,
+            trustedWitnessKeys: this.head.trustedWitnessKeys,
+            prev: this.head,
+        };
+        mutate(next);
+        this.head = next;
+    }
+    /** Apply the tenant default policy document. */
+    applyDefaultPolicy(policy, trustedTime) {
+        this.deltaLog.push({ op: "defaultPolicy", t: trustedTime, policy });
+        this.push(trustedTime, (next) => {
+            next.defaultPolicy = policy;
+        });
+    }
+    /** Apply a per-database policy document. */
+    applyDbPolicy(dbid, policy, trustedTime) {
+        this.deltaLog.push({ op: "dbPolicy", t: trustedTime, dbid, policy });
+        this.push(trustedTime, (next) => {
+            next.dbPolicies = new Map(this.head.dbPolicies);
+            next.dbPolicies.set(dbid, policy);
+        });
+    }
+    /** Apply an access-control rule document (replaces any rule with the same id). */
+    applyRule(rule, trustedTime) {
+        this.deltaLog.push({ op: "rule", t: trustedTime, rule });
+        this.push(trustedTime, (next) => {
+            next.rulesByType = new Map(this.head.rulesByType);
+            const existing = next.rulesByType.get(rule.type) ?? [];
+            const replaced = existing.filter((r) => r.ruleId !== rule.ruleId);
+            replaced.push(rule);
+            next.rulesByType.set(rule.type, replaced);
+        });
+    }
+    /** Remove a rule (e.g. its document was deleted). */
+    removeRule(ruleId, ruleType, trustedTime) {
+        this.deltaLog.push({ op: "removeRule", t: trustedTime, ruleId, ruleType });
+        this.push(trustedTime, (next) => {
+            next.rulesByType = new Map(this.head.rulesByType);
+            const existing = next.rulesByType.get(ruleType) ?? [];
+            next.rulesByType.set(ruleType, existing.filter((r) => r.ruleId !== ruleId));
+        });
+    }
+    /** Apply a trusted-witness document, keyed by its public key. */
+    applyTrustedWitness(witness, trustedTime) {
+        this.deltaLog.push({ op: "trustedWitness", t: trustedTime, witness });
+        this.push(trustedTime, (next) => {
+            next.trustedWitnessKeys = new Map(this.head.trustedWitnessKeys);
+            next.trustedWitnessKeys.set(witness.witnessPublicKey, witness);
+        });
+    }
+    /** Remove a trusted witness (rotation: drop the old doc). */
+    removeTrustedWitness(witnessPublicKey, trustedTime) {
+        this.deltaLog.push({ op: "removeTrustedWitness", t: trustedTime, witnessPublicKey });
+        this.push(trustedTime, (next) => {
+            next.trustedWitnessKeys = new Map(this.head.trustedWitnessKeys);
+            next.trustedWitnessKeys.delete(witnessPublicKey);
+        });
+    }
+    /** Apply (insert or replace) a user grant, keyed by `username_hash`. */
+    applyGrant(grant, trustedTime) {
+        this.deltaLog.push({ op: "grant", t: trustedTime, grant });
+        this.push(trustedTime, (next) => {
+            next.usersByHash = new Map(this.head.usersByHash);
+            next.usersByHash.set(grant.usernameHash, grant);
+            next.bySigningKey = buildBySigningKey(next.usersByHash);
+        });
+    }
+    /**
+     * Mark a grant revoked by signing key (legacy standalone `revokeaccess`
+     * compatibility, §8.1). If the key belongs to a known grant, the grant is
+     * deactivated.
+     */
+    revokeBySigningKey(signingKey, trustedTime) {
+        const grant = this.head.bySigningKey.get(signingKey);
+        if (!grant)
+            return;
+        this.deltaLog.push({ op: "revokeBySigningKey", t: trustedTime, signingKey });
+        this.push(trustedTime, (next) => {
+            next.usersByHash = new Map(this.head.usersByHash);
+            const deactivated = { ...grant, active: false };
+            next.usersByHash.set(deactivated.usernameHash, deactivated);
+            next.bySigningKey = buildBySigningKey(next.usersByHash);
+        });
+    }
+    /**
+     * Apply (insert or replace) a single group document's contribution, keyed by
+     * its document id, at trusted time `T`. Because several documents may share a
+     * group name (offline merge, §8.1), the resulting `groupsByName[name]` is the
+     * union of member hashes across every contributing document seen so far.
+     */
+    applyGroupDoc(docId, name, memberHashes, trustedTime) {
+        this.deltaLog.push({ op: "groupDoc", t: trustedTime, docId, name, memberHashes });
+        this.groupContributions.set(docId, { name, memberHashes: [...memberHashes] });
+        this.recomputeGroup(name, trustedTime);
+    }
+    /** Drop a group document's contribution (e.g. it was deleted), at time `T`. */
+    removeGroupDoc(docId, trustedTime) {
+        const existing = this.groupContributions.get(docId);
+        if (!existing)
+            return;
+        this.deltaLog.push({ op: "removeGroupDoc", t: trustedTime, docId });
+        this.groupContributions.delete(docId);
+        this.recomputeGroup(existing.name, trustedTime);
+    }
+    /**
+     * Recompute the union-by-name {@link GroupSnapshot} for `name` from the
+     * current per-document contributions and push a node at trusted time `T`.
+     * Removes the entry when no contributing document remains.
+     */
+    recomputeGroup(name, trustedTime) {
+        const memberHashes = new Set();
+        let hasContribution = false;
+        for (const contribution of this.groupContributions.values()) {
+            if (contribution.name !== name)
+                continue;
+            hasContribution = true;
+            for (const hash of contribution.memberHashes) {
+                memberHashes.add(hash);
+            }
+        }
+        this.push(trustedTime, (next) => {
+            next.groupsByName = new Map(this.head.groupsByName);
+            if (hasContribution) {
+                next.groupsByName.set(name, { name, memberHashes: [...memberHashes] });
+            }
+            else {
+                next.groupsByName.delete(name);
+            }
+        });
+    }
+    /**
+     * Replace the full set of groups (mirrors the directory's post-merge result).
+     * Retained for direct/unit use; the directory feed prefers the per-revision
+     * {@link applyGroupDoc} / {@link removeGroupDoc}.
+     */
+    setGroups(groups, trustedTime) {
+        this.deltaLog.push({
+            op: "setGroups",
+            t: trustedTime,
+            groups: [...groups.values()].map((g) => ({ name: g.name, memberHashes: [...g.memberHashes] })),
+        });
+        this.push(trustedTime, (next) => {
+            next.groupsByName = new Map(groups);
+        });
+    }
+}
+exports.DirectoryStateChainBuilder = DirectoryStateChainBuilder;
+//# sourceMappingURL=DirectoryStateNode.js.map

package/dist/core/accesscontrol/DirectoryStateNode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectoryStateNode.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryStateNode.ts"],"names":[],"mappings":";;;AA4EA,8CAYC;AAOD,oCAMC;AA1BD,iEAAiE;AACjE,SAAgB,iBAAiB;IAC/B,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;QAC/C,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,kBAAkB,EAAE,IAAI,GAAG,EAAE;QAC7B,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAwB,EAAE,CAAS;IAC9D,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CACxB,WAA2C;IAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAyBD;;;;;;;;GAQG;AACH,MAAa,0BAA0B;IAAvC;QACU,SAAI,GAAuB,iBAAiB,EAAE,CAAC;QAEvD;;;WAGG;QACK,aAAQ,GAA6B,EAAE,CAAC;QAEhD;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAAoD,CAAC;IA4P3F,CAAC;IA1PC,qCAAqC;IACrC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,CAAS;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAgC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK,eAAe;oBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,MAAM;oBACT,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM;gBACR,KAAK,YAAY;oBACf,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM;gBACR,KAAK,sBAAsB;oBACzB,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,OAAO;oBACV,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,WAAW;oBACd,IAAI,CAAC,SAAS,CACZ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EACzC,CAAC,CAAC,CAAC,CACJ,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,WAAmB,EAAE,MAA0C;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAuB;YAC/B,qBAAqB,EAAE,KAAK;YAC5B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACtC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,MAA8B,EAAE,WAAmB;QACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,aAAa,CAAC,IAAY,EAAE,MAA8B,EAAE,WAAmB;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,SAAS,CAAC,IAAgB,EAAE,WAAmB;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,MAAc,EAAE,QAAkB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mBAAmB,CAAC,OAA0B,EAAE,WAAmB;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,gBAAwB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,UAAU,CAAC,KAAwB,EAAE,WAAmB;QACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,WAAW,GAAsB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,KAAa,EACb,IAAY,EACZ,YAAsB,EACtB,WAAmB;QAEnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAAY,EAAE,WAAmB;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YACzC,eAAe,GAAG,IAAI,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC7C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAkC,EAAE,WAAmB;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,WAAW;YACf,CAAC,EAAE,WAAW;YACd,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA3QD,gEA2QC"}

package/dist/core/accesscontrol/DirectoryTimeTravelIndex.d.ts

@@ -0,0 +1,118 @@
+import { RevisionCursor } from "../types";
+import type { LocalCacheStore } from "../cache/LocalCacheStore";
+import type { ICacheable } from "../cache/CacheManager";
+import { DirectoryStateChainBuilder, DirectoryStateNode } from "./DirectoryStateNode";
+/** LocalCacheStore `type` namespace for the persisted time-travel chain. */
+export declare const DIR_TT_CACHE_TYPE = "dir-tt";
+/** Bump when {@link PersistedTimeTravelState} layout changes (forces rebuild). */
+export declare const DIR_TT_CACHE_VERSION = 2;
+/**
+ * A directory document revision the chain is built from, keyed by its store
+ * entry id. This is the raw projection *input* (not the projected delta), so the
+ * chain can be rebuilt deterministically in trusted-time order by re-running the
+ * projection — which is what makes out-of-order arrivals and re-stamps correct:
+ * a re-emitted revision simply replaces the prior record for the same entry id,
+ * and the whole chain is replayed in sorted order.
+ */
+export interface StoredDirectoryRevision {
+    /** Store entry id of the change (the upsert key). */
+    entryId: string;
+    /** Document the revision belongs to. */
+    docId: string;
+    /** The document's merged data as of this revision's trusted-time frontier. */
+    data: Record<string, unknown>;
+    /** Whether the document was deleted as of this revision. */
+    deleted: boolean;
+    /** Trusted time of this revision (orders the chain). */
+    trustedTime: number;
+    /** True when the trusted time came from a witness `receivedAt`. */
+    witnessed: boolean;
+}
+/**
+ * Projection callback: apply a single stored revision onto the chain builder.
+ * Supplied by the directory (which owns group-name normalization and the
+ * document-classification rules) so this index stays decoupled from projection.
+ */
+export type ProjectRevisionFn = (builder: DirectoryStateChainBuilder, revision: StoredDirectoryRevision) => void;
+/**
+ * Owns the access-control time-travel directory-state chain (docs/accesscontrol.md
+ * §8): the {@link DirectoryStateChainBuilder}, its resume cursor in the
+ * revision-grain changefeed, and the bookkeeping needed to keep it current and
+ * persist it.
+ *
+ * Revisions are accumulated keyed by store entry id ({@link upsertRevision}) and
+ * the chain is (re)built by replaying them through the projection in
+ * `(trustedTime, entryId)` order ({@link rebuild}). Keying by entry id makes
+ * out-of-order arrivals and witness re-stamps correct without any special-casing
+ * in the chain builder: a later, earlier-trusted-time revision (or a re-stamped
+ * one) just replaces the prior record and the chain is replayed in sorted order,
+ * so every node — head and intermediate — reflects the correct trusted-time
+ * frontier. Replaying is pure in-memory (no decryption / Automerge), so it is
+ * cheap relative to the (incremental) feed that produces the revisions.
+ */
+export declare class DirectoryTimeTravelIndex implements ICacheable {
+    private readonly cachePrefix;
+    /** The copy-on-write chain. Rebuilt from {@link revisions} via the projection. */
+    readonly builder: DirectoryStateChainBuilder;
+    /** Revisions the chain is built from, keyed by store entry id. */
+    private revisions;
+    /** Resume position in the revision feed; `null` means "scan from genesis". */
+    cursor: RevisionCursor | null;
+    /**
+     * The directory DB's latest `changeSeq` observed at the last build. Persisted
+     * and restored so the directory's fast-path gate (see
+     * `BaseMindooTenantDirectory.ensureTimeTravelCurrent`) can short-circuit on a
+     * cold start when nothing has changed since the chain was flushed.
+     */
+    lastChangeSeq: number | null;
+    /**
+     * Entry ids of folded revisions that are still un-witnessed (their trusted
+     * time is the provisional `now`). Exposed via {@link hasUnwitnessed} so the
+     * directory knows the head overlay may still move when the entries are
+     * witnessed.
+     */
+    private unwitnessedIds;
+    private dirty;
+    constructor(cachePrefix: string);
+    /** The head node ("now"). */
+    getHead(): DirectoryStateNode;
+    /** The node covering trusted time `T`. */
+    getStateAt(T: number): DirectoryStateNode;
+    /** Reset to an empty chain (full rebuild from genesis). */
+    reset(): void;
+    /**
+     * Record the directory DB's latest `changeSeq` as of this build so it can be
+     * persisted alongside the chain and consulted by the cold-start gate.
+     */
+    recordChangeSeq(changeSeq: number | null): void;
+    /**
+     * True while any folded revision is still un-witnessed: its provisional
+     * trusted time (`now`) may move when the entry is later witnessed, so consumers
+     * should not treat the head as final for those entries.
+     */
+    hasUnwitnessed(): boolean;
+    /**
+     * Insert or replace a revision (keyed by entry id) and advance the resume
+     * cursor. Replacing an existing entry id is how out-of-order arrivals and
+     * witness re-stamps are absorbed; the chain is rebuilt separately via
+     * {@link rebuild}. Returns true if the stored set changed.
+     */
+    upsertRevision(revision: StoredDirectoryRevision, cursor: RevisionCursor | null): boolean;
+    /**
+     * Rebuild the chain by replaying every stored revision through `project` in
+     * `(trustedTime, entryId)` order. Pure in-memory: no decryption, no Automerge.
+     */
+    rebuild(project: ProjectRevisionFn): void;
+    getCachePrefix(): string;
+    hasDirtyState(): boolean;
+    clearDirty(): void;
+    flushToCache(store: LocalCacheStore): Promise<number>;
+    /**
+     * Restore the persisted revisions and cursor. Returns false (leaving the index
+     * empty) on a cache miss or version mismatch, so the caller does a full
+     * rebuild. The caller must invoke {@link rebuild} afterwards to materialize the
+     * chain (this index does not own the projection).
+     */
+    restoreFromCache(store: LocalCacheStore): Promise<boolean>;
+}
+//# sourceMappingURL=DirectoryTimeTravelIndex.d.ts.map

package/dist/core/accesscontrol/DirectoryTimeTravelIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectoryTimeTravelIndex.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryTimeTravelIndex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEtF,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;CACpB;AAoBD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,0BAA0B,EACnC,QAAQ,EAAE,uBAAuB,KAC9B,IAAI,CAAC;AAEV;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,wBAAyB,YAAW,UAAU;IA4B7C,OAAO,CAAC,QAAQ,CAAC,WAAW;IA3BxC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,6BAAoC;IAEpD,kEAAkE;IAClE,OAAO,CAAC,SAAS,CAA8C;IAE/D,8EAA8E;IAC9E,MAAM,EAAE,cAAc,GAAG,IAAI,CAAQ;IAErC;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAQ;IAEpC;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAqB;IAE3C,OAAO,CAAC,KAAK,CAAS;gBAEO,WAAW,EAAE,MAAM;IAEhD,6BAA6B;IAC7B,OAAO,IAAI,kBAAkB;IAI7B,0CAA0C;IAC1C,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAIzC,2DAA2D;IAC3D,KAAK,IAAI,IAAI;IASb;;;OAGG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO/C;;;;OAIG;IACH,cAAc,IAAI,OAAO;IAIzB;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO;IAoBzF;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAezC,cAAc,IAAI,MAAM;IAIxB,aAAa,IAAI,OAAO;IAIxB,UAAU,IAAI,IAAI;IAIZ,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAY3D;;;;;OAKG;IACG,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;CAkBjE"}