mindoodb 0.0.50 → 0.0.53

package/dist/core/accesscontrol/DirectoryStateNode.js

@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DirectoryStateChainBuilder = void 0;
 exports.createGenesisNode = createGenesisNode;
 exports.nodeCovering = nodeCovering;
+exports.isSamePerson = isSamePerson;
+exports.grantAtOrBefore = grantAtOrBefore;
+exports.signingKeysEqual = signingKeysEqual;
+exports.grantForSigningKey = grantForSigningKey;
 /** The empty genesis node: access control not yet configured. */
 function createGenesisNode() {
     return {
@@ -29,6 +33,54 @@ function nodeCovering(head, T) {
     }
     return node ?? createGenesisNode();
 }
+/**
+ * Whether `creatorSigningKey` and `signerSigningKey` belong to the same person.
+ *
+ * The creator is resolved against {@link creatorNode} (typically the directory
+ * at the trusted time of the `doc_create` entry) so authorship survives
+ * retirement of the creating device. If that node no longer indexes the
+ * creating key — because the device was later retired, or because the
+ * creator's trusted time sits past every directory bound — we walk `prev`
+ * until we find a node that still had the key. Signing keys are not reused
+ * across people, so that look-back still names the original person.
+ *
+ * The signer is resolved against {@link signerNode} only (no look-back) so a
+ * revoked device cannot act as `$author`.
+ *
+ * Keys that never appear in a grant (admin, trusted non-user keys) fall back
+ * to device-key equality, matching the historical `$author` behaviour for
+ * those identities.
+ */
+function isSamePerson(creatorNode, signerNode, creatorSigningKey, signerSigningKey) {
+    const creatorGrant = grantAtOrBefore(creatorNode, creatorSigningKey);
+    const signerGrant = grantForSigningKey(signerNode, signerSigningKey);
+    if (creatorGrant && signerGrant) {
+        return creatorGrant.usernameHash === signerGrant.usernameHash;
+    }
+    // Signer is (or never was) a granted user-device. A revoked grant key is
+    // absent from `bySigningKey` at signer time and must not pass, even if it
+    // still matches the creator key byte-for-byte.
+    if (signerGrant)
+        return false;
+    if (creatorGrant)
+        return false;
+    return creatorSigningKey === signerSigningKey;
+}
+/**
+ * The grant that contained `signingKey` at `node`, or at the most recent
+ * predecessor that still indexed it. Used for creator resolution so a retired
+ * creating device can still be attributed to its person.
+ */
+function grantAtOrBefore(node, signingKey) {
+    let current = node;
+    while (current) {
+        const grant = grantForSigningKey(current, signingKey);
+        if (grant)
+            return grant;
+        current = current.prev;
+    }
+    return undefined;
+}
 /** Rebuild a reverse signing-key index from a `usersByHash` map. */
 function buildBySigningKey(usersByHash) {
     const bySigningKey = new Map();
@@ -41,6 +93,25 @@ function buildBySigningKey(usersByHash) {
     }
     return bySigningKey;
 }
+/** True when two Ed25519 PEM signing keys are the same device, ignoring whitespace. */
+function signingKeysEqual(a, b) {
+    if (a === b)
+        return true;
+    const left = a.replace(/\s+/g, "");
+    const right = b.replace(/\s+/g, "");
+    return left.length > 0 && left === right;
+}
+/** Match a signing key in {@link DirectoryStateNode.bySigningKey}, ignoring PEM whitespace. */
+function grantForSigningKey(node, signingKey) {
+    const exact = node.bySigningKey.get(signingKey);
+    if (exact)
+        return exact;
+    for (const [key, grant] of node.bySigningKey) {
+        if (signingKeysEqual(key, signingKey))
+            return grant;
+    }
+    return undefined;
+}
 /**
  * Incrementally builds a {@link DirectoryStateNode} chain as directory
  * documents are observed in trusted-time (iteration) order.
@@ -65,6 +136,13 @@ class DirectoryStateChainBuilder {
          * rebuilt deterministically when {@link importDeltaLog} replays the log.
          */
         this.groupContributions = new Map();
+        /**
+         * Per-grant-document contributions, keyed by grant document id. Several
+         * `grantaccess` documents may share a `username_hash` (offline duplicates /
+         * historical re-registers); the live trust cache unions their keys, so the
+         * time-travel node must do the same (§6.5, §8.1).
+         */
+        this.grantContributions = new Map();
     }
     /** The current head node ("now"). */
     getHead() {
@@ -79,6 +157,7 @@ class DirectoryStateChainBuilder {
         this.head = createGenesisNode();
         this.deltaLog = [];
         this.groupContributions.clear();
+        this.grantContributions.clear();
     }
     /**
      * The ordered mutation log. This is the compact on-disk representation of the
@@ -117,6 +196,12 @@ class DirectoryStateChainBuilder {
                 case "grant":
                     this.applyGrant(d.grant, d.t);
                     break;
+                case "grantDoc":
+                    this.applyGrantDoc(d.docId, d.grant, d.t);
+                    break;
+                case "removeGrantDoc":
+                    this.removeGrantDoc(d.docId, d.t);
+                    break;
                 case "revokeBySigningKey":
                     this.revokeBySigningKey(d.signingKey, d.t);
                     break;
@@ -205,12 +290,80 @@ class DirectoryStateChainBuilder {
             next.trustedWitnessKeys.delete(witnessPublicKey);
         });
     }
-    /** Apply (insert or replace) a user grant, keyed by `username_hash`. */
+    /**
+     * Apply (insert or replace) a user grant for a single logical stream keyed by
+     * `username_hash`. Equivalent to {@link applyGrantDoc} with a synthetic
+     * document id — kept for unit tests and legacy delta logs. Prefer
+     * {@link applyGrantDoc} when projecting real directory revisions so multiple
+     * grant documents for the same user union their device keys.
+     */
     applyGrant(grant, trustedTime) {
-        this.deltaLog.push({ op: "grant", t: trustedTime, grant });
+        this.applyGrantDoc(`grant:${grant.usernameHash}`, grant, trustedTime);
+    }
+    /**
+     * Apply (insert or replace) one grant document's contribution at trusted time
+     * `T`. Because several documents may share a `username_hash` (offline merge /
+     * duplicate registers), {@link DirectoryStateNode.usersByHash} is the union of
+     * active keys across every contributing document — matching
+     * `trustedKeysCache` / `getUserGrantOverview`.
+     */
+    applyGrantDoc(docId, grant, trustedTime) {
+        const previous = this.grantContributions.get(docId);
+        this.deltaLog.push({ op: "grantDoc", t: trustedTime, docId, grant });
+        this.grantContributions.set(docId, grant);
+        if (previous && previous.usernameHash !== grant.usernameHash) {
+            this.recomputeUser(previous.usernameHash, trustedTime);
+        }
+        this.recomputeUser(grant.usernameHash, trustedTime);
+    }
+    /** Drop a grant document's contribution (e.g. it was deleted), at time `T`. */
+    removeGrantDoc(docId, trustedTime) {
+        const existing = this.grantContributions.get(docId);
+        if (!existing)
+            return;
+        this.deltaLog.push({ op: "removeGrantDoc", t: trustedTime, docId });
+        this.grantContributions.delete(docId);
+        this.recomputeUser(existing.usernameHash, trustedTime);
+    }
+    /**
+     * Recompute the union-by-hash {@link UserGrantSnapshot} for `usernameHash`
+     * from the current per-document contributions and push a node at trusted
+     * time `T`. Removes the entry when no contributing document remains.
+     */
+    recomputeUser(usernameHash, trustedTime) {
+        // Pair signing → encryption so index alignment survives a cross-doc union
+        // (encryption arrays alone can omit empty keys and are not a reliable zip).
+        const encBySigning = new Map();
+        const wipeRequested = new Set();
+        let hasContribution = false;
+        for (const contribution of this.grantContributions.values()) {
+            if (contribution.usernameHash !== usernameHash)
+                continue;
+            hasContribution = true;
+            contribution.signingKeys.forEach((signingKey, index) => {
+                if (!encBySigning.has(signingKey)) {
+                    encBySigning.set(signingKey, contribution.encryptionKeys[index] ?? "");
+                }
+            });
+            for (const wipeKey of contribution.wipeRequestedSigningKeys) {
+                wipeRequested.add(wipeKey);
+            }
+        }
         this.push(trustedTime, (next) => {
             next.usersByHash = new Map(this.head.usersByHash);
-            next.usersByHash.set(grant.usernameHash, grant);
+            if (hasContribution) {
+                const signingKeys = [...encBySigning.keys()];
+                next.usersByHash.set(usernameHash, {
+                    usernameHash,
+                    signingKeys,
+                    encryptionKeys: signingKeys.map((key) => encBySigning.get(key) ?? ""),
+                    wipeRequestedSigningKeys: [...wipeRequested],
+                    active: signingKeys.length > 0,
+                });
+            }
+            else {
+                next.usersByHash.delete(usernameHash);
+            }
             next.bySigningKey = buildBySigningKey(next.usersByHash);
         });
     }
@@ -220,7 +373,7 @@ class DirectoryStateChainBuilder {
      * deactivated.
      */
     revokeBySigningKey(signingKey, trustedTime) {
-        const grant = this.head.bySigningKey.get(signingKey);
+        const grant = grantForSigningKey(this.head, signingKey);
         if (!grant)
             return;
         this.deltaLog.push({ op: "revokeBySigningKey", t: trustedTime, signingKey });

package/dist/core/accesscontrol/DirectoryStateNode.js.map

@@ -1 +1 @@
-{"version":3,"file":"DirectoryStateNode.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryStateNode.ts"],"names":[],"mappings":";;;AA4EA,8CAYC;AAOD,oCAMC;AA1BD,iEAAiE;AACjE,SAAgB,iBAAiB;IAC/B,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;QAC/C,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,kBAAkB,EAAE,IAAI,GAAG,EAAE;QAC7B,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAwB,EAAE,CAAS;IAC9D,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CACxB,WAA2C;IAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAyBD;;;;;;;;GAQG;AACH,MAAa,0BAA0B;IAAvC;QACU,SAAI,GAAuB,iBAAiB,EAAE,CAAC;QAEvD;;;WAGG;QACK,aAAQ,GAA6B,EAAE,CAAC;QAEhD;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAAoD,CAAC;IA4P3F,CAAC;IA1PC,qCAAqC;IACrC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,CAAS;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAgC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK,eAAe;oBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,MAAM;oBACT,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM;gBACR,KAAK,YAAY;oBACf,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM;gBACR,KAAK,sBAAsB;oBACzB,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,OAAO;oBACV,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,WAAW;oBACd,IAAI,CAAC,SAAS,CACZ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EACzC,CAAC,CAAC,CAAC,CACJ,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,WAAmB,EAAE,MAA0C;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAuB;YAC/B,qBAAqB,EAAE,KAAK;YAC5B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACtC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,MAA8B,EAAE,WAAmB;QACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,aAAa,CAAC,IAAY,EAAE,MAA8B,EAAE,WAAmB;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,SAAS,CAAC,IAAgB,EAAE,WAAmB;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,MAAc,EAAE,QAAkB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mBAAmB,CAAC,OAA0B,EAAE,WAAmB;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,gBAAwB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,UAAU,CAAC,KAAwB,EAAE,WAAmB;QACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,WAAW,GAAsB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,KAAa,EACb,IAAY,EACZ,YAAsB,EACtB,WAAmB;QAEnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAAY,EAAE,WAAmB;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YACzC,eAAe,GAAG,IAAI,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC7C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAkC,EAAE,WAAmB;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,WAAW;YACf,CAAC,EAAE,WAAW;YACd,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA3QD,gEA2QC"}
+{"version":3,"file":"DirectoryStateNode.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryStateNode.ts"],"names":[],"mappings":";;;AA4EA,8CAYC;AAOD,oCAMC;AAoBD,oCAiBC;AAOD,0CAWC;AAiBD,4CAKC;AAGD,gDAUC;AApHD,iEAAiE;AACjE,SAAgB,iBAAiB;IAC/B,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;QAC/C,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,kBAAkB,EAAE,IAAI,GAAG,EAAE;QAC7B,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAwB,EAAE,CAAS;IAC9D,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,YAAY,CAC1B,WAA+B,EAC/B,UAA8B,EAC9B,iBAAyB,EACzB,gBAAwB;IAExB,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACrE,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY,CAAC;IAChE,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,KAAK,gBAAgB,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,IAAwB,EACxB,UAAkB;IAElB,IAAI,OAAO,GAA8B,IAAI,CAAC;IAC9C,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CACxB,WAA2C;IAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,uFAAuF;AACvF,SAAgB,gBAAgB,CAAC,CAAS,EAAE,CAAS;IACnD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAChC,IAAwB,EACxB,UAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA2BD;;;;;;;;GAQG;AACH,MAAa,0BAA0B;IAAvC;QACU,SAAI,GAAuB,iBAAiB,EAAE,CAAC;QAEvD;;;WAGG;QACK,aAAQ,GAA6B,EAAE,CAAC;QAEhD;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAAoD,CAAC;QAEzF;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAuUpE,CAAC;IArUC,qCAAqC;IACrC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,CAAS;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAgC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK,eAAe;oBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,MAAM;oBACT,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM;gBACR,KAAK,YAAY;oBACf,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM;gBACR,KAAK,sBAAsB;oBACzB,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,OAAO;oBACV,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,WAAW;oBACd,IAAI,CAAC,SAAS,CACZ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EACzC,CAAC,CAAC,CAAC,CACJ,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,WAAmB,EAAE,MAA0C;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAuB;YAC/B,qBAAqB,EAAE,KAAK;YAC5B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACtC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,MAA8B,EAAE,WAAmB;QACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,aAAa,CAAC,IAAY,EAAE,MAA8B,EAAE,WAAmB;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,SAAS,CAAC,IAAgB,EAAE,WAAmB;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,MAAc,EAAE,QAAkB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mBAAmB,CAAC,OAA0B,EAAE,WAAmB;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,gBAAwB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,KAAwB,EAAE,WAAmB;QACtD,IAAI,CAAC,aAAa,CAAC,SAAS,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,KAAa,EAAE,KAAwB,EAAE,WAAmB;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,YAAoB,EAAE,WAAmB;QAC7D,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,YAAY,KAAK,YAAY;gBAAE,SAAS;YACzD,eAAe,GAAG,IAAI,CAAC;YACvB,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;gBACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;gBAC5D,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE;oBACjC,YAAY;oBACZ,WAAW;oBACX,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACrE,wBAAwB,EAAE,CAAC,GAAG,aAAa,CAAC;oBAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,WAAW,GAAsB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,KAAa,EACb,IAAY,EACZ,YAAsB,EACtB,WAAmB;QAEnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAAY,EAAE,WAAmB;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YACzC,eAAe,GAAG,IAAI,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC7C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAkC,EAAE,WAAmB;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,WAAW;YACf,CAAC,EAAE,WAAW;YACd,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA9VD,gEA8VC"}

package/dist/core/accesscontrol/directoryProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directoryProjection.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,UAAU,EACV,sBAAsB,EAEtB,QAAQ,EAIT,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,0BAA0B,EAE3B,MAAM,sBAAsB,CAAC;AAI9B,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,CA+BpF;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAmB1F;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,GAC5B,IAAI,CAyCN"}
+{"version":3,"file":"directoryProjection.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,UAAU,EACV,sBAAsB,EAEtB,QAAQ,EAIT,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,0BAA0B,EAE3B,MAAM,sBAAsB,CAAC;AAI9B,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,CA+BpF;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAmB1F;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,GAC5B,IAAI,CAkDN"}

package/dist/core/accesscontrol/directoryProjection.js

@@ -67,19 +67,28 @@ function parseRuleDoc(data, ruleType) {
 function projectDirectoryRevision(builder, input) {
     const { docId, data, deleted, trustedTime } = input;
     // Grant documents (`useroperation`/`grantaccess`). Revocation is expressed by
-    // removing keys from the grant in place (§6.5), so applyGrant with an empty
-    // key array deactivates the user.
+    // removing keys from the grant in place (§6.5), so a contribution with an
+    // empty key array deactivates that document's share of the user. Multiple
+    // grant documents for the same `username_hash` union their device keys
+    // (matching `trustedKeysCache` / admin grant overview).
     if (data.form === "useroperation" && data.type === "grantaccess") {
+        if (deleted) {
+            builder.removeGrantDoc(docId, trustedTime);
+            return;
+        }
         if (typeof data.username_hash === "string") {
-            const signingKeys = (0, grantKeys_1.extractSigningPublicKeys)(data);
+            // Build signing/encryption arrays from paired entries so index alignment
+            // survives the cross-document union in the chain builder.
+            const pairs = (0, grantKeys_1.extractActiveKeyPairs)(data);
+            const signingKeys = pairs.map((pair) => pair.signingPublicKey);
             const grant = {
                 usernameHash: data.username_hash,
                 signingKeys,
-                encryptionKeys: (0, grantKeys_1.extractEncryptionPublicKeys)(data),
+                encryptionKeys: pairs.map((pair) => pair.encryptionPublicKey),
                 wipeRequestedSigningKeys: (0, grantKeys_1.extractWipeRequestedSigningKeys)(data),
                 active: signingKeys.length > 0,
             };
-            builder.applyGrant(grant, trustedTime);
+            builder.applyGrantDoc(docId, grant, trustedTime);
         }
         return;
     }

package/dist/core/accesscontrol/directoryProjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"directoryProjection.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":";;AAwBA,wCA+BC;AAGD,oCAmBC;AAqBD,4DA4CC;AA9ID,2CAIqB;AACrB,mCAUiB;AAMjB,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,CAAC,CAAU,EAAwB,EAAE,CACvD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC;QAC/E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACnF,sBAAsB,EACpB,IAAI,CAAC,sBAAsB,KAAK,sBAAsB;YACpD,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,IAAI,CAAC,sBAAsB,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,6BAA6B,EAC3B,OAAO,IAAI,CAAC,6BAA6B,KAAK,QAAQ;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,6BAA6B;YACpC,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,YAAY,CAAC,IAA6B,EAAE,QAAkB;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,CAAC,CAAE,IAAI,CAAC,UAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAChE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,IAAI,CAAC,MAAgB;QAC7B,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChF,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACrD,UAAU;QACV,YAAY,EAAE,WAAW;QACzB,eAAe,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACrF,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;KAClD,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,OAAmC,EACnC,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpD,8EAA8E;IAC9E,4EAA4E;IAC5E,kCAAkC;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjE,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAA,oCAAwB,EAAC,IAAI,CAAC,CAAC;YACnD,MAAM,KAAK,GAAsB;gBAC/B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW;gBACX,cAAc,EAAE,IAAA,uCAA2B,EAAC,IAAI,CAAC;gBACjD,wBAAwB,EAAE,IAAA,2CAA+B,EAAC,IAAI,CAAC;gBAC/D,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;aAC/B,CAAC;YACF,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzC,CAAC;QACD,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,2BAAmB,EAAE,CAAC;QACtC,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAC9B,OAAmC,EACnC,KAAa,EACb,IAA6B,EAC7B,OAAgB,EAChB,WAAmB;IAEnB,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,iCAAyB,EAAE,CAAC;YACxC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,4BAAoB,EAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAsB;gBACjC,IAAI,EAAE,2BAAmB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;YACF,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,8BAA8B;IAC9B,IAAK,kBAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAgB,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"directoryProjection.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":";;AAuBA,wCA+BC;AAGD,oCAmBC;AAqBD,4DAqDC;AAtJD,2CAGqB;AACrB,mCAUiB;AAMjB,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,CAAC,CAAU,EAAwB,EAAE,CACvD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC;QAC/E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACnF,sBAAsB,EACpB,IAAI,CAAC,sBAAsB,KAAK,sBAAsB;YACpD,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,IAAI,CAAC,sBAAsB,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,6BAA6B,EAC3B,OAAO,IAAI,CAAC,6BAA6B,KAAK,QAAQ;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,6BAA6B;YACpC,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,YAAY,CAAC,IAA6B,EAAE,QAAkB;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,CAAC,CAAE,IAAI,CAAC,UAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAChE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,IAAI,CAAC,MAAgB;QAC7B,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChF,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACrD,UAAU;QACV,YAAY,EAAE,WAAW;QACzB,eAAe,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACrF,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;KAClD,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,OAAmC,EACnC,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpD,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC3C,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,KAAK,GAAG,IAAA,iCAAqB,EAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAsB;gBAC/B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW;gBACX,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAC7D,wBAAwB,EAAE,IAAA,2CAA+B,EAAC,IAAI,CAAC;gBAC/D,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;aAC/B,CAAC;YACF,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,2BAAmB,EAAE,CAAC;QACtC,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAC9B,OAAmC,EACnC,KAAa,EACb,IAA6B,EAC7B,OAAgB,EAChB,WAAmB;IAEnB,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,iCAAyB,EAAE,CAAC;YACxC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,4BAAoB,EAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAsB;gBACjC,IAAI,EAAE,2BAAmB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;YACF,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,8BAA8B;IAC9B,IAAK,kBAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAgB,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/accesscontrol/grantKeys.d.ts

@@ -6,16 +6,18 @@
  * Active devices and revoked devices live in TWO SEPARATE lists:
  *
  *  - `userKeyPairs`: the ACTIVE device key pairs, an array of
- *    `{ signingPublicKey, encryptionPublicKey, label? }` objects. Pairing the
- *    keys per device keeps a device's signing and encryption keys together and
- *    lets each carry an optional human-readable label. This is the canonical
- *    list the server/auth treat as granting access. Because revoked devices are
- *    NOT in this list, any reader (old or new) that treats `userKeyPairs` as
- *    "the keys that have access" is correct without understanding revocation.
+ *    `{ signingPublicKey, encryptionPublicKey, label?, addedAt?, joinResponseWrapped? }` objects.
+ *    Pairing the keys per device keeps a device's signing and encryption keys
+ *    together and lets each carry an optional human-readable label and the
+ *    trusted-time it was added. This is the canonical list the server/auth
+ *    treat as granting access. Because revoked devices are NOT in this list,
+ *    any reader (old or new) that treats `userKeyPairs` as "the keys that have
+ *    access" is correct without understanding revocation.
  *  - `revokedUserKeyPairs`: the RETAINED revoked device key pairs (§6.5), same
- *    shape plus an optional `revokedAt` timestamp. Membership in this list — not
- *    a per-entry flag — is what marks a device revoked. Retaining them lets
- *    admin UIs list "devices with revoked access" and optionally restore them.
+ *    shape plus an optional `revokedAt` timestamp (and retained `addedAt`).
+ *    Membership in this list — not a per-entry flag — is what marks a device
+ *    revoked. Retaining them lets admin UIs list "devices with revoked access"
+ *    and optionally restore them.
  *
  * For older clients that predate `userKeyPairs`, writers also mirror the ACTIVE
  * keys into the legacy forms, read in this order of authority:
@@ -41,9 +43,9 @@
 import type { GrantKeyPair } from "../types";
 /**
  * All device key pairs on this document — active first, then revoked — in the
- * canonical `{ signingPublicKey, encryptionPublicKey, label?, revoked?,
- * revokedAt? }` shape (§6.5). Used by write paths that need to preserve the
- * full device set (e.g. relabel/merge/revoke) before re-applying.
+ * canonical `{ signingPublicKey, encryptionPublicKey, label?, addedAt?,
+ * revoked?, revokedAt? }` shape (§6.5). Used by write paths that need to
+ * preserve the full device set (e.g. relabel/merge/revoke) before re-applying.
  *
  * For older documents that predate the canonical lists it reconstructs pairs
  * from the parallel signing/encryption arrays (index-aligned) or the legacy
@@ -82,8 +84,9 @@ export declare function applyKeyPairFields(data: Record<string, unknown>, pairs:
 /**
  * Merge `additional` pairs into `existing`, keyed by signing public key. A new
  * entry with the same signing key replaces the existing one (so its encryption
- * key and/or label are updated). Order is preserved: existing pairs first
- * (updated in place), then brand-new pairs in input order.
+ * key and/or label are updated). An omitted {@link GrantKeyPair.addedAt} on the
+ * incoming pair keeps the existing timestamp. Order is preserved: existing
+ * pairs first (updated in place), then brand-new pairs in input order.
  */
 export declare function mergeKeyPairs(existing: GrantKeyPair[], additional: GrantKeyPair[]): GrantKeyPair[];
 /**

package/dist/core/accesscontrol/grantKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grantKeys.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/grantKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAkG7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAK7E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAKnF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAEpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CA6C7F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAKlG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAShF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAanF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEvF"}
+{"version":3,"file":"grantKeys.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/grantKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAsG7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAK7E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAKnF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAEpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAqD7F;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAmBlG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAShF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAanF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEvF"}

package/dist/core/accesscontrol/grantKeys.js

@@ -7,16 +7,18 @@
  * Active devices and revoked devices live in TWO SEPARATE lists:
  *
  *  - `userKeyPairs`: the ACTIVE device key pairs, an array of
- *    `{ signingPublicKey, encryptionPublicKey, label? }` objects. Pairing the
- *    keys per device keeps a device's signing and encryption keys together and
- *    lets each carry an optional human-readable label. This is the canonical
- *    list the server/auth treat as granting access. Because revoked devices are
- *    NOT in this list, any reader (old or new) that treats `userKeyPairs` as
- *    "the keys that have access" is correct without understanding revocation.
+ *    `{ signingPublicKey, encryptionPublicKey, label?, addedAt?, joinResponseWrapped? }` objects.
+ *    Pairing the keys per device keeps a device's signing and encryption keys
+ *    together and lets each carry an optional human-readable label and the
+ *    trusted-time it was added. This is the canonical list the server/auth
+ *    treat as granting access. Because revoked devices are NOT in this list,
+ *    any reader (old or new) that treats `userKeyPairs` as "the keys that have
+ *    access" is correct without understanding revocation.
  *  - `revokedUserKeyPairs`: the RETAINED revoked device key pairs (§6.5), same
- *    shape plus an optional `revokedAt` timestamp. Membership in this list — not
- *    a per-entry flag — is what marks a device revoked. Retaining them lets
- *    admin UIs list "devices with revoked access" and optionally restore them.
+ *    shape plus an optional `revokedAt` timestamp (and retained `addedAt`).
+ *    Membership in this list — not a per-entry flag — is what marks a device
+ *    revoked. Retaining them lets admin UIs list "devices with revoked access"
+ *    and optionally restore them.
  *
  * For older clients that predate `userKeyPairs`, writers also mirror the ACTIVE
  * keys into the legacy forms, read in this order of authority:
@@ -82,10 +84,11 @@ function legacyEncryptionKeys(data) {
     return scalar ? [scalar] : [];
 }
 /**
- * Parse an array of `{ signingPublicKey, encryptionPublicKey, label? }` entries
- * into {@link GrantKeyPair}s, de-duplicated by signing key. When `markRevoked`
- * is set (parsing `revokedUserKeyPairs`), every parsed pair is marked revoked
- * and carries its `revokedAt` timestamp.
+ * Parse an array of
+ * `{ signingPublicKey, encryptionPublicKey, label?, addedAt?, revokedAt? }`
+ * entries into {@link GrantKeyPair}s, de-duplicated by signing key. When
+ * `markRevoked` is set (parsing `revokedUserKeyPairs`), every parsed pair is
+ * marked revoked and carries its `revokedAt` timestamp.
  */
 function parsePairEntries(value, markRevoked) {
     if (!Array.isArray(value))
@@ -105,6 +108,11 @@ function parsePairEntries(value, markRevoked) {
         const pair = { signingPublicKey, encryptionPublicKey };
         if (label !== undefined)
             pair.label = label;
+        if (typeof rec.addedAt === "number")
+            pair.addedAt = rec.addedAt;
+        const joinResponseWrapped = asScalarString(rec.joinResponseWrapped);
+        if (joinResponseWrapped)
+            pair.joinResponseWrapped = joinResponseWrapped;
         if (markRevoked) {
             pair.revoked = true;
             if (typeof rec.revokedAt === "number")
@@ -145,9 +153,9 @@ function legacyKeyPairs(data) {
 }
 /**
  * All device key pairs on this document — active first, then revoked — in the
- * canonical `{ signingPublicKey, encryptionPublicKey, label?, revoked?,
- * revokedAt? }` shape (§6.5). Used by write paths that need to preserve the
- * full device set (e.g. relabel/merge/revoke) before re-applying.
+ * canonical `{ signingPublicKey, encryptionPublicKey, label?, addedAt?,
+ * revoked?, revokedAt? }` shape (§6.5). Used by write paths that need to
+ * preserve the full device set (e.g. relabel/merge/revoke) before re-applying.
  *
  * For older documents that predate the canonical lists it reconstructs pairs
  * from the parallel signing/encryption arrays (index-aligned) or the legacy
@@ -207,10 +215,14 @@ function applyKeyPairFields(data, pairs) {
         if (pair.label !== undefined && pair.label.length > 0) {
             entry.label = pair.label;
         }
+        entry.addedAt = typeof pair.addedAt === "number" ? pair.addedAt : Date.now();
+        if (typeof pair.joinResponseWrapped === "string" && pair.joinResponseWrapped.length > 0) {
+            entry.joinResponseWrapped = pair.joinResponseWrapped;
+        }
         return entry;
     });
     // Revoked devices: retained in a SEPARATE list (§6.5). Membership here marks
-    // a device revoked; we keep the `revokedAt` timestamp and label for admin UIs.
+    // a device revoked; we keep addedAt/revokedAt and label for admin UIs.
     data.revokedUserKeyPairs = revokedPairs.map((pair) => {
         const entry = {
             signingPublicKey: pair.signingPublicKey,
@@ -219,6 +231,10 @@ function applyKeyPairFields(data, pairs) {
         if (pair.label !== undefined && pair.label.length > 0) {
             entry.label = pair.label;
         }
+        entry.addedAt = typeof pair.addedAt === "number" ? pair.addedAt : Date.now();
+        if (typeof pair.joinResponseWrapped === "string" && pair.joinResponseWrapped.length > 0) {
+            entry.joinResponseWrapped = pair.joinResponseWrapped;
+        }
         if (typeof pair.revokedAt === "number") {
             entry.revokedAt = pair.revokedAt;
         }
@@ -240,15 +256,29 @@ function applyKeyPairFields(data, pairs) {
 /**
  * Merge `additional` pairs into `existing`, keyed by signing public key. A new
  * entry with the same signing key replaces the existing one (so its encryption
- * key and/or label are updated). Order is preserved: existing pairs first
- * (updated in place), then brand-new pairs in input order.
+ * key and/or label are updated). An omitted {@link GrantKeyPair.addedAt} on the
+ * incoming pair keeps the existing timestamp. Order is preserved: existing
+ * pairs first (updated in place), then brand-new pairs in input order.
  */
 function mergeKeyPairs(existing, additional) {
     const merged = new Map();
     for (const pair of existing)
         merged.set(pair.signingPublicKey, pair);
-    for (const pair of additional)
-        merged.set(pair.signingPublicKey, pair);
+    for (const pair of additional) {
+        const previous = merged.get(pair.signingPublicKey);
+        if (!previous) {
+            merged.set(pair.signingPublicKey, pair);
+            continue;
+        }
+        const next = { ...pair };
+        if (pair.addedAt === undefined && previous.addedAt !== undefined) {
+            next.addedAt = previous.addedAt;
+        }
+        if (!pair.joinResponseWrapped && previous.joinResponseWrapped) {
+            next.joinResponseWrapped = previous.joinResponseWrapped;
+        }
+        merged.set(pair.signingPublicKey, next);
+    }
     return Array.from(merged.values());
 }
 /**

package/dist/core/accesscontrol/grantKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"grantKeys.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/grantKeys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;;AA8GH,0CAKC;AAOD,sDAKC;AAOD,wDAEC;AAkBD,gDA6CC;AAQD,sCAKC;AAQD,4DASC;AAMD,kEAaC;AAMD,0DAEC;AAED,gEAEC;AAOD,0EAEC;AAzQD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAA6B;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,IAA6B;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,WAAoB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACrF,CAAC;AAED,+DAA+D;AAC/D,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAA6B;IAC1D,OAAO,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,IAA6B;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,OAAO,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,IAA6B;IAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAA6B;IACjE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAA6B;IAClE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,kBAAkB,CAAC,IAA6B,EAAE,KAAqB;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAEnE,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,KAAK,GAA4B;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAA4B;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,CAAC,qBAAqB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,wBAAwB,GAAG,WAAW;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;SACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC5D,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAAwB,EAAE,UAA0B;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,IAA6B;IACvE,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,qBAAqB,CAAC,IAAI,CAAC;aACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;aACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAA6B;IACtE,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,+BAA+B,CAAC,IAA6B;IAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"grantKeys.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/grantKeys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;;AAkHH,0CAKC;AAOD,sDAKC;AAOD,wDAEC;AAkBD,gDAqDC;AASD,sCAmBC;AAQD,4DASC;AAMD,kEAaC;AAMD,0DAEC;AAED,gEAEC;AAOD,0EAEC;AApSD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAA6B;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,IAA6B;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,WAAoB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAChE,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,mBAAmB;YAAE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QACxE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACrF,CAAC;AAED,+DAA+D;AAC/D,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAA6B;IAC1D,OAAO,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,IAA6B;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,OAAO,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,IAA6B;IAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAA6B;IACjE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAA6B;IAClE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,kBAAkB,CAAC,IAA6B,EAAE,KAAqB;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAEnE,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,KAAK,GAA4B;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7E,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxF,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAA4B;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7E,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxF,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,CAAC,qBAAqB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,wBAAwB,GAAG,WAAW;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;SACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC5D,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,QAAwB,EAAE,UAA0B;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAiB,EAAE,GAAG,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC9D,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,IAA6B;IACvE,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,qBAAqB,CAAC,IAAI,CAAC;aACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;aACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAA6B;IACtE,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,+BAA+B,CAAC,IAA6B;IAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/core/accesscontrol/types.d.ts

@@ -230,17 +230,22 @@ export interface AccessDecision {
 /** Singleton id of the tenant default policy document. */
 export declare const ACL_DEFAULT_POLICY_DOC_ID = "acl_defaultpolicy";
 /**
- * Encode an arbitrary string into a component made only of `[A-Za-z0-9_]`, so
- * it can be embedded in a fixed document ID that satisfies
+ * Encode an arbitrary string into a component made only of `[a-z0-9_]`, so it
+ * can be embedded in a fixed document ID that satisfies
  * {@link CUSTOM_DOC_ID_REGEX} (§6).
  *
- * The encoding is injective and reversible: ASCII letters and digits pass
- * through unchanged; every other byte (including a literal `_`) is escaped as
- * `_` followed by two lowercase hex digits. Because every literal underscore is
- * escaped, decoding is unambiguous. Examples:
+ * The encoding is injective and reversible: lowercase ASCII letters and digits
+ * pass through unchanged; every other byte (including uppercase letters and a
+ * literal `_`) is escaped as `_` followed by two lowercase hex digits. Uppercase
+ * has to be escaped rather than lowercased because document IDs are
+ * case-insensitive, so folding `A` to `a` would let two distinct components
+ * (say the database IDs `Sales` and `sales`) collide on one ACL document.
+ * Because every literal underscore is escaped, decoding is unambiguous.
+ * Examples:
  * - `directory` -> `directory`
  * - `test-db`   -> `test_2ddb`
  * - `a_b`       -> `a_5fb`
+ * - `Sales`     -> `_53ales`
  */
 export declare function encodeAclIdComponent(raw: string): string;
 /** Inverse of {@link encodeAclIdComponent}. */
@@ -425,7 +430,8 @@ export declare function isKeyDistributionDocId(docId: string): boolean;
  * Validate the structural invariants of a key distribution before publish
  * (docs/accesscontrol.md §13). Throws on the first violation:
  *
- *  - `keyId` is non-empty and not a protected id (`default` / `$publicinfos`);
+ *  - `keyId` is non-empty and not a protected id (`$publicinfos`);
+ *    the tenant `default` key may be distributed (including pullfrom);
  *  - `pushto` and `pullfrom` user-hash sets are disjoint;
  *  - every `pushto` device entry covers EXACTLY the manifest's version
  *    fingerprints (full coverage, no extras), so every recipient can decrypt